SCJ: structural code analysis and three merged F Prime contributions Bee Rosa Davis Research note · Version 0.3 · Updated 15 October 2026 Shadow Clone Jutsu studies structural relationships in code to prioritize human investigation. Three merged F Prime contributions make the results inspectable: two local size checks and a reusable CodeQL query. The security research setting is IBM; F Prime is the upstream software examined. TL;DR The question: Given a known bug pattern, can a structural ranking of functions put real defects near the top of an analyst’s review queue without flooding it with false alarms? What the work does: scj-hunt: a Rust tool that ingests C and C++ functions into GIGI via tree-sitter, applies per-target sink and guard catalogs, and ranks candidates across about 473,000 lines of NASA-related code. What is still open: Discovery of unknown bugs rather than recovery of known ones, on frozen repositories with labeled cases, a fixed review budget, and guard propagation from callers. THE RESEARCH IN CONTEXT Static analysis tools scan source code for shapes associated with vulnerabilities, such as copying externally supplied data into a fixed-size buffer without checking its length. The difficulty is context. A pattern that looks dangerous in one function may be safe because a caller already validated the input or because a type limits the value’s range. Tools that flag every match bury reviewers in false positives; tools that flag too little miss real defects. Flight software is a demanding test case: it can be reached through communication links, and it has already been reviewed extensively, so a genuine finding must survive that history. The June 2026 report covers scj-hunt versions 0.6 to 0.11. Each function becomes a record in GIGI carrying pattern-presence flags. Rules combine flags in a present-and-present-and-not form, so a rule fires only when a dangerous call appears without its matching guard, and a forward breadth-first pass marks functions reachable from Software Bus message handling. Catalogs are split into per-target profiles of roughly 100–200 lines of TOML and YAML. The corpus spans cFS core, apps, PSP and OSAL (1,981 functions), the 42 simulator, eefs, SBN, CryptoLib and F Prime. Before writing profiles, the author ran an LLM-assisted manual review as a baseline. On F Prime, the initial profile flagged 63 functions above score 1.0 and 4 above the audit threshold; recognizing three F Prime defensive idioms reduced these to 13 and 1. The remaining function, FileUplink::File::open, copies a path without a local length check and is safe only because a field in another file is declared as an 8-bit integer. A hardening pull request adding the check was merged on 9 June 2026, and rerunning the tool on the 829 functions of the Svc tree then reported none above threshold. The report notes that profiles were written after the baseline findings, so the ranking mainly tests recovery of known answers. AVAILABLE RECORD June investigation report and three verified upstream merges: F Prime #5262, #5518 and #5544. Public merge records checked 15 October 2026. TECHNICAL FIGURE source-informed technical atlas Source: SCJ manuscript, inter-procedural reachability and cFS triage sections. The service relationships and hit counts are reported source material; candidates are not confirmed defects. How architectural triage changed the candidate queue Manuscript table Compound rule | v0.7 | v0.8 | v0.9 | v0.9b | v0.9c module_load_with_cmd_filename | 0 | 1 | 0 | 0 | 0 psp_write_from_sb | 0 | 7 | 0 | 0 | 0 sb_memcpy_unbounded | 0 | 12 | 1 | 0 | 0 sb_tbl_load_dispatch | 0 | 3 | 3 | 1 | 1 tbl_load_no_validate | 0 | 3 | 3 | 1 | 1 tbl_address_deref_no_check | 0 | 8 | 8 | 6 | 6 cds_restore_unvalidated | 0 | 2 | 2 | 2 | 2 fs_header_no_magic_check | 0 | 1 | 1 | 1 | 1 Total | 0 | 29 | 18 | 11 | 11 High-severity slice (weight ≥ 5) | 0 | 20 | 1 | 0 | 0 Five cFS bundles, approximately 650 functions. These counts are rule hits, not confirmed vulnerabilities. The manuscript explains the surviving v0.9c patterns as correct by design or guarded by another function. Zero high-severity hits does not prove the software is vulnerability-free. paper.tex — Table labeled tab:cfs-fp, Compound-Rule Hit Reduction Accepted contributions to F Prime FileUplink #5262, merged 9 June 2026, adds a local destination-path length check before copying. The existing U8 length already constrained valid inputs; this is defense in depth, not a demonstrated overflow under the existing type contract. DpCompressProc #5518, merged 4 August 2026, rejects undersized packet buffers before container construction, emits a dedicated event, and adds an off-nominal regression