Trace-Guided Compositional Analysis

• Trace-guided compositional analysis is a methodological pattern that leverages trace artifacts—such as symbolic traces, tracelets, and trace formulas—to enable modular reasoning over program behaviors.
• It employs various techniques including symbolic execution, KAT refinement, and automata-theoretic constructions to compose local analyses into compact, scalable summaries.
• Practical implementations like Gillian and GoT-CQA demonstrate its effectiveness in compressing search spaces, refining counterexamples, and improving analysis performance in real-world systems.

Searching arXiv for the cited works and closely related trace/compositional-analysis papers to ground the article. Search 1: Gillian / compositional symbolic execution / traces. Trace-guided compositional analysis denotes a family of methods in which traces, or trace-like objects, are used to drive modular reasoning about behavior while preserving some notion of composition. Across the literature, the guiding artifact may be a symbolic execution trace, a Graph-of-Thought, a Kleene Algebra with Tests (KAT) trace class, a tracelet, a trace formula, a traceability link, a symbolic regular expression, or an abstract counterexample path. What unifies these approaches is not a single formalism but a recurring principle: local analyses are performed relative to traces, and the resulting local facts are then composed by summaries, algebraic operators, proof rules, nesting relations, or automata-theoretic constructions rather than by monolithic global exploration (Santos et al., 2020, Antonopoulos et al., 2019, Behr, 2019, Gurov et al., 2024, Yuan et al., 2 Sep 2025, Kundu et al., 3 Sep 2025).

1. Conceptual scope and historical strands

In program analysis, one major strand treats traces as operational paths enriched with symbolic state. Gillian is a language-independent framework for compositional symbolic execution built around GIL, a parametric notion of state model, and a uniform symbolic engine shared by whole-program symbolic testing, verification, and bi-abduction. In that setting, compositional symbolic execution is explicitly decomposed into procedural compositionality, state compositionality, and trace compositionality; symbolic traces are related to concrete traces by a parametric soundness relation, and summaries allow multiple symbolic traces to be folded into compact specifications (Santos et al., 2020).

A second strand arises from reasoning about changing programs. "Specification and Inference of Trace Refinement Relations" introduces trace-refinement relations as a disjunctive relational specification over trace classes, extending the earlier state-based refinement tradition associated with Benton and Yang to reactive traces represented in KAT. There, traces are not merely witnesses of executions but the primary semantic medium for comparing versions, partitioning behaviors, and correlating events and conditions by hypotheses (Antonopoulos et al., 2019).

A third strand is categorical and rewriting-theoretic. "Tracelets and Tracelet Analysis Of Compositional Rewriting Systems" treats tracelets as minimal derivation traces that universally encode sequential compositions of rewriting rules; associativity of rule composition and the concurrency theorem make these objects compositional in a precise algebraic sense (Behr, 2019). "Compositionality in Coalgebraic Trace Semantics" extends the Turi–Plotkin bialgebraic perspective from strong bisimilarity to trace equivalence in Kleisli categories, showing that trace-guided compositionality can also be phrased as congruence of trace semantics under syntax constructors via De Simone laws (Jourde et al., 18 May 2026).

Other strands specialize the same design principle to distinct domains. In chart question answering, GoT-CQA treats a question-specific Graph-of-Thought as an explicit reasoning trace that hard-constrains the computation graph of Loc, Num, and Log modules (Zhang et al., 2024). In model-driven engineering, model composition traceability formalizes traces as links between left, right, and composed model elements, with nesting relations that reflect rule-call structure (Laghouaouta et al., 2015). In recursive-program verification, trace formulas with chop and least fixed points yield a fully compositional semantics and proof calculus over finite traces (Gurov et al., 2024). In strategic rewriting, traced types statically approximate legal execution paths of rewrite strategies and distinguish well-traced from ill-traced compositions (Fu et al., 2023). In incorrectness reasoning, symbolic regular expressions and symbolic finite automata drive underapproximate type inference for bad traces across effectful library APIs (Yuan et al., 2 Sep 2025). In hybrid systems, abstract counterexample traces guide CEGAR refinement without explicit construction of the full product automaton (Kundu et al., 3 Sep 2025).

This distribution of techniques suggests that trace-guided compositional analysis is best understood as a methodological pattern rather than a domain-specific algorithm.

2. Trace objects and their semantics

The surveyed literature uses several distinct trace carriers.

Setting	Trace object	Compositional role
Gillian	symbolic traces $\hat\cf \ssemarrow^* \hat\cf'$, path conditions, fixes	summaries, predicates, bi-abductive specs
GoT-CQA	DAG $\mathcal G = \{\mathcal O,\mathcal E\}$	module wiring and execution order
Trace refinement	KAT expressions and trace classes $k \cap r$	partitioning and correlation by hypotheses
Rewriting	tracelets	composition of derivations and causal abstraction
Recursive programs	trace formulas with chop and $\mu$	denotational semantics and proof rules
MDE composition	traceability links and nesting relations	provenance and dependency structure
Incorrectness typing	SREs and SFAs	underapproximate witness search
Hybrid reachability	step paths and shallow paths	abstract search and refinement

In Gillian, the basic operational object is a configuration

$\cf = \langle \prog, \st, \cs, i\rangle,$

with multi-step relations $\cf \ssemarrow^* \cf'$ and symbolic states $\hat\st = \langle \smem, \ssto, \hat\arec, \pi \rangle$. Path conditions $\pi$, symbolic heaps, SL-style predicates, and bi-abductive fixes are all trace-like structures because they record which branches, resources, and action preconditions are required for a symbolic path to correspond to concrete executions (Santos et al., 2020).

In GoT-CQA, a trace is a directed acyclic graph

$\mathcal G = \{ \mathcal O, \mathcal E \},$

whose nodes $o_i = (\widetilde{o}_i,\mathrm{type}(o_i))$ have type in $\mathcal G = \{\mathcal O,\mathcal E\}$0. This is simultaneously a structural trace, because it records dependency order, and a semantic trace, because node contents are human-readable instructions such as “locate P1” or “subtract value(P2) − value(P1)” (Zhang et al., 2024).

In KAT-based refinement, a trace is abstracted as a word in a regular language of events and tests. Trace classes are obtained by intersection, as in $\mathcal G = \{\mathcal O,\mathcal E\}$1, and a trace-refinement relation is a set of triples $\mathcal G = \{\mathcal O,\mathcal E\}$2 satisfying

$\mathcal G = \{\mathcal O,\mathcal E\}$3

with $\mathcal G = \{\mathcal O,\mathcal E\}$4 partitioning the left trace space. The partition itself is trace-guided: different restrictions $\mathcal G = \{\mathcal O,\mathcal E\}$5 correspond to different behavioral classes, and hypotheses $\mathcal G = \{\mathcal O,\mathcal E\}$6 encode which events or tests are ignored, equated, or fixed (Antonopoulos et al., 2019).

In rewriting systems over adhesive categories, tracelets are minimal derivation traces whose evaluation

$\mathcal G = \{\mathcal O,\mathcal E\}$7

maps them to composite rules. Every derivation trace is uniquely represented, up to isomorphism, as a tracelet plus a match into the initial object. Hence the semantic role of a tracelet is not merely documentary; it is a canonical representative of a compositional causal pattern (Behr, 2019).

In recursive-program logic, the semantic domain is $\mathcal G = \{\mathcal O,\mathcal E\}$8, the set of non-empty finite traces of states. Formula constructors

$\mathcal G = \{\mathcal O,\mathcal E\}$9

mirror state predicates, binary relations, sequencing via chop, and recursion via least fixed points. The trace logic is expressive enough that each recursive program can be mapped to a strongest trace formula, and each trace formula can be mapped back to a canonical program, up to stuttering (Gurov et al., 2024).

In MDE traceability, the trace object is not a path but a relational link

$k \cap r$0

together with nesting relations $k \cap r$1 between links. This suggests that “trace” in compositional analysis need not be linear: a graph of provenance links can also guide modular analysis when composition itself is rule-based and hierarchical (Laghouaouta et al., 2015).

In incorrectness typing, the trace space is represented by symbolic regular expressions such as

$k \cap r$2

and by the corresponding symbolic finite automata. The trace object here is explicitly property-directed: only behaviors relevant to witnessing incorrectness are retained by the underapproximate analysis (Yuan et al., 2 Sep 2025).

In compositional affine hybrid systems, traces are abstract counterexample paths. Step paths are sequences $k \cap r$3 of simultaneous label sets; shallow paths are their stutter-free variants. These trace forms mediate between the discrete SAT abstraction and the symbolic continuous-state refinement (Kundu et al., 3 Sep 2025).

3. Mechanisms of compositionality

A central distinction in this literature is between using traces to represent behavior and using traces to justify composition. Gillian makes this distinction explicit. Procedure summaries are encoded as specifications $k \cap r$4, and the verification semantics uses Getter(P) and Setter(Q) instead of re-executing the body. Local reasoning is further supported by frame-preserving state models and assertions $k \cap r$5, with fold/unfold commands summarizing data-structure-manipulating trace segments into predicates (Santos et al., 2020).

