FlowGap

--alias-analysis= value of the aggregate run containing this sink.

--solver= value of the aggregate run containing this sink. Only ide-xtaint emits a data-flow graph.

Analyzer wire value for this exact run: no-check, feasible-only, or both (see com.stigway.metamodels.analysis.PathFeasibility, whose Kotlin constant names differ from these kebab-case wire strings — every enum in that package carries a @JsonValue-annotated wire mapping). Derived from the run-plan args, not from opening the (potentially tens-of-MB) aggregate analysis-<run-stem>.json. Absent --path-feasibility-mode means the analyzer default no-check applies: Z3 was not invoked for this run. No activity in this project currently enables FEASIBLE_ONLY/BOTH, so no-check is the standing practice here, not an accidental gap in this one run. Under no-check, a "positive" (leaked) sink is a pure taint-reachability result from the data-flow solver — every declared source is unconditionally treated as tainted, and a leak means the solver's flow/call-graph facts reach the sink, not that a concrete runtime execution was proven to carry a bad value there (see com.stigway.metamodels.analysis.AnalysisKind for what "reached" means for each analysis direction).