PBSOI CISG MVP v0.9 — Impact Engine

/tmp/pbsio_git_1i2r9j2z/head_snapshot · Python repository · evidence-grounded static graph

1
Files
32
Nodes
41
Edges
12
Impact targets
10
Data values
0
State regions
0
Defects
0
Motifs

MVP pipeline

Repository → CISG → Data/State Closure → Impact Engine → review scope

v0.9 technical view preserves one-hop direct evidence from bounded derived impact. Derived impact uses resolved local-call reachability and shared-state coupling; it is review scope, not a claim that every reachable entity will change at runtime.

Metrics

{
  "loaded_files": 1,
  "nodes": 32,
  "edges": 41,
  "node_types": {
    "file": 1,
    "function": 10,
    "data_value": 10,
    "data_sink": 10,
    "boundary_call": 1
  },
  "edge_types": {
    "contains": 10,
    "defines": 10,
    "contains_data": 10,
    "returns_value": 10,
    "calls": 1
  },
  "resolved_local_calls": 0,
  "boundary_calls": 1,
  "findings_by_category": {},
  "findings_by_severity": {},
  "motif_instances": 0,
  "motif_clusters": 1,
  "data_values": 10,
  "phi_nodes": 0,
  "data_edges": 20,
  "alias_edges": 0,
  "state_regions": 0,
  "state_reads": 0,
  "state_writes": 0,
  "module_binding_reads": 0,
  "exception_handlers": 0,
  "explicit_raises": 0,
  "unresolved_local_uses": 0,
  "warnings": 0
}

Highest review breadth

KindTargetReview breadthPath
function1app.py
function0app.py
function0app.py
function0app.py
function0app.py
function0app.py
function0app.py
function0app.py
function0app.py
function0app.py

Warnings

  • None

Impact Engine

Direct = one-hop graph evidence. Derived = bounded resolved call paths + shared-state coupling. No single impact score is treated as truth.

Choose a target.

Code-Induced Semantic Graph

Overview shows 11 of 11 file/class/function entities. Full graph is in cisg.json / cisg.graphml.
app.pyapp.py{"id": "file_13cce7fd076299c8", "type": "file", "label": "app.py", "path": "app.py", "module": "app", "status": "observed", "confidence": 1.0, "evidence": {"path": "app.py", "line": 1, "end_line": 31, "source_hash": "16ce9f73cb54f1450da1ef9734374ca6d5fea5b93afa0cd5b93fef2a5e98902d", "source_kind": "code"}}f0f0{"id": "fn_2ecebf4bcf31eacc", "type": "function", "label": "f0", "path": "app.py", "module": "app", "symbol": "f0", "async": false, "status": "observed", "confidence": 1.0, "fragment_fingerprint": "frag_e27d6eea7a480fbf2ec03c92", "fragment_source_hash": "a40b99e802c15736f0d52f536587fe070827e059f2ccbf4be6002c61f4eea979", "fragment_context_fingerprint": "ctx_2d3d43e98bba4739e6f2f2b7", "evidence": {"path": "app.py", "line": 3, "end_line": 4, "source_hash": "a40b99e802c15736f0d52f536587fe070827e059f2ccbf4be6002c61f4eea979", "source_kind": "code"}, "shape_signature": "shape_0614d3c684b2dd94", "features": {"controls": [], "effects": [], "state_reads": 0, "state_writes": 0, "state_read_targets": [], "state_write_targets": [], "local_calls": 0, "boundary_calls": 0}, "motif_signature": "motif_exact_83e42922287b", "motif_coarse_signature": "motif_coarse_fca123bd72d6"}f1f1{"id": "fn_79b13a5724d0b243", "type": "function", "label": "f1", "path": "app.py", "module": "app", "symbol": "f1", "async": false, "status": "observed", "confidence": 1.0, "fragment_fingerprint": "frag_10189f10eed74075ad9049ca", "fragment_source_hash": "6eb223cd51fdd74c7d68d81bca9e6e3b6bcf7647beabe2aefd40bef6de3f6eb6", "fragment_context_fingerprint": "ctx_2d3d43e98bba4739e6f2f2b7", "evidence": {"path": "app.py", "line": 6, "end_line": 7, "source_hash": "6eb223cd51fdd74c7d68d81bca9e6e3b6bcf7647beabe2aefd40bef6de3f6eb6", "source_kind": "code"}, "shape_signature": "shape_bde66ac8d10840cf", "features": {"controls": [], "effects": [], "state_reads": 0, "state_writes": 0, "state_read_targets": [], "state_write_targets": [], "local_calls": 0, "boundary_calls": 0}, "motif_signature": "motif_exact_83e42922287b", "motif_coarse_signature": "motif_coarse_fca123bd72d6"}f2f2{"id": "fn_7dfbf5c9f791acce", "type": "function", "label": "f2", "path": "app.py", "module": "app", "symbol": "f2", "async": false, "status": "observed", "confidence": 1.0, "fragment_fingerprint": "frag_ffff593e223d43de6d89e922", "fragment_source_hash": "b29239dfc422ae2a5157f4dc70bcff56c15d54b1e370915f1f4031c296b4e7d5", "fragment_context_fingerprint": "ctx_2d3d43e98bba4739e6f2f2b7", "evidence": {"path": "app.py", "line": 9, "end_line": 10, "source_hash": "b29239dfc422ae2a5157f4dc70bcff56c15d54b1e370915f1f4031c296b4e7d5", "source_kind": "code"}, "shape_signature": "shape_17841751b3a44beb", "features": {"controls": [], "effects": [], "state_reads": 0, "state_writes": 0, "state_read_targets": [], "state_write_targets": [], "local_calls": 0, "boundary_calls": 0}, "motif_signature": "motif_exact_83e42922287b", "motif_coarse_signature": "motif_coarse_fca123bd72d6"}f3f3{"id": "fn_328e6508b0d626a0", "type": "function", "label": "f3", "path": "app.py", "module": "app", "symbol": "f3", "async": false, "status": "observed", "confidence": 1.0, "fragment_fingerprint": "frag_49509581d746f8835d225e46", "fragment_source_hash": "99f29205fbf2ca5cfe985927bb7dbbd9a70bf689eb3f63b8f9f9e314b437c69a", "fragment_context_fingerprint": "ctx_2d3d43e98bba4739e6f2f2b7", "evidence": {"path": "app.py", "line": 12, "end_line": 13, "source_hash": "99f29205fbf2ca5cfe985927bb7dbbd9a70bf689eb3f63b8f9f9e314b437c69a", "source_kind": "code"}, "shape_signature": "shape_8c4d67c1d7ee4bec", "features": {"controls": [], "effects": [], "state_reads": 0, "state_writes": 0, "state_read_targets": [], "state_write_targets": [], "local_calls": 0, "boundary_calls": 0}, "motif_signature": "motif_exact_83e42922287b", "motif_coarse_signature": "motif_coarse_fca123bd72d6"}f4f4{"id": "fn_ed7e539cdf0e39ff", "type": "function", "label": "f4", "path": "app.py", "module": "app", "symbol": "f4", "async": false, "status": "observed", "confidence": 1.0, "fragment_fingerprint": "frag_11c24a1a4f0426c44c6f6339", "fragment_source_hash": "2810151efab8a7f9caa9b54c89aad5c5e84584ff675698d70fe43601aafd2dae", "fragment_context_fingerprint": "ctx_2d3d43e98bba4739e6f2f2b7", "evidence": {"path": "app.py", "line": 15, "end_line": 16, "source_hash": "2810151efab8a7f9caa9b54c89aad5c5e84584ff675698d70fe43601aafd2dae", "source_kind": "code"}, "shape_signature": "shape_5cad95b0f5e84abb", "motif_signature": "motif_exact_44528bd13829", "motif_coarse_signature": "motif_coarse_b2feb91af8fa", "features": {"controls": [], "effects": [], "state_reads": 