PBSOI CISG MVP v0.9 — Impact Engine

/tmp/pbsio_git_9ci7d656/head_snapshot · Python repository · evidence-grounded static graph

1
Files
15
Nodes
19
Edges
6
Impact targets
5
Data values
0
State regions
0
Defects
0
Motifs

MVP pipeline

Repository → CISG → Data/State Closure → Impact Engine → review scope

v0.9 technical view preserves one-hop direct evidence from bounded derived impact. Derived impact uses resolved local-call reachability and shared-state coupling; it is review scope, not a claim that every reachable entity will change at runtime.

Metrics

{
  "loaded_files": 1,
  "nodes": 15,
  "edges": 19,
  "node_types": {
    "file": 1,
    "function": 4,
    "data_value": 5,
    "data_sink": 4,
    "boundary_call": 1
  },
  "edge_types": {
    "contains": 4,
    "defines": 5,
    "contains_data": 4,
    "returns_value": 4,
    "flows_to": 1,
    "calls": 1
  },
  "resolved_local_calls": 0,
  "boundary_calls": 1,
  "findings_by_category": {},
  "findings_by_severity": {},
  "motif_instances": 0,
  "motif_clusters": 1,
  "data_values": 5,
  "phi_nodes": 0,
  "data_edges": 10,
  "alias_edges": 0,
  "state_regions": 0,
  "state_reads": 0,
  "state_writes": 0,
  "module_binding_reads": 0,
  "exception_handlers": 0,
  "explicit_raises": 0,
  "unresolved_local_uses": 0,
  "warnings": 0
}

Highest review breadth

KindTargetReview breadthPath
function1app.py
function0app.py
function0app.py
function0app.py

Warnings

  • None

Impact Engine

Direct = one-hop graph evidence. Derived = bounded resolved call paths + shared-state coupling. No single impact score is treated as truth.

Choose a target.

Code-Induced Semantic Graph

Overview shows 5 of 5 file/class/function entities. Full graph is in cisg.json / cisg.graphml.
app.pyapp.py{"id": "file_13cce7fd076299c8", "type": "file", "label": "app.py", "path": "app.py", "module": "app", "status": "observed", "confidence": 1.0, "evidence": {"path": "app.py", "line": 1, "end_line": 12, "source_hash": "6fcb76ea57d6e1a8a83b6e57e19c812ea7987aa83cea5fc938e57e161f0a4fda", "source_kind": "code"}}aa{"id": "fn_df32e3f47f3075ed", "type": "function", "label": "a", "path": "app.py", "module": "app", "symbol": "a", "async": false, "status": "observed", "confidence": 1.0, "fragment_fingerprint": "frag_3a1f3d69b58f6ffbd3316f56", "fragment_source_hash": "95f631d4ef0ecd602c72db4ead951a3d543a47b56db55b4884f825bead1c5759", "fragment_context_fingerprint": "ctx_9f20ffb551ac0ae80098d2ca", "evidence": {"path": "app.py", "line": 1, "end_line": 2, "source_hash": "95f631d4ef0ecd602c72db4ead951a3d543a47b56db55b4884f825bead1c5759", "source_kind": "code"}, "shape_signature": "shape_bde66ac8d10840cf", "features": {"controls": [], "effects": [], "state_reads": 0, "state_writes": 0, "state_read_targets": [], "state_write_targets": [], "local_calls": 0, "boundary_calls": 0}, "motif_signature": "motif_exact_83e42922287b", "motif_coarse_signature": "motif_coarse_fca123bd72d6"}bb{"id": "fn_33cf649322609c89", "type": "function", "label": "b", "path": "app.py", "module": "app", "symbol": "b", "async": false, "status": "observed", "confidence": 1.0, "fragment_fingerprint": "frag_69ee021b2202645ddd13ecb0", "fragment_source_hash": "8236477aa953e6eb8a98d1c42a170aef64b2e32e088f54226283f7483c8a73a1", "fragment_context_fingerprint": "ctx_9f20ffb551ac0ae80098d2ca", "evidence": {"path": "app.py", "line": 4, "end_line": 6, "source_hash": "8236477aa953e6eb8a98d1c42a170aef64b2e32e088f54226283f7483c8a73a1", "source_kind": "code"}, "shape_signature": "shape_9edc62e24ddb118c", "motif_signature": "motif_exact_44528bd13829", "motif_coarse_signature": "motif_coarse_b2feb91af8fa", "features": {"controls": [], "effects": [], "state_reads": 0, "state_writes": 0, "state_read_targets": [], "state_write_targets": [], "local_calls": 0, "boundary_calls": 1}}cc{"id": "fn_49a307de0692e924", "type": "function", "label": "c", "path": "app.py", "module": "app", "symbol": "c", "async": false, "status": "observed", "confidence": 1.0, "fragment_fingerprint": "frag_f25c4d4cc9c2fd1d62c0911c", "fragment_source_hash": "d1c891fcca054e5d7c6eb524ebf195859f3ab27d60ffc7e16887e22d84df8255", "fragment_context_fingerprint": "ctx_9f20ffb551ac0ae80098d2ca", "evidence": {"path": "app.py", "line": 8, "end_line": 9, "source_hash": "d1c891fcca054e5d7c6eb524ebf195859f3ab27d60ffc7e16887e22d84df8255", "source_kind": "code"}, "shape_signature": "shape_8c4d67c1d7ee4bec", "motif_signature": "motif_exact_83e42922287b", "motif_coarse_signature": "motif_coarse_fca123bd72d6", "features": {"controls": [], "effects": [], "state_reads": 0, "state_writes": 0, "state_read_targets": [], "state_write_targets": [], "local_calls": 0, "boundary_calls": 0}}dd{"id": "fn_68898d5a8a0a533c", "type": "function", "label": "d", "path": "app.py", "module": "app", "symbol": "d", "async": false, "status": "observed", "confidence": 1.0, "fragment_fingerprint": "frag_32887fd662309073b6d77bc5", "fragment_source_hash": "4995f9aedfba34a3ce5cc55a3b1bd462129b978b1511a820dcdca5a64cc06e8d", "fragment_context_fingerprint": "ctx_9f20ffb551ac0ae80098d2ca", "evidence": {"path": "app.py", "line": 11, "end_line": 12, "source_hash": "4995f9aedfba34a3ce5cc55a3b1bd462129b978b1511a820dcdca5a64cc06e8d", "source_kind": "code"}, "shape_signature": "shape_da93537be674a83a", "motif_signature": "motif_exact_83e42922287b", "motif_coarse_signature": "motif_coarse_fca123bd72d6", "features": {"controls": [], "effects": [], "state_reads": 0, "state_writes": 0, "state_read_targets": [], "state_write_targets": [], "local_calls": 0, "boundary_calls": 0}}

Node evidence

Click a node.

SSA-like data flow

Local data footprint feeds Impact Engine but is not transitive across function boundaries.

RelationSourceTargetEvidenceStatus
returns_valuex#0return@2app.py:2observed
flows_tox#0y#1app.py:5observed
returns_valuey#1return@6app.py:6observed
returns_valuex#0return@9app.py:9observed
returns_valuex#0return@12app.py:12observed

State regions

AccessFunctionRegionKindEvidence

Module binding reads

FunctionBindingEvidence

Explicit exception flow

RelationSourceTargetEvidenceStatus

Findings

SeverityClassTypeLocationSymbolEvidence statement

Deterministic motif candidates

KindPathSymbolConfidenceStructural rule

Name-independent structural signature clusters

Motif IDMembersIdentity basis
motif_coarse_fca123bd72d63name-independent coarse structural feature signature

Per-file SHA-256

PathBytesSHA-256
app.py1226fcb76ea57d6e1a8…

Epistemic contract

observed

  • Python AST definitions
  • imports
  • call syntax
  • control syntax
  • source spans
  • local file hashes
  • SSA-like local definitions/uses
  • self/cls/explicit-global state accesses
  • module-binding reads
  • explicit raise/except syntax
  • definition-time Python name aliases

strongly_inferred

  • local call target resolution
  • parameter-container state regions
  • effect hints
  • branch/loop phi merges
  • explicit exception catch matching
  • structural motif candidates

unresolved

  • runtime dispatch
  • reflection
  • native extension behavior
  • external library semantics
  • precise heap points-to beyond definition-time alias
  • dynamic exception behavior from calls
  • concurrency semantics