Add call graph fixtures for various languages and scenarios

- Introduced `all-edge-reasons.json` to test edge resolution reasons in .NET.
- Added `all-visibility-levels.json` to validate method visibility levels in .NET.
- Created `dotnet-aspnetcore-minimal.json` for a minimal ASP.NET Core application.
- Included `go-gin-api.json` for a Go Gin API application structure.
- Added `java-spring-boot.json` for the Spring PetClinic application in Java.
- Introduced `legacy-no-schema.json` for legacy application structure without schema.
- Created `node-express-api.json` for an Express.js API application structure.

src/Cli/__Tests/StellaOps.Cli.Tests/Commands/CommandHandlersTests.cs

@@ -134,21 +134,23 @@ public sealed class CommandHandlersTests
         var console = new TestConsole();
         var originalConsole = AnsiConsole.Console;
 
+        var bestPlan = new EntryTracePlan(
+            ImmutableArray.Create("/usr/bin/python", "app.py"),
+            ImmutableDictionary<string, string>.Empty,
+            "/workspace",
+            "appuser",
+            "/usr/bin/python",
+            EntryTraceTerminalType.Managed,
+            "python",
+            0.95,
+            ImmutableDictionary<string, string>.Empty);
+
         var graph = new EntryTraceGraph(
             EntryTraceOutcome.Resolved,
             ImmutableArray<EntryTraceNode>.Empty,
             ImmutableArray<EntryTraceEdge>.Empty,
             ImmutableArray<EntryTraceDiagnostic>.Empty,
-            ImmutableArray.Create(new EntryTracePlan(
-                ImmutableArray.Create("/usr/bin/python", "app.py"),
-                ImmutableDictionary<string, string>.Empty,
-                "/workspace",
-                "appuser",
-                "/usr/bin/python",
-                EntryTraceTerminalType.Managed,
-                "python",
-                0.95,
-                ImmutableDictionary<string, string>.Empty)),
+            ImmutableArray.Create(bestPlan),
             ImmutableArray.Create(new EntryTraceTerminal(
                 "/usr/bin/python",
                 EntryTraceTerminalType.Managed,
@@ -166,7 +168,8 @@ public sealed class CommandHandlersTests
                 "sha256:deadbeef",
                 DateTimeOffset.Parse("2025-11-02T12:00:00Z", CultureInfo.InvariantCulture, DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal),
                 graph,
-                new[] { "{\"type\":\"terminal\"}" })
+                new[] { "{\"type\":\"terminal\"}" },
+                bestPlan)
         };
 
         var provider = BuildServiceProvider(backend);
@@ -178,6 +181,7 @@ public sealed class CommandHandlersTests
                 provider,
                 "scan-123",
                 includeNdjson: true,
+                includeSemantic: false,
                 verbose: false,
                 cancellationToken: CancellationToken.None);
 
@@ -211,6 +215,7 @@ public sealed class CommandHandlersTests
                 provider,
                 "scan-missing",
                 includeNdjson: false,
+                includeSemantic: false,
                 verbose: false,
                 cancellationToken: CancellationToken.None));
 
@@ -1342,104 +1347,6 @@ public sealed class CommandHandlersTests
         }
     }
 
