Repository navigation
Code Analysis Java Qualified Calls
Draft validated, not Labs: #1259, runtime 5f0b6414f3121733fe69c17528ac4b5502ea649a, evidence/package head ddfd5683095ba6d86de784446ea4cb1a3c37610b. This ordinary independent PR builds on preserved #1252, retaining original team authors, commits and PR ownership. Go #1256 and Rust #1258 remain separate; this Java package is not a combined Go/Rust release. No approval, merge, release or live installation.
Before, fixed SLF4J LoggerFactory.java:454 Util.getCallingClass was captured but unresolved. After, it navigates through the explicit org.slf4j.helpers.Util import into helpers/Util.java:98, then the already supported bare static getSecurityManager helper. The next securityManager.getClassContext call remains unsupported method dispatch. LoggerFactory.java:427 iLoggerFactory.getLogger still cannot identify the runtime provider.
Reserved Commons Lang calls ClassUtils.java:733/995 StringUtils.isEmpty now reach StringUtils.java:3604 through the same-package class identity. This is direct source navigation, not runtime execution, compilation or complete impact.
- SLF4J 9783320b6c4411a0b120cad9e32cd9a981b1dac2, analyzer root slf4j-api. The selected cross-file source answer was frozen before analyzer execution and implementation; independent JDK attribution confirms its target. A negative-control line was initially transcribed as434 and is explicitly corrected to427 in a separate retained record.
- Commons Lang 3.14.0 c8774fa74adbbbcd4e5f915ab6bc3aa10d877419, analyzer root src/main/java. Source-inspected reserved review slice after initial code was written, before its first execution; not used for initial tuning and not a blind study.
Full report · public CLI replay · compiler audit · source/ZIP parity.
Place exact checkouts named slf4j and commons-lang under one sample directory. Run python3 benchmarks/code-analysis-java-cross-file-static-calls/run.py --cli archify/bin/archify.mjs --samples-root /path/to/samples --out /tmp/java-source; repeat with the extracted ZIP CLI. The analyzer requires Node/existing npm dependencies, not a JDK. Independent audit uses a JDK17 and AllStaticCalls.java, with no project execution or annotation processing.
Three frozen source targets: parent0correct/3missed → candidate3correct/0wrong/0missed. One interface-dispatch unknown stays unknown. All checks/questions exit0. These finite observations are not a general accuracy estimate.
Supplemental post-design javac attribution succeeds for all 45 SLF4J main sources and 246 Commons main sources, zero compiler errors. All 112 newly emitted main-source qualified targets agree (7+105), zero disagree. Three additional SLF4J test-source targets were source-reviewed outside that compiler graph; they are not compiler-agreed results.
| Compiler-known project-static-call sites | Parent correct/missed | Candidate correct/missed | Wrong / omitted |
|---|---|---|---|
| SLF4J main, 115 sites | 45/70 | 52/63 | 0/0 |
| Commons main, 2,442 sites | 558/1884 | 663/1779 | 0/0 |
Compiler-known unresolved targets count as misses, not successful unknowns. This denominator excludes instance/virtual/external/runtime calls. It is additional attribution evidence, not an original pre-development oracle. All 1,492 / 8,397 call ranges, all 52 / 558 previously bound records, functions and imports remain unchanged across the captures.
Model java-static-lexical-v2 additionally resolves explicit imported, same-package or fully qualified class paths to unique public explicitly static fixed-arity body methods in captured public top-level ordinary classes without explicit supertypes. It reuses Java's native type/import/package resolution, source ranges/hashes, saved questions and paired known references. Current readers retain v1 coverage; historical facts are not relabeled v2.
Value names, type parameters/local types, duplicate owners, static value/wildcard imports, overloads, varargs, inherited classes, lambdas/nested/anonymous callers and nonpublic targets can retain unknowns. Method-wide value blockers can conservatively exclude valid calls before a later declaration/outside a pattern branch. Argument applicability/compilation is not checked. Methods/interfaces, generated code, static-imported bare calls and full impact remain unsupported. Qualified-call-only dependency edges are not added by this change; method evidence and the dependency graph remain distinct.
Independent javac controls establish that a same-named variable can invoke another class's static method. A supplemental static-imported field control exposed the same danger in expression/type namespaces; its final guard is regression-tested, and removing only the guard makes the test fail. This prevents wrong navigation rather than treating every matching name as a class.
| Layer | Evidence |
|---|---|
| Local | 347 pass / 1 inherited TS installed-configuration assertion / 0 skipped; exact parent reproduces same assertion. Targeted Java/question/change checks pass. |
| Normal source / ZIP | Two raw-facts files byte-identical; four saved questions equal after installation/output/workflow path normalization. Authored paired regression finds foreign callers of a changed definition; not a new real-version-pair study. |
| Package | Two canonical builds equal;157 tracked module files match. Ten old/new Java checks pass from extracted ZIP. ZIP SHA256 6c58592ae3c4f9d913c966f3af52eaa1ed338ebf6cf1a0b2222f7800a6275735. |
| Remote CI | Final head ddfd56830 run 42392549030 completed: Code Analysis 348/348 pass; full regression shard 1 passes. Overall fails only on inherited README Classic artifact drift in shard 2 (same expected ca273484… / actual 7f68d730… hashes) and its test(22) aggregate. All other executed jobs pass; deployments skipped. |
| Integration | Draft only; not approved/merged/released/installed. |
Next: use compiler-known misses and actual investigation interruptions to choose the next bounded problem. Preserve wrong-target guards, clarify missing dependency edges and retain explicit dynamic/semantic unknowns across languages.