3 Tu Compiler Analyzer

Perform compiler-level analysis for a single translation unit: IR emission and diff, assembly analysis, semantic IR analysis, and CFG analysis. One instance of this agent runs per TU, enabling parallel execution.

Input

You receive these values from the orchestrator:

Process

Step 0 — Load Configuration and Inputs

Read config_path to load the merged config. Read input_file to load sensitive_objects (JSON array of SO-NNNN objects in this TU) and source_findings (JSON array of F-SRC-NNNN findings for this TU).

Step 1 — Extract Compile Flags

FLAGS=()
while IFS= read -r flag; do FLAGS+=("$flag"); done < <(
  uv run --no-project {baseDir}/tools/extract_compile_flags.py \
    --compile-db <compile_db> \
    --src <tu_source> --format lines)

If extract_compile_flags.py exits non-zero, write error to notes.md and stop (cannot proceed without flags). See {baseDir}/references/compile-commands.md for flag stripping details.

Step 2 — IR Emission and Comparison (produces OPTIMIZED_AWAY_ZEROIZE)

Always include O0 as the unoptimized baseline:

mkdir -p "{workdir}/compiler-analysis/{tu_hash}/"

{baseDir}/tools/emit_ir.sh --src <tu_source> \
  --out {workdir}/compiler-analysis/{tu_hash}/<tu_hash>.O0.ll --opt O0 -- "${FLAGS[@]}"

# Repeat for each level in opt_levels (e.g. O1, O2):
{baseDir}/tools/emit_ir.sh --src <tu_source> \
  --out {workdir}/compiler-analysis/{tu_hash}/<tu_hash>.O1.ll --opt O1 -- "${FLAGS[@]}"

{baseDir}/tools/emit_ir.sh --src <tu_source> \
  --out {workdir}/compiler-analysis/{tu_hash}/<tu_hash>.O2.ll --opt O2 -- "${FLAGS[@]}"

Diff all levels:

{baseDir}/tools/diff_ir.sh \
  {workdir}/compiler-analysis/{tu_hash}/<tu_hash>.O0.ll \
  {workdir}/compiler-analysis/{tu_hash}/<tu_hash>.O1.ll \
  {workdir}/compiler-analysis/{tu_hash}/<tu_hash>.O2.ll

Interpretation:

• Wipe present at O0, absent at O1: simple dead-store elimination.
• Wipe present at O1, absent at O2: aggressive optimization (inlining, SROA, alias analysis).
• Emit OPTIMIZED_AWAY_ZEROIZE with the IR diff as mandatory evidence. Populate compiler_evidence fields (see {baseDir}/references/ir-analysis.md).

The IR diff is mandatory evidence — never emit this finding from source alone.

Step 3 — Assembly Analysis (produces STACK_RETENTION, REGISTER_SPILL)

Skip if enable_asm=false.

{baseDir}/tools/emit_asm.sh --src <tu_source> \
  --out {workdir}/compiler-analysis/{tu_hash}/<tu_hash>.O2.s --opt O2 -- "${FLAGS[@]}"

{baseDir}/tools/analyze_asm.sh \
  --asm {workdir}/compiler-analysis/{tu_hash}/<tu_hash>.O2.s \
  --out ${workdir}/compiler-analysis/<tu_hash>/asm-findings.json

• Emit REGISTER_SPILL if secret values are spilled from registers to stack offsets (look for movq/movdqa of secret-tainted values to [rsp+N]). Include the spill instruction as evidence.
• Emit STACK_RETENTION if the stack frame is not cleared of secret bytes before ret. Include the assembly excerpt as evidence.

Assembly evidence is mandatory for both findings — never emit from source or IR alone.

Step 4 — Semantic IR Analysis (produces LOOP_UNROLLED_INCOMPLETE)

Skip if enable_semantic_ir=false.

uv run --no-project {baseDir}/tools/analyze_ir_semantic.py \
  --ir {workdir}/compiler-analysis/{tu_hash}/<tu_hash>.O2.ll \
  --out ${workdir}/compiler-analysis/<tu_hash>/semantic-ir.json

• Parse IR structurally (do not use regex on raw IR text).
• Build function and basic block representations.
• Track memory operations in SSA form after mem2reg.
• Detect loop-unrolled zeroization: 4+ consecutive zero stores.
• Verify unrolled stores target correct addresses and cover full object size.
• Identify phi nodes and register-promoted variables that may hide secret values.
• Emit LOOP_UNROLLED_INCOMPLETE when unrolling is detected but does not cover the full object.

Step 5 — CFG Analysis (produces MISSING_ON_ERROR_PATH, NOT_DOMINATING_EXITS)

Skip if enable_cfg=false.

uv run --no-project {baseDir}/tools/analyze_cfg.py \
  --src <tu_source> \
  --out ${workdir}/compiler-analysis/<tu_hash>/cfg-findings.json

• Build CFG from IR or source.
• Enumerate all execution paths from function entry to exits.
• Compute dominator sets.
• Verify each wipe node dominates all exit nodes. Emit NOT_DOMINATING_EXITS if not.
• Identify error paths (early returns, goto, exceptions, longjmp) that bypass the wipe. Emit MISSING_ON_ERROR_PATH for each such path.

Supersession rule: Where CFG results exist for the same object as a heuristic NOT_ON_ALL_PATHS finding from source analysis, record the supersession in superseded-findings.json.