Compilation Context as a Security Variable: A Cross-Language Classification Framework

Abstract

The compilation context of a program — the flags, format settings, feature selections, and diagnostic instrumentation used at build time — is not necessarily represented by the source file itself. Changing these elements, without modifying a single line of source, can change what the program does, what code it contains, what its test suite exercises, and what failures become visible. This paper presents a methodology for detecting, reproducing, and classifying compilation context divergences, developed through empirical analysis of legacy COBOL systems, Rust cryptographic libraries, and C system programs. Three primary case studies demonstrate compilation-context divergence across interpretation, coverage, and observability dimensions. An adjacent case study illustrates the extensibility of the experimental protocol to deployment and package-management context. A three-tier classification framework — CONFIRMADO, PROBABLE, and OBSERVADO — is proposed to distinguish actionable security findings from intentional design decisions and unresolved observations.