@clear-capabilities/agentic-security-scanner 0.136.2 → 0.137.0

package/src/engine.js

@@ -121,7 +121,7 @@ import { scanRuby } from './sast/ruby.js';
 import { scanPhp } from './sast/php.js';
 import { classifySecretCandidate as _entropyClassifySecret } from './sast/_secret-entropy.js';
 // Phase 1 — precision-engineering posture modules.
-import { annotateConfidence } from './posture/confidence.js';
+import { annotateConfidence, applyUnvalidatedPenalty } from './posture/confidence.js';
 import { backfillFindingDefaults } from './posture/finding-defaults.js';
 import { annotatePocs } from './posture/poc-generator.js';
 import { annotateExecutionProofs } from './posture/prove-findings.js';
@@ -148,7 +148,7 @@ import { ingestLogicClaims } from './posture/logic-claims.js';
 import { annotateNarration } from './posture/flow-narration.js';
 import { applyPathConstraints } from './posture/path-predicates.js';
 // Phase 3 (Sentinel-parity Layer 1 + 2) — IR + interprocedural taint engine.
-import { buildProjectIR } from './ir/index.js';
+import { buildProjectIR, buildProjectIRAsync } from './ir/index.js';
 import { collectIrStats, irStatsTarget, writeIrStats } from './ir/ir-stats.js';
 import { runDeepAnalysis } from './dataflow/index.js';
 // v3 next-gen — Pillars 1, 4, 5, 6, 8, 9.
@@ -1271,13 +1271,75 @@ function _guardWindow(ctx, before = 25, after = