100%

CPG data-flow query layer

Goal

Add a data-flow query layer over the existing CPG so the reviewer can detect side-logic-in-wrong-layer, taint, and cross-phase coupling.

Dependency

  • The CPG substrate (:CfgBlock / :DataFlowNode / :DEF_USE / :SUCCESSOR) is delivered by the COMPLETED intel-graph-evolution plan, section s-cf292ad3 (plans/completed/intel-graph-evolution/content/cpg-facet-for-ori-arc-aims--s-cf292ad3.md; intel_repo/neo4j/schema.cypher:617-689).
  • This is a CROSS-PLAN dependency on {plan: intel-graph-evolution, section: s-cf292ad3}, set structurally per INV-21 via cross_plan_needs on this section (python -m scripts.plan_corpus set-cross-plan-needs); hint_needs cannot express a cross-plan edge.
  • The dataflow queries do NOT depend on intra-plan siblings gds-activation (s-4e62453e) or query-primitives (s-9fb83bc7); CDG + reachableBy are confirmed absent from the live graph today, so this section’s work is net-new over the existing CPG.

Scope boundary

  • This section authors the dataflow signals AND wires them into their consumer: the CDG edge, the reachableBy layer, the three dataflow queries, and their integration into the /impl-hygiene-review phase-2.5-graph-recon pre-pass.
  • Consumer-wiring is IN SCOPE here, co-located with the queries it consumes: scripts/impl_hygiene_review_runtime/recon.py batches a FIXED primitive set via the hygiene-recon intel-query macro, so adding the dataflow lens is a deliberate multi-file extension with no zero-effort hook.
  • The recon-wiring obligation is folded into w-b8b36d34 (the dataflow-query work item) and pinned by the L12 production-entry criteria below; it is NOT deferred to query-primitives (s-9fb83bc7), which is COMPLETE + reviewed and exposes no extension point.

Implementation Sketch

Add a CDG control-dependence edge over existing CfgBlock nodes; build a reachableBy query layer over DataFlowNode/CfgBlock/DEF_USE; author source/sink/barrier queries for side-logic-in-wrong-layer, taint, and cross-phase coupling.

Work Items

  • Add a CDG (control-dependence) edge to the CPG extraction over existing CfgBlock nodes (intel_repo/neo4j/cpg_extractor.py), pinned with a control-dependent-pair test case.
  • Build a Joern-style reachableBy query layer over DataFlowNode/CfgBlock/DEF_USE. Document the intended extraction surface (CPG_SCOPE_PREFIXES in intel_repo/neo4j/cpg_scopes.py) so the query-coverage criterion is measured against the intended crate/path set; expand CPG_SCOPE_PREFIXES if the queries must cover parser/typecheck code.
  • Author side-logic-in-wrong-layer / taint / cross-phase-coupling queries on the reachableBy layer, then wire them into the /impl-hygiene-review phase-2.5-graph-recon pre-pass by extending the hygiene-recon intel-query macro plus scripts/impl_hygiene_review_runtime/recon.py to surface the three dataflow candidate sets. The recon primitive set is FIXED (no zero-effort extension point), so this consumer-wiring is co-located with the queries authored here and routed through scripts/impl_hygiene_review_runtime/ per script-first.md; it is NOT deferred to the COMPLETED query-primitives (s-9fb83bc7).

Test Coverage

  • The retained shell-exit probe (intel-query.sh dataflow reachableBy exits ok) is a smoke probe only — “returns” is not “returns correct results”; it is NOT the close gate.
  • Per-work-item pytest pins (intel_repo/tests/test_cpg_dataflow.py) against a seeded live-graph fixture match the bar set by gds-activation (sc-89902b3f) and query-primitives:
    • CDG edge correctness (w-3c66fa58, sc-cd9e01): positive pin (control-dependent block pair carries the edge) + negative pin (independent pair does not).
    • reachableBy result-shape (w-1b96e818, sc-eac4b0): positive pin (reachable source->sink path returned as a flow path) + negative pin (unreachable pair returns empty).
    • dataflow queries (w-b8b36d34, sc-da7a09): each of the three queries returns the documented violating-path shape + rejects a seeded false-positive.
  • L12 Production entry point — COVERED: sc-d1f7a0 drives the REAL /impl-hygiene-review phase-2.5 recon pre-pass on the live graph (the dataflow lens feeds scripts/impl_hygiene_review_runtime/recon.py’s candidate set); sc-d1f7b5 drives the REAL intel-query.sh dataflow query on a REAL CPG target asserting threshold-compliant violating flow paths — neither is a seeded-fixture or seam-injected test.
  • Tests are authored test-first: the failing assertion frames each slice before the code lands, per the matrix-testing rule.

References

intel_repo/neo4j/cpg_extractor.py; intel_repo/neo4j/cpg_scopes.py (CPG_SCOPE_PREFIXES); intel_repo/tests/test_cpg_dataflow.py; scripts/impl_hygiene_review_runtime/recon.py; hygiene-recon intel-query macro; DataFlowNode/CfgBlock/DEF_USE; Joern reachableBy; CodeQL source/sink/barrier model; plans/completed/intel-graph-evolution/content/cpg-facet-for-ori-arc-aims—s-cf292ad3.md (s-cf292ad3; schema.cypher:617-689); gds-activation (s-4e62453e) sc-89902b3f; query-primitives (s-9fb83bc7) recon pre-pass.