Software Engineering

AI SEARCH

FLOW ALGEBRA — SOFTWARE ENTITIES
Semantic Library
Version: 4.0
Canonical Page:
https://kirethresearch.org/booksai-core/entity-graph/computational-entities/software-entities.html

FLOW SOFTWARE_ENTITIES {

  META {
    DOMAIN = "Entity Graph"
    SUBDOMAIN = "Computational Entities"
    ONTOLOGY = "Software Entities"
    PURPOSE = "Formalise software entities, their identities, structures, versions, dependencies, execution artefacts, configurations, relationships and provenance for semantic entity-graph reasoning."
    LOCALE = "en-GB"
  }

  ENTITY_TYPES {
    SOFTWARE_ENTITY
    SOFTWARE
    SOFTWARE_SYSTEM
    APPLICATION
    APPLICATION_SOFTWARE
    SYSTEM_SOFTWARE
    SERVICE
    DAEMON
    PROCESS
    THREAD
    PROGRAM
    EXECUTABLE
    BINARY
    SOURCE_CODE
    SOURCE_FILE
    MODULE
    PACKAGE
    LIBRARY
    FRAMEWORK
    COMPONENT
    PLUGIN
    EXTENSION
    DRIVER
    DEVICE_DRIVER
    OPERATING_SYSTEM
    KERNEL
    FIRMWARE
    MIDDLEWARE
    RUNTIME
    VIRTUAL_MACHINE
    INTERPRETER
    COMPILER
    ASSEMBLER
    LINKER
    LOADER
    SCRIPT
    COMMAND
    API
    ENDPOINT
    INTERFACE
    PROTOCOL
    FUNCTION
    PROCEDURE
    METHOD
    CLASS
    OBJECT
    DATA_STRUCTURE
    ALGORITHM
    CONFIGURATION
    CONFIGURATION_FILE
    ENVIRONMENT
    ENVIRONMENT_VARIABLE
    DEPENDENCY
    SOFTWARE_DEPENDENCY
    PACKAGE_DEPENDENCY
    VERSION
    RELEASE
    BUILD
    ARTIFACT
    CONTAINER_IMAGE
    CONTAINER
    VIRTUAL_MACHINE_IMAGE
    REPOSITORY
    COMMIT
    BRANCH
    TAG
    LICENSE
    VENDOR
    DEVELOPER
    MAINTAINER
    INSTALLATION
    INSTANCE
    DEPLOYMENT
    HOST
    PLATFORM
    ARCHITECTURE
    OPERATING_ENVIRONMENT
    STATE
    EVENT
    ERROR
    FAILURE
    VULNERABILITY
    PATCH
    UPDATE
    EVIDENCE
    CONFIDENCE_SCORE
    PROVENANCE_RECORD
  }

  RELATIONSHIPS {
    IS_A
    INSTANCE_OF
    PART_OF
    CONTAINS
    IMPLEMENTS
    PROVIDES
    EXPOSES
    USES
    CALLS
    INVOKES
    IMPORTS
    EXPORTS
    DEPENDS_ON
    LINKS_TO
    LOADS
    EXECUTES
    RUNS_ON
    HOSTED_BY
    DEPLOYED_TO
    INSTALLED_ON
    COMPILED_FROM
    BUILT_FROM
    GENERATED_FROM
    PACKAGED_AS
    CONFIGURED_BY
    HAS_CONFIGURATION
    HAS_VERSION
    HAS_RELEASE
    HAS_BUILD
    HAS_LICENSE
    DEVELOPED_BY
    MAINTAINED_BY
    PUBLISHED_BY
    SUPPORTS
    COMPATIBLE_WITH
    INTEROPERATES_WITH
    COMMUNICATES_WITH
    SUPERSEDES
    UPDATES
    PATCHES
    FIXES
    HAS_STATE
    TRANSITIONS_TO
    FAILS_WITH
    AFFECTED_BY
    DERIVED_FROM
    INFERRED_FROM
    HAS_EVIDENCE
    HAS_CONFIDENCE
    HAS_PROVENANCE
    MAPS_TO
    SEMANTICALLY_EQUIVALENT_TO
  }

