Modern static analysis tools prioritize performance and ease-of-use over reproducibility, introducing non-determinism through parallel execution, timestamps, heuristics, and floating- point arithmetic. This non-determinism erodes trust in critical environments where “probably correct” is insufficient: security audits demand provable results, compliance frameworks require auditable decisions, and debugging necessitates reproducible behavior. We present VCR (Valori Code Replay), a deterministic, fail-closed code analysis infrastructure that guarantees identical results across executions. VCR introduces an epoch-based memory model that eliminates global state, a bounded analysis framework with explicit limits, and a snapshot replay mechanism with cryptographic verification. Our architecture enforces determinism at every layer: deterministic graph construction via sequential IDs, parallel-safe execution with serial commits, and canonical SHA-256 hashing over sorted representations. VCR fails closed hash mismatches, parse errors, and version conflicts trigger immediate panics rather than silent corruption. We formalize VCR’s determinism guarantees through four formal guarantees covering input determinism, snapshot replay correctness, parallel equivalence, and fail-closed safety. Our implementation in Rust demonstrates that deterministic analysis is both feasible and practical, with formal verification of hash consistency across 100+ executions and byte-for-byte reproducibility across platforms. VCR serves as open-source infrastructure for high-assurance environments, filling the gap between heuristic tools (CodeQL, Semgrep) and sound verifiers (Frama-C, Astr´ee) by prioritizing reproducibility as a first-class concern. The system is available under MIT/Apache-2.0 at https://github.com/varshith-Git/vcr, CodeBase DOI: https://doi.org/10.5281/ze nodo.18441515
Varshith Gudur (Sat,) studied this question.