@clear-capabilities/agentic-security-scanner 0.118.2 → 0.119.1

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-7625811bf6f85d6a9d7dd8b96cded3aff2a57426d1816b1591c3a410d87df8b5  agentic-security.mjs
+40d6882dc7b5dbd62ac41f10cb01ec4e43fa42081dbcc0427553e0282748fedb  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.118.2",
+  "version": "0.119.1",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, SARIF ingest, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -27,7 +27,9 @@
     "src/",
     "bin/",
     "dist/",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "!**/.agentic-security",
+    "!**/.agentic-security/**"
   ],
   "engines": {
     "node": ">=24.0.0"
@@ -55,16 +57,19 @@
   },
   "scripts": {
     "build": "ncc build bin/agentic-security.js -o dist --minify -e web-tree-sitter -e tree-sitter-wasms && mv dist/index.js dist/agentic-security.mjs && rm -f dist/package.json && chmod +x dist/agentic-security.mjs && node -e \"const fs=require('fs');const p='dist/agentic-security.mjs';const c=fs.readFileSync(p,'utf8');if(!c.startsWith('#!'))fs.writeFileSync(p,'#!/usr/bin/env node\\n'+c);\" && node -e \"const fs=require('fs');const c=require('crypto');const h=c.createHash('sha256').update(fs.readFileSync('dist/agentic-security.mjs')).digest('hex');fs.writeFileSync('dist/agentic-security.mjs.sha256',h+'  agentic-security.mjs\\n');\"",
-    "prepublishOnly": "npm run build && node -e \"const fs=require('fs');const cur=fs.existsSync('CHANGELOG.md')?fs.readFileSync('CHANGELOG.md','utf8'):'';const src=fs.readFileSync('../CHANGELOG.md','utf8');if(cur && cur!==src){console.error('scanner/CHANGELOG.md has local edits that differ from ../CHANGELOG.md.');console.error('Refusing to overwrite. Either commit the edit upstream first or rm scanner/CHANGELOG.md to accept the upstream copy.');process.exit(1);}fs.writeFileSync('CHANGELOG.md',src);\"",
-    "test": "npm run test:smoke && npm run test:sast && npm run test:posture && npm run test:dataflow && npm run test:mcp && npm run test:report && npm run test:bench-modules && npm run test:lifecycle && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js",
+    "prepublishOnly": "npm run build && node ../scripts/sync-scanner-changelog.mjs",
+    "test": "npm run test:smoke && npm run test:sast && npm run test:posture && npm run test:dataflow && npm run test:mcp && npm run test:report && npm run test:bench-modules && npm run test:lifecycle && npm run test:eval && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js",
     "test:smoke": "node --test test/smoke.test.js",
-    "test:sast": "node --test test/llm.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/wrong-context-sanitizer.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js",
-    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/coverage-report.test.js test/corpus-status.test.js",
-    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/kcfa-context.test.js test/callgraph-resolve.test.js",
+    "test:sast": "node --test test/llm.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js",
+    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js",
+    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js",
-    "test:report": "node --test test/sarif-ingest.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/grader-calibration.test.js",
+    "test:report": "node --test test/sarif-ingest.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js",
     "test:lifecycle": "node --test test/dead-code.test.js test/no-dead-modules.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js && node ../scripts/lint-command-descriptions.mjs",
+    "test:eval": "node --test test/independent-eval.test.js",
+    "eval:independent": "node ../bench/independent-eval/runner.mjs",
+    "eval:independent:gate": "node ../bench/independent-eval/runner.mjs --gate default",
     "smoke": "node bin/agentic-security.js scan test/fixtures/vulnerable-js",
     "prebench": "npm run build",
     "bench": "node test/benchmark/bench.js",

package/src/dataflow/CLAUDE.md

@@ -28,7 +28,7 @@ Layer-2 taint engine. Walks the Layer-1 IR (`../ir/`) with field-sensitive forwa
 
 ## Entry points
 
-- `runTaintEngine(perFileIR, callGraph, opts)` — the public entry. Called from `engine.js` when `AGENTIC_SECURITY_DEEP=1` (or auto-enabled outside CI).
+- `runTaintEngine(perFileIR, callGraph, opts)` — the public entry. Runs from `engine.js` when `AGENTIC_SECURITY_DEEP=1`. **R1 (PRD §5):** the CLI entry (`bin/agentic-security.js#cmdScan`) sets that env var by default for local/interactive scans (not in CI, and not when `--no-deep`/`AGENTIC_SECURITY_DEEP=0`), so the default `/scan --all` runs deep. In-process callers (tests, the cve-replay corpus) invoke `runScan()` directly without the CLI default and therefore stay deep-off unless they set the env var themselves (e.g. `test/deep-taint.test.js`).
 - `applyPathFeasibility` — constant-fold pass that runs before the worklist.
 - `annotateBackwardSlices` — backward-slice annotation for already-emitted findings.
 - `annotateProvenClean(findings, perFileIR)` (`proven-clean.js`) — proves a SQL sink is reached only through a parameterizer; sets `provenClean`. Wired by default in `runDeepAnalysis` (opt out: `AGENTIC_SECURITY_NO_PROOF_GATE=1`).