  INPUTS {
    SOFTWARE_INVENTORIES
    PACKAGE_METADATA
    REPOSITORY_METADATA
    SOURCE_CODE_METADATA
    BUILD_METADATA
    RELEASE_METADATA
    VERSION_DATA
    DEPENDENCY_MANIFESTS
    LOCK_FILES
    BINARY_METADATA
    INSTALLATION_DATA
    DEPLOYMENT_DATA
    RUNTIME_DATA
    PROCESS_DATA
    API_METADATA
    CONFIGURATION_DATA
    LICENSE_DATA
    VENDOR_DATA
    SECURITY_ADVISORIES
    PATCH_DATA
    ERROR_LOGS
    PROVENANCE_DATA
    ONTOLOGY_TERMS
  }

  NORMALISE {
    STANDARDISE_SOFTWARE_IDENTIFIERS
    NORMALISE_SOFTWARE_NAMES
    NORMALISE_PACKAGE_NAMES
    NORMALISE_MODULE_NAMES
    NORMALISE_VERSION_IDENTIFIERS
    NORMALISE_RELEASE_IDENTIFIERS
    NORMALISE_BUILD_IDENTIFIERS
    NORMALISE_REPOSITORY_IDENTIFIERS
    NORMALISE_COMMIT_IDENTIFIERS
    NORMALISE_PLATFORM_NAMES
    NORMALISE_ARCHITECTURE_NAMES
    NORMALISE_DEPENDENCY_IDENTIFIERS
    NORMALISE_LICENSE_IDENTIFIERS
    NORMALISE_VENDOR_NAMES
    NORMALISE_CONFIGURATION_IDENTIFIERS
    RESOLVE_SOFTWARE_ENTITY_IDENTITIES
    ALIGN_ONTOLOGY_TERMS
    REMOVE_DUPLICATES
    VALIDATE_METADATA
    PRESERVE_PROVENANCE
  }

  PROCESS SOFTWARE_ENTITY_PIPELINE {
    SOFTWARE_REFERENCE
      -> ENTITY_IDENTIFICATION
      -> ENTITY_TYPE_CLASSIFICATION
      -> VERSION_AND_BUILD_RESOLUTION
      -> COMPONENT_AND_DEPENDENCY_MAPPING
      -> PLATFORM_AND_ENVIRONMENT_MAPPING
      -> INSTALLATION_DEPLOYMENT_AND_RUNTIME_MAPPING
      -> LICENSE_SECURITY_AND_PROVENANCE_MAPPING
      -> VALIDATION
      -> OUTPUT
  }

