feat(cpp): enforce bounded Clang static analysis

cpp/.clang-tidy

@@ -0,0 +1,4 @@
+Checks: "-*,clang-analyzer-core.*,clang-analyzer-cplusplus.*,clang-analyzer-unix.Malloc,clang-analyzer-unix.MismatchedDeallocator,bugprone-dangling-handle,bugprone-use-after-move"
+WarningsAsErrors: "*"
+InheritParentConfig: false
+HeaderFilterRegex: ".*"

cpp/CMakeLists.txt

@@ -47,6 +47,16 @@ install(TARGETS uos_cpp_pilot RUNTIME DESTINATION bin)
 enable_testing()
 add_executable(protocol_tests tests/protocol_tests.cpp)
 target_link_libraries(protocol_tests PRIVATE pilot_core)
+option(UOS_ANALYSIS_CONTROLS "Expose analysis-only fixture compilation commands" OFF)
+if(UOS_ANALYSIS_CONTROLS)
+  add_library(analysis_controls OBJECT EXCLUDE_FROM_ALL tests/analysis/raw_defects.cpp tests/analysis/clean_ownership.cpp tests/analysis/clean_cancel.cpp)
+  target_link_libraries(analysis_controls PRIVATE pilot_core)
+  target_include_directories(analysis_controls SYSTEM PRIVATE tests/analysis/fixture_sdk)
+  add_custom_target(cpp-static-analysis
+    COMMAND /usr/bin/python3 "${PROJECT_SOURCE_DIR}/tools/analyze.py" "$ENV{UOS_CPP_TOOLCHAIN_DIR}" pi-release
+    WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}/.."
+    VERBATIM)
+endif()
 if(UOS_SANITIZE)
   target_compile_options(protocol_tests PRIVATE -fsanitize=address,undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer)
   target_link_options(protocol_tests PRIVATE -fsanitize=address,undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer)

cpp/CMakePresets.json

@@ -14,6 +14,7 @@
         "CMAKE_FIND_USE_SYSTEM_PACKAGE_REGISTRY": "OFF",
         "CMAKE_TOOLCHAIN_FILE": "$env{UOS_CPP_TOOLCHAIN_DIR}/probe/pi-arm64.cmake",
         "CMAKE_BUILD_TYPE": "Release",
+        "UOS_ANALYSIS_CONTROLS": "ON",
         "CMAKE_CXX_FLAGS_RELEASE": "-O2 -DNDEBUG -g1",
         "CMAKE_CXX_FLAGS": "-B$env{UOS_CPP_TOOLCHAIN_DIR}/host-tools/bin/",
         "CMAKE_AR": "$env{UOS_CPP_TOOLCHAIN_DIR}/host-tools/bin/ar",

