feat(ir): add is_example_file + is_config_file booleans to Symbol

Per the WI-gumoz-zoboz audit verdict (DOCUMENT + EXTEND), surface two
sibling role flags on Symbol that mirror is_test_file (WI-rigun) and
is_generated_file (WI-tizij):

- is_example_file: True when the file matches an EXAMPLE_PATTERN
  (examples/, demos/, samples/, tutorials/).
- is_config_file: True when the basename matches a known
  dependency/build manifest (pyproject.toml, package.json, Cargo.toml,
  go.mod, etc.).

The integer supply_chain_tier is unchanged. Within tier 2 (INTERNAL_DEP),
the role flags is_test_file / is_example_file / is_config_file are
mutually exclusive — at most one is True per Symbol — making the
four-way distinction inside tier 2 derivable as the XOR of the bits.
The is_config bit is suppressed on a file when is_test or is_example
already fires (e.g., examples/foo/package.json is is_example, not
is_config) to preserve mutual exclusion.

Wired through Symbol.to_dict / from_dict (round-trips via supply_chain
sub-object) and both supply-chain-classification call sites in cli.py
(_classify_symbols) and sketch.py.

Also: closes a pre-existing per-package isolation coverage gap on
mainstream/py.py:1724 by adding a _detect_source_roots test covering
the skip-list / dot-prefixed directory branch (verified existed on
plain dev before this PR).

Closes WI-jobuj.

Signed-off-by: jgstern-agent <josh-agent@iterabloom.com>

Author: jgstern-agent

.ci/affected-tests.txt

@@ -1,14 +1,16 @@
 # Test selection manifest
-# Generated by smart-test at 2026-05-02T04:22:28-04:00
+# Generated by smart-test at 2026-05-02T06:02:41-04:00
 # Mode: targeted
-# Baseline: 989a35bd7dc16209d641af307605bdcfc6907a11
-# Changed files: 6
-# Changed source files: 2
-# Selected tests: 168
+# Baseline: 3b45c0d3eddc739bf5c14a3c7eeed6167aee64ff
+# Changed files: 9
+# Changed source files: 4
+# Selected tests: 171
 #
 # === CHANGED_SOURCE_FILES ===
-packages/hypergumbo-core/src/hypergumbo_core/datamodels.py
+packages/hypergumbo-core/src/hypergumbo_core/cli.py
 packages/hypergumbo-core/src/hypergumbo_core/ir.py
+packages/hypergumbo-core/src/hypergumbo_core/sketch.py
+packages/hypergumbo-core/src/hypergumbo_core/supply_chain.py
 # === SELECTED_TESTS ===
 packages/hypergumbo-core/tests/BRANCHES_test_compact.py
 packages/hypergumbo-core/tests/BRANCHES_test_database_query.py
@@ -70,6 +72,7 @@ packages/hypergumbo-core/tests/test_grpc_linker.py
 packages/hypergumbo-core/tests/test_handler_slices.py
 packages/hypergumbo-core/tests/test_http_linker.py
 packages/hypergumbo-core/tests/test_inheritance_linker.py
+packages/hypergumbo-core/tests/test_install_extras.py
 packages/hypergumbo-core/tests/test_ipc_linker.py
 packages/hypergumbo-core/tests/test_ir.py
 packages/hypergumbo-core/tests/test_jackson_dispatch_linker.py
@@ -102,6 +105,7 @@ packages/hypergumbo-core/tests/test_route_handler_linker.py
 packages/hypergumbo-core/tests/test_router_routes_linker.py
 packages/hypergumbo-core/tests/test_rubyffi_linker.py
 packages/hypergumbo-core/tests/test_run_behavior_map.py
+packages/hypergumbo-core/tests/test_rust_analyzer_install.py
 packages/hypergumbo-core/tests/test_rust_trait_dispatch_linker.py
 packages/hypergumbo-core/tests/test_schema_compliance.py
 packages/hypergumbo-core/tests/test_schema.py
@@ -163,6 +167,7 @@ packages/hypergumbo-lang-mainstream/tests/test_html_analysis.py
 packages/hypergumbo-lang-mainstream/tests/test_java.py
 packages/hypergumbo-lang-mainstream/tests/test_js_ts.py
 packages/hypergumbo-lang-mainstream/tests/test_jupyter.py
+packages/hypergumbo-lang-mainstream/tests/test_jvm_deps.py
 packages/hypergumbo-lang-mainstream/tests/test_kotlin.py
 packages/hypergumbo-lang-mainstream/tests/test_manifest_targets.py
 packages/hypergumbo-lang-mainstream/tests/test_markdown.py

