Analyze source code

STIG connects selected C and C++ implementation behavior to the authored specification. It recompiles the selected source files as LLVM bitcode using the native target's compilation commands, applies reviewed transform rules, runs cascading-fault and data-and-control-flow analysis, and includes the resulting evidence in the report.

Use the pages in this order:

1. Add a source-backed element and choose whether code or Kotlin owns its Context interfaces.

2. Configure and run the automated analysis pipeline.

3. Check and align analysis evidence with stigCheckAnalysis and $stig:source-analysis: resolve missing registry definitions, missing required activity use(...) entries, and other incorrect configuration, then confirm every active activity transform rule and compare every sink through LLVM, analyzer, and report stages before accepting knownGaps. Use --configuration-only for its P1–P5 collection mode and track completion separately for each activity.

The analysis harness defines lifecycle entry points and source/sink boundaries. Bitcode rewrite modeling explains the reviewed semantics used for functions outside the analysis boundary. External symbol categories explains missing library definitions, category meanings, and classification sources. Generated diagrams and metrics are documented under Reports.

The CREATE Analysis viewpoint describes engineering failures and propagation intent. Source-code analysis supplies implementation evidence for that specification; it does not replace the authored viewpoint.