engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wave28 survey: 8 clean-scan additions (sci/Lisp/Scheme/F#/routing) + 2 partial-scan caveats

Browse source 
fsharp, gnuradio, geant4, spack, sbcl, racket, frr, riak (wrapper) clean.
Pharo + full Riak deferred (Smalltalk language module gap, Erlang
submodule structure). Honor roll cumulative: 192 projects.

sbcl 727 + racket 383 M1 are Lisp (member ...)/(memq ...) tradition
primitives (continuation of Wave 24 maxima pattern). spack 72 M7 are
intentional Spec.intersects() dependency resolution algorithm.
This commit is contained in:
russell@unturf.com 2026-04-25 19:30:06 -04:00
parent e1716b98b4
commit 9f7d28ffb9
No known key found for this signature in database
1 changed files with 87 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

87
whitepaper/outreach/wave28-sci-lisp-smalltalk-survey.md Normal file
View file

@ -0,0 +1,87 @@
# Wave 28 — Scientific niches, Lisp/Scheme, Smalltalk, Erlang DB, Routing
**Survey date:** 2026-04-25
**Tool:** unmoad (9 active MOAD detectors, HIGH+ severity filter)
**Scope:** 10 projects across software-defined radio (gnuradio), particle physics (geant4), HPC package manager (spack), Lisp/Scheme (sbcl, racket), F# compiler (fsharp), Smalltalk (pharo), Erlang KV store (riak), and routing daemon (frr).
---
## Summary
Wave 28 totals 2,053 HIGH+ findings across 10 projects. **8 new clean-scan honor roll entries.** Honor roll cumulative: **192 projects** across waves 3-28.
**No flagship CWE-407 patches ship this pass.** Lisp/Scheme projects (sbcl, racket) cluster their findings in `(member ...)` / `(memq ...)` / `(position ...)` primitives — the canonical Lisp linear-search idiom (same Wave 24 maxima pattern). HPC/scientific projects (spack, geant4) cluster theirs in intentional spec/spatial intersection algorithms.
Two zero-finding results need caveats:
- **pharo** (Smalltalk): 0 findings because unmoad has no Smalltalk language module — `.st` files were not scanned. Joins backlog as "unverified, awaiting Smalltalk detector".
- **riak** (Erlang): 0 findings, but the cloned `riak` repo is the rebar3 wrapper (3.5MB) — actual riak_kv code lives in submodules. Noted as partial scan.
## Clean-scan honor roll — 8 new entries
| Project | Lang | Role | Notes |
|---------|------|------|-------|
| **fsharp** | F# | F# compiler + tooling | 10 findings: `fsihelp.fs` xpath `contains(@name, ...)` is XPath function (intentional XML query); `Source.cs` `ranges[i].GetSpan(...).Contains(caretPoint)` is WPF text-view containment (geometric); `ProjectReferenceNode.IndexOf('|')` single-char position. **clean** |
| **gnuradio** | C++/Python | Software-defined radio | 62 findings: `qsettings.contains(full_key)` is Qt QSettings.contains (O(log) hash), build-time Python tools (`cppfile_editor.py`, `blocktool/comments.py` parsing build artifacts). **clean** |
| **geant4** | C++ | Monte Carlo particle simulation | 87 findings: `liblist.c` "."/".." dirent skip (constant 2 strings), `G4StrUtil::contains(aString, "#")` substring search, `BooleanProcessor.src` `plane.distance(...)` is intentional geometry primitive. **clean** |
| **spack** | Python | HPC package manager | 459 findings: 356 M3 in test files; 72 M7 are `Spec.intersects(other)` — intentional Spack version-spec intersection (the algorithm, not a lookup). Same Wave 24 maxima Lisp-algorithm pattern. **clean** |
| **sbcl** | Common Lisp | Steel Bank Common Lisp | 741 findings: 727 M1 are Lisp `(member ...)`/`(position ...)` in `tools-for-build/ucd.lisp` (Unicode character database build), `target-package.lisp` (package internals), `meta-vmdef.lisp` (VM definitions). Lisp-tradition O(N) primitives, bounded by language input. **clean** |
| **racket** | Racket/Scheme | Racket programming language | 388 findings: 383 M1 are Scheme/Racket `memq`/`member`/`assq` in compiler bootstrap (`xform.rkt`, `s/syntax.ss`). Same Lisp-tradition pattern as sbcl/maxima. **clean** |
| **frr** | C | FRRouting (routing daemon family) | 306 findings: `ospf6d.c` per-VRF name comparison (bounded by VRF count, typically <100), `bgpd/bgp_mplsvpn.c` route-map name lookup, `bgpd/bgpd.c` peer-group name lookup. Bounded by network configuration size. **clean** |
