# Rust ↔ Clang Scanning Pipeline Parity

> Generated 2026-05-28. Gap analysis between fold's two source scanning pipelines.

## Pipeline Comparison

| Component | Clang Pipeline | Rust Pipeline | Parity? |
|-----------|---------------|---------------|---------|
| Frontend | Clang LibTooling (in-process) | fold-rust + rustc_driver (subprocess) | Partial |
| AST/IR | `clang::Expr` tree → `ir::Expr` | HIR → `RustExprNode` | Partial |
| CFG | `security_walker.cpp` (homegrown) | None (expression tree only) | **No** |
| Path predicates | Full forking (if/else, ternary, &&/\|\|) | None (path=true always) | **No** |
| Z3 encoding | `encoder.cpp` (BV-64, typed) | `rust_ir_encoder.cpp` (BV-64 only) | Partial |
| Observer hooks | Full SafetyObserver interface | Partial (onPointerDeref, onBinaryArith, onDivision) | Partial |
| Type threading | Bit-width + signedness | int_width only (no signedness threading) | **No** |
| Interprocedural | SymbolicSummary + SummaryStore | None | **No** |
| Taint tracking | Source-to-sink flow | TaintOrigin (local only, no propagation) | Partial |
| Memory model | HeapModel (malloc/free tracking) | None | **No** |

## Priority Fixes

### Phase 1 — Quick wins (S effort, high impact)

| # | Gap | Fix | FP reduction |
|---|-----|-----|-------------|
| 1 | No path predicates | Fork path in encodeRustNode for &&/\|\| and ternaries | 30-40% null-deref |
| 2 | No known-safe prefixes | Add KnownSafePaths set to classify_origin | ~200 path-traversal |

### Phase 2 — Structural (M-L effort)

| # | Gap | Fix |
|---|-----|-----|
| 3 | No CFG | Wire MIR basic blocks into encoder (task 120) |
| 4 | No signedness | Thread int_signed through observer hooks (done: `93439bf`) |
| 5 | No Member encoding | Add Member case to encodeRustNode (done: `93439bf`) |
| 6 | No summaries | Interprocedural SymbolicSummary for Rust (task 123) |

### Phase 3 — Unification (M effort)

| # | Gap | Fix |
|---|-----|-----|
| 7 | Separate IR types | Add language discriminator to RustExprNode (task 124) |
| 8 | Separate encoders | Unify encodeRustIr + encodeClangExpr into single encodeIr |

## Current State

After this session's fixes, the Rust pipeline has:
- ✅ Taint origin tracking (LiteralValue vs UnknownProvenance)
- ✅ ts_rs function filtering (~500 FPs eliminated)
- ✅ augment_args filtering (~150 FPs eliminated)
- ✅ Rust signedness threading through observer hooks
- ✅ Member encoding for struct field access
- ✅ hasInit + isExceptionVariable filters for uninit-read

Remaining priorities: path predicate tracking (task 121) and MIR control flow (task 120).