packages/hypergumbo-core/src/hypergumbo_core/cli.py

@@ -6094,6 +6094,8 @@ def _classify_symbols(
         symbol.supply_chain_tier = classification.tier.value
         symbol.supply_chain_reason = classification.reason
         symbol.is_test_file = classification.is_test
+        symbol.is_example_file = classification.is_example
+        symbol.is_config_file = classification.is_config
         symbol.is_generated_file = classification.is_generated
         # WI-zimum: fold in modifier-derived export signal. The analyzer
         # may have already set Symbol.is_exported at extraction time

packages/hypergumbo-core/src/hypergumbo_core/ir.py

@@ -223,6 +223,19 @@ class Symbol:
         supply_chain_tier: Position in dependency graph (1=first_party, 2=internal_dep,
             3=external_dep, 4=derived). See §14 of spec.
         supply_chain_reason: Why this tier was assigned (e.g., "matches ^src/")
+        is_test_file: True if the file holds test code (WI-rigun). Independent
+            of tier — co-located test files can be tier 1.
+        is_example_file: True if the file is example/demo/sample/tutorial code
+            (WI-jobuj). Set when the path matches an EXAMPLE_PATTERN.
+        is_config_file: True if the file is a dependency/build manifest such as
+            ``pyproject.toml`` / ``package.json`` / ``Cargo.toml`` (WI-jobuj).
+            Within tier 2, ``is_test_file`` / ``is_example_file`` /
+            ``is_config_file`` are mutually exclusive — at most one is True
+            per Symbol.
+        is_generated_file: True if the file is generated code (WI-tizij).
+            Independent of the role flags above.
+        is_exported: True if the symbol is part of the package's public API
+            (WI-zimum).
         cyclomatic_complexity: McCabe cyclomatic complexity (decision points + 1).
             Counts if/elif/else, for, while, except, with, and/or, match/case.
         lines_of_code: Number of source lines in the symbol body (end_line - start_line + 1).
@@ -251,6 +264,8 @@ class Symbol:
     supply_chain_tier: int = 1  # Default to first_party
     supply_chain_reason: str = ""
     is_test_file: bool = False  # WI-rigun: independent of tier
+    is_example_file: bool = False  # WI-jobuj: example/demo/sample/tutorial code
+    is_config_file: bool = False  # WI-jobuj: dependency/build manifest
     is_generated_file: bool = False  # WI-tizij: generated code flag
     is_exported: bool = False  # WI-zimum: public API / externally reachable
     cyclomatic_complexity: Optional[int] = None
@@ -291,6 +306,8 @@ def to_dict(self) -> dict:
                 "tier_name": _TIER_NAMES.get(self.supply_chain_tier, "first_party"),
                 "reason": self.supply_chain_reason,
                 "is_test_file": self.is_test_file,
+                "is_example_file": self.is_example_file,
+                "is_config_file": self.is_config_file,
                 "is_generated_file": self.is_generated_file,
                 "is_exported": self.is_exported,
             },
@@ -325,6 +342,8 @@ def from_dict(cls, d: dict) -> "Symbol":
             supply_chain_tier=supply_chain.get("tier", 1),
             supply_chain_reason=supply_chain.get("reason", ""),
             is_test_file=supply_chain.get("is_test_file", False),
+            is_example_file=supply_chain.get("is_example_file", False),
+            is_config_file=supply_chain.get("is_config_file", False),
             is_generated_file=supply_chain.get("is_generated_file", False),
             is_exported=supply_chain.get("is_exported", False),
             cyclomatic_complexity=d.get("cyclomatic_complexity"),

packages/hypergumbo-core/src/hypergumbo_core/sketch.py

@@ -5025,6 +5025,8 @@ def _run_analysis(
         symbol.supply_chain_tier = classification.tier.value
         symbol.supply_chain_reason = classification.reason
         symbol.is_test_file = classification.is_test
+        symbol.is_example_file = classification.is_example
+        symbol.is_config_file = classification.is_config
         symbol.is_generated_file = classification.is_generated
         # WI-zimum: fold in modifier-derived export signal. Analyzer
         # may have already set is_exported (WI-gipag Python __all__);

packages/hypergumbo-core/src/hypergumbo_core/supply_chain.py

@@ -163,19 +163,28 @@ def from_dict(cls, data: dict) -> "SupplyChainConfig":
 class FileClassification:
     """Classification result for a file.
 
-    `tier` and `is_test` are independent axes (WI-rigun-patuz). The
-    classifier may demote a file to INTERNAL_DEP because it is a test
-    file, but consumers that want a clean 'real third-party deps' or
-    'production code only' query should compose `tier` with `is_test`
-    rather than re-deriving test-ness from path patterns. The historical
-    'tests = tier 2' framing (89154fa20) is preserved on `tier`; the new
-    `is_test` flag exposes the test-detection result as a separate bit.
+    `tier` and the boolean role flags (`is_test`, `is_example`,
+    `is_config`, `is_generated`) are independent axes (WI-rigun-patuz,
+    WI-jobuj). The classifier may demote a file to INTERNAL_DEP because
+    it is a test/example/config file, but consumers that want a clean
+    'real third-party deps' or 'production code only' query should
+    compose `tier` with the role flag rather than re-deriving the role
+    from path patterns. The historical 'tests = tier 2' framing
+    (89154fa20) is preserved on `tier`; the role flags expose the
+    detection results as separate bits.
+
+    Within tier 2 (INTERNAL_DEP), at most one of `is_test`,
+    `is_example`, `is_config` is True per file — the four-way
+    distinction (test / example / config / pure internal_dep) is
+    derivable from those bits.
     """
 
     tier: Tier
     reason: str
     package_name: Optional[str] = None
     is_test: bool = False
+    is_example: bool = False
+    is_config: bool = False
     is_generated: bool = False
 
