feat(graph): Python intra-procedural data edges + PARAMETER nodes

[smochan]

Summary

Track C1 — the taint-analysis foundation (gap-analysis Capability A, step 1):

• New EdgeKinds DATA_ASSIGN / DATA_ARG / DATA_RETURN (no store migration needed — enum-driven)
• PARAMETER nodes emitted per function param (+ first real use of PARAM_OF), seeding per-function scope
• Python parser emits intra-procedural def-use edges: assignments (incl. augmented/annotated), call args (positional + kwarg sentinels unresolved::arg::<callee>::<slot>), returns (<return> sentinel), call-result bridging (unresolved::ret::<callee>)
• Reviewer addition: for-loop targets — for url in scraped_urls: now registers the loop var fed by its iterable (element-of propagation; critical for the SSRF source pattern)
• Line-qualified VARIABLE nodes keep shadowing chains distinct; nested defs don't leak scope
• Kill-switch: PythonExtractor.emit_data_edges = False
• Perf: no measurable parse-time overhead (~1.0×); cli.py gains +507 data edges / +101 PARAMETER nodes

Documented limits: no attribute tracking (obj.field), tuple unpacking takes first identifier, comprehensions share function scope.

Implemented by a Sonnet subagent against a Fable spec; reviewed + for-loop gap fixed by the orchestrating session.

Test plan

• 20 tests in tests/test_data_edges_python.py (params, assign chains, args, kwargs, returns, call-result, shadowing, nested-def isolation, kill-switch, for-loop targets, perf sanity)
• Full suite 726 passed; ruff + mypy --strict + self-lint clean

🤖 Generated with Claude Code

[github-actions]

codegraph PR review

Diff vs main · severity ≤ high

codegraph review (target: main)

Diff: +37 / -0 / ~0 nodes, +209 / -0 edges

Findings (0)

No findings.

_{Triggered by codegraph CI · last run}