codeanalyzer-java: L4 SDG — param_in/out + semantic DDG + Neo4j overlay

[sinha108]

Plan (optional)

Design spec: https://github.com/codellm-devkit/codeanalyzer-java/blob/main/docs/design/specs/schema-v2-l3-l4-design.md

Problem

No interprocedural dataflow. L4 must add the synthetic parameter vertices, the cross-function param_in/param_out edges, and the semantic (alias/heap-aware) ddg — stitching L3's per-callable PDGs into a System Dependence Graph.

Scope boundary

Interprocedural edges + semantic DDG, over L3's PDGs. Excludes the summary pass (its own issue). The analyzer is a pure graph provider — no slicing/taint. Includes the L4 Neo4j overlay (J_PARAM_IN/J_PARAM_OUT).

Goals

• Synthetic vertices in body{}: formal_in{of:param}, formal_out{of:$ret|by-ref}, actual_in{of:argN,parent:callsite-id}, actual_out{of:$ret,parent}
• param_in (actual_in→formal_in) and param_out (formal_out→actual_out) at application scope, via WALA SDG + ModRef; Statement.Kind (PARAM_CALLER/CALLEE, *_RET_*, HEAP_*) → vertices/edges
• Semantic ddg (prov:["points-to"]) via DataDependenceOptions.FULL, added to (not replacing) L3's ssa edges
• Points-to: RTA default + --precision {rta,0-cfa,0-1-cfa} (D6)
• Global/static state modeled as extra formal/actual vertices
• Flag-gated at -a 4; J_PARAM_IN/J_PARAM_OUT Neo4j overlay

Caveats and known risks

• RTA heap precision ⇒ conservative/sparse semantic ddg (acceptable; still monotonic). Higher precision behind --precision.
• Weak-update / over-approximate posture (no strong updates through aliases) — this is what keeps L3 ⊆ L4 additive.

Definition of done

• No dangling param_in/param_out endpoints; param_in/param_out arity matches each callable's parameters.
• Semantic prov:["points-to"] ddg edges present and added to the L3 prov:["ssa"] edges (the L3 ⊆ L4 superset holds).
• Output validates against the SDK v2 model; both projections agree; -j N byte-identical to -j 1.