codeanalyzer-java: L3 intraprocedural dataflow (CFG/CDG/DDG) + Neo4j overlay

[sinha108]

Plan (optional)

Design spec: https://github.com/codellm-devkit/codeanalyzer-java/blob/main/docs/design/specs/schema-v2-l3-l4-design.md

Problem

The analyzer has no intraprocedural dataflow. L3 must complete each callable's body{} with statement nodes + synthetic @entry/@exit, and lay the three syntactic intra-callable overlays cfg/cdg/ddg on the callable.

Scope boundary

Intraprocedural only — no interprocedural SDG / param_* / summary (that is L4). The analyzer is a pure graph provider: no slicing or taint (those are SDK queries). Includes the L3 Neo4j overlay so the level ships in both projections.

Goals

• CFG via WALA SSACFG/ISSABasicBlock, projected to source-statement line:col nodes (D5); single normalized @exit; every node reachable from @entry and reaching @exit
• Java lowering, each with a documented rule and a fixture: checked-exception edges (per throws/throwing call → nearest handler or @exit), try/catch/finally (+ finally duplication, try-with-resources), synchronized blocks, static/instance initializer blocks, switch (classic + arrow), labeled break/continue
• CDG via post-dominance (Ferrante–Ottenstein–Warren), rooted at @exit
• Syntactic DDG (prov:["ssa"]) from WALA SSA def-use; var = k-limited access path (--graph-field-depth, default 3)
• Neo4j overlay: J_HAS_BODY_NODE/J_HAS_CFG_NODE, J_CFG_NEXT(kind), J_CDG, J_DDG(var,prov)

Caveats and known risks

• SSA → source-statement projection fidelity (multiple SSA instrs per line; synthetic phi/pi; temporaries) — AST-CFG fallback (D5) recorded if unresolvable.
• Over-approximate exceptional edges; k-limiting mandatory for access-path finiteness.
• Determinism: assign ids by sorted source position; collect then sort; never emit during parallel fan-out.

Definition of done

• CFG gate (every node a real span; single @entry/@exit; reachability; each fixture construct emits its documented edges incl. exception).
• Dominance gate (post-dominator tree rooted at @exit; hand-computed control deps for if/loop/early-return match the cdg edges exactly).
• PDG backward-slice gate: reverse reachability over cdg ∪ ddg of a named variable at a named line equals the hand-computed node set exactly (loop-carried + shadowed-scope cases).
• L2 ⊆ L3; both projections agree; -j N byte-identical to -j 1.