 
@@ -295,6 +304,46 @@ class FileClassification:
     r"^tutorials?/",  # tutorials/ or tutorial/
 ]
 
+# WI-jobuj: dependency/build manifest filenames. Files matching these
+# names are flagged with ``is_config=True`` independently of tier (see
+# FileClassification). The set is intentionally narrow — canonical
+# package-manager and build-tool manifests, not arbitrary dotfiles —
+# so the bit means "this file declares dependencies / build config",
+# not "this file happens to configure something."
+CONFIG_FILE_NAMES = frozenset({
+    # Python
+    "pyproject.toml",
+    "setup.py",
+    "setup.cfg",
+    "Pipfile",
+    "Pipfile.lock",
+    # Node
+    "package.json",
+    "package-lock.json",
+    "yarn.lock",
+    # Rust
+    "Cargo.toml",
+    "Cargo.lock",
+    # Go
+    "go.mod",
+    "go.sum",
+    # Ruby
+    "Gemfile",
+    "Gemfile.lock",
+    # Java / Kotlin / JVM
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "settings.gradle",
+    "settings.gradle.kts",
+    # PHP
+    "composer.json",
+    "composer.lock",
+    # Elixir
+    "mix.exs",
+    "mix.lock",
+})
+
 # Patterns for documentation directories (tier 2) — not production code.
 # Checked with re.search to match at any depth (e.g., Sources/Lib/Documentation.docc/).
 # Swift DocC (.docc) bundles contain tutorial fragments, articles, and extension files
@@ -397,6 +446,18 @@ def _is_generated_file(rel_path: str) -> bool:
     return False
 
 
+def _is_config_file(rel_path: str) -> bool:
+    """Check if a file path matches a known dependency/build manifest filename.
+
+    WI-jobuj: matches the basename against ``CONFIG_FILE_NAMES``.
+    Path-position-agnostic — a ``pyproject.toml`` at the repo root and
+    one inside a workspace are both flagged.
+    """
+    rel_norm = rel_path.replace("\\", "/")
+    basename = rel_norm.rsplit("/", 1)[-1]
+    return basename in CONFIG_FILE_NAMES
+
+
 def _has_generated_header(path: Path) -> bool:
     """Check the first few KB of *path* for a generated-file marker.
 
@@ -437,6 +498,11 @@ def classify_file(
         FileClassification with tier, reason, and optional package_name.
         The ``is_generated`` flag is set independently of tier when the
         file path matches known generated-code patterns (WI-tizij).
+        The ``is_config`` flag (WI-jobuj) is set independently of tier
+        when the basename matches a dependency/build manifest filename
+        (``pyproject.toml``, ``package.json``, ``Cargo.toml``, etc.) —
+        but NOT when ``is_test`` or ``is_example`` is already True, so
+        the role flags remain mutually exclusive within tier 2.
     """
     # Get relative path for pattern matching
     try:
@@ -449,10 +515,16 @@ def classify_file(
     # WI-pofin: fall back to a content-based header scan when the path
     # is unambiguous. Path check first because it's cheaper.
     generated = _is_generated_file(rel) or _has_generated_header(path)
+    config_filename = _is_config_file(rel)
 
     result = _classify_file_core(rel, path, repo_root, package_roots, config)
     if generated:
         result.is_generated = True
+    # WI-jobuj: is_config is mutually exclusive with is_test / is_example
+    # within tier 2 (test and example detection wins on a tie, e.g., a
+    # package.json under examples/ is is_example=True, not is_config).
+    if config_filename and not result.is_test and not result.is_example:
+        result.is_config = True
     return result
 
 
@@ -502,7 +574,9 @@ def _classify_file_core(
     # 4. Check example/demo patterns (lower priority than workspace packages)
     for pattern in EXAMPLE_PATTERNS:
         if re.match(pattern, rel):
-            return FileClassification(Tier.INTERNAL_DEP, f"path matches {pattern}")
+            return FileClassification(
+                Tier.INTERNAL_DEP, f"path matches {pattern}", is_example=True
+            )
 
     # 4b. Check documentation patterns (DocC bundles, etc.)
     for pattern in DOCUMENTATION_PATTERNS: