Research: Graft-inspired derived dependency graph for ownership diagnostic explanations (bounded spike) #435

Classification

• Type: bounded research / diagnostic explainability and structural-query feasibility
• Priority: P2 / backlog; no production graph implementation by default
• Area: OwnIR → existing ownership analysis / MOS → diagnostic witness / triage
• Prior art: wimkeir/graft, Java-bytecode Code Property Graph (CPG) research prototype.
• Related, not superseded: P-022 diagnostics: normalized AnalysisTrace and first-divergence minimizer for Python↔Rust shadow mode #269 (normalized Python↔Rust AnalysisTrace and first-divergence minimization), Research: evaluate Tabby-style stateful path pruning for bounded ownership diagnostics #424 (Tabby-style stateful path pruning), Research: evaluate Bifrost for C# code intelligence, agent navigation, and evidence contracts #426 (Bifrost evidence/completeness and navigation), Research: COVA-inspired targeted path-condition oracle for ownership soundness (bounded spike) #431 (COVA path-feasibility oracle), Canonical first-party call facts: preserve interprocedural calls instead of collapsing them into frontend release/use/escape guesses #382 (canonical first-party call facts), Research: semantic mutation testing harness for Own.NET analyzer coverage (bounded pilot) #405 (semantic mutation testing).

Motivation / question

Graft shows a compact architecture combining Soot/Jimple-derived AST, CFG and data-dependence edges, interprocedural call/argument/return edges, and queryable Apache TinkerPop/Gremlin graphs (TinkerGraph/Neo4j). It also sketches class-level incremental rebuilding using class-file hashes.

The candidate benefit for Own.NET is not replacing the Rust/Python ownership engine with a CPG. It is whether a small, derived, queryable dependency/evidence graph, constructed from facts Own.NET already knows, helps engineers explain and debug real ownership findings more reliably than today's OwnIR, CFG, MOS, diagnostic evidence and existing tooling.

Research question: Can a bounded graph projection explain at least one independently adjudicated real diagnostic or analyzer gap materially better than current explain/trace/source navigation, without changing verdicts or laundering missing facts into proofs?

Potential example:

resource allocation -> assignment/alias -> call/Dispose
    -> control-flow merge -> later resource use

A connected graph path is not proof the path is executable, that alias identity matches, or that resource ownership transferred. Presentation/witness utility and detector correctness must be evaluated separately.

Verified Graft implementation details / caveats

Inspect the source at a pinned commit before repeating or extending these observations:

• CpgBuilder builds a graph from Java .class files via Soot/Jimple, adding AST, CFG and PDG and then interprocedural edges: source.
• PdgBuilder uses SimpleLocalDefs for intraprocedural local def-use links: source.
• Interproc links call/return sites and parameter/return dependencies, without demonstrating a call/return-matched, context-sensitive ownership analysis: source.
• AliasAnalysis records a basic intraprocedural may-alias relation from reference assignments; do not equate this with sound/context-sensitive points-to modeling: source.
• TaintAnalysis traverses PDG paths with timeLimit(50000) and checks CFG paths with timeLimit(10000). Its isSanitized check may accept the case where no CFG paths are returned, so exhaustion/incompleteness must never count as proof of sanitization: source. This is a source-level risk, not a demonstrated end-to-end exploit.
• CfgBuilder uses BriefUnitGraph upstream and recursively visits successors; inspect exceptional-flow omission and deep recursion as potential fidelity/stack risks: source.
• amendCpg() uses changed class hashes for incremental rebuilding; its strategy is inspiration only, not proven correct invalidation of all cross-class dependencies.
• At inspection, latest repository commit was 2023-03-27 and test classes included empty/stub JUnit tests. Verify any runnable test coverage rather than assuming production maturity. GitHub repository does not identify a license; do not copy code into Own.NET without checking rights.

Proposed bounded spike

0. Duplicate/overlap gate: inspect current Own.NET features first

Pin the Own.NET commit and read existing explain, OwnIR/CFG/MOS evidence, #269 tracing, #424, #426 and #431. Write a short non-overlap matrix:

• P-022 diagnostics: normalized AnalysisTrace and first-divergence minimizer for Python↔Rust shadow mode #269 tracks engine semantic first-divergence and minimizing mismatches. Do not create another trace pipeline.
• Research: evaluate Tabby-style stateful path pruning for bounded ownership diagnostics #424 targets stateful traversal/pruning for analyzer accuracy. Do not create another path-state solver.
• Research: evaluate Bifrost for C# code intelligence, agent navigation, and evidence contracts #426 examines graph/code-navigation and evidence completeness. Reuse its findings; do not build a second provenance/completeness schema.
• This issue tests only whether a derived graph of existing ownership facts adds identifiable diagnostic triage/explainability value.

If the existing facilities already provide the same answers at similar cost, stop NO-GO without coding.