KAT-based trace refinement obtains compositionality from algebraic operators. If $k \cap r$6 and $k \cap r$7, then Theorem 3.13 yields compositional closure under sequencing, choice, and star. Corollary 3.14 further shows that a local trace relation can be embedded into arbitrary KAT contexts. This is trace-level modularity: fragments need not be re-analyzed when larger contexts evolve (Antonopoulos et al., 2019).

Tracelets obtain compositionality from associative rule composition. The tracelet main theorem states that matches of tracelets coincide with matches of their evaluated composite rules, evaluation preserves composition, and tracelet composition is associative up to isomorphism. Together with tracelet surgery and shift equivalence, this yields a domain in which longer derivations can be assembled from shorter ones or compressed into macro-steps without loss of the relevant causal structure (Behr, 2019).

In recursive-program logic, compositionality is encoded both semantically and proof-theoretically. The denotational semantics uses restriction by guards, duplication of the first state via $k \cap r$8, and chop

$k \cap r$9

Procedure meanings are the least fixed point of a global transformer $\mu$0, and the proof calculus has direct rules for Skip, Assign, Seq, If, and Call. The Call rule internalizes fixed-point induction by assuming a contract $\mu$1 for recursive calls and proving the body against that contract (Gurov et al., 2024).

GoT-CQA uses a different but still compositional mechanism: module composition by data flow. Each node executes

$\mu$2

with predecessor fusion and SELF–CROSS attention. Composition is therefore externalized into the GoT itself: the trace dictates which modules exist, how they are wired, and when they are executed (Zhang et al., 2024).

Coalgebraic trace semantics formulates compositionality as congruence. De Simone laws

$\mu$3

are lifted to Kleisli categories, and under affineness and refined naturality conditions the trace map $\mu$4 becomes a morphic $\mu$5-congruence. This recovers classical compositionality of De Simone rules for trace equivalence and extends it to probabilistic trace equivalence for almost surely terminating probabilistic De Simone specifications (Jourde et al., 18 May 2026).

Strategic rewriting provides a static analogue. Typed ELEVATE attaches trace identifiers and trace members to strategy types; compTrace composes traces of higher-order strategy arguments by selecting identifier slices, renaming, unifying traced types, and adding successful compositions into the result. Choice unions trace identifiers, while sequencing requires compatible path-wise unification (Fu et al., 2023).

In model composition traceability, compositionality appears as nesting. Every rule activation creates exactly one traceability link, and explicit or implicit rule calls induce parent–child relations between those links. The resulting trace graph reconstructs how local merge or transform steps compose into the target model (Laghouaouta et al., 2015).

4. Trace guidance, refinement, and inference

Trace guidance is strongest when traces do not merely summarize completed behavior but actively restrict search and proof obligations. Gillian’s restriction operator $\mu$6 plays precisely that role. For symbolic states $\mu$7, $\mu$8 strengthens the first by conjoining path conditions and combining allocator records. The trace-guided soundness theorem then states that if a symbolic trace $\mu$9 is fixed, any concrete execution starting from a state satisfying the restricted initial symbolic state must follow a corresponding concrete trace ending in a state approximated by $\cf = \langle \prog, \st, \cs, i\rangle,$0. In bi-abduction, failures return fixes $\cf = \langle \prog, \st, \cs, i\rangle,$1, and accumulated fixes along traces become candidate preconditions $\cf = \langle \prog, \st, \cs, i\rangle,$2 (Santos et al., 2020).

In trace-refinement synthesis, trace guidance is operationalized by counterexamples. The algorithm Synth translates both programs into KAT, invokes KATdiff, receives counterexample strings, and passes them to SolveDiff. A custom edit-distance algorithm then determines whether to remove actions by hypotheses $\cf = \langle \prog, \st, \cs, i\rangle,$3, split on Boolean tests $\cf = \langle \prog, \st, \cs, i\rangle,$4 versus $\cf = \langle \prog, \st, \cs, i\rangle,$5, or replace actions/tests by equivalence hypotheses. Restrict instruments the source programs with assume statements corresponding to those choices, creating sub-programs and refined abstractions. The resulting refinement relation is therefore literally trace-guided by divergences in abstract trace sets (Antonopoulos et al., 2019).