0, "state_writes": 0, "state_read_targets": [], "state_write_targets": [], "local_calls": 0, "boundary_calls": 1}}f5f5{"id": "fn_03ac8544d8e37989", "type": "function", "label": "f5", "path": "app.py", "module": "app", "symbol": "f5", "async": false, "status": "observed", "confidence": 1.0, "fragment_fingerprint": "frag_1d5f77b2b8ef2623853f5800", "fragment_source_hash": "c3ed14726292056a1c7808ac074cf59e876ace0dd4c302d30bb8856baee30a1e", "fragment_context_fingerprint": "ctx_2d3d43e98bba4739e6f2f2b7", "evidence": {"path": "app.py", "line": 18, "end_line": 19, "source_hash": "c3ed14726292056a1c7808ac074cf59e876ace0dd4c302d30bb8856baee30a1e", "source_kind": "code"}, "shape_signature": "shape_0c1b2ce2042d19a2", "features": {"controls": [], "effects": [], "state_reads": 0, "state_writes": 0, "state_read_targets": [], "state_write_targets": [], "local_calls": 0, "boundary_calls": 0}, "motif_signature": "motif_exact_83e42922287b", "motif_coarse_signature": "motif_coarse_fca123bd72d6"}f6f6{"id": "fn_c9971abc96845a7f", "type": "function", "label": "f6", "path": "app.py", "module": "app", "symbol": "f6", "async": false, "status": "observed", "confidence": 1.0, "fragment_fingerprint": "frag_7c8563873f697e8cce89030e", "fragment_source_hash": "69669f841df9e6dbec7b4654742883538f8941f3573eb5183949f66131873d42", "fragment_context_fingerprint": "ctx_2d3d43e98bba4739e6f2f2b7", "evidence": {"path": "app.py", "line": 21, "end_line": 22, "source_hash": "69669f841df9e6dbec7b4654742883538f8941f3573eb5183949f66131873d42", "source_kind": "code"}, "shape_signature": "shape_86d6c1801ac417b5", "features": {"controls": [], "effects": [], "state_reads": 0, "state_writes": 0, "state_read_targets": [], "state_write_targets": [], "local_calls": 0, "boundary_calls": 0}, "motif_signature": "motif_exact_83e42922287b", "motif_coarse_signature": "motif_coarse_fca123bd72d6"}f7f7{"id": "fn_2d32cca1ecb4c19f", "type": "function", "label": "f7", "path": "app.py", "module": "app", "symbol": "f7", "async": false, "status": "observed", "confidence": 1.0, "fragment_fingerprint": "frag_3cea8948782fe65df22d9ddc", "fragment_source_hash": "a398d35764a0e50ac32f7f16dfa0eeccbde037070a95d322aa63814dca1df527", "fragment_context_fingerprint": "ctx_2d3d43e98bba4739e6f2f2b7", "evidence": {"path": "app.py", "line": 24, "end_line": 25, "source_hash": "a398d35764a0e50ac32f7f16dfa0eeccbde037070a95d322aa63814dca1df527", "source_kind": "code"}, "shape_signature": "shape_4a5d4e51668a335a", "features": {"controls": [], "effects": [], "state_reads": 0, "state_writes": 0, "state_read_targets": [], "state_write_targets": [], "local_calls": 0, "boundary_calls": 0}, "motif_signature": "motif_exact_83e42922287b", "motif_coarse_signature": "motif_coarse_fca123bd72d6"}f8f8{"id": "fn_e28cd0e614b49897", "type": "function", "label": "f8", "path": "app.py", "module": "app", "symbol": "f8", "async": false, "status": "observed", "confidence": 1.0, "fragment_fingerprint": "frag_78d1d6a026139435a9f3cdbe", "fragment_source_hash": "74b1fc96de3b7f14ed64b538d36a34d76266ff56b7a73d756281df54993c521c", "fragment_context_fingerprint": "ctx_2d3d43e98bba4739e6f2f2b7", "evidence": {"path": "app.py", "line": 27, "end_line": 28, "source_hash": "74b1fc96de3b7f14ed64b538d36a34d76266ff56b7a73d756281df54993c521c", "source_kind": "code"}, "shape_signature": "shape_d2041aaa91b58866", "features": {"controls": [], "effects": [], "state_reads": 0, "state_writes": 0, "state_read_targets": [], "state_write_targets": [], "local_calls": 0, "boundary_calls": 0}, "motif_signature": "motif_exact_83e42922287b", "motif_coarse_signature": "motif_coarse_fca123bd72d6"}f9f9{"id": "fn_b9d92b9c1cd37864", "type": "function", "label": "f9", "path": "app.py", "module": "app", "symbol": "f9", "async": false, "status": "observed", "confidence": 1.0, "fragment_fingerprint": "frag_89fe312896de66341688fd9d", "fragment_source_hash": "3bcfb8cbf72f54543c9bd6182b0ca921a3ce669ade9bd38770bf3ede60095077", "fragment_context_fingerprint": "ctx_2d3d43e98bba4739e6f2f2b7", "evidence": {"path": "app.py", "line": 30, "end_line": 31, "source_hash": "3bcfb8cbf72f54543c9bd6182b0ca921a3ce669ade9bd38770bf3ede60095077", "source_kind": "code"}, "shape_signature": "shape_ea8cf458cf5fe890", "features": {"controls": [], "effects": [], "state_reads": 0, "state_writes": 0, "state_read_targets": [], "state_write_targets": [], "local_calls": 0, "boundary_calls": 0}, "motif_signature": "motif_exact_83e42922287b", "motif_coarse_signature": "motif_coarse_fca123bd72d6"}