package/src/dataflow/catalog.js

@@ -166,6 +166,21 @@ export const CATALOG = [
   { kind: 'source', id: 'go-buffalo-request',language:'go', framework:'buffalo',match: { type: 'member', object: 'c', prop: 'Request' }, label: 'c.Request (buffalo)' },
   { kind: 'source', id: 'go-gorilla-vars',  language: 'go', framework: 'gorilla',match: { type: 'call', callee: 'Vars' },        label: 'mux.Vars (gorilla)' },
 
+  // ─── SINKS (Go — database/sql) — R3 (PRD §5) ──────────────────────────────
+  // callee 'Query' is also a net/http SOURCE (r.URL.Query). The engine
+  // disambiguates by position — source at the assignment RHS, sink at a call
+  // with a tainted query argument — so coexistence is benign (a source call
+  // like r.URL.Query() has no tainted arg, so it never fires the sink).
+  { kind: 'sink', id: 'go-sql-query',    language: 'go', framework: 'database/sql', match: { type: 'call', callee: 'Query' },    argIndex: 0,
+    vuln: { name: 'SQL Injection (db.Query — Go)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Use parameterized queries: db.Query("SELECT … WHERE id = $1", id). Never concatenate untrusted input into the SQL string.' } },
+  { kind: 'sink', id: 'go-sql-queryrow', language: 'go', framework: 'database/sql', match: { type: 'call', callee: 'QueryRow' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (db.QueryRow — Go)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Use placeholders ($1 / ?) and pass args separately.' } },
+  { kind: 'sink', id: 'go-sql-exec',     language: 'go', framework: 'database/sql', match: { type: 'call', callee: 'Exec' },     argIndex: 0,
+    vuln: { name: 'SQL Injection (db.Exec — Go)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Use parameterized statements: db.Exec("UPDATE t SET x=$1 WHERE id=$2", x, id).' } },
+
   // ─── SOURCES (Ruby — Rails / Sinatra) ─────────────────────────────────────
   { kind: 'source', id: 'rb-rails-params',  language: 'rb', framework: 'rails', match: { type: 'global', name: 'params' }, label: 'params (Rails)' },
   { kind: 'source', id: 'rb-rails-cookies', language: 'rb', framework: 'rails', match: { type: 'global', name: 'cookies' }, label: 'cookies (Rails)' },
@@ -747,22 +762,46 @@ function filterByProvenance(entries) {
   return list;
 }
 
-export function matchSource(memberExpr) {
-  // memberExpr is exprDesc: { kind: 'member', object: {kind:'ident',name}, prop }
-  if (!memberExpr || memberExpr.kind !== 'member') return null;
-  if (memberExpr.object?.kind !== 'ident') return null;
-  const k = `${memberExpr.object.name}.${memberExpr.prop}`;
-  const raw = MEMBER_INDEX.get(k);
-  if (!raw) return null;
-  const hits = filterByProvenance(raw);
-  if (!hits.length) return null;
-  return hits.find(h => h.kind === 'source') || null;
+export function matchSource(expr) {
+  if (!expr) return null;
+  // Member sources (req.query): the original path — unchanged.
+  if (expr.kind === 'member' && expr.object?.kind === 'ident') {
+    const raw = MEMBER_INDEX.get(`${expr.object.name}.${expr.prop}`);
+    if (raw) {
+      const hits = filterByProvenance(raw);
+      const s = hits.find(h => h.kind === 'source');
+      if (s) return s;
+    }
+  }
+  // R3 (PRD §5): CALL sources (r.FormValue(), r.URL.Query(), c.QueryParam()).
+  // matchSource previously handled only member reads, so Go's call-shaped
+  // sources were never recognized at the assignment RHS. Match by callee last
+  // segment (Go gives a dotted string; JS/Py a member/ident expr).
+  if (expr.kind === 'call') {
+    let cn = null;
+    if (typeof expr.callee === 'string') cn = expr.callee.includes('.') ? expr.callee.slice(expr.callee.lastIndexOf('.') + 1) : expr.callee;
+    else if (expr.callee && expr.callee.kind === 'member') cn = expr.callee.prop;
+    else if (expr.callee && expr.callee.kind === 'ident') cn = expr.callee.name;
+    if (cn) {
+      const raw = CALLEE_INDEX.get(cn);
+      if (raw) {
+        const hits = filterByProvenance(raw);
+        const s = hits.find(h => h.kind === 'source');
+        if (s) return s;
+      }
+    }
+  }
+  return null;
 }
 
 export function matchSinkOrSanitizer(calleeExpr) {
   if (!calleeExpr) return null;
   let calleeName = null;
-  if (calleeExpr.kind === 'ident') calleeName = calleeExpr.name;
+  // R3 (PRD §5): the Go IR (and other string-callee parsers) represent a call
+  // target as a dotted STRING ("db.Query") rather than a member expr. Match on
+  // the last segment so those languages' sinks/sanitizers are recognized too.
+  if (typeof calleeExpr === 'string') calleeName = calleeExpr.includes('.') ? calleeExpr.slice(calleeExpr.lastIndexOf('.') + 1) : calleeExpr;
+  else if (calleeExpr.kind === 'ident') calleeName = calleeExpr.name;
   else if (calleeExpr.kind === 'member') calleeName = calleeExpr.prop;
   if (!calleeName) return null;
   const raw = CALLEE_INDEX.get(calleeName);

package/src/dataflow/engine.js

@@ -39,6 +39,7 @@ import { aliasesForVar } from './points-to.js';
 import { higherOrderTaintFlow } from './higher-order.js';
 import { SummaryCache, entryStateFromCall } from './summaries.js';
 import { lookupBuiltinSummary } from './builtin-summaries.js';
+import { isImplicitFlowEnabled, buildImplicitContext, implicitAssignTarget, markImplicitTaint, createImplicitFinding } from './implicit-flow.js';
 