In incorrectness typing, the specification automaton guides every local judgment. The analysis decomposes an incorrectness specification such as

$\cf = \langle \prog, \st, \cs, i\rangle,$6

into context and continuation automata. Library calls like get are typed by intersecting the current context SFA with the SFA required by the library specification, which allows abduction of equalities such as $\cf = \langle \prog, \st, \cs, i\rangle,$7 or $\cf = \langle \prog, \st, \cs, i\rangle,$8. Composition of subterms is restricted to traces still capable of witnessing the bad pattern. This is an explicitly underapproximate, witness-oriented use of trace guidance (Yuan et al., 2 Sep 2025).

The hybrid-systems algorithm is CEGAR-centric in a directly trace-guided sense. SAT-based search enumerates a step compositional path $\cf = \langle \prog, \st, \cs, i\rangle,$9 in the discrete abstraction; symbolic reachability validates the corresponding shallow path $\cf \ssemarrow^* \cf'$0. If the path is infeasible, a path negation constraint is added to the SAT formula, blocking that trace and its extensions. If the reachable sets intersect the unsafe region, the tool reports Unknown rather than unsafe, because the symbolic continuous analysis is over-approximate (Kundu et al., 3 Sep 2025).

Strategic rewriting gives a static failure analysis in similar spirit. Empty-traced result types $\cf \ssemarrow^* \cf'$1 reduce to fail, and empty-traced strategy types $\cf \ssemarrow^* \cf'$2 are unproductive for any input. Conversely, non-empty traced executions are guaranteed to have some successful execution path. This is not CEGAR, but it is trace-guided inference: the analysis distinguishes globally dead strategies, which become type errors, from dead sub-branches, which can be reported as warnings when another branch remains well-traced (Fu et al., 2023).

GoT-CQA uses externally supplied traces rather than inferred ones. The GoT is not latent; it is given per question from templates or Qwen2‑7B parsing and explicitly guides operator choice, predecessor wiring, and topological execution order. This suggests a different form of trace guidance: instead of refining traces against counterexamples, the method constrains the model to execute only the trace prescribed by the graph (Zhang et al., 2024).

5. Systems, tools, and empirical evidence

The practical literature shows that trace-guided compositional analysis is not confined to toy formalisms. Gillian is instantiated to JavaScript and C. For JavaScript, whole-program symbolic testing on data-structure libraries reports tens of thousands of GIL commands with times approximately $\cf \ssemarrow^* \cf'$3–$\cf \ssemarrow^* \cf'$4s, verification approximately $\cf \ssemarrow^* \cf'$5–$\cf \ssemarrow^* \cf'$6s, and bi-abduction generating $\cf \ssemarrow^* \cf'$7–$\cf \ssemarrow^* \cf'$8 specs per library in a few seconds. The C instantiation, based on CompCert’s Csharpminor, is reported to perform very well on pointer-manipulating data structures such as lists and trees (Santos et al., 2020).

GoT-CQA reports gains precisely where explicit reasoning traces should matter most. On ChartQA, the three-operator model with GoT obtains Human $\cf \ssemarrow^* \cf'$9, Augmented $\hat\st = \langle \smem, \ssto, \hat\arec, \pi \rangle$0, and Overall $\hat\st = \langle \smem, \ssto, \hat\arec, \pi \rangle$1, compared with $\hat\st = \langle \smem, \ssto, \hat\arec, \pi \rangle$2, $\hat\st = \langle \smem, \ssto, \hat\arec, \pi \rangle$3, and $\hat\st = \langle \smem, \ssto, \hat\arec, \pi \rangle$4 without GoT. On PlotQA-D1, the Loc+Num+Log model improves Reasoning from $\hat\st = \langle \smem, \ssto, \hat\arec, \pi \rangle$5 without GoT to $\hat\st = \langle \smem, \ssto, \hat\arec, \pi \rangle$6 with GoT, and Overall from $\hat\st = \langle \smem, \ssto, \hat\arec, \pi \rangle$7 to $\hat\st = \langle \smem, \ssto, \hat\arec, \pi \rangle$8. The paper explicitly notes that gains are especially pronounced for reasoning questions and human-written questions (Zhang et al., 2024).

Knotical demonstrates that KAT-based trace refinement is not merely theoretical. It integrates InterProc and SymKAT, and useful relations are efficiently generated across a suite of $\hat\st = \langle \smem, \ssto, \hat\arec, \pi \rangle$9 benchmarks including changing fragments of array programs, systems code, and web servers. Most examples run in seconds or less, while more complex array and server benchmarks can take up to about $\pi$0 seconds and yield many solution variants (Antonopoulos et al., 2019).

