PBSOI CISG MVP v0.2 — Data/State Closure

/mnt/data/PBSOI_CISG_MVP_v0.2/feature_demo · Python repository · evidence-grounded static graph

1
Files
32
Nodes
48
Edges
10
Data values
2
Phi
2
State regions
1
Explicit raises
1
Defects
1
Motifs

MVP pipeline

Repository → Source fingerprint → AST/Symbols → SSA-like Data Flow → State Regions → Exception Flow → Typed CISG → Findings / Motifs

v0.2 adds versioned local values, conservative phi merges, state regions, explicit raise/except flow, and definition-time alias edges. Dynamic points-to and concurrency remain unresolved by design.

Metrics

{
  "loaded_files": 1,
  "nodes": 32,
  "edges": 48,
  "node_types": {
    "file": 1,
    "class": 1,
    "method": 2,
    "function": 1,
    "data_value": 10,
    "state_region": 2,
    "control": 4,
    "module_binding": 1,
    "data_phi": 2,
    "data_sink": 4,
    "exception_handler": 1,
    "exception_event": 1,
    "boundary_call": 1,
    "data_undefined": 1
  },
  "edge_types": {
    "contains": 4,
    "defines": 12,
    "writes_state": 3,
    "controls": 4,
    "reads_state": 2,
    "reads_binding": 1,
    "flows_to": 3,
    "aliases_at_definition": 1,
    "guards": 3,
    "phi_input": 4,
    "contains_data": 4,
    "returns_value": 3,
    "contains_exception_handler": 1,
    "raises": 1,
    "caught_by": 1,
    "calls": 1
  },
  "resolved_local_calls": 0,
  "boundary_calls": 1,
  "findings_by_category": {
    "defect": 1
  },
  "findings_by_severity": {
    "high": 1
  },
  "motif_instances": 1,
  "motif_clusters": 0,
  "data_values": 10,
  "phi_nodes": 2,
  "data_edges": 26,
  "alias_edges": 1,
  "state_regions": 2,
  "state_reads": 2,
  "state_writes": 3,
  "module_binding_reads": 1,
  "exception_handlers": 1,
  "explicit_raises": 1,
  "unresolved_local_uses": 1,
  "warnings": 0
}

Warnings

  • None

Code-Induced Semantic Graph

Overview shows 5 of 5 file/class/function entities. Full graph is in cisg.json / cisg.graphml.
sample.pysample.py{"id": "file_6cba1a015c72e33f", "type": "file", "label": "sample.py", "path": "sample.py", "module": "sample", "status": "observed", "confidence": 1.0, "evidence": {"path": "sample.py", "line": 1, "end_line": 28, "source_hash": "e58875698fb2fefc92355c10740454b828d6adfba39566bdfa081406dcfe6c42", "source_kind": "code"}}CounterCounter{"id": "class_8c92ad6574d0d358", "type": "class", "label": "Counter", "path": "sample.py", "module": "sample", "symbol": "Counter", "status": "observed", "confidence": 1.0, "evidence": {"path": "sample.py", "line": 4, "end_line": 23, "source_hash": "e58875698fb2fefc92355c10740454b828d6adfba39566bdfa081406dcfe6c42", "source_kind": "code"}}Counter.__init__Counter.__init__{"id": "fn_803813c165b14713", "type": "method", "label": "Counter.__init__", "path": "sample.py", "module": "sample", "symbol": "Counter.__init__", "async": false, "status": "observed", "confidence": 1.0, "evidence": {"path": "sample.py", "line": 5, "end_line": 6, "source_hash": "e58875698fb2fefc92355c10740454b828d6adfba39566bdfa081406dcfe6c42", "source_kind": "code"}, "motif_signature": "motif_exact_10bda00c16de", "motif_coarse_signature": "motif_coarse_fca123bd72d6", "features": {"controls": [], "effects": [], "state_reads": 0, "state_writes": 1, "state_read_targets": [], "state_write_targets": ["sample:Counter:self.cache"], "local_calls": 0, "boundary_calls": 0}}Counter.updateCounter.update{"id": "fn_f6f1d1f7db99983a", "type": "method", "label": "Counter.update", "path": "sample.py", "module": "sample", "symbol": "Counter.update", "async": false, "status": "observed", "confidence": 1.0, "evidence": {"path": "sample.py", "line": 8, "end_line": 23, "source_hash": "e58875698fb2fefc92355c10740454b828d6adfba39566bdfa081406dcfe6c42", "source_kind": "code"}, "motif_signature": "motif_exact_157ddc76757a", "motif_coarse_signature": "motif_coarse_7b884010fd49", "features": {"controls": ["branch", "try", "branch"], "effects": [], "state_reads": 2, "state_writes": 2, "state_read_targets": ["sample:Counter:self.cache", "sample:global:GLOBAL_COUNT"], "state_write_targets": ["sample:Counter:self.cache", "sample:global:GLOBAL_COUNT"], "local_calls": 0, "boundary_calls": 1}}intentionally_brokenintentionally_broken{"id": "fn_dca82e933c856982", "type": "function", "label": "intentionally_broken", "path": "sample.py", "module": "sample", "symbol": "intentionally_broken", "async": false, "status": "observed", "confidence": 1.0, "evidence": {"path": "sample.py", "line": 25, "end_line": 28, "source_hash": "e58875698fb2fefc92355c10740454b828d6adfba39566bdfa081406dcfe6c42", "source_kind": "code"}, "motif_signature": "motif_exact_33da3ae324f9", "motif_coarse_signature": "motif_coarse_e6dd3d82f5ef", "features": {"controls": ["branch"], "effects": [], "state_reads": 0, "state_writes": 0, "state_read_targets": [], "state_write_targets": [], "local_calls": 0, "boundary_calls": 0}}