Node evidence

Click a node.

SSA-like data flow

Local data footprint feeds Impact Engine but is not transitive across function boundaries.

RelationSourceTargetEvidenceStatus
returns_valuex#0return@4app.py:4observed
returns_valuex#0return@7app.py:7observed
returns_valuex#0return@10app.py:10observed
returns_valuex#0return@13app.py:13observed
returns_valuex#0return@16app.py:16observed
returns_valuex#0return@19app.py:19observed
returns_valuex#0return@22app.py:22observed
returns_valuex#0return@25app.py:25observed
returns_valuex#0return@28app.py:28observed
returns_valuex#0return@31app.py:31observed

State regions

AccessFunctionRegionKindEvidence

Module binding reads

FunctionBindingEvidence

Explicit exception flow

RelationSourceTargetEvidenceStatus

Findings

SeverityClassTypeLocationSymbolEvidence statement

Deterministic motif candidates

KindPathSymbolConfidenceStructural rule

Name-independent structural signature clusters

Motif IDMembersIdentity basis
motif_coarse_fca123bd72d69name-independent coarse structural feature signature

Per-file SHA-256

PathBytesSHA-256
app.py30616ce9f73cb54f145…

Epistemic contract

observed

  • Python AST definitions
  • imports
  • call syntax
  • control syntax
  • source spans
  • local file hashes
  • SSA-like local definitions/uses
  • self/cls/explicit-global state accesses
  • module-binding reads
  • explicit raise/except syntax
  • definition-time Python name aliases

strongly_inferred

  • local call target resolution
  • parameter-container state regions
  • effect hints
  • branch/loop phi merges
  • explicit exception catch matching
  • structural motif candidates

unresolved

  • runtime dispatch
  • reflection
  • native extension behavior
  • external library semantics
  • precise heap points-to beyond definition-time alias
  • dynamic exception behavior from calls
  • concurrency semantics