Modules
BEAM program analysis via Souffle Datalog.
Atom safety analysis.
Call cycle (deadlock) detection.
Bare receive inside an OTP callback.
Coverage and precision meta-analysis.
Deferred startup deadlock detection.
Distributed systems analysis.
Error handling analysis.
ETS table analysis.
gen_statem state machine correctness analysis.
A message a module sends itself and cannot handle.
A monitor whose {:DOWN, ...} nobody is waiting for any more.
One-for-one coupling analysis.
Process bottleneck detection.
Process registry and naming analysis.
Verifies @pure true contracts (see Argus.Purity).
A deferred reply that can never be sent.
Dangerous operations reachable from request-shaped input.
Credentials an inspect/1 will print.
Cleanup in terminate/2 that will not run when it matters.
Supervision tree analysis.
Synchronous calls in init/1 detection.
GenServer timeout chain detection.
TLS that encrypts without authenticating.
Side effects inside a database transaction that the database cannot undo.
Processes an outside party can create without limit.
Unlinked spawn detection.
Unsafe task usage detection.
Behaviour and API for BEAM program analyses.
Basic-block control-flow graphs derived from Layer-1 facts, with dominators and loop headers.
One basic block: a maximal straight-line run of instructions with a single entry (the leader) and a single exit (the terminator).
One function's control-flow graph: basic blocks, typed edges, dominators, post-dominators, and loop headers, plus lookup helpers.
Forward, all-paths walks over a function's control flow, one instruction at a time.
Real-world checkouts as a regression corpus: a repository at the commit before a closed-issue fix, and at the fix, compiled once into a cache and analyzed in this VM.
Reaching definitions over Layer-1 facts: which instruction's register write feeds which instruction's register read.
Behaviour for domain-specific fact extractors.
Every call instruction in a module, indexed once.
How a multi-clause function chooses a clause, read from its bytecode.
Shared helpers for domain-specific fact extractors.
Calls to known APIs, classified by a table.
Call-site argument extractor.
The message tags a handle_call/3, handle_cast/2 or handle_info/2
discriminates on, and whether it has a catch-all.
ETS usage extractor.
Ecto schema fields, and which of them are redacted.
Which socket transports a Phoenix endpoint actually enables.
Error handling extractor.
What a try handler catches: the classes it tests for, the reason tags
it discriminates on, and whether some path catches a class outright.
gen_statem extractor.
{:call, from} clauses that return without answering the caller.
What event types a gen_statem callback discriminates on, and whether it has a catch-all.
Monitor and demonitor call sites.
OTP pattern extractor.
Process registry and naming extractor.
Purity contracts and call classification.
What an OTP callback returns, and whether it kept the means to reply.
The HTTP routes a Phoenix router declares.
Supervision tree extractor.
TLS peer verification, where it is disabled and where it is left to the default.
Schema-driven typed decoding of raw fact rows for in-process consumers.
Structured findings from running analyses in-process.
Structured form of an instruction ID ("Mod:func/arity#idx").
Resolves anchor IDs to source lines using line_info facts.
Orchestrates parallel fact extraction from BEAM modules.
Resolves module identifiers to .beam paths and disassembles them.
Transforms normalized BEAM instructions into Layer 1 fact tuples.
Thin normalization pass over disassembled BEAM instructions.
Appends one module's facts at a time to per-relation .facts files,
opening each file on first use. Rows land in the order extraction
yields them, which Argus.Pipeline keeps deterministic.
Declare that a function performs no side effects, and have it checked.
The effect model: which calls are observable effects, and which are known to be free of them.
Fact relation definitions for Argus analysis.
Souffle execution via shell-out to the souffle command-line tool.
Interned fact symbols: every string a fact row carries, mapped once to a small integer.
The default store: two public ETS tables and an atomic counter, so parallel extraction workers intern without coordination. A binary that loses the insert race takes the id the winner assigned.
Where a Argus.Symbols table keeps its mapping. Both directions must
be safe to call from any process, and intern/2 must return the same
id for the same binary for the table's lifetime.
Mix Tasks
Maintainer tooling over Argus.Corpus, the checkouts the test suite
verifies rules against.
Writes priv/dl/base.dl and priv/dl/layer2.dl from Argus.Schema.
Writes test/argus/analysis_inputs.exs: for every built-in analysis,
the relations Souffle's transformed program actually reads.