Learning epic: build codeanalyzer-rust to a level-3 SDG — in Rust, by hand

[rahlk]

The premise

I am learning Rust by writing the CLDK Rust analyzer in Rust — the backend-in-its-own-language
rule, taken as a curriculum. Like The Rust Programming Language book's final project (a web server
built up chapter by chapter), the issues below are sorted in escalating complexity: retire them
in order and the result is a mature codeanalyzer-rust — canonical analysis.json, Neo4j
projection, packaged releases, and finally native level-3 dataflow graphs (CFG → PDG → SDG)
with slicing and taint.

Every issue names the Rust concepts it exercises (with TRPL chapters by name) and ends in a
gate — a concrete, testable definition of done taken from the CLDK skillset's verification
criteria. The gate discipline is the pedagogy: no issue starts until the previous one's gate is
green.

What already exists (Feb 2025 scaffold)

• src/entities/ — 1,238 LOC of thoughtful Rust-native schema types (is_async/is_unsafe,
  lifetimes, generics, SafetyAnalysis). Better than the canonical spine at the leaves; missing
  the spine itself (no signature, no symbol_table/call_graph root, no serde wiring).
• src/main.rs — a clap CLI whose run() is an empty stub, with a --project-root-pom flag
  copy-pasted from the Java analyzer (a fossil to remove).
• A working single-target release.yml + devcontainer.

Issue 01 starts from auditing this, not from cargo new.

Locked tooling (defaulted from the skill's recommendations — revisit before issue 04 if desired)

codeanalyzer-rust — architecture & tooling
 depth: level 1 → level 3 (level 2 / MIR deliberately skipped; seam stays stubbed)
 runtime: Rust (static binary via cargo)
 structural: tree-sitter-rust [DEFAULTED — syn / ra_ap_syntax were the alternatives]
 resolution: hand-rolled name resolution (use-map + scope chain + receiver-type inference),
 upgraded by a later issue [DEFAULTED — ra_ap_hir-from-day-one was the alternative]
 L3 substrate: CFG hand-built from the AST; hand-built reaching definitions;
 type-based may-alias oracle (ownership makes it unusually strong: &mut is exclusive)
 packaging: cargo cross-compile → GitHub Release binaries + thin PyPI wheel + brew formula
 extra nodes: traits, impls, enums-with-data, macros; trait bounds → base_classes

Record the final versions of these in the README under Architecture & Tooling (issue 01) and
every schema decision in .claude/SCHEMA_DECISIONS.md (issue 02).

The contract that binds every issue

The canonical CLDK shape the sibling analyzers (canpy / cants / canclang) already emit:
Application { symbol_table: Map<relative path, Module>, call_graph: [identity-only edges] },
snake_case JSON, ONE signature_of() canonicalizer producing every id, edges that byte-match real
callable signatures, rich per-call data on Callsite.callee_signature (null → backfilled).
Reference: the cldk-forge codeanalyzer-backend skill (references/canonical-schema.md,
schema-reference.md, testing-and-validation.md, dataflow-graphs.md,
dataflow-construction.md) and codeanalyzer-clang / codeanalyzer-python as worked examples.

The ladder

Phase 0 — foundations (modules, error handling, serde, the contract)

• 01 — Audit & re-scaffold: modular skeleton + the CLDK CLI contract #10 01 — Audit & re-scaffold: modular skeleton + the CLDK CLI contract
• 02 — The schema contract: canonical spine + Rust-native leaves #11 02 — The schema contract: canonical spine + Rust-native leaves

Phase 1 — level 1 (iterators, FFI parsing, ownership at scale, name resolution, testing, release engineering)

• 03 — Discovery & materialization: walk the crate, ask cargo #12 03 — Discovery & materialization: walk the crate, ask cargo
• 04 — Structural parse I: free functions into the symbol table #13 04 — Structural parse I: free functions into the symbol table
• 05 — Structural parse II: structs, enums, traits, impls — the full symbol table #14 05 — Structural parse II: structs, enums, traits, impls
• 06 — Name resolution & the Tier-1 call graph #15 06 — Name resolution & the Tier-1 call graph
• 07 — Caching, incremental analysis & the CLI gates in CI #16 07 — Caching, incremental analysis & the CLI gates in CI
• 08 — Packaging & release: cross-compiled binaries, the wheel, and brew #17 08 — Packaging & release: cross-compiled binaries, wheel, brew (closes Sign generated binaries so it may be called from mac os natively #1)
• 09 — Neo4j projection: the same IR as a property graph #18 09 — Neo4j projection: the same IR as a property graph
• 10 — README, agent guide & the SDK handoff #19 10 — README, agent guide & the SDK handoff

Phase 3 — level 3, native dataflow (smart pointers & arenas, graph algorithms, dataflow frameworks, fixpoints, fearless concurrency)

• 11 — Level 3, stage 1: the CFG — lowering Rust control flow #20 11 — CFG: lowering Rust control flow
• 12 — Level 3, stage 2: dominance & control dependence #21 12 — Dominance & control dependence
• 13 — Level 3, stage 3: access paths, reaching definitions & the DDG #22 13 — Access paths, reaching definitions & the DDG
• 14 — Level 3, stage 4: the PDG & the backward-slice gate #23 14 — The PDG & the backward-slice gate
• 15 — Level 3, stages 5–7: summaries, SCC fixpoints & SDG assembly #24 15 — Summaries, SCC fixpoints & SDG assembly
• 16 — Level 3, stage 8: emission (-a 3) & CPG; slicing/taint move to the SDK #25 16 — Emission (-a 3), slicing & taint as SDG queries
• 17 — Capstone: fearless parallelism & byte-identical determinism #26 17 — Capstone: fearless parallelism & byte-identical determinism

Out of scope, on purpose

• Level 2 (MIR / rustc-internals framework backend): nightly-only and immature; the type-based
  oracle covers most of what it would add, because ownership already answers many alias questions.
  The semantic_analysis seam for it is scaffolded empty in issue 01.
• Implementation by anyone but me. Agents may review, critique, and teach — not write the code.

How I work

Issue → branch (feat/issue-XXX) → work → PR, one issue at a time, in order. Each PR must show its
issue's gate passing (tests in CI). If a gate exposes a wrong earlier decision, reopen the earlier
issue rather than patching around it.