-    [Fact]
-    public async Task HandleAdviseRunAsync_WritesMarkdownWithCitations_ForExplain()
-    {
-        var originalExit = Environment.ExitCode;
-        var originalConsole = AnsiConsole.Console;
-        var testConsole = new TestConsole();
-
-        try
-        {
-            Environment.ExitCode = 0;
-            AnsiConsole.Console = testConsole;
-
-            var planResponse = new AdvisoryPipelinePlanResponseModel
-            {
-                TaskType = "Conflict",
-                CacheKey = "plan-conflict",
-                PromptTemplate = "prompts/advisory/conflict.liquid",
-                Budget = new AdvisoryTaskBudgetModel
-                {
-                    PromptTokens = 128,
-                    CompletionTokens = 64
-                },
-                Chunks = Array.Empty<PipelineChunkSummaryModel>(),
-                Vectors = Array.Empty<PipelineVectorSummaryModel>(),
-                Metadata = new Dictionary<string, string>()
-            };
-
-            var outputResponse = new AdvisoryPipelineOutputModel
-            {
-                CacheKey = planResponse.CacheKey,
-                TaskType = planResponse.TaskType,
-                Profile = "default",
-                Prompt = "Sanitized prompt",
-                Response = "Rendered conflict body.",
-                Citations = new[]
-                {
-                    new AdvisoryOutputCitationModel { Index = 1, DocumentId = "doc-42", ChunkId = "chunk-42" }
-                },
-                Metadata = new Dictionary<string, string>(),
-                Guardrail = new AdvisoryOutputGuardrailModel
-                {
-                    Blocked = false,
-                    SanitizedPrompt = "Sanitized prompt",
-                    Violations = Array.Empty<AdvisoryOutputGuardrailViolationModel>(),
-                    Metadata = new Dictionary<string, string>()
-                },
-                Provenance = new AdvisoryOutputProvenanceModel
-                {
-                    InputDigest = "sha256:conflict-in",
-                    OutputHash = "sha256:conflict-out",
-                    Signatures = Array.Empty<string>()
-                },
-                GeneratedAtUtc = DateTimeOffset.Parse("2025-11-06T12:00:00Z", CultureInfo.InvariantCulture),
-                PlanFromCache = false
-            };
-
-            var backend = new StubBackendClient(new JobTriggerResult(true, "ok", null, null))
-            {
-                AdvisoryPlanResponse = planResponse,
-                AdvisoryOutputResponse = outputResponse
-            };
-
-            var provider = BuildServiceProvider(backend);
-            var outputPath = Path.GetTempFileName();
-
-            await CommandHandlers.HandleAdviseRunAsync(
-                provider,
-                AdvisoryAiTaskType.Conflict,
-                "ADV-42",
-                null,
-                null,
-                null,
-                "default",
-                Array.Empty<string>(),
-                forceRefresh: false,
-                timeoutSeconds: 0,
-                outputFormat: AdvisoryOutputFormat.Markdown,
-                outputPath: outputPath,
-                verbose: false,
-                cancellationToken: CancellationToken.None);
-
-            var markdown = await File.ReadAllTextAsync(outputPath);
-            Assert.Contains("Conflict", markdown, StringComparison.OrdinalIgnoreCase);
-            Assert.Contains("Rendered conflict body", markdown, StringComparison.OrdinalIgnoreCase);
-            Assert.Contains("doc-42", markdown, StringComparison.OrdinalIgnoreCase);
-            Assert.Contains("chunk-42", markdown, StringComparison.OrdinalIgnoreCase);
-            Assert.Contains("Citations", markdown, StringComparison.OrdinalIgnoreCase);
-            Assert.Equal(0, Environment.ExitCode);
-            Assert.Contains("Conflict", testConsole.Output, StringComparison.OrdinalIgnoreCase);
-            Assert.Equal(AdvisoryAiTaskType.Conflict, backend.AdvisoryPlanRequests.Last().TaskType);
-        }
-        finally
-        {
-            AnsiConsole.Console = originalConsole;
-            Environment.ExitCode = originalExit;
-        }
-    }
-
     [Fact]
     public async Task HandleAdviseRunAsync_WritesMarkdownWithCitations_ForRemediationTask()
     {
@@ -2503,6 +2410,7 @@ public sealed class CommandHandlersTests
                         "sbom:S-42",
                         new[] { "CVE-2021-23337", "GHSA-xxxx-yyyy" },
                         new PolicyFindingVexMetadata("VendorX-123", "vendor-x", "not_affected"),
+                        null,
                         4,
                         DateTimeOffset.Parse("2025-10-26T14:06:01Z", CultureInfo.InvariantCulture, DateTimeStyles.AssumeUniversal),
                         "run:P-7:2025-10-26:auto")
@@ -2570,6 +2478,7 @@ public sealed class CommandHandlersTests
                         "sbom:S-99",
                         Array.Empty<string>(),
                         null,
+                        null,
                         3,
                         DateTimeOffset.MinValue,
                         null)
@@ -2638,6 +2547,7 @@ public sealed class CommandHandlersTests
                 "sbom:S-1",
                 new[] { "CVE-1111" },
                 new PolicyFindingVexMetadata("VendorY-9", null, "affected"),
+                null,
                 7,
                 DateTimeOffset.Parse("2025-10-26T12:34:56Z", CultureInfo.InvariantCulture, DateTimeStyles.AssumeUniversal),
                 "run:P-9:1234")
@@ -2787,6 +2697,14 @@ public sealed class CommandHandlersTests
                 outputPath: null,
                 explain: true,
                 failOnDiff: false,
+                withExceptions: Array.Empty<string>(),
+                withoutExceptions: Array.Empty<string>(),
+                mode: null,
+                sbomSelectors: Array.Empty<string>(),
+                includeHeatmap: false,
+                manifestDownload: false,
+                reachabilityStates: Array.Empty<string>(),
+                reachabilityScores: Array.Empty<string>(),
                 verbose: false,
                 cancellationToken: CancellationToken.None);
 