cpp/README.md

@@ -20,6 +20,8 @@ python3 cpp/tools/build.py /absolute/qualified-sdk native-asan test
 python3 cpp/tools/build.py /absolute/qualified-sdk pi-release tidy
 ```
 
+`pi-release complete` runs configure, build, all six CTests and the mandatory static-analysis gate. `tidy` runs that same gate separately; the always-run CMake target is `cpp-static-analysis`. The gate verifies the Pi compilation database, analyzes all twelve production translation units plus `protocol_tests.cpp`, and checks three analysis-only controls. See [static-analysis.md](docs/static-analysis.md) for the selected checks, receipts and limitations.
+
 The driver creates one reusable directory per preset under `.data/cpp-build`, a task-local CMake executable view, disk-backed compiler scratch, and full command/resource logs under `.data/cpp-evidence`. Its view executes the same qualified SDK binaries through their pinned loader with `--argv0`, so generated archive, regeneration, test and install commands use that same loader. The SDK itself stays read-only; no global library path changes are required.
 
 Build jobs remain1. The first512MiB compiler virtual-memory limit was measured insufficient for the transport translation unit. The owner authorized768MiB for the compiler and bounded build cgroup; this is distinct from the candidate's provisional96MiB service-memory acceptance target. The one-second build sampler reports a lower-bound disk peak, enforces the additional768MiB/aggregate2GB storage envelope and refuses filesystem free space below2GiB. Native ASan runtime requires its shadow address space and does not inherit the compiler VM cap.

cpp/clang14-beast-read-baseline.json

@@ -0,0 +1,139 @@
+{
+  "schema": "uos-clang14-beast-read-v1",
+  "source": "cpp/src/session.cpp",
+  "sdk_sha256": {
+    "root/lib/ld-linux-aarch64.so.1": "7fa5037b2ea1643fd2b8b7f3f3c1d9d546271011b4385aeea3e85fed0d5dcadd",
+    "root/usr/bin/clang-tidy-14": "c66bd47837a3621500d26b3ec4636890eaf6c85f0afefd5b3d8f570eecdc8e90",
+    "root/usr/include/boost/beast/http/impl/read.hpp": "dcace292f59d5e5d6ca45930fb02eeea4418f940c91af52de28de2fa6f53a6ce",
+    "root/usr/include/boost/asio/coroutine.hpp": "aa981b4602747d1c62d105e5266026b47d7e4dfb4ce2d03ac6cbcdbc0160aa60",
+    "root/usr/include/boost/asio/compose.hpp": "5fa98287529632714d7e46c8da09312ab357a2b7afb026208fd83621f6abdde7",
+    "root/usr/lib/aarch64-linux-gnu/libclang-cpp.so.14": "b9cdd42ec88a2655f2ff005738dfcfe4cab08a188daa4ebabb200251d6773d84",
+    "root/usr/lib/aarch64-linux-gnu/libLLVM-14.so.1": "1ff1243403be3b8dd5120198e13212f69256d4399d39271dc00bc04f24393dca"
+  },
+  "diagnostics": [
+    {
+      "check": "bugprone-use-after-move",
+      "primary": {
+        "path": "boost/beast/http/impl/read.hpp",
+        "offset": 6729,
+        "line": 248,
+        "column": 61,
+        "message": "'self' used after it was moved",
+        "replacements": []
+      },
+      "notes": [
+        {
+          "path": "boost/beast/http/impl/read.hpp",
+          "offset": 6693,
+          "line": 248,
+          "column": 25,
+          "message": "move occurred here",
+          "replacements": []
+        },
+        {
+          "path": "boost/beast/http/impl/read.hpp",
+          "offset": 6729,
+          "line": 248,
+          "column": 61,
+          "message": "the use happens in a later loop iteration than the move",
+          "replacements": []
+        }
+      ],
+      "level": "Warning"
+    },
+    {
+      "check": "bugprone-use-after-move",
+      "primary": {
+        "path": "boost/beast/http/impl/read.hpp",
+        "offset": 6786,
+        "line": 251,
+        "column": 13,
+        "message": "'self' used after it was moved",
+        "replacements": []
+      },
+      "notes": [
+        {
+          "path": "boost/beast/http/impl/read.hpp",
+          "offset": 5590,
+          "line": 215,
+          "column": 24,
+          "message": "move occurred here",
+          "replacements": []
+        }
+      ],
+      "level": "Warning"
+    },
+    {
+      "check": "bugprone-use-after-move",
+      "primary": {
+        "path": "boost/beast/http/impl/read.hpp",
+        "offset": 7674,
+        "line": 287,
+        "column": 41,
+        "message": "'self' used after it was moved",
+        "replacements": []
+      },
+      "notes": [
+        {
+          "path": "boost/beast/http/impl/read.hpp",
+          "offset": 7654,
+          "line": 287,
+          "column": 21,
+          "message": "move occurred here",
+          "replacements": []
+        },
+        {
+          "path": "boost/beast/http/impl/read.hpp",
+          "offset": 7674,
+          "line": 287,
+          "column": 41,
+          "message": "the use happens in a later loop iteration than the move",
+          "replacements": []
+        }
+      ],
+      "level": "Warning"
+    },
+    {
+      "check": "bugprone-use-after-move",
+      "primary": {
+        "path": "boost/beast/http/impl/read.hpp",
+        "offset": 8090,
+        "line": 301,
+        "column": 51,
+        "message": "'self' used after it was moved",
+        "replacements": []
+      },
+      "notes": [
+        {
+          "path": "boost/beast/http/impl/read.hpp",
+          "offset": 8023,
+          "line": 300,
+          "column": 25,
+          "message": "move occurred here",
+          "replacements": []
+        },
+        {
+          "path": "boost/beast/http/impl/read.hpp",
+          "offset": 8090,
+          "line": 301,
+          "column": 51,
+          "message": "the use happens in a later loop iteration than the move",
+          "replacements": []
+        }
+      ],
+      "level": "Warning"
+    }
+  ],
+  "proof": {
+    "original_source": "6a1c02674c45bc4b9fcbf6d17a72226fc074e9a4",
+    "failed_ref": "fae1741f-4e00-446f-a5eb-3540ddcf1016",
+    "reduction_ref": "b40d5db8-1a12-4d60-8d04-3d757ccbf877",
+    "reduction_sha256": "f5aebc7aed2ff847ee92415484c3e98581a8afb5f7cf6273dc93fa486f9a633f",
+    "reason": "Asio stackless YIELD transfers handler and exits invocation; reentry binds moved-to handler. Clang14 flow-sensitive use-after-move does not correlate this macro control path.",
+    "source_sha256": {
+      "cpp/src/session.cpp": "5f6ece8ae6ddefb9363a6f6ee846bd6f75d7f30b090917a3f668e5604cc17590",
+      "cpp/src/server.cpp": "bf83d9b3fdfb67b0015f64f602fecacd1f58a66da42bea2d484467ad71f91531"
+    }
+  },
+  "policy_sha256": "6711fc1ae69b8fea751850754030df2c882b7ed8610d5e43bea173515a331966"
+}