diamond-recursion deeper scan: CLEAN for pytorch/tensorflow/sklearn/ray/prefect/luigi/numpy

defects/luigi/luigi-diamond-recursion-CLEAN.md

@@ -0,0 +1,12 @@
+## Diamond Recursion Scan (luigi) — CLEAN (deeper scan)
+
+**Scan date:** 2026-03-29
+**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))
+
+### Files examined
+
+- `luigi/tools/deps.py:dfs_paths` — "find all paths" function; re-visiting shared nodes on different paths is intentional (not a diamond blowup defect). Covered by luigi-0001 (O(D²) set-rebuild fix). — CLEAN re diamond recursion
+- `luigi/execution_summary.py:_depth_first_search` — uses `visited` set — CLEAN
+- `luigi/scheduler.py:_upstream_status` — iterative with `upstream_status_table` memoization — CLEAN
+
+### Verdict: CLEAN — no NEW diamond recursion CWE-407; luigi-0001 covers existing issue

defects/numpy/numpy-diamond-recursion-CLEAN.md

@@ -0,0 +1,12 @@
+## Diamond Recursion Scan (numpy) — CLEAN (deeper scan)
+
+**Scan date:** 2026-03-29
+**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))
+
+### Files examined
+
+- `numpy/f2py/crackfortran.py:_get_depend_dict` — uses `deps` dict as memoization cache; O(N²) list scan covered by numpy-0001 — CLEAN re diamond recursion
+- `numpy/linalg/lapack_lite/make_lite.py:resolveAllDependencies` — iterative fixpoint with `done_this` set — CLEAN
+- `numpy/f2py/crackfortran.py:traverse` — tree walker, not DAG — CLEAN
+
+### Verdict: CLEAN — no NEW diamond recursion CWE-407; numpy-0001 covers existing list-scan issue

defects/prefect/prefect-diamond-recursion-CLEAN.md

@@ -0,0 +1,12 @@
+## Diamond Recursion Scan (prefect) — CLEAN (deeper scan)
+
+**Scan date:** 2026-03-29
+**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))
+
+### Files examined
+
+- `src/prefect/cli/transfer/_dag.py:TransferDAG` — proper Kahn's algorithm, `visited: set[uuid.UUID]` — CLEAN
+- `src/prefect/cli/transfer/_dag.py:has_cycles` — three-color DFS with `color` dict — CLEAN
+- `src/prefect/utilities/collections.py:visit_collection` — tree-walker, not DAG — CLEAN
+
+### Verdict: CLEAN — no diamond recursion CWE-407 found beyond existing pre-0001..0002

defects/pytorch/pytorch-diamond-recursion-CLEAN.md

@@ -0,0 +1,18 @@
+## Diamond Recursion Scan (pytorch) — CLEAN (deeper scan)
+
+**Scan date:** 2026-03-29
+**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))
+
+### Files examined
+
+- `torch/_inductor/scheduler.py:topological_sort_schedule` — uses `seen = OrderedSet()` — CLEAN
+- `torch/_inductor/memory.py:topological_sort_lpmf` — uses `seen` OrderedSet — CLEAN  
+- `torch/_inductor/memory.py:dfs_visit` — uses `color` dict (WHITE/GRAY/BLACK) — CLEAN
+- `torch/_inductor/augmented_graph_helper.py:_get_all_ancestors` — iterative with `ancestors` set — CLEAN
+- `torch/_inductor/fx_passes/overlap_scheduling.py:_collect_node_ancestors` — iterative DP — CLEAN
+- `torch/_dynamo/graph_deduplication.py:_has_cycle` — delegates to topological sort — CLEAN
+- `torch/package/_digraph.py` — uses networkx DiGraph — CLEAN
+- `torch/utils/data/graph.py:traverse_dps` — no DAG traversal without visited — CLEAN
+- `torch/autograd/` — engine is C++, Python wrappers don't do DAG traversal — CLEAN
+
+### Verdict: CLEAN — no diamond recursion CWE-407 found beyond existing pytorch-0001..0003

defects/ray/ray-diamond-recursion-CLEAN.md

@@ -0,0 +1,13 @@
+## Diamond Recursion Scan (ray) — CLEAN (deeper scan)
+
+**Scan date:** 2026-03-29
+**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))
+
+### Files examined
+
+- `python/ray/dag/dag_node.py:apply_recursive` — uses UUID cache (_CachingFn) for memoization — CLEAN
+- `python/ray/dag/dag_node.py:traverse_and_apply` — uses `visited = set()` — CLEAN
+- `python/ray/dag/vis_utils.py:_dfs` — delegates to apply_recursive (cached) — CLEAN
+- `python/ray/workflow/` — empty (only __init__.py) — CLEAN
+
+### Verdict: CLEAN — no diamond recursion CWE-407 found beyond existing ray-0001

defects/sklearn/sklearn-diamond-recursion-CLEAN.md

@@ -0,0 +1,13 @@
+## Diamond Recursion Scan (scikit-learn) — CLEAN
+
+**Scan date:** 2026-03-29
+**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))
+
+### Files examined
+
+- `sklearn/utils/graph.py:single_source_shortest_path_length` — BFS with `seen` dict — CLEAN
+- `sklearn/pipeline.py` — linear pipeline (no DAG) — CLEAN
+- `sklearn/tree/_reingold_tilford.py` — tree (not DAG, no diamond possible) — CLEAN
+- `sklearn/cluster/_agglomerative.py:ward_tree` — uses `not_visited` numpy array — CLEAN
+
+### Verdict: CLEAN — no diamond recursion CWE-407 found beyond existing sklearn-0001

defects/tensorflow/tensorflow-diamond-recursion-CLEAN.md

@@ -0,0 +1,13 @@
+## Diamond Recursion Scan (tensorflow) — CLEAN (deeper scan)
+
+**Scan date:** 2026-03-29
+**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))
+
+### Files examined
+
+- `tensorflow/python/ops/variables.py:_has_cycle` — uses `state` dict with _STARTED/_FINISHED markers (three-color DFS) — CLEAN
+- `tensorflow/python/keras/engine/functional.py:_build_map_helper` — uses `finished_nodes` set + `nodes_in_progress` set — CLEAN
+- `tensorflow/python/checkpoint/restore.py` — uses BFS with deferred queue — CLEAN
+- `tensorflow/python/ops/control_flow_util_v2.py:resource_input_index` — linear parent-chain walk, not DAG traversal — CLEAN
+
+### Verdict: CLEAN — no diamond recursion CWE-407 found beyond existing tensorflow-0001