v0.3.17 — R18 v1 Interaction Graph Layer + telemetry + critical TS ESM resolver fix

Interaction Graph Layer (R18 v1) infrastructure + telemetry + critical TypeScript ESM resolver fix (Cycle 111, DG-123 A + DG-123.0.1 + DG-123.0.2).

Adds a file-level Interaction Graph to the Coordinator — every Finding in a supported language (TS/TSX/JS/Python) now carries fileContext (role + imports/importedBy) and symbolContext (top-level symbols) that the Brain Layer receives as part of the Triage prompt. Ships with Output-channel telemetry to observe the graph, plus a critical hotfix for the resolver that made it useful for TypeScript ESM projects (specifiers ending in .js).

Empirical classification (Baseline-8d in SENTINEL workspace): H1.5-implicit

The graph builds correctly with rich data (e.g. colony-db.ts role=library imports=1 importedBy=3 symbols=14), the LLM (Sonnet-4.6 via deepseek-v4-flash) produces sophisticated rationales, but does NOT explicitly cite the graph section keywords (imported by, exports, library, entry). Interpretation: for intra-file findings (like SENTINEL's eval-usage and taint-command-injection), the graph context is structurally redundant — the verdict depends on local API usage. R18 v1's real value would surface on cross-module findings; symbol-level cross-file resolution (R18 v2) is documented backlog.

Added

• DG-123 A — R18 v1 Interaction Graph Layer: new module interaction-graph.ts (~560 lines) with buildInteractionGraph(rootPath) two-pass walker (WASM parsing via web-tree-sitter@0.20.8 + tree-sitter-wasms@0.1.13 for 4 grammars, +5.87 MB uncompressed / +750 KB gzipped vsix bloat). Coordinator Stage 1.5b enriches each finding with fileContext + symbolContext. Triage + Context agents get a new "File interaction context" section in the prompt.
• DG-123.0.1 — Telemetry via ScanOptions callbacks: onInteractionGraphBuilt + onFindingEnriched best-effort callbacks; CLI wires to [DG-123 A] prefixed lines in the terminal output.
• DG-123.0.2 — Critical resolver fix for TypeScript ESM: EXTENSION_SUBSTITUTES table maps .js → [.ts, .tsx, .jsx], .mjs → [.mts], .cjs → [.cts], .jsx → [.tsx]. Without this fix, 100% of relative imports in TS ESM projects failed to resolve (Baseline-8c evidence).

Known Issues / Honest tradeoffs

• LLM utilization is workload-dependent — intra-file findings see structurally redundant graph context; cross-module findings should benefit more (R18 v2 backlog).
• Only 4 languages in v1 (TS/TSX/JS/Python).
• Only relative static imports resolve — bare imports (react, zod) return null.
• role='leaf' has ambiguous semantics for importedByCount === 1 (R18 v1.1 refinement candidate).
• First-scan latency +500ms-2s from WASM init + graph build (no cache yet).
• Provider deepseek-v4-flash intermittently returned empty responses in Baselines 8c and 8d (Security check suppressed 2/2 fail, CORS flipped success → failure). Not a graph bug — separate follow-up (DG-125 A candidate).
• Users of pre-release stepN.vsix (step8/step9) should re-install this release to see accurate role=library values (DG-123.0.2 cascade fix).

Notes

• pnpm verify VERDE: 63 test files / 779 tests + manifest gate + activation gate. Test growth from v0.3.16: +16 tests (763 → 779).
• vsce publish to VS Code Marketplace is not part of this release. Marketplace listing is on v0.3.3; 15 GitHub-only releases now accumulate (v0.3.4 → v0.3.17). To install: download synaptic-sentinel-0.3.17.vsix and use code --install-extension synaptic-sentinel-0.3.17.vsix or Install from VSIX... in the Extensions view.
• Roadmap next: R18 v1.1 (bare imports informational + symbol count refinement); R18 v2 (symbol-level cross-file); DG-125 A (provider intermittent-empty follow-up if persists).

Verification

• File: synaptic-sentinel-0.3.17.vsix
• Size: 4,135,298 bytes (3.94 MB), 1849 files
• SHA-256: c7e6536ec34e0fea164a151c1baeea88d93b6df7e2bdb91c543899c26deca528