  PROCESS IDENTITY_REASONING {
    SOFTWARE_NAME + VENDOR_OR_NAMESPACE + VERSION_CONTEXT
      -> CANDIDATE_ENTITY_SET

    CANDIDATE_ENTITY_SET
      -> PACKAGE_REPOSITORY_BUILD_AND_PLATFORM_COMPARISON

    MATCHING_EVIDENCE
      -> CANONICAL_SOFTWARE_ENTITY

    AMBIGUOUS_EVIDENCE
      -> PRESERVE_MULTIPLE_CANDIDATES
  }

  PROCESS VERSION_REASONING {
    SOFTWARE_ENTITY
      -> VERSION_SET

    VERSION
      -> RELEASE

    RELEASE
      -> BUILD_SET

    BUILD
      -> PLATFORM_ARCHITECTURE_AND_CONFIGURATION

    VERSION_OR_RELEASE_CHANGE
      -> FEATURE_DEPENDENCY_AND_COMPATIBILITY_CHANGE_ANALYSIS
  }

  PROCESS DEPENDENCY_REASONING {
    SOFTWARE_ENTITY
      -> DIRECT_DEPENDENCIES

    DIRECT_DEPENDENCIES
      -> DEPENDENCY_GRAPH

    DEPENDENCY_GRAPH
      -> TRANSITIVE_DEPENDENCIES

    VERSION_CONSTRAINTS
      -> RESOLVED_DEPENDENCY_SET

    RESOLVED_DEPENDENCY_SET
      -> COMPATIBILITY_AND_CONFLICT_ANALYSIS
  }

  PROCESS BUILD_REASONING {
    SOURCE_CODE + BUILD_CONFIGURATION + TOOLCHAIN
      -> BUILD_PROCESS

    BUILD_PROCESS
      -> BUILD_ARTIFACTS

    BUILD_ARTIFACTS
      -> EXECUTABLE_LIBRARY_PACKAGE_OR_IMAGE

    BUILD_ARTIFACT
      -> SOURCE_AND_CONFIGURATION_PROVENANCE
  }

  PROCESS INSTALLATION_REASONING {
    SOFTWARE_PACKAGE_OR_ARTIFACT
      -> INSTALLATION_REQUEST

    INSTALLATION_REQUEST
      -> PLATFORM_AND_DEPENDENCY_CHECK

    VALID_INSTALLATION_CONTEXT
      -> INSTALLED_INSTANCE

    INSTALLED_INSTANCE
      -> CONFIGURATION_AND_STATE
  }

  PROCESS DEPLOYMENT_REASONING {
    SOFTWARE_ARTIFACT
      -> DEPLOYMENT_CONFIGURATION

    DEPLOYMENT_CONFIGURATION
      -> TARGET_HOST_PLATFORM_OR_CONTAINER

    DEPLOYMENT
      -> SOFTWARE_INSTANCE

    SOFTWARE_INSTANCE
      -> RUNTIME_STATE
  }

  PROCESS EXECUTION_REASONING {
    EXECUTABLE_OR_RUNTIME_ARTEFACT
      -> LOAD

    LOAD
      -> PROCESS_OR_RUNTIME_INSTANCE

    PROCESS_OR_RUNTIME_INSTANCE
      -> EXECUTION_STATE

    EXECUTION_STATE
      -> CALLS_DEPENDENCIES_RESOURCES_AND_EVENTS
  }

  PROCESS API_REASONING {
    SOFTWARE_SERVICE
      -> API_OR_INTERFACE

    API_OR_INTERFACE
      -> ENDPOINT_OR_OPERATION_SET

    CLIENT
      -> REQUEST

    REQUEST
      -> ENDPOINT

    ENDPOINT
      -> SOFTWARE_OPERATION
      -> RESPONSE
  }

  PROCESS SECURITY_REASONING {
    SOFTWARE_ENTITY + VERSION
      -> SECURITY_ADVISORY_MATCHING

    MATCHED_ADVISORY
      -> VULNERABILITY_CANDIDATE

    VULNERABILITY_CANDIDATE
      -> AFFECTED_VERSION_RANGE_CHECK

    AFFECTED_VERSION
      -> PATCH_OR_UPDATE_RELATION

    PATCH_OR_UPDATE
      -> REMEDIATION_STATE
  }

  RULES {
    IF SOFTWARE_ENTITY_IS_IDENTIFIED
    THEN PRESERVE NAME_NAMESPACE_VENDOR_VERSION_AND_PLATFORM_CONTEXT

    IF SAME_SOFTWARE_NAME_APPEARS_IN_DIFFERENT_NAMESPACES
    THEN DO_NOT_ASSUME SAME_ENTITY

    IF VERSION_DIFFERS
    THEN DO_NOT_ASSUME IDENTICAL_FEATURE_DEPENDENCY_SECURITY_OR_RUNTIME_BEHAVIOUR

    IF BUILD_DIFFERS
    THEN PRESERVE TOOLCHAIN_PLATFORM_ARCHITECTURE_AND_CONFIGURATION_CONTEXT

    IF SOFTWARE_IS_INSTALLED
    THEN DISTINGUISH SOFTWARE_PRODUCT_FROM_INSTALLED_INSTANCE

    IF SOFTWARE_IS_RUNNING
    THEN DISTINGUISH SOFTWARE_ARTEFACT_FROM_RUNTIME_PROCESS_OR_INSTANCE

    IF DEPENDENCY_IS_DECLARED
    THEN DO_NOT_ASSUME EXACT_RESOLVED_VERSION_WITHOUT_RESOLUTION_CONTEXT

    IF SEMANTIC_IDENTIFIERS_DIFFER
    AND SOFTWARE_REFERENT_IS_SAME
    THEN APPLY SEMANTIC_EQUIVALENCE
  }

  CONFIDENCE {
    CONFIDENCE_SCORE =
      WEIGHT(
        SOFTWARE_IDENTITY_CERTAINTY,
        VERSION_CERTAINTY,
        BUILD_CERTAINTY,
        PACKAGE_AND_NAMESPACE_CERTAINTY,
        DEPENDENCY_RESOLUTION_COMPLETENESS,
        PLATFORM_AND_RUNTIME_CERTAINTY,
        SECURITY_EVIDENCE_QUALITY,
        PROVENANCE_COMPLETENESS
      )

