feat(pkg/go): validate entrypoints from the weighted graph

[SoulPancake]

Adds pkg/go/validation/graph_validation.go, which builds the weighted graph through the exported builder and reports unreachable relations by reading it rather than by walking the rewrite tree. A relation node carries one weight per terminal type it can reach, so reaching none is what the traversal calls an impossible relation.

EngineOptions.UseGraphValidation selects it, and the two paths are an if/else rather than two phases. They answer the same question by different means, so running both would report one problem twice and disagree wherever they diverge. It is off by default because the graph path is not the source of truth yet.

Over the 84 non-skipped cases of the shared semantic corpus, validation and the graph reject 33 of the same models, validation rejects 47 the graph builds, and the graph rejects none that validation accepts. Of the 51 the graph builds, the new rule and the traversal name an identical set of entrypoint findings on all 51, compared as whole findings including symbol, line, column and message. The rule fires on 7, so that comparison is not of empty lists.

Under the option, 73 of 84 corpus cases pass. The 11 that do not diverge one way: Build stops at the first problem and returns no graph with its error, so there is nothing left to enumerate relations from, and a model with three broken relations yields one finding naming none of them. Those cases report the new graph-model-unbuildable instead, which carries no position. It chains the error the builder returned under ErrModelNotBuildable, so errors.Is reaches both the refusal and the reason.

Nothing under pkg/go/graph changes.

Description

What problem is being solved?

How is it being solved?

What changes are made to solve it?

References

Review Checklist

• I have clicked on "allow edits by maintainers".
• I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
• The correct base branch is being used, if not main
• I have added tests to validate that the change in functionality is working as expected

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: abaae151-3f1c-4b0d-8a37-c0a554cf90c1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}