@@ -2849,6 +2767,14 @@ public sealed class CommandHandlersTests
                 outputPath: null,
                 explain: false,
                 failOnDiff: false,
+                withExceptions: Array.Empty<string>(),
+                withoutExceptions: Array.Empty<string>(),
+                mode: null,
+                sbomSelectors: Array.Empty<string>(),
+                includeHeatmap: false,
+                manifestDownload: false,
+                reachabilityStates: Array.Empty<string>(),
+                reachabilityScores: Array.Empty<string>(),
                 verbose: false,
                 cancellationToken: CancellationToken.None);
 
@@ -2898,6 +2824,14 @@ public sealed class CommandHandlersTests
                 outputPath: null,
                 explain: false,
                 failOnDiff: true,
+                withExceptions: Array.Empty<string>(),
+                withoutExceptions: Array.Empty<string>(),
+                mode: null,
+                sbomSelectors: Array.Empty<string>(),
+                includeHeatmap: false,
+                manifestDownload: false,
+                reachabilityStates: Array.Empty<string>(),
+                reachabilityScores: Array.Empty<string>(),
                 verbose: false,
                 cancellationToken: CancellationToken.None);
 
@@ -2937,6 +2871,14 @@ public sealed class CommandHandlersTests
                 outputPath: null,
                 explain: false,
                 failOnDiff: false,
+                withExceptions: Array.Empty<string>(),
+                withoutExceptions: Array.Empty<string>(),
+                mode: null,
+                sbomSelectors: Array.Empty<string>(),
+                includeHeatmap: false,
+                manifestDownload: false,
+                reachabilityStates: Array.Empty<string>(),
+                reachabilityScores: Array.Empty<string>(),
                 verbose: false,
                 cancellationToken: CancellationToken.None);
 
@@ -4454,6 +4396,7 @@ spec:
             "sbom:default",
             Array.Empty<string>(),
             null,
+            null,
             1,
             DateTimeOffset.UtcNow,
             null);
@@ -4472,7 +4415,7 @@ spec:
         public List<(AdvisoryAiTaskType TaskType, AdvisoryPipelinePlanRequestModel Request)> AdvisoryPlanRequests { get; } = new();
         public AdvisoryPipelinePlanResponseModel? AdvisoryPlanResponse { get; set; }
         public Exception? AdvisoryPlanException { get; set; }
-        public Queue<AdvisoryPipelineOutputModel?> AdvisoryOutputQueue { get; } = new();
+        public Queue<AdvisoryPipelineOutputModel?> AdvisoryOutputQueue { get; set; } = new();
         public AdvisoryPipelineOutputModel? AdvisoryOutputResponse { get; set; }
         public Exception? AdvisoryOutputException { get; set; }
         public List<(string CacheKey, AdvisoryAiTaskType TaskType, string Profile)> AdvisoryOutputRequests { get; } = new();
@@ -4704,6 +4647,119 @@ spec:
 