Node evidence

Click a node.

SSA-like data flow

Shows local value flow, phi inputs, control guards, returns/yields, and definition-time alias edges. Full export: dataflow.json.

RelationSourceTargetEvidenceStatus
flows_tovalue#0alias#1sample.py:10observed
aliases_at_definitionvalue#0alias#1sample.py:10observed
guardsflag#0branchsample.py:11observed
flows_toalias#1result#1sample.py:12observed
phi_inputresult#1result#3sample.py:11strongly_inferred
phi_inputresult#2result#3sample.py:11strongly_inferred
flows_toself#0previous#1sample.py:15observed
guardsresult#3branchsample.py:19observed
returns_valueprevious#1return@22sample.py:22observed
returns_valueresult#3return@23sample.py:23observed
guardsflag#0branchsample.py:26observed
phi_inputonly_some_paths#1only_some_paths#2sample.py:26strongly_inferred
phi_inputonly_some_paths:undefinedonly_some_paths#2sample.py:26unresolved
returns_valueonly_some_paths#2return@28sample.py:28observed

State regions

Mutable state is restricted to self/cls fields, explicit globals, and conservative container regions. Read-only module constants/type aliases are kept separately as bindings.

AccessFunctionRegionKindEvidence
writes_stateCounter.__init__sample:Counter:self.cacheobject_fieldsample.py:6
reads_stateCounter.updatesample:Counter:self.cacheobject_fieldsample.py:15
writes_stateCounter.updatesample:Counter:self.cacheobject_fieldsample.py:16
reads_stateCounter.updatesample:global:GLOBAL_COUNTmodule_globalsample.py:17
writes_stateCounter.updatesample:global:GLOBAL_COUNTmodule_globalsample.py:17

Module binding reads

FunctionBindingEvidence
Counter.updatesample:binding:LIMITsample.py:23

Explicit exception flow

RelationSourceTargetEvidenceStatus
raisesCounter.updateraise ValueErrorsample.py:20observed
caught_byraise ValueErrorexcept ValueErrorsample.py:20strongly_inferred

Findings

SeverityClassTypeLocationSymbolEvidence statement
highdefectpossibly_undefined_localsample.py:28intentionally_brokenLocal variable 'only_some_paths' may be undefined on at least one reaching control-flow path.

Deterministic motif candidates

KindPathSymbolConfidenceStructural rule
read_modify_writesample.pyCounter.update0.86same function reads and writes the same state target

Name-independent structural signature clusters

Motif IDMembersIdentity basis

Per-file SHA-256

PathBytesSHA-256
sample.py617e58875698fb2fefc…

Epistemic contract

observed

  • Python AST definitions
  • imports
  • call syntax
  • control syntax
  • source spans
  • local file hashes
  • SSA-like local definitions/uses
  • self/cls/explicit-global state accesses
  • module-binding reads
  • explicit raise/except syntax
  • definition-time Python name aliases

strongly_inferred

  • local call target resolution
  • parameter-container state regions
  • effect hints
  • branch/loop phi merges
  • explicit exception catch matching
  • structural motif candidates

unresolved

  • runtime dispatch
  • reflection
  • native extension behavior
  • external library semantics
  • precise heap points-to beyond definition-time alias
  • dynamic exception behavior from calls
  • concurrency semantics