## Diamond Recursion Scan — CLEAN

**Scan date:** 2026-03-29
**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

### Files examined

- `subprojects/core/src/main/java/org/gradle/execution/plan/DetermineExecutionPlanAction.java` — cycle detection, `findCycles`
- `subprojects/core/src/main/java/org/gradle/execution/plan/Node.java` — dependency node
- `platforms/core-configuration/model-core/src/main/java/org/gradle/model/internal/registry/DefaultModelRegistry.java` — model dependency resolution

### Findings

**DetermineExecutionPlanAction:** Uses two `HashSet<Node>` accumulators (`visiting` and `visited`) for DFS traversal. The `findCycles` method delegates to `graphWalker.findCycles()` which uses proper SCC cycle detection. CLEAN.

**DefaultModelRegistry:** Uses a goal state machine (`NotSeen / VisitingDependencies / Achieved`) where each goal can only be in one state at a time. Goals transition from `NotSeen` → `VisitingDependencies` → `Achieved`, preventing re-traversal. CLEAN.

Note: `gradle-0002` covers a pre-existing CWE-407 defect in `NodeState.addIncomingEdge` ArrayList membership scan.

### Verdict: CLEAN — no diamond recursion CWE-407 found