 // v0.70 #2 — addPath that also taints every alias of the variable.
 // When `target` is a dotted path like "a.x" and the root `a` has aliases
@@ -157,6 +158,13 @@ function exprIsSource(expr) {
     const hit = matchSource(expr);
     if (hit) return hit;
   }
+  // R3 (PRD §5): call-shaped sources (r.FormValue(), r.URL.Query(), c.Query()).
+  // Previously only member reads were recognized, so Go's call-style sources
+  // never tainted the assignment target. matchSource now resolves call sources.
+  if (expr.kind === 'call') {
+    const hit = matchSource(expr);
+    if (hit) return hit;
+  }
   if (expr.kind === 'member' && expr.object) {
     return exprIsSource(expr.object);
   }
@@ -383,6 +391,20 @@ function step(node, stateIn, callContext) {
           });
         }
       }
+      // R4 (PRD §5): array-element taint. A mutating array method (push/unshift/
+      // splice/fill/copyWithin) called with a tainted argument taints the
+      // receiver array; an index read (a[0] → access path "a.0") is then covered
+      // by the receiver prefix. Object-property taint already flows via the
+      // access-path lattice — this closes the array case.
+      if (node.callee && node.callee.kind === 'member' && typeof node.callee.prop === 'string'
+          && /^(?:push|unshift|splice|fill|copyWithin)$/.test(node.callee.prop)
+          && Array.isArray(argTaints) && argTaints.some(Boolean)) {
+        // Mutate the state Set IN PLACE (the binding is const; the call case
+        // returns this same Set ref). Avoids touching the unrelated mutated-param
+        // paths in this case, keeping the blast radius to array-element taint only.
+        const _arrRecv = accessPathOf(node.callee.object);
+        if (_arrRecv) state.add(_arrRecv);
+      }
       if (cat) {
         for (const e of cat) {
           if (e.kind === 'sink' && (
@@ -493,6 +515,11 @@ function step(node, stateIn, callContext) {
 // control flow) can otherwise hold past the global timeout.
 function analyzeFunction(fn, entryState, callContext) {
   const nodes = fn.cfg.nodes;
+  // R2 (PRD §5): set the call-string caller context to THIS function while its
+  // worklist computes callee summaries (so a callee is keyed by its caller).
+  // No-op for the key unless AGENTIC_SECURITY_KCFA_CALLSTRING=1. Restored below.
+  const _prevCallerCtx = (callContext && callContext._summaryCache && callContext._summaryCache.setCallerContext)
+    ? callContext._summaryCache.setCallerContext(fn.qid) : undefined;
   const work = [];
   const inStates = new Map();
   const outStates = new Map();
@@ -535,6 +562,47 @@ function analyzeFunction(fn, entryState, callContext) {
     }
   }
 
+  // R4 (PRD §5) — implicit / control-dependence flow. OPT-IN (default OFF, see
+  // isImplicitFlowEnabled). Post-pass over the converged CFG: a sink reached
+  // INSIDE a tainted-condition branch can leak information even when its
+  // argument is constant or only implicitly tainted (a var assigned in that
+  // branch). Findings carry implicit:true + capped confidence.
+  if (isImplicitFlowEnabled() && fn.cfg) {
+    try {
+      const union = new Set();
+      for (const s of inStates.values()) for (const p of s) union.add(p);
+      const ictx = buildImplicitContext(fn.cfg, (expr) => exprTaint(expr, union));
+      // Mark vars assigned inside a tainted branch as implicit-tainted.
+      let implicitState = new Set();
+      for (const [nid, ctx] of ictx) {
+        const t = implicitAssignTarget(nodes[nid], ctx);
+        if (t) implicitState = markImplicitTaint(implicitState, t);
+      }
+      // A sink in a tainted branch whose arg is implicit-tainted (or constant)
+      // — and NOT already explicitly tainted (the normal pass covers that).
+      for (const [nid, ctx] of ictx) {
+        const node = nodes[nid];
+        if (!node || node.kind !== 'call') continue;
+        const cat = matchSinkOrSanitizer(node.callee);
+        const sink = cat && cat.find((e) => e.kind === 'sink');
+        if (!sink) continue;
+        const inS = inStates.get(nid) || new Set();
+        if ((node.args || []).some((a) => exprTaint(a, inS))) continue;
+        const argRefsImplicit = (node.args || []).some((a) => {
+          const ap = accessPathOf(a); return ap && isCoveredBy(implicitState, `implicit:${ap}`);
+        });
+        const allConst = (node.args || []).length > 0 && (node.args || []).every((a) => a && a.kind === 'literal');
+        if (argRefsImplicit || allConst) {
+          callContext._findings.push({
+            ...createImplicitFinding(node, ctx.conditionLabel),
+            _funcQid: fn.qid, sinkId: sink.id,
+            cwe: (sink.vuln && sink.vuln.cwe) || 'CWE-200',
+          });
+        }
+      }
+    } catch { /* implicit flow is best-effort + opt-in */ }
+  }
+
   const exit = outStates.get(fn.cfg.exit) || new Set();
   // v0.66 — record which params are tainted at function exit so the
   // caller's applyAtCallSite can propagate that mutated taint back. We
@@ -546,6 +614,10 @@ function analyzeFunction(fn, entryState, callContext) {
       if (isCoveredBy(exit, p)) callContext._mutatedParamsOut.add(p);
     }
   }
+  // R2: restore the caller context for the enclosing function's analysis.
+  if (_prevCallerCtx !== undefined && callContext && callContext._summaryCache && callContext._summaryCache.setCallerContext) {
+    callContext._summaryCache.setCallerContext(_prevCallerCtx);
+  }
   return exit;
 }
 
@@ -749,7 +821,10 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
         cwe: f.cwe,
         remediation: f.remediation,
         parser: 'IR-TAINT',
-        confidence: 0.75,
+        // R4 implicit-flow: preserve the implicit flag + its capped confidence
+        // (a control-dependence finding, not an explicit data-flow one).
+        confidence: (f.implicit && typeof f.confidence === 'number') ? f.confidence : 0.75,
+        ...(f.implicit === true ? { implicit: true } : {}),
         source: f.trace && f.trace.length ? {
           file: fn.file,
           line: f.trace[0].line,

package/src/dataflow/implicit-flow.js

@@ -34,8 +34,10 @@
 import { addPath } from './access-paths.js';
 
 export function isImplicitFlowEnabled() {
-  if (process.env.AGENTIC_SECURITY_IMPLICIT_FLOW === '0') return false;
-  return true;
+  // OPT-IN (default OFF): implicit/control-dependence flow is famously noisy, so
+  // it must be explicitly requested. Findings carry implicit:true + capped
+  // confidence so the standard pipeline ranks them below explicit flows.
+  return process.env.AGENTIC_SECURITY_IMPLICIT_FLOW === '1';
 }
 
 /**

package/src/dataflow/index.js

@@ -48,12 +48,17 @@ export function runDeepAnalysis(perFileIR, callGraph, opts = {}) {
       scanner: opts.scannerVersion || 'unknown',
       rules: opts.rulesDigest || `catalog:${_catalogSize()}`,
     };
+    // Compute current file hashes UNCONDITIONALLY — the first scan (and any
+    // scan after a version/rule invalidation) must persist a baseline so the
+    // NEXT scan has something to reuse. This previously lived inside the
+    // valid-state branch, so a cold cache never committed and incremental was
+    // a permanent no-op (the commit guard at the bottom keys on currentFileHashes).
+    currentFileHashes = {};
+    for (const [fp, content] of Object.entries(opts.fileContents)) {
+      currentFileHashes[fp] = hashFileContent(content);
+    }
     const valid = validateIncrementalState(priorState, currentVersion);
     if (valid.valid) {
-      currentFileHashes = {};
-      for (const [fp, content] of Object.entries(opts.fileContents)) {
-        currentFileHashes[fp] = hashFileContent(content);
-      }
       const diff = diffFileHashes(priorState.files || {}, currentFileHashes);
       const changedQids = new Set();
       // Map a changed file to the qids it owns. perFileIR exposes file→fns.

package/src/dataflow/proof-gate.js

@@ -76,6 +76,11 @@ export function annotateProofGate(findings, opts = {}) {
 
     // proven-clean | proven-infeasible → recall-preserving demotion.
     if (verdict === 'proven-clean') stats.provenClean++; else stats.provenInfeasible++;
+    // R13 (PRD §5): make "provably safe" a first-class, queryable verdict — not
+    // just a quiet confidence demotion. "We proved this can't fire" is a
+    // stronger, rarer claim than any confidence score, and lets the report
+    // optionally hide discharged findings (--hide-proven-safe).
+    f.provablySafe = true;
 
     if (typeof f.confidence === 'number') {
       f._confidenceBeforeProofGate = f.confidence;

package/src/dataflow/summaries.js

@@ -64,12 +64,30 @@ export class SummaryCache {
     const envCap = Number(process.env.AGENTIC_SECURITY_KCFA_MAX_CONTEXTS);
     this._maxContextsPerFn = Number.isFinite(envCap) && envCap >= 0 ? envCap : 16;
     this._contextCapHits = 0;
+    // R2 (PRD §5): bounded k=1 call-string sensitivity. OPT-IN (default OFF).
+    // When on, the cache key is extended with the immediate caller's qid, so two
+    // call paths reaching a helper with the SAME tainted-arg shape get DISTINCT
+    // summaries instead of sharing one (removes the over-merge that the pure
+    // value-context cache produces). Off by default → keys are byte-identical to
+    // before, so no behavior change for the shipped engine.
+    this._callString = process.env.AGENTIC_SECURITY_KCFA_CALLSTRING === '1';
+    this._callerCtx = null;
+  }
+
+  // Set the immediate-caller qid for call-string keying; returns the previous
+  // value so the engine can save/restore it around nested callee analysis.
+  setCallerContext(callerQid) {
+    const prev = this._callerCtx;
+    this._callerCtx = callerQid || null;
+    return prev;
   }
 
   _key(qid, taintedParams, receiverType) {
     // P1.2: when a receiver type is provided, extend the cache key with
     // its hash. Backward-compatible: no receiverType → same key as before.
-    const base = `${qid}::${_hashState(taintedParams)}`;
+    let base = `${qid}::${_hashState(taintedParams)}`;
+    // R2: append the caller qid when call-string sensitivity is enabled.
+    if (this._callString && this._callerCtx) base = `${base}@${this._callerCtx}`;
     if (!receiverType) return base;
     return `${base}::${hashReceiverType(receiverType)}`;
   }

package/src/engine.js

@@ -35,6 +35,10 @@ import { scanMobileManifest } from './sast/mobile-manifest.js';
 import { scanQuarkusHardening } from './sast/quarkus-hardening.js';
 import { scanFastapiHardening } from './sast/fastapi-hardening.js';
 import { scanAuthZ } from './sast/authz.js';
+import { scanApiBrokenAuthz } from './sast/api-authz.js';
+import { scanTerraform } from './sast/iac-terraform.js';
+import { scanCrossService } from './sast/cross-service.js';
+import { scanRbacConsistency } from './sast/rbac-consistency.js';
 import { scanModelLoad } from './sast/model-load.js';
 import { scanPromptTemplate } from './sast/prompt-template.js';
 import { scanXXE } from './sast/xxe.js';
@@ -81,7 +85,7 @@ import { scanLDAPInjection } from './sast/ldap-injection.js';
 import { scanXPathInjection } from './sast/xpath-injection.js';
 import { scanSSTI } from './sast/ssti.js';
 import { scanOpenRedirect } from './sast/open-redirect.js';
-import { scanWrongContextSanitizer } from './sast/wrong-context-sanitizer.js';
+import { scanWrongContextSanitizer, scanSanitizerContextMismatch } from './sast/wrong-context-sanitizer.js';
 import { scanFrontendHygiene } from './sast/frontend-hygiene.js';
 import { scanCsvInjection } from './sast/csv-injection.js';
 import { scanStoredTaint } from './sast/stored-taint.js';
@@ -99,6 +103,9 @@ import { scanResponseSplitting } from './sast/response-splitting.js';
 import { scanStoredPromptInjection, scanStoredPromptInjectionCrossFile } from './sast/llm-stored-prompt.js';
 import { scanRAGPoisoning } from './sast/rag-poisoning.js';
 import { scanAgentToolEscalation } from './sast/agent-tool-escalation.js';
+import { scanAgentUntrustedFlow } from './sast/agent-untrusted-flow.js';
+import { scanInstallScripts } from './sca/install-script-analysis.js';
+import { scanEventEntrypoints } from './sast/event-entrypoint.js';
 import { scanDbTaint, scanDbTaintCrossFile } from './sast/db-taint.js';
 import { scanSSRFCloudMetadata } from './sast/ssrf-cloud-metadata.js';
 import { scanMutationXSS } from './sast/mutation-xss.js';
@@ -143,6 +150,8 @@ import { annotateFeatureFlagGating } from './posture/feature-flags.js';
 import { annotatePersonaScores } from './posture/persona-prioritization.js';
 import { annotateMitigationComposite } from './posture/mitigation-composite.js';
 import { annotateCompositeRisk } from './posture/composite-risk.js';
+import { annotateScaVerdicts } from './posture/sca-verdict.js';
+import { annotateFindingProvenance } from './posture/provenance.js';
 
 // ── Integration block: world-class scaffolded modules ──────────────────────
 // Each module is opt-in via its own env var so partial adoption is safe.
@@ -6691,6 +6700,42 @@ function _parseMavenDependencyTree(text, filePath){
   return out;
 }
 
+// R10 (PRD §5): Gradle transitive graph. `gradle dependencies` (or
+// `gradle :app:dependencies`) prints the FULL resolved tree; build.gradle alone
+// only declares direct deps. Canonical committed path: `gradle-dependencies.txt`.
+// Format (tree-drawing prefixes we strip), version may be conflict-resolved:
+//   +--- group:artifact:1.0
+//   |    \--- group:artifact:1.0 -> 1.2   (resolved to 1.2)
+// Config headers ("compileClasspath - …"), project deps, and (*)/(c) markers skipped.
+function _parseGradleDependencies(text, filePath) {
+  const out = [];
+  const seen = new Set();
+  for (const rawLine of String(text).split('\n')) {
+    if (!rawLine.trim()) continue;
+    const indent = rawLine.length - rawLine.replace(/^[\s|+\\-]+/, '').length;
+    const stripped = rawLine.replace(/^[\s|+\\-]+/, '').trim();
+    if (!stripped || stripped.startsWith('project ') || /\bproject\s+[':]/.test(stripped)) continue;
+    // group:artifact:version, with optional `-> resolved` and trailing (*)/(c)/(n).
+    const m = stripped.match(/^([A-Za-z0-9._-]+):([A-Za-z0-9._-]+):([^\s(]+?)(?:\s*->\s*([^\s(]+))?\s*(?:\([*cn]\))?\s*$/);
+    if (!m) continue;
+    const group = m[1], artifact = m[2];
+    let ver = (m[4] || m[3] || '').replace(/[{}]/g, '');
+    ver = ver.replace(/^(?:strictly|require|prefer)\s+/, '');
+    if (!group || !artifact || !ver) continue;
+    const key = `${group}:${artifact}:${ver}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({
+      name: `${group}:${artifact}`, version: ver, group, scope: 'required',
+      purl: _makePurl('maven', artifact, ver, group), ecosystem: 'maven', filePath,
+      isUnpinned: false,
+      isTransitive: indent > 6,
+      pomSource: 'gradle-dependencies',
+    });
+  }
+  return out;
+}
+
 function _parseBuildGradle(text,filePath){
   const out=[];
   const pat=/(?:implementation|api|compile|runtimeOnly|testImplementation|testCompile|compileOnly|classpath)\s*(?:\(|['"])\s*['"]?([a-zA-Z0-9._\-]+):([a-zA-Z0-9._\-]+):([^'")\s,]+)/g;
@@ -6969,6 +7014,8 @@ function parseManifests(allFileContents){
     // `target/dependency-tree.txt` (per `mvn dependency:tree -DoutputFile=...`)
     // but users sometimes commit it as `dependency-tree.txt` at repo root.
     'dependency-tree.txt':_parseMavenDependencyTree,
+    // R10: Gradle resolved transitive graph — `gradle dependencies > gradle-dependencies.txt`.
+    'gradle-dependencies.txt':_parseGradleDependencies,
   };
   const out=[],seen=new Set();
   for(const[fp,content]of Object.entries(allFileContents)){
@@ -7346,12 +7393,13 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   const _perFileTimeoutMs = parseInt(process.env.AGENTIC_SECURITY_PER_FILE_TIMEOUT_MS || '10000', 10);
   const _fileTimings = [];
   let _filesSkipped = 0, _filesTimedOut = 0, _filesDenseSkipped = 0;
-  const files=Object.keys(fileContents).filter(f=>shouldScan(f) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];let i=0;for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}fc[p]=c;aR.push(...scanRoutes(p,c));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,c));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,c));aF.push(...scanExtraStructural(p,c));aF.push(...scanAliasedSinks(p,c));aF.push(...scanJavaSAST(p,c));aF.push(...scanJavaBenchExtras(p,c));aLogic.push(...scanMiddlewareOrdering(p,c));aLogic.push(...scanReDoS(p,c));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,c));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,c);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,c));aF.push(...scanIaC(p,c));
+  const files=Object.keys(fileContents).filter(f=>shouldScan(f) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];let i=0;for(const p of files){i++;const _ft0=Date.now();setProgress({current:i,total:files.length,file:p.split("/").pop(),phase:"Scanning"});try{const c=fileContents[p];if(!c||c.length>500000){_filesSkipped++;continue;}const _avgLine=c.length/Math.max(c.split('\n').length,1);if(_avgLine>400&&c.length>10000){_filesDenseSkipped++;continue;}fc[p]=c;aR.push(...scanRoutes(p,c));const ta=performAnalysis(p,c);pfr[p]=ta;aF.push(...ta.findings);aSrc.push(...ta.sources);aSink.push(...ta.sinks);aSan.push(...ta.sanitizers);aLogic.push(...scanLogicVulns(p,c));aSecrets.push(...scanCredentials(p,c));aF.push(...scanStructuralVulns(p,c));aF.push(...scanExtraStructural(p,c));aF.push(...scanAliasedSinks(p,c));aF.push(...scanJavaSAST(p,c));aF.push(...scanJavaBenchExtras(p,c));aLogic.push(...scanMiddlewareOrdering(p,c));aLogic.push(...scanReDoS(p,c));if(/\.(?:java|cs|kt|py|php|phtml)$/i.test(p)){try{aLogic.push(...scanRegexReDoS(p,c));}catch(_){}}aLogic.push(...scanTodosNearSecurity(p,c));aSecrets.push(...scanEntropySecrets(p,c));const cp=scanCiphers(p,c);aCiphersRest.push(...cp.atRest);aCiphersTransit.push(...cp.inTransit);if(/\.(graphql|gql)$/i.test(p))aF.push(...scanGraphQL(p,c));aF.push(...scanIaC(p,c));aF.push(...scanTerraform(p,c));
       aF.push(...scanLLM(p,c));
       aF.push(...scanLLMOwasp(p,c));
       aLogic.push(...scanBusinessLogic(p,c));
       aF.push(...scanPipeline(p,c));
       aF.push(...scanContainer(p,c));
+      aF.push(...scanInstallScripts(p,c));
       aF.push(...scanMCP(p,c));
       aF.push(...scanClaudeSettings(p,c));
       aF.push(...scanClaudeMdPromptInjection(p,c));
@@ -7409,6 +7457,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
       aF.push(...scanSSTI(p,c));
       aF.push(...scanOpenRedirect(p,c));
       aF.push(...scanWrongContextSanitizer(p,c));
+      aF.push(...scanSanitizerContextMismatch(p,c));
       aF.push(...scanFrontendHygiene(p,c));
       aF.push(...scanCsvInjection(p,c));
       aF.push(...scanStoredTaint(p,c));
@@ -7424,6 +7473,8 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
       aF.push(...scanStoredPromptInjection(p,c));
       aF.push(...scanRAGPoisoning(p,c));
       aF.push(...scanAgentToolEscalation(p,c));
+      aF.push(...scanAgentUntrustedFlow(p,c));
+      aF.push(...scanEventEntrypoints(p,c));
       aF.push(...scanDbTaint(p,c));
       aF.push(...scanSSRFCloudMetadata(p,c));
       aF.push(...scanMutationXSS(p,c));
@@ -7585,6 +7636,12 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   setProgress({current:i,total:files.length,file:"Stored taint...",phase:"Linking"});const storedRegistry=buildStoredTaintRegistry(fc);const stf=crossStoredTaint(fc,storedRegistry);aF.push(...stf);
   setProgress({current:i,total:files.length,file:"Session taint...",phase:"Linking"});const sess=crossSessionTaint(fc);aF.push(...sess);
   setProgress({current:i,total:files.length,file:"Call graph...",phase:"Linking"});const callGraph=buildCallGraph(fc);
+  // R19 (PRD §5): cross-route BOLA/BFLA over the aggregated route inventory.
+  try{aF.push(...scanApiBrokenAuthz(aR));}catch(_){}
+  // R22 (PRD §5): cross-service edges inferred from code (client call → matched route).
+  try{aF.push(...scanCrossService(aR,fc));}catch(_){}
+  // R21 (PRD §5): RBAC role-tier consistency over the route inventory.
+  try{aF.push(...scanRbacConsistency(aR,fc));}catch(_){}
   setProgress({current:i,total:files.length,file:"Reachability + guards...",phase:"Linking"});annotateReachability(aF,aR,callGraph,fc);aF.forEach(f=>detectGuardsForFinding(f,fc));
   setProgress({current:i,total:files.length,file:"Inferring sanitizers...",phase:"Linking"});const learned=inferSanitizers(fc);applyLearnedSanitizers(aF,learned,fc);
   setProgress({current:i,total:files.length,file:"Sanitizer effectiveness...",phase:"Linking"});applySanitizerEffectiveness(aF);
@@ -7593,6 +7650,9 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   setProgress({current:i,total:files.length,file:"OSV vulnerability database...",phase:"SCA"});
   const allFileContents={...fc, ...depFileContents};
   const components=parseManifests(allFileContents);
+  // R8 (PRD §5): OS packages from an extracted container image's package DBs
+  // (dpkg/apk) — baked-in deps the Dockerfile never names. Feed the OSV/SBOM pipeline.
+  try{const{extractImagePackages}=await import('./sca/image-packages.js');for(const ip of extractImagePackages(allFileContents)){if(!components.some(c=>c.ecosystem===ip.ecosystem&&c.name===ip.name&&c.version===ip.version))components.push(ip);}}catch(_){}
   try{const{detectVendoredLibraries}=await import('./sca/vendor-detect.js');const vendored=detectVendoredLibraries(fc);for(const v of vendored){const key=`${v.ecosystem}:${v.name}:${v.version}`;if(!components.some(c=>`${c.ecosystem}:${c.name}:${c.version}`===key))components.push({...v,group:'',purl:`pkg:${v.ecosystem}/${v.name}@${v.version}`,filePath:v.file,isUnpinned:false,reachable:true});}}catch(_){}
   const reach=buildReachabilitySet(fc);
   const reachabilitySet=reach.imported;
@@ -7607,6 +7667,14 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   // 0.10.0: enrich SCA findings with CISA KEV (CISA KEV catalog)
   try{supplyChain=await _enrichWithKEV(supplyChain);}catch(_){}
   try{markUsedVulnFunctions(supplyChain,fc);}catch(_){}
+  // R7 (PRD §5): import-aware call-site augmentation for npm/pypi deps. The regex
+  // pass above misses aliased / namespace imports (import {merge as deepMerge};
+  // deepMerge()) and over-matches bare names in files that don't import the
+  // package. This parses each JS/TS + Python file's imports, resolves vuln-fn
+  // calls THROUGH the alias map, and gates them to files that actually import the
+  // package — then ADDS the recovered sites so the route-reachability classifier
+  // below (which decides reachable/unreachable/unknown) sees them. Additive only.
+  try{const{augmentReachabilityViaImports}=await import('./sca/import-reachability.js');augmentReachabilityViaImports(supplyChain,fc,VULN_FUNCTION_HINTS);}catch(_){}
   // Python AST-based function validation (deep mode only)
   if(process.env.AGENTIC_SECURITY_DEEP==='1'){try{const{validateOsvFunctionsExist}=await import('./sca/py-package-functions.js');for(const sc of supplyChain){if(sc.type!=='vulnerable_dep'||sc.ecosystem!=='pypi')continue;if(!sc.osvVulnFunctions||!sc.osvVulnFunctions.length)continue;const{validated,missing}=validateOsvFunctionsExist(sc.name,sc.osvVulnFunctions,scanRoot);if(validated.length)sc._pyAstValidated=validated;if(missing.length)sc._pyAstMissing=missing;}}catch(_){}}
   // LLM-assisted function extraction for CVEs without hints (opt-in: AGENTIC_SECURITY_LLM_SCA=1)
@@ -8050,10 +8118,14 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   try { await annotateNarration(finalFindings); }
   catch (e) { _annotatorErrors.push({ phase: 'annotateNarration', err: String((e && e.message) || e) }); }
   // Phase 3 (Sentinel-parity FR-L1, FR-L2) — IR + interprocedural taint.
-  // Opt-in via AGENTIC_SECURITY_DEEP=1 because it's currently breadth-first,
-  // not benchmark-tuned. Findings ride through the standard dedup/cluster/
-  // confidence pipeline below; the LLM-validator stage above already ran but
-  // any deep-mode finding emitted here will be unvalidated.
+  // R1 (PRD §5): the CLI entry (bin/agentic-security.js#cmdScan) now sets
+  // AGENTIC_SECURITY_DEEP=1 by default for local/interactive scans, so deep mode
+  // runs on the default `/scan --all` path. This gate is the enforcement +
+  // CI-safety point: it honors an explicit opt-out (DEEP=0) and keeps deep off in
+  // CI unless DEEP_IN_CI=1. In-process callers (tests, the cve-replay corpus) invoke
+  // runScan()/runFullScan() directly without the CLI default, so they stay deep-off
+  // and remain deterministic regression gates. Findings ride through the standard
+  // dedup/cluster/confidence pipeline below and the LLM-validator stage that follows.
   //
   // SAFETY: Deep mode is gated for CI safety:
   //   - Global timeout via AGENTIC_SECURITY_DEEP_TIMEOUT_MS (default 300_000 = 5 min)
@@ -8195,13 +8267,29 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null},
   // apply accept-risk / SLA / major-version-freeze rules. supplyChain
   // findings get suppressed/tagged in place.
   try { const sp = loadScaPolicy(scanRoot); if (sp && !sp._error) applyScaPolicy(supplyChain, sp); } catch (_) {}
+  // R12 (PRD §5): deterministic decision-first verdict per dep, derived from the
+  // signals enriched above (composite risk × KEV × EPSS × reachability × policy).
+  // testsDetected is read from the UNFILTERED fileContents because shouldScan()
+  // strips test files out of `fc`.
+  try {
+    const _testsDetected = Object.keys(fileContents).some(f =>
+      /(?:^|\/)(?:tests?|spec|__tests__)\//i.test(f) ||
+      /\.(?:test|spec)\.[cm]?[jt]sx?$/i.test(f) ||
+      /(?:^|\/)test_[^/]*\.py$/i.test(f) || /_test\.(?:py|go)$/i.test(f));
+    annotateScaVerdicts(supplyChain, { testsDetected: _testsDetected });
+  } catch (_) {}
   // 0.9.0 Feat-15: dep confusion
   try{const dc=detectDepConfusion(annotatedComponents,scanRoot);aF.push(...dc);}catch(_){}
   // Deployment-platform security checklist
   try{const dpf=scanDeployPlatform(scanRoot);aLogic.push(...dpf);}catch(_){}
   // Stack-specific security playbook
   try{const sp=runStackPlaybook(scanRoot);if(sp&&sp.findings)aLogic.push(...sp.findings);}catch(_){}
-  finalFindings.sort((a,b)=>(b.toxicityScore||0)-(a.toxicityScore||0)||(b.triageScore||0)-(a.triageScore||0)||({critical:0,high:1,medium:2,low:3}[a.severity]??4)-({critical:0,high:1,medium:2,low:3}[b.severity]??4));
+  // R17 (PRD §5): annotate per-finding corroboration ("one issue, many signals")
+  // after evidence + validator verdicts are populated, then use it as a final
+  // tiebreaker so multi-signal findings rank above single-signal ones at equal
+  // severity. Does not alter calibrated confidence.
+  try { annotateFindingProvenance(finalFindings); } catch (_) {}
+  finalFindings.sort((a,b)=>(b.toxicityScore||0)-(a.toxicityScore||0)||(b.triageScore||0)-(a.triageScore||0)||({critical:0,high:1,medium:2,low:3}[a.severity]??4)-({critical:0,high:1,medium:2,low:3}[b.severity]??4)||((b.corroborationCount||1)-(a.corroborationCount||1)));
   // Auto-PoC filter: tag whether a concrete payload+test can be derived. When
   // AGENTIC_SECURITY_POC=1, demote ≥medium findings that fail this check.
   // Used as a precision lever for users who want to ship clean reports —

