feat(conflict): Add the Tango conflict analyzer

submitqueue/extension/conflict/README.md

@@ -16,6 +16,7 @@ The analyzer does not mutate batch inputs and may be called concurrently. Implem
 - [`fake/`](fake/) — wraps another analyzer and optionally injects configured failures for tests and example wiring.
 - [`none/`](none/) — optimistic stub: reports no conflicts. Useful as a best-case baseline and for wiring tests where speculation should run all batches in parallel.
 - [`pathoverlap/`](pathoverlap/) — resolves changed files and reports overlap conflicts by whole file or parent directory.
+- [`tango/`](tango/) — compares the build targets each batch affects, as reported by a Tango build graph, and reports target-overlap conflicts.
 
 ## Adding a new backend
 

submitqueue/extension/conflict/tango/BUILD.bazel

@@ -3,6 +3,7 @@ load("@rules_go//go:def.bzl", "go_library", "go_test")
 go_library(
     name = "go_default_library",
     srcs = [
+        "analyzer.go",
         "cache.go",
         "intersect.go",
         "mock_request.go",
@@ -17,13 +18,18 @@ go_library(
     visibility = ["//visibility:public"],
     deps = [
         "//platform/base/change:go_default_library",
+        "//submitqueue/core/changeset:go_default_library",
+        "//submitqueue/entity:go_default_library",
+        "//submitqueue/extension/conflict:go_default_library",
+        "//submitqueue/extension/storage:go_default_library",
         "@org_uber_go_mock//gomock:go_default_library",
     ],
 )
 
 go_test(
     name = "go_default_test",
     srcs = [
+        "analyzer_test.go",
         "cache_test.go",
         "intersect_test.go",
         "request_test.go",
@@ -32,7 +38,12 @@ go_test(
     embed = [":go_default_library"],
     deps = [
         "//platform/base/change:go_default_library",
+        "//submitqueue/core/changeset/mock:go_default_library",
+        "//submitqueue/entity:go_default_library",
+        "//submitqueue/extension/conflict:go_default_library",
+        "//submitqueue/extension/storage:go_default_library",
         "@com_github_stretchr_testify//assert:go_default_library",
         "@com_github_stretchr_testify//require:go_default_library",
+        "@org_uber_go_mock//gomock:go_default_library",
     ],
 )

submitqueue/extension/conflict/tango/README.md

@@ -0,0 +1,23 @@
+# Tango conflict analyzer
+
+A `conflict.Analyzer` that decides whether two batches conflict by comparing the build targets each one affects, as reported by a Tango build graph. Two batches conflict when their target sets share an ID, which catches a change that touches code another batch's targets depend on, even when the changed files differ. It reports `ConflictTypeTargetOverlap`.
+
+## Signatures
+
+A batch's signature is the sorted set of its affected targets, each as a 64-bit ID (the first 8 bytes of the SHA-256 of the target label) with its distance from the nearest directly changed source. It is created once, when the batch is first analyzed, and never recomputed: asking Tango again later would use a newer base and could give a different answer. A signature is durable in the signature store, and a byte-bounded in-memory cache in front of it can be dropped at any time at the cost of store reads.
+
+## Behaviour
+
+- Only the batch being analyzed is ever sent to Tango, and only when it has no recorded signature. Redelivery finds the record the earlier attempt created and does not call Tango again.
+- The new batch is signed even when nothing is in flight, so later batches find its record.
+- An in-flight batch is read from the cache, then the store, and never from Tango. A missing record or a store error fails the analysis (`ErrNoSignature` for the missing record), because a signature computed later could differ from the one the batch was admitted with.
+- The analyzer fails closed on any error.
+- A queue must have no in-flight batches when it is switched to this analyzer, because batches admitted earlier have no signature.
+
+## Limits
+
+Each signature is computed against trunk at its own analysis time, without the other in-flight batches applied. If one batch adds a dependency on a target that another batch changes, no overlap is reported, the same kind of miss that path overlap has. Adding the destination of each new dependency edge to the signature would close it.
+
+## Injected pieces
+
+The analyzer owns no connection. A deployment supplies the Tango client adapter, which collects the response and resolves each target's label, and a function that returns the commit SHA of the target branch tip a new batch is analyzed against. The changes of a batch come from the changeset resolver, the signature store is bound to one queue, and one signature cache can be shared by every queue's analyzer. The MySQL implementations of the signature and dictionary stores are in `mysql/`.