1. Choose and preregister 5–10 cases

Use existing adjudicated real warnings and mistakes where possible, not fabricated success demos. Include:

• correct use-after-release and double-release witnesses;
• wrong resource/alias target;
• guarded/partial release and branch merge;
• call/parameter/return handoff;
• one unresolved/virtual/opaque callee, and one exception/early-exit boundary.

For each case record source-level ground truth before inspecting graph output, diagnostic/absence, relevant normalized facts, expected minimal explanation, and what existing explain/trace/source navigation can answer.

2. Optional disposable proof-of-concept only after the gate

Build an offline read-only projection from existing pinned OwnIR/CFG/MOS/evidence, for selected methods/resources only. A plain typed adjacency list + deterministic JSON/DOT is sufficient; no mandatory Neo4j, Gremlin, TinkerPop, global CPG store, schema migration or production dependency.

Suggested nodes/edges (adjust to real existing data, do not invent unsupported facts):

• stable source/function/block/instruction/resource IDs;
• allocation, use, release, assignment, argument, return, known call targets, and relevant join/guard events;
• typed def-use, CFG, call, parameter mapping, return/effect, and derived evidence edges;
• exact provenance/phase and status of relation (known, may, unknown/incomplete), with query scope and limits.

Keep a clear distinction between:

1. syntactically connected candidates,
2. semantically justified analysis facts,
3. independently verified executable witnesses.

Never turn a missing edge (especially #382-lost call facts), traversal timeout, unresolved dispatch, alias ambiguity or missing exceptional flow into proof of safety, absence, or verified path feasibility.

3. Compare against existing workflow

On the same pinned cases compare baseline vs graph-assisted triage:

• did the reviewer identify the same real cause and correct resource/call site?
• was a missing/incorrect upstream fact or first meaningful inference error localized?
• were false leads, unsupported conclusions, or omitted conditions introduced?
• evidence size, determinism, review time/steps (if measurable), build/query runtime and peak memory;
• separately report any actual TP/FP/FN delta; a nicer witness is not a recall/precision gain.

Required adversarial controls: wrong receiver/alias, two call sites with different return continuations, guarded and unguarded release, unmodeled exception, opaque call, recursive/deep CFG, query budget exceeded. Any incomplete graph must report incompleteness rather than silently pruning.

4. Final disposition

Produce one short reproducible note with pinned commits, commands, fixtures, raw outputs, per-case comparisons, limitations and NO-GO / RESEARCH ONLY / FOLLOW-UP CANDIDATE verdict. If there is a measurable, non-duplicative win, propose the smallest follow-up implementation issue with permanent regression cases. This issue itself does not authorize production integration.

Acceptance / kill criteria

• Source-backed Graft note identifying construction, traversal, invalidation, and semantic/soundness limits, plus licensing caveat.
• Explicit non-overlap matrix vs P-022 diagnostics: normalized AnalysisTrace and first-divergence minimizer for Python↔Rust shadow mode #269/Research: evaluate Tabby-style stateful path pruning for bounded ownership diagnostics #424/Research: evaluate Bifrost for C# code intelligence, agent navigation, and evidence contracts #426/Research: COVA-inspired targeted path-condition oracle for ownership soundness (bounded spike) #431 and current Own.NET explain/evidence.
• Pinned baseline and 5–10 pre-reviewed cases or a documented early NO-GO when overlap makes a graph unnecessary.
• If prototyped: deterministic, read-only graph projection, reproducible DOT/JSON and stated completeness/provenance; no engine verdict changes.
• Per-case baseline comparison includes helpful explanations and false leads, missing facts, costs, and ambiguous/unknown cases.
• No new Safe, no warning suppression, and no claim of path feasibility solely from graph connectivity.
• KILL if results are merely visual, duplicate existing traces, rely on a new graph database, hide uncertainty, or provide no practical gain over simpler structured evidence.
• Separate narrowly scoped follow-up only for a reproduced, adjudicated and worthwhile improvement.

Explicit non-goals

• No porting Graft/Soot/Java bytecode frontend to C#.
• No generic CPG platform, graph database, graph UI or agent-navigation infrastructure.
• No replacement of OwnIR, MOS, Roslyn lowering, or Python/Rust core.
• No changes to soundness/verdict policy, no production taint/alias/path solver.
• No reopening Post-cutover: summary-backed lifecycle release reachability (generalize the landed #293/#302 predicates) #304 or taking over P-022 diagnostics: normalized AnalysisTrace and first-divergence minimizer for Python↔Rust shadow mode #269/Research: evaluate Tabby-style stateful path pruning for bounded ownership diagnostics #424/Research: evaluate Bifrost for C# code intelligence, agent navigation, and evidence contracts #426/Research: COVA-inspired targeted path-condition oracle for ownership soundness (bounded spike) #431.

Deliverable: evidence-backed GO/NO-GO about a derived diagnostic graph, not a graph product.