    LEVELS {
      HIGH
      MODERATE
      LOW
      INSUFFICIENT
    }

    IF VERSION_OR_NAMESPACE_IS_UNKNOWN
    THEN REDUCE_ENTITY_RESOLUTION_CONFIDENCE

    IF BUILD_OR_PLATFORM_IS_UNKNOWN
    THEN REDUCE_RUNTIME_COMPATIBILITY_CONFIDENCE

    IF AUTHORITATIVE_PACKAGE_BUILD_OR_REPOSITORY_METADATA_CONFIRMS_IDENTITY
    THEN INCREASE_CONFIDENCE_SCORE
  }

  SEMANTIC_EQUIVALENCE {
    EQUIVALENCE_KEY =
      NORMALISE(
        ENTITY_TYPE,
        CANONICAL_NAME,
        VENDOR_OR_NAMESPACE,
        VERSION,
        BUILD,
        PLATFORM,
        ARCHITECTURE
      )

    IF EQUIVALENCE_KEY(A) == EQUIVALENCE_KEY(B)
    THEN A SEMANTICALLY_EQUIVALENT_TO B

    ELSE PRESERVE_DISTINCT_ENTITIES
  }

  REASONING_CONSTRAINTS {
    SOFTWARE_PRODUCT != SOFTWARE_INSTANCE
    SOURCE_CODE != EXECUTABLE
    PROGRAM != PROCESS
    PACKAGE != INSTALLED_INSTANCE
    VERSION != BUILD
    RELEASE != BUILD
    LIBRARY != APPLICATION
    API != IMPLEMENTATION
    INTERFACE != ENDPOINT
    DEPENDENCY_DECLARATION != RESOLVED_DEPENDENCY
    COMPATIBILITY != IDENTITY
    SAME_NAME != SAME_SOFTWARE_ENTITY
    INSTALLED != RUNNING
    BUILD_SUCCESS != RUNTIME_CORRECTNESS
    VULNERABILITY_ADVISORY_MATCH != CONFIRMED_EXPLOITABILITY_WITHOUT_CONTEXT
    PATCH_AVAILABLE != PATCH_APPLIED
    PLATFORM_ARCHITECTURE_CONFIGURATION_AND_VERSION_AFFECT_SOFTWARE_BEHAVIOUR
    PROVENANCE_MUST_BE_PRESERVED
    UNCERTAINTY_MUST_NOT_BE_DISCARDED
  }

  VALIDATION {
    CHECK_ENTITY_TYPES
    CHECK_RELATION_DOMAINS_AND_RANGES
    CHECK_SOFTWARE_IDENTIFIER
    CHECK_NAME_AND_NAMESPACE
    CHECK_VENDOR
    CHECK_VERSION
    CHECK_RELEASE
    CHECK_BUILD
    CHECK_PLATFORM_AND_ARCHITECTURE
    CHECK_COMPONENT_RELATIONS
    CHECK_DEPENDENCY_GRAPH
    CHECK_BUILD_PROVENANCE
    CHECK_INSTALLATION_RELATIONS
    CHECK_DEPLOYMENT_RELATIONS
    CHECK_RUNTIME_RELATIONS
    CHECK_API_RELATIONS
    CHECK_LICENSE
    CHECK_SECURITY_RELATIONS
    CHECK_CONFIGURATION
    CHECK_PROVENANCE
    CHECK_CONFIDENCE
    CHECK_SEMANTIC_CONSISTENCY
  }

  OUTPUTS {
    NORMALISED_SOFTWARE_ENTITIES
    SOFTWARE_TYPE_RELATIONS
    VERSION_RELEASE_AND_BUILD_RELATIONS
    COMPONENT_RELATIONS
    DEPENDENCY_GRAPHS
    BUILD_RELATIONS
    INSTALLATION_RELATIONS
    DEPLOYMENT_RELATIONS
    RUNTIME_INSTANCE_RELATIONS
    API_AND_INTERFACE_RELATIONS
    PLATFORM_AND_ARCHITECTURE_RELATIONS
    CONFIGURATION_RELATIONS
    LICENSE_RELATIONS
    SECURITY_AND_PATCH_RELATIONS
    SOFTWARE_STATE_TRANSITIONS
    CONFIDENCE_SCORES
    EVIDENCE_LINKS
    PROVENANCE_RECORDS
    EXPLANATION_PATHS
  }