| **riak** | Erlang | Distributed KV store (Basho) | 0 findings — the `riak` GitHub repo is the rebar3 wrapper (3.5MB). Actual `riak_kv`, `riak_core` code lives in git submodules not pulled. **partial scan** — joins honor roll on the wrapper but `riak_kv`/`riak_core` deferred. |
Honor roll now stands at **192 projects** validated zero-real-finding under MOAD-0001 scanning.
## Per-target findings
| Project | Lang | Total | M1 | M3 | M4 | M5 | M6 | M7 | M9 | M11 | Triage |
|---------|------|------:|---:|---:|---:|---:|---:|---:|---:|----:|--------|
| **sbcl** | Lisp | 741 | 727 | - | 14 | - | - | - | - | - | Lisp `(member ...)` build-time + runtime primitives. **clean** |
| **spack** | Python | 459 | 24 | 356 | - | 1 | 1 | 72 | - | 5 | Test ContextValue + Spec.intersects algorithm. **clean** |
| **racket** | Racket | 388 | 383 | - | 3 | - | - | - | 2 | - | Scheme memq/member compiler bootstrap. **clean** |
| **frr** | C | 306 | 241 | 1 | 13 | - | 22 | 21 | - | 8 | Per-VRF + route-map + peer-group. **clean** |
| **geant4** | C++ | 87 | 37 | - | 1 | - | - | 49 | - | - | dirent skip + spatial geometry. **clean** |
| **gnuradio** | C++/Python | 62 | 40 | 14 | - | - | - | 7 | - | 1 | QSettings + build-time Python. **clean** |
| **fsharp** | F# | 10 | 5 | - | - | - | - | 5 | - | - | XPath + WPF text-view geometry. **clean** |
| pharo | Smalltalk | 0 | - | - | - | - | - | - | - | - | **unscanned** — no Smalltalk language module. |
| **riak** (wrapper) | Erlang | 0 | - | - | - | - | - | - | - | - | rebar3 wrapper only (3.5MB); actual app code in submodules. **partial** |
## Investigations
### Lisp/Scheme `(member ...)` ecosystem pattern (sbcl, racket, maxima)
Lisp's `(member item list :test ...)` is the canonical containment primitive — O(N) linear scan returning the tail of the list at the match. Used pervasively in:
- **sbcl** Unicode character database builds, package symbol resolution, VM type definitions
- **racket** Scheme/Chez compiler bootstrap, syntax expansion, scribble doc generation
- **maxima** (Wave 24) graph isomorphism, sheaf cohomology, gentran transformations
Replacing with hash-based membership changes Lisp semantics (member returns the matched-from-here tail, callers may rely on this). The Lisp ecosystem's idiom is to use `member` for small lists and explicit hash tables (`make-hash-table`) for large ones — the choice is intentional per call site.
**Detector enhancement candidate** (continued from Wave 24 maxima): Lisp `member`/`memq`/`assq`/`position` algorithm awareness — these aren't to be replaced wholesale.
### spack `Spec.intersects` — intentional algorithm
Spack's `spack.spec.Spec.intersects(other)` is the version/variant intersection algorithm at the heart of dependency resolution. The 72 M7 hits are recursive intersection calls down the spec tree — the algorithm is the work, not a lookup that should be cached.
### geant4 `G4StrUtil::contains(aString, "#")` substring + `plane.distance(...)` geometry
`contains(aString, "#")` is single-char comment detection in CHEM file parsing. `BooleanProcessor.src` Constructive Solid Geometry uses `plane.distance(...)` for boolean-mesh operations — intentional geometric algorithm, not a lookup.
### pharo Smalltalk gap
Pharo's source is `.st` files (Smalltalk class definitions). unmoad's language detection covers ~42 languages but not Smalltalk yet. Joins the gap-list alongside Erlang's full Riak codebase.
## Triage backlog
1. **Scanner enhancement: Smalltalk language module** — would enable scanning Pharo + GToolkit + Squeak.
2. **Scanner enhancement: Lisp `(member ...)` algorithm awareness** (continued from Wave 24) — sbcl + racket reinforce.
3. **Scanner enhancement: Spack/conan-style intersects() algorithm awareness** — package-spec intersection is the algorithm, not a lookup.
## Method
Same as Waves 3-27: shallow clone, `unmoad -s high -f json`, filter test/vendor/codegen noise, manual triage of strongest source-only candidates per project. **Eight projects added to clean-scan honor roll.** Two more (pharo, riak) noted as partial-scan with caveats. No new UNDF IDs assigned (no patches shipped).
## References
- `unmoad` detection engine: `git.unturf.com/engineering/unmoad.com`
- Earlier surveys: `/test-harness-survey/` through `/wave27-pkg-build-script-firmware-survey/`
- Clean-scan honor roll cumulative: 192 projects across waves 3-28