feat: confluence benchmark, pattern extractor, agent KB, UX spec

- extract-patterns.js: mines layered arch, ArgoCD appsets, cloud regions,
  CIDR allocations, naming conventions, sync waves, tech stack from code
- agent-kb.js: token-efficient JSON rendering of same doc tree
- eval-confluence-ref-questions.json: 32 reference-only benchmark questions
- wiggum-v2.sh: Ralph Wiggum loop targeting confluence baseline (77.8%)
- docs/human-ux-spec.md: BMad UX designer spec for human doc structure
- Eval results: V2 at 28.7% vs confluence 77.8% baseline
- Hub/spoke ownership now correctly extracted (95% on that question)
- Naming conventions, regions, CIDRs surfaced in system-architecture.md

flow.js

@@ -190,6 +190,80 @@ function traceFlow(entryPoint, index, opts = {}) {
   };
 }
 
+/**
+ * Auto-detect entry points from the graph.
+ * Heuristics:
+ * 1. Helm Deployments/StatefulSets with incoming Service/Ingress edges
+ * 2. Python files with __main__ guard
+ * 3. Shell scripts with main() function
+ * 4. CI pipeline files (.github/workflows/, .gitlab-ci.yml)
+ * 5. Go files with main() function in package main
+ */
+function detectEntryPoints(graph) {
+  const entryPoints = [];
+  const seen = new Set();
+
+  for (const [id, node] of graph.nodes) {
+    // 1. Helm: Deployments/StatefulSets that have a Service pointing to them
+    if (node.kind === 'helm-resource' || node.kind === 'HelmWorkloads') {
+      const resourceType = node.resourceType || node.name || '';
+      if (resourceType.includes('Deployment') || resourceType.includes('StatefulSet') ||
+          node.type === 'Deployment' || node.type === 'StatefulSet') {
+        // Check if any Service/Ingress references this
+        const hasService = graph.edges.some(e =>
+          (e.target === id || e.source === id) &&
+          (e.type === 'EXPOSES' || e.type === 'ROUTES_TO' || e.type === 'DEPENDS_ON')
+        );
+        if (hasService && !seen.has(id)) {
+          seen.add(id);
+          entryPoints.push({ id, name: node.name, kind: 'helm-workload', reason: 'Deployment/StatefulSet with service' });
+        }
+      }
+    }
+
+    // 2. Python __main__
+    if (node._file && node._file.endsWith('.py') && node.type === 'Function' && node.name === '__main__') {
+      if (!seen.has(id)) {
+        seen.add(id);
+        entryPoints.push({ id, name: node.name, kind: 'python-main', reason: 'Python __main__ guard' });
+      }
+    }
+
+    // 3. Shell main()
+    if (node._file && (node._file.endsWith('.sh') || node._file.endsWith('.bash'))) {
+      if (node.type === 'Function' && node.name === 'main') {
+        if (!seen.has(id)) {
+          seen.add(id);
+          entryPoints.push({ id, name: node.name, kind: 'shell-main', reason: 'Shell main() function' });
+        }
+      }
+    }
+
+    // 4. Go main()
+    if (node._file && node._file.endsWith('.go') && node.type === 'Function' && node.name === 'main') {
+      if (!seen.has(id)) {
+        seen.add(id);
+        entryPoints.push({ id, name: node.name, kind: 'go-main', reason: 'Go main() function' });
+      }
+    }
+  }
+
+  // 5. CI pipeline files
+  for (const [filePath] of graph.fileIndex) {
+    const rel = filePath;
+    if (rel.includes('.github/workflows/') || rel.includes('.gitlab-ci') ||
+        rel.includes('Jenkinsfile') || rel.includes('.circleci/')) {
+      const fileEntities = graph.fileIndex.get(filePath);
+      if (fileEntities && !seen.has(filePath)) {
+        seen.add(filePath);
+        entryPoints.push({ id: filePath, name: filePath, kind: 'ci-pipeline', reason: 'CI/CD pipeline file' });
+      }
+    }
+  }
+
+  return entryPoints;
+}
+
 if (require.main === module) {
   const snapshotPath = process.argv[2];
   const entryPoint = process.argv[3];
@@ -205,4 +279,4 @@ if (require.main === module) {
   console.log(JSON.stringify(result, null, 2));
 }
 
-module.exports = { buildFlowIndex, traceFlow };
+module.exports = { buildFlowIndex, traceFlow, detectEntryPoints };