submitqueue/extension/conflict/tango/analyzer.go

@@ -0,0 +1,151 @@
+// Copyright (c) 2026 Uber Technologies, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package tango
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/uber/submitqueue/submitqueue/core/changeset"
+	"github.com/uber/submitqueue/submitqueue/entity"
+	"github.com/uber/submitqueue/submitqueue/extension/conflict"
+	"github.com/uber/submitqueue/submitqueue/extension/storage"
+)
+
+// ErrNoSignature means an in-flight batch has no recorded signature. Tango is
+// never asked for it: a signature computed later could differ from the one the
+// batch was admitted with.
+var ErrNoSignature = errors.New("no target signature recorded for in-flight batch")
+
+// Params are the dependencies of one queue's Analyzer.
+type Params struct {
+	// Signatures persists signatures. It must be bound to the queue the
+	// analyzer serves.
+	Signatures SignatureStore
+
+	// Cache holds recently used signatures and may be shared across queues.
+	Cache *SignatureCache
+
+	// Client returns the targets a set of changes affects.
+	Client ChangedTargetsClient
+
+	// BaseRevision returns the full commit SHA of the target branch tip that a
+	// new batch of the named queue is analyzed against.
+	BaseRevision func(ctx context.Context, queue string) (string, error)
+
+	// Changes resolves a batch into the changes it contains.
+	Changes changeset.Resolver
+}
+
+type analyzer struct {
+	Params
+}
+
+// New returns a conflict.Analyzer that reports an in-flight batch as a
+// ConflictTypeTargetOverlap conflict when its signature shares a target ID with
+// the analyzed batch's. It fails closed: any signature it cannot obtain fails
+// the analysis.
+func New(params Params) conflict.Analyzer {
+	return &analyzer{Params: params}
+}
+
+// Analyze signs batch, which is the only step that can call Tango, and compares
+// it with the recorded signature of each in-flight batch. The new batch is
+// signed even when nothing is in flight, so later batches find its record.
+func (a *analyzer) Analyze(ctx context.Context, batch entity.Batch, inFlight []entity.Batch) ([]entity.Conflict, error) {
+	mine, err := a.signNewBatch(ctx, batch)
+	if err != nil {
+		return nil, fmt.Errorf("failed to sign batch %s: %w", batch.ID, err)
+	}
+
+	// TODO(tango): read the in-flight signatures concurrently with a bound.
+	// New dependency edges are not in the signatures yet; see the TODO in signNewBatch.
+	var conflicts []entity.Conflict
+	for _, other := range inFlight {
+		theirs, found, err := a.recordedSignature(ctx, other.Queue, other.ID)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read the signature of in-flight batch %s: %w", other.ID, err)
+		}
+		if !found {
+			return nil, fmt.Errorf("in-flight batch %s: %w", other.ID, ErrNoSignature)
+		}
+		if sharesTarget(mine.Targets, theirs.Targets) {
+			conflicts = append(conflicts, entity.Conflict{BatchID: other.ID, Type: entity.ConflictTypeTargetOverlap})
+		}
+	}
+	return conflicts, nil
+}
+
+func (a *analyzer) recordedSignature(ctx context.Context, queue, batchID string) (TargetSignature, bool, error) {
+	if signature, found := a.Cache.get(queue, batchID); found {
+		return signature, true, nil
+	}
+	signature, found, err := a.Signatures.Get(ctx, batchID)
+	if err != nil || !found {
+		return TargetSignature{}, false, err
+	}
+	a.Cache.put(signature)
+	return signature, true, nil
+}
+
+// signNewBatch returns the batch's own record if an earlier attempt created
+// one; otherwise it creates the signature first, so racing attempts agree.
+func (a *analyzer) signNewBatch(ctx context.Context, batch entity.Batch) (TargetSignature, error) {
+	signature, found, err := a.recordedSignature(ctx, batch.Queue, batch.ID)
+	if err != nil || found {
+		return signature, err
+	}
+
+	changes, err := a.Changes.ChangesForBatch(ctx, batch)
+	if err != nil {
+		return TargetSignature{}, fmt.Errorf("failed to resolve the changes: %w", err)
+	}
+	baseRevision, err := a.BaseRevision(ctx, batch.Queue)
+	if err != nil {
+		return TargetSignature{}, fmt.Errorf("failed to resolve the base revision of queue %s: %w", batch.Queue, err)
+	}
+	affected, err := a.Client.ChangedTargets(ctx, changedTargetsRequestFor(baseRevision, changes))
+	if err != nil {
+		return TargetSignature{}, fmt.Errorf("failed to get the changed targets: %w", err)
+	}
+
+	// TODO(tango): record the labels in the target dictionary before creating the signature.
+	// TODO(tango): add the destination of each new dependency edge to the signature, the RFC's known gap. The adapter must return direct dependencies first.
+	targets, _ := toSignatureTargets(affected)
+	signature = TargetSignature{
+		Queue:        batch.Queue,
+		BatchID:      batch.ID,
+		BaseRevision: baseRevision,
+		Targets:      targets,
+		CreatedAt:    time.Now().UnixMilli(),
+	}
+
+	if err := a.Signatures.Create(ctx, signature); err != nil {
+		if !errors.Is(err, storage.ErrAlreadyExists) {
+			return TargetSignature{}, fmt.Errorf("failed to create the signature: %w", err)
+		}
+		signature, found, err = a.Signatures.Get(ctx, batch.ID)
+		if err != nil {
+			return TargetSignature{}, fmt.Errorf("failed to read the existing signature: %w", err)
+		}
+		if !found {
+			return TargetSignature{}, fmt.Errorf("signature reported as existing but not found")
+		}
+	}
+	a.Cache.put(signature)
+	return signature, nil
+}