  UPDATE_MODEL {
    ON SOFTWARE_VERSION_RELEASE_OR_BUILD_CHANGE {
      NORMALISE
      RESOLVE_SOFTWARE_IDENTITY
      UPDATE_VERSION_RELEASE_AND_BUILD_RELATIONS
      UPDATE_DEPENDENCY_GRAPH
      UPDATE_PLATFORM_COMPATIBILITY
      UPDATE_SECURITY_RELATIONS
      RECOMPUTE_AFFECTED_RELATIONS
      UPDATE_CONFIDENCE
      PRESERVE_VERSION_HISTORY
    }

    ON INSTALLATION_DEPLOYMENT_OR_RUNTIME_CHANGE {
      LINK_EVIDENCE
      UPDATE_INSTANCE_RELATIONS
      UPDATE_CONFIGURATION
      UPDATE_RUNTIME_STATE
      UPDATE_HOST_AND_PLATFORM_RELATIONS
      UPDATE_CONFIDENCE
      RECORD_PROVENANCE
    }

    ON ONTOLOGY_REVISION {
      REMAP_TERMS
      CHECK_SEMANTIC_EQUIVALENCE
      IDENTIFY_DEPRECATED_TERMS
      MIGRATE_RELATIONSHIPS
      PRESERVE_PRIOR_VERSION_REFERENCES
    }
  }

  FLOW_HASH {
    HASH_INPUT =
      CANONICALISE(
        ENTITY_TYPES,
        RELATIONSHIPS,
        RULES,
        CONFIDENCE,
        SEMANTIC_EQUIVALENCE,
        REASONING_CONSTRAINTS,
        UPDATE_MODEL
      )

    FLOW_HASH = SHA256(HASH_INPUT)
  }

  AI_CONSUMPTION {
    INDEX {
      ONTOLOGY
      ENTITY_TYPES
      RELATIONSHIPS
      RULES
      OUTPUTS
    }

    RETRIEVE {
      BY_SOFTWARE
      BY_SOFTWARE_TYPE
      BY_PACKAGE
      BY_MODULE
      BY_LIBRARY
      BY_VERSION
      BY_RELEASE
      BY_BUILD
      BY_DEPENDENCY
      BY_PLATFORM
      BY_INSTALLATION
      BY_DEPLOYMENT
      BY_RUNTIME_INSTANCE
      BY_API
      BY_SECURITY_STATE
      BY_CONFIDENCE
    }

    REASON {
      APPLY_RELATIONSHIPS
      APPLY_RULES
      RESOLVE_SOFTWARE_IDENTITIES
      TRACE_VERSION_RELEASE_AND_BUILD_RELATIONS
      BUILD_DEPENDENCY_GRAPH
      TRACE_BUILD_PROVENANCE
      TRACE_INSTALLATIONS
      TRACE_DEPLOYMENTS
      TRACE_RUNTIME_INSTANCES
      ANALYSE_APIS_AND_INTERFACES
      ANALYSE_SECURITY_AND_PATCH_RELATIONS
      CHECK_SEMANTIC_EQUIVALENCE
      PRESERVE_UNCERTAINTY
      TRACE_EVIDENCE
      TRACE_PROVENANCE
      GENERATE_EXPLANATION_PATH
    }

    RESPONSE_POLICY {
      DISTINGUISH_SOFTWARE_PRODUCT_ARTEFACT_AND_RUNTIME_INSTANCE
      DISTINGUISH_VERSION_RELEASE_AND_BUILD
      PRESERVE_NAME_NAMESPACE_VENDOR_PLATFORM_ARCHITECTURE_AND_CONFIGURATION_CONTEXT
      DISTINGUISH_DECLARED_FROM_RESOLVED_DEPENDENCIES
      DISTINGUISH_PATCH_AVAILABLE_FROM_PATCH_APPLIED
      RETURN_CONFIDENCE_WHEN_AVAILABLE
      RETURN_PROVENANCE_WHEN_AVAILABLE
      AVOID_UNSUPPORTED_SOFTWARE_ENTITY_INFERENCE
    }
  }

  TERMINAL {
    RESULT =
      VALIDATED(
        SEMANTICALLY_NORMALISED(
          EVIDENCE_LINKED(
            CONFIDENCE_AWARE(
              SOFTWARE_ENTITY_KNOWLEDGE
            )
          )
        )
      )
  }
}

END FLOW