             return Task.FromResult(AdvisoryOutputResponse);
         }
+
+        public Task<RiskProfileListResponse> ListRiskProfilesAsync(RiskProfileListRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new RiskProfileListResponse());
+
+        public Task<RiskSimulateResult> SimulateRiskAsync(RiskSimulateRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new RiskSimulateResult());
+
+        public Task<RiskResultsResponse> GetRiskResultsAsync(RiskResultsRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new RiskResultsResponse());
+
+        public Task<RiskBundleVerifyResult> VerifyRiskBundleAsync(RiskBundleVerifyRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new RiskBundleVerifyResult());
+
+        public Task<ReachabilityUploadCallGraphResult> UploadCallGraphAsync(ReachabilityUploadCallGraphRequest request, Stream callGraphStream, CancellationToken cancellationToken)
+            => Task.FromResult(new ReachabilityUploadCallGraphResult());
+
+        public Task<ReachabilityListResponse> ListReachabilityAnalysesAsync(ReachabilityListRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new ReachabilityListResponse());
+
+        public Task<ReachabilityExplainResult> ExplainReachabilityAsync(ReachabilityExplainRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new ReachabilityExplainResult());
+
+        public Task<GraphExplainResult> ExplainGraphAsync(GraphExplainRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new GraphExplainResult());
+
+        public Task<ApiSpecListResponse> ListApiSpecsAsync(string? tenant, CancellationToken cancellationToken)
+            => Task.FromResult(new ApiSpecListResponse());
+
+        public Task<ApiSpecDownloadResult> DownloadApiSpecAsync(ApiSpecDownloadRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new ApiSpecDownloadResult());
+
+        public Task<SdkUpdateResponse> CheckSdkUpdatesAsync(SdkUpdateRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new SdkUpdateResponse());
+
+        public Task<SdkListResponse> ListInstalledSdksAsync(string? language, string? tenant, CancellationToken cancellationToken)
+            => Task.FromResult(new SdkListResponse());
+
+        public Task<PolicyHistoryResponse> GetPolicyHistoryAsync(PolicyHistoryRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new PolicyHistoryResponse());
+
+        public Task<PolicyExplainResult> GetPolicyExplainAsync(PolicyExplainRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new PolicyExplainResult());
+
+        public Task<PolicyVersionBumpResult> BumpPolicyVersionAsync(PolicyVersionBumpRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new PolicyVersionBumpResult());
+
+        public Task<PolicySubmitResult> SubmitPolicyForReviewAsync(PolicySubmitRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new PolicySubmitResult());
+
+        public Task<PolicyReviewCommentResult> AddPolicyReviewCommentAsync(PolicyReviewCommentRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new PolicyReviewCommentResult());
+
+        public Task<PolicyApproveResult> ApprovePolicyReviewAsync(PolicyApproveRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new PolicyApproveResult());
+
+        public Task<PolicyRejectResult> RejectPolicyReviewAsync(PolicyRejectRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new PolicyRejectResult());
+
+        public Task<PolicyReviewSummary?> GetPolicyReviewStatusAsync(PolicyReviewStatusRequest request, CancellationToken cancellationToken)
+            => Task.FromResult<PolicyReviewSummary?>(null);
+
+        public Task<PolicyPublishResult> PublishPolicyAsync(PolicyPublishRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new PolicyPublishResult());
+
+        public Task<PolicyPromoteResult> PromotePolicyAsync(PolicyPromoteRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new PolicyPromoteResult());
+