test. A reviewer reproduced the failure without the guard and reported ten passing component tests on an intermediate revision; the final event refinement was subsequently approved and merged. CodeQL #5544, merged 5 August 2026, generalizes the investigation into a query for unchecked unsigned size subtraction. Its guard matching distinguishes the object being checked from other buffers in the same function. Following maintainer review, assertions count as valid checks. The rule is a scoped heuristic, not a proof of path safety. What the search actually represents Davis identifies the 2025 NASA Gemini Drift paper as the precursor to SCJ. Gemini Drift searches for related code after a patch; the later SCJ work develops this into a broader source-code investigation workflow. The NASA origin and the later IBM research setting are distinct. The SCJ manuscript describes a function-level corpus in GIGI. Functions are ranked using sink reach, interprocedural reachability, and combinations of guard primitives. The engineering work extends binary ingestion from Ghidra exports to C and C++ source ingestion using tree-sitter, and adds compositional AND–AND–NOT patterns and a forward breadth-first reachability pass. Per-target profiles matter because the same apparent pattern can be safe in one architecture and unsafe in another. A missing local check can be supplied by a caller; a dangerous sink can be unreachable from the relevant input. The ranking narrows an investigation—it does not settle it. Eliminating false positives is part of the contribution The paper describes a cFS investigation in which apparently severe findings were reduced through architectural explanation and triage. That is a useful outcome on a mature codebase: the detector becomes more informative when it learns which guards and calling conventions it initially missed. Other reported investigations led to manually examined findings and upstream pull requests. A filed fix, a maintainer-confirmed defect, and a published advisory are different stages. This account does not describe every submitted candidate as a confirmed vulnerability or claim that structural similarity finds every instance of a bug. Keep network anomaly detection separate The older catalog also lists behavioral network anomaly detection. That work has a different unit of observation and needs time-stamped traffic labels and false-alert accounting. The SCJ code-review record cannot supply its precision or false-positive rate. THE NEXT RESEARCH STEP The next useful report should retain the full funnel: all ranked candidates, exclusions with reasons, analyst time, reproducible triggers where appropriate, and maintainer dispositions. That would measure how much useful investigation the representation enables. TEACHING CONSTRUCTION (not project measurements) Freeze a repository snapshot and an annotation policy. Represent functions or network observations, rank candidates, and evaluate a fixed analyst budget k. Keep code-retrieval experiments separate from time-dependent network anomaly experiments. precision@k = confirmed relevant candidates among the first k / k k: Predeclared candidate-review budget. Relevance: A documented judgment against the specified investigation task. Recall: The fraction of known relevant cases retrieved; it needs an adequate reference set. If a toy search returns ten functions and two are independently confirmed relevant, precision at ten is 0.2. That says nothing about recall unless the total set of relevant functions is known. Duplicate copies of the same function should not be counted as independent discoveries. SOURCE RECORD SCJ research companion: https://www.davisgeometric.com/scj/ F Prime contribution atlas: https://www.davisgeometric.com/scj/fprime.html Merged FileUplink contribution #5262: https://github.com/nasa/fprime/pull/5262 Merged DpCompressProc contribution #5518: https://github.com/nasa/fprime/pull/5518 Merged CodeQL contribution #5544: https://github.com/nasa/fprime/pull/5544 Gemini Drift: the NASA precursor to SCJ: https://www.davisgeometric.com/research/papers/gemini-drift.html SRCV: build/runtime concordance: https://www.davisgeometric.com/research/papers/srcv.html SCJ project report (PDF): https://www.davisgeometric.com/scj/papers/scj-hunt-vs-nasa-oss-2026-06.pdf local-project/shadow_clone_jutsu/papers/paper.tex — local source reviewed; not republished local-project/shadow_clone_jutsu/papers/README.md — local source reviewed; not republished Source versions: https://www.davisgeometric.com/research/account-source-records.json No new experiments are reported in this research note. Illustrated study: https://www.davisgeometric.com/research/figures/draft-security.html