Epic: codeanalyzer-java → canonical schema v2 + L3/L4 dataflow (analyzer + SDK)

[sinha108]

Spec

https://github.com/codellm-devkit/codeanalyzer-java/blob/main/docs/design/specs/schema-v2-l3-l4-design.md

Summary

Migrate codeanalyzer-java from the legacy v1 output to the canonical schema v2 (one additive CPG: application → module → type → callable → body with typed edge overlays) and grow it to analysis level 4 — L3 intraprocedural cfg/cdg/ddg, L4 interprocedural param_in/param_out/summary + semantic ddg — in both projections (analysis.json + Neo4j). This is a schema-major change (new envelope, can:// ids, identity-only call_graph, body call nodes, structured decorators, nested metrics/refs). The python-sdk Java models migrate to v2 in lockstep behind a frozen public API.

Affected repos (from Contract-Impact Triage)

• codeanalyzer-java — analyzer emission (L1–L4) + Neo4j projection — backend rung
• python-sdk — Java models → v2 two-layer views; new get_program_dependency_graph — frontend rung
• docs (user-facing schema/levels) — later, finishing-cldk-work

Design decisions

• D1 Pure canonical v2 (drop code/flat lines/call_sites[]; SDK views reconstruct)
• D2 Structured decorators:[{name,args,span}]
• D3 Nested metrics:{cyclomatic} + refs:{types,fields}
• D4 Single type kind (class/interface/enum/record/annotation) + nesting
• D5 L3 CFG: WALA engine → source-statement line:col nodes (AST-CFG fallback if fidelity fails)
• D6 L4 points-to: RTA default + --precision {rta,0-cfa,0-1-cfa}
• D7 L4 summary edges: own summary pass (parity with codeanalyzer-python)
• D8 can://java/<app>/<file>/<type>/<sig> ids
• D9 Neo4j keeps the J_ relationship prefix
• Scope guard: analyzer is a pure graph provider — no slicing/taint in the analyzer (those are SDK queries)

Release plan

• Analyzer = major release (breaking output). L1–L4 are independently shippable behind -a, so cut the major once L1/L2 v2 (± L3) are green; grow L4 in a follow-up minor.
• SDK = major release; pins the analyzer only after the analyzer v2 release is cut (old SDK models can't parse v2 until then).
• Neo4j schema.neo4j.json and the JSON schema move in lockstep.

Definition of done (epic-level)

• Every sub-issue closed and its PR's gate green.
• Analyzer output validates against the SDK v2 models at max_level; L1 ⊆ L2 ⊆ L3 ⊆ L4 superset gate holds; parity clause holds (no renamed/repurposed shared vocabulary).
• SDK public API unchanged (major bump + documented semantic shifts).
• Docs / CHANGELOG updated; analyzer↔SDK versions pinned in lockstep.