+        public Task<PolicyRollbackResult> RollbackPolicyAsync(PolicyRollbackRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new PolicyRollbackResult());
+
+        public Task<PolicySignResult> SignPolicyAsync(PolicySignRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new PolicySignResult());
+
+        public Task<PolicyVerifySignatureResult> VerifyPolicySignatureAsync(PolicyVerifySignatureRequest request, CancellationToken cancellationToken)
+            => Task.FromResult(new PolicyVerifySignatureResult());
+
+        public Task<VexConsensusListResponse> ListVexConsensusAsync(VexConsensusListRequest request, string? tenant, CancellationToken cancellationToken)
+            => Task.FromResult(new VexConsensusListResponse(Array.Empty<VexConsensusItem>(), 0, 0, 0, false));
+
+        public Task<VexConsensusDetailResponse?> GetVexConsensusAsync(string vulnerabilityId, string productKey, string? tenant, CancellationToken cancellationToken)
+            => Task.FromResult<VexConsensusDetailResponse?>(null);
+
+        public Task<VexSimulationResponse> SimulateVexConsensusAsync(VexSimulationRequest request, string? tenant, CancellationToken cancellationToken)
+            => Task.FromResult(new VexSimulationResponse(
+                Array.Empty<VexSimulationResultItem>(),
+                new VexSimulationParameters(0.0, 0),
+                new VexSimulationSummary(0, 0, 0, 0, 0)));
+
+        public Task<VexExportResponse> ExportVexConsensusAsync(VexExportRequest request, string? tenant, CancellationToken cancellationToken)
+            => Task.FromResult(new VexExportResponse("export-0"));
+
+        public Task<Stream> DownloadVexExportAsync(string exportId, string? tenant, CancellationToken cancellationToken)
+            => Task.FromResult<Stream>(new MemoryStream(Encoding.UTF8.GetBytes("{}")));
+
+        public Task<VulnListResponse> ListVulnerabilitiesAsync(VulnListRequest request, string? tenant, CancellationToken cancellationToken)
+            => Task.FromResult(new VulnListResponse(Array.Empty<VulnItem>(), 0, 0, 0, false));
+
+        public Task<VulnDetailResponse?> GetVulnerabilityAsync(string vulnerabilityId, string? tenant, CancellationToken cancellationToken)
+            => Task.FromResult<VulnDetailResponse?>(null);
+
+        public Task<VulnWorkflowResponse> ExecuteVulnWorkflowAsync(VulnWorkflowRequest request, string? tenant, CancellationToken cancellationToken)
+            => Task.FromResult(new VulnWorkflowResponse(true, request.Action, 0, Array.Empty<string>()));
+
+        public Task<VulnSimulationResponse> SimulateVulnerabilitiesAsync(VulnSimulationRequest request, string? tenant, CancellationToken cancellationToken)
+            => Task.FromResult(new VulnSimulationResponse(
+                Array.Empty<VulnSimulationDelta>(),
+                new VulnSimulationSummary(0, 0, 0, 0, 0)));
+
+        public Task<VulnExportResponse> ExportVulnerabilitiesAsync(VulnExportRequest request, string? tenant, CancellationToken cancellationToken)
+            => Task.FromResult(new VulnExportResponse("export-0"));
+
+        public Task<Stream> DownloadVulnExportAsync(string exportId, string? tenant, CancellationToken cancellationToken)
+            => Task.FromResult<Stream>(new MemoryStream(Encoding.UTF8.GetBytes("{}")));
     }
 
     private sealed class StubExecutor : IScannerExecutor
@@ -4832,6 +4888,12 @@ spec:
             LastQuery = query;
             return Task.FromResult(_response);
         }
+
+        public Task<AdvisoryLinksetResponse> GetLinksetAsync(AdvisoryLinksetQuery query, CancellationToken cancellationToken)
+            => Task.FromResult(new AdvisoryLinksetResponse());
+
+        public Task<AdvisoryLinksetObservation?> GetObservationByIdAsync(string tenant, string observationId, CancellationToken cancellationToken)
+            => Task.FromResult<AdvisoryLinksetObservation?>(null);
     }
 
     [Fact]