Strengthen the analysis engine

[MrBearing]

Summary

Make the analysis engine more flexible and more powerful, enabling extensibility and more multi-faceted analysis.

Proposal

• Support custom plugins (e.g. Wasm / .so, or a trait-based API that allows users to extend analysis modules)
• Implement dependency-graph analysis (cycle detection, centrality, isolated packages, etc.)
• Provide a CLI feature to diff between report.json files

Expected impact

• Easier external sharing/provisioning of specialized analysis logic and custom use cases
• Higher value for large projects and CI pipelines

---

A phased implementation is fine. Technical proposals and requirement discussion are encouraged in comments.

[MrBearing]

To keep issue scope clearer, I suggest drawing the boundary between #34 and #36 like this:

#34 Strengthen the analysis engine

Use this for work on the execution/analysis core, for example:

• scanner improvements
• package/CMake/dependency graph analysis
• diff analysis between reports
• plugin execution model
• graph algorithms / centrality / cycle detection
• analysis data model expansion

In short: how Chelonian gathers and computes analysis results.

#36 Extend the rule system

Use this for work on the rule authoring/matching layer, for example:

• new matcher types
• rule DSL/schema changes
• compound conditions
• priority/supersedes/tags/filtering
• rule chaining/grouping
• richer rule metadata

In short: how users describe detection logic.

A practical heuristic:

• if the change improves the core analyzer even without adding new rules, it belongs in Strengthen the analysis engine #34
• if the change mainly improves what rule authors can express, it belongs in Extend the rule system #36