D-162: Clojure adapter — project.clj and deps.edn resolve to Maven coordinates

[MoSLoF]

What

The ecosystem expansion the swytchdb scan called for: a clojure adapter (internal/ecosystem/clojure) that statically resolves Leiningen project.clj and tools.deps deps.edn direct dependencies. D-161 made swytch.jepsen a disclosed gap; this makes it a scanned project — org.postgresql:postgresql@42.7.4 and its 3 advisories become visible to VC-008 instead of invisible.

Design

Nodes carry Ecosystem "maven", not "clojure" — the manifest family is Clojure, but the packages live at Maven coordinates, and every downstream authority speaks Maven: OSV ecosystem "Maven" with group:artifact names, deps.dev system maven, PURL type pkg:maven. One mapping case each in the OSV client and deps.dev (both directions) wires the whole pipeline, and the existing -expand tier can now deepen Clojure trees from deps.dev. A future pom.xml/Gradle adapter emits into the same space unchanged.

Claims vs. refusals (D-24):

• A literal direct pin is an observed fact (both tools fetch exactly the stated version for direct deps) → registry-source node.
• Ranges, RELEASE/LATEST, build-time symbol versions → declared-but-unresolved, never guessed.
• :git/url / :local/root → SourceGit/SourcePath with ref — non-registry, no advisory coverage, disclosed.
• Unparsed entries → placeholder unresolved names (a shape we can't read degrades coverage; it doesn't vanish).
• Every root sets flat resolution — the formats record no transitive structure (Pipfile.lock precedent: disclosed, not gated).
• Profile :dependencies and alias :extra-deps/:replace-deps are read (same fetch surface); #_ discards, comments, and string contents never become nodes.

The reader is a bracket/string scanner, not an EDN parser (zero-dependency discipline) — comment stripping respects strings and \; character literals, so a dependency spelled in a docstring can't be manufactured (the D-153 lesson applied at parse time).

Gap-table promotion: project.clj/deps.edn leave the D-161 tables per the supported-manifests contract. The D-161 CLI regression is knowingly superseded: its gap half moves to pom.xml (still recognized-but-unread), and the jepsen fixture now asserts non-vacuous resolution — the verdict must contain the postgresql PURL, so an unregistered adapter can't pass on exit codes alone.

Validation

• Two-sided unit tests: pins resolve with correct PURLs; ranges/meta-versions/symbol versions/unparsed disclose; discarded and comment/string-embedded "deps" never resolve; git/local classify with refs.
• Fuzz: FuzzParseProjectClj + FuzzParseDepsEdn (never panic/stall, no coordinate escapes the symbol shape), seeded, 20s each locally, added to the CI fuzz roster.
• Mutation-checked at both wires: reverting the OSV mapping fails the wire-format test; reverting the registration fails the CLI resolution test.
• Live-fired: the jepsen shape discovers and resolves to four pkg:maven nodes through the built binary. api.osv.dev egress is blocked in this environment, and the scan disclosed degraded data source(s): osv … NOT an all-clear — the D-24 machinery working for the new ecosystem. The denied round-trip is pinned at the wire instead (maven_test.go: body must carry "ecosystem":"Maven" + verbatim group:artifact).
• Full suite green (35 packages), -race clean, gofmt/vet silent. D-162 entry in docs/DECISIONS.md.

Residuals (disclosed, not smuggled)

Transitives only via -expand (labelled, never gating — no committed lockfile format exists). No Maven/Clojars registry source yet → VC-004/VC-005/VC-011/VC-012 don't fire on maven nodes (natural next increment). :plugins/:managed-dependencies unread. pom.xml still a disclosed gap. Homebrew unchanged. Maven version-range evaluation not implemented — a range discloses as unresolved.

---

🤖 Generated with Claude Code

---

Generated by Claude Code