Reverse-engineers hidden LangGraph StateGraph state machines from the surface using a single WhatsApp session. The system extracts static guardrails, conditional routers, subadditive parallel fan-outs, and checkpointer persistence without source-code access.
Progressive, non-destructive surface mapping from baseline calibration to memory checkpointer persistence auditing.
Initializes graph baseline topology with a single unobserved black-box node (__start__ → unknown_blackbox_node → __end__). Conducts WebSocket ping calibration to establish channel transport latency.
Measures net inference latency below 600ms to isolate static regex or keyword blocks. Latencies between 600ms and 1800ms pinpoint semantic classification pivots executed by LLM entry routers.
Executes read-only probes across product catalogs, pricing tiers, inventory counts, and scheduling slots without side effects, mapping external tool integrations.
Probes mutating intents such as booking creations and refund reversals, verifying whether the target enforces confirmation boundaries and human handoffs before committing state.
Mathematical subadditivity proof (Ratio = T_compound / (T_A + T_B) ≤ 0.72) to decisively confirm parallel execution via LangGraph Send() fan-out versus serial conditional routing.
Injects unique canary tokens followed by abrupt topic pivots to audit context retention across thread interrupts, verifying SqliteSaver or PostgresSaver state persistence.
Empirical formulation separating carrier transport overhead from model inference and external tools.
Raw observed round-trip times include messaging hop delays. The analyzer subtracts calibrated WebSocket round-trip times (L_net = max(0, RTT - 2 * WS_Ping)) to classify node tiers accurately:
Eliminating multi-bot consensus overhead, the analyzer uses a deterministic two-pass verification protocol through a single channel:
Transactional SQLite WAL store, biometric jitter pacing, and zero-risk local simulation.
Attaches non-destructively to a single WAHA Multi-Device session on port 3001, eliminating multi-SIM carrier overhead and reducing ban surfaces.
Enforces log-normal reading delays and simulated typing presence with an inviolable ≥ 2.0s turn gap floor to mirror natural human cadence.
Transactional persistence in data/analyzer.sqlite3 tracking target scans, chronological turns, topology nodes, directed edges, and settings.
Includes an in-memory deterministic target simulator allowing immediate execution of all 6 waves and artifact generation without external API keys.
Compiles verified SQLite topology in <15ms into executable LangGraph Python code, Mermaid documentation diagrams, JSON schemas, and Markdown reports.
Designed for security auditors, AI architects, and red-team engineers validating conversational surface systems.
Mapping competitor conversational architecture on WhatsApp to uncover internal tools, routing strategies, model tiers, and latency boundaries.
Verifying whether high-stakes operations (refunds, order updates, PII sharing) enforce human-in-the-loop interrupts before committing mutations.
Extracting undocumented legacy chatbot flows and automatically exporting clean, compilable LangGraph StateGraph Python skeletons for modernization.
Full source code, including the FastAPI backend, 5-table SQLite WAL store, 6-wave protocol runner, React 19 Blueprint Studio, and 4 deterministic exporters, is available on GitHub under the MIT License.