package/src/ir/parser-go.js

@@ -79,6 +79,14 @@ function _lowerExpr(text) {
     const parts = _splitTopLevelCommas(inner).map(_lowerExpr);
     return { kind: 'tpl', parts };
   }
+  // R3 (PRD §5): string concat with `+` MUST be checked before the bare-literal
+  // rule below — otherwise `"SELECT " + q` (starts with `"`) is captured whole as
+  // a single literal and taint cannot flow through the concatenation. Only fires
+  // when there's a top-level `+` (a pure literal still falls through to literal).
+  if (/["'`]/.test(s) && s.includes('+')) {
+    const plusParts = _splitTopLevelPlus(s);
+    if (plusParts.length > 1) return { kind: 'tpl', parts: plusParts.map(_lowerExpr) };
+  }
   if (/^"/.test(s) || /^`/.test(s)) return { kind: 'literal', value: s };
   if (/^\d/.test(s)) return { kind: 'literal', value: s };
   if (/^(true|false|nil)\b/.test(s)) return { kind: 'literal', value: s };

package/src/mcp/tools.js

@@ -16,7 +16,7 @@ import * as fs from 'node:fs';
 import * as fsp from 'node:fs/promises';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
-import { applyFix as applyFixHistory } from '../posture/fix-history.js';
+import { applyFix as applyFixHistory, fixAcceptanceRate } from '../posture/fix-history.js';
 import { verifyLastScan } from '../posture/integrity.js';
 import { redactString, redactFinding } from './redact.js';
 
@@ -578,7 +578,11 @@ export const apply_fix = {
       }
       throw e;
     }
-    return { _meta: META, applied: true, historyId: entry.id, file: f.file, backupPath: entry.backupPath, integrity: status, attemptOrdinal: entry.attemptOrdinal };
+    // R25 (PRD §5): surface the running auto-fix acceptance rate after each
+    // applied fix, so the closed loop reports its own success metric.
+    let acceptance = null;
+    try { acceptance = fixAcceptanceRate(ctx.sessionRoot); } catch { /* metric is best-effort */ }
+    return { _meta: META, applied: true, historyId: entry.id, file: f.file, backupPath: entry.backupPath, integrity: status, attemptOrdinal: entry.attemptOrdinal, acceptance };
   },
 };