Tracelet analysis is presented as a prototype, but the FETA algorithm already statically generates minimal derivation traces with prescribed terminal events by exploring compositions of rules rather than concrete state spaces. In the paper’s example, $\pi$1 yields exactly one pathway family $\pi$2 for each $\pi$3, whereas $\pi$4 yields no pathways of length at least $\pi$5, demonstrating how tracelet analysis can prove that some terminal events do not emerge freshly (Behr, 2019).

SAT-Reach-C provides the hybrid-systems counterpart. The paper reports that NAV3C5 has $\pi$6 product locations and $\pi$7 transitions, NAV25 has $\pi$8 locations and $\pi$9 transitions, and the method avoids explicit construction of those products. Caching reduces postC calls substantially; for NAV25U2 the count drops from $\mathcal G = \{ \mathcal O, \mathcal E \},$0 to $\mathcal G = \{ \mathcal O, \mathcal E \},$1, and runtime falls from about $\mathcal G = \{ \mathcal O, \mathcal E \},$2s to about $\mathcal G = \{ \mathcal O, \mathcal E \},$3s (Kundu et al., 3 Sep 2025).

Across these systems, the empirical pattern is consistent: traces are used to compress search spaces, to reuse analyses across equivalent or shared prefixes, or to expose intermediate structure that monolithic exploration would ignore.

6. Limitations, misconceptions, and open directions

A common misconception is that trace-guided compositional analysis always means explicit human-authored traces. The literature does not support that reading. GoT-CQA uses explicit, externally supplied GoTs; Gillian infers symbolic traces during execution; Knotical synthesizes trace classes from KAT counterexamples; traced types infer legal strategy paths compositionally; and SAT-Reach-C extracts abstract counterexample traces from SAT models (Zhang et al., 2024, Santos et al., 2020, Antonopoulos et al., 2019, Fu et al., 2023, Kundu et al., 3 Sep 2025). This suggests that the defining feature is not the origin of the trace but its control over composition.

Another misconception is that compositionality has a uniform meaning. In the surveyed work it ranges over at least five forms: procedure-summary reasoning and frame rules in separation logic, algebraic closure under $\mathcal G = \{ \mathcal O, \mathcal E \},$4, $\mathcal G = \{ \mathcal O, \mathcal E \},$5, and $\mathcal G = \{ \mathcal O, \mathcal E \},$6 in KAT, associative composition of tracelets, congruence of trace semantics under syntax constructors, and provenance nesting in model composition traces (Santos et al., 2020, Antonopoulos et al., 2019, Behr, 2019, Jourde et al., 18 May 2026, Laghouaouta et al., 2015). The term therefore designates a family resemblance, not a single theorem schema.

Limitations are equally heterogeneous. KAT refinement currently handles terminating behaviors only, uses a restricted hypothesis class, and faces combinatorial growth from case splitting (Antonopoulos et al., 2019). The trace logic for recursive programs is restricted to finite traces and requires an oracle for logical implication in its relative completeness argument (Gurov et al., 2024). GoT-CQA depends on the correctness of template rules or Qwen2‑7B decompositions, has only three operator types, and provides no explicit supervision for intermediate steps (Zhang et al., 2024). Model-composition traceability does not yet fully capture additional target objects created in rule bodies or direct target wiring that bypasses resolve/targetEquivalent (Laghouaouta et al., 2015). Strategic rewriting deliberately relies on nondeterministic choice because left-biased choice would invalidate the “well-traced implies some successful execution path” interpretation (Fu et al., 2023). Incorrectness typing is intentionally underapproximate and therefore does not claim completeness (Yuan et al., 2 Sep 2025). Hybrid CEGAR is bounded, affine, and may return Unknown when over-approximate reachable sets intersect the unsafe region (Kundu et al., 3 Sep 2025).

Several papers also point toward refinement-oriented futures. Gillian’s restriction operators, path conditions, and fixes are described as well suited to counterexample-guided refinement or predicate abstraction layered on top of symbolic traces (Santos et al., 2020). The KAT work explicitly proposes global edit distance on KAT expressions and temporal verification modulo trace refinement (Antonopoulos et al., 2019). GoT-CQA proposes exploring more reasonable operators and suggests broader GoT-like reasoning across domains (Zhang et al., 2024). The coalgebraic account of De Simone laws indicates that further quantitative trace notions may admit congruence results under similar categorical structure (Jourde et al., 18 May 2026).

Taken together, these limitations and proposals indicate that trace-guided compositional analysis is mature enough to have domain-specific toolchains and meta-theory, yet still open on three recurring fronts: richer trace languages, stronger automation for trace acquisition or refinement, and scalability of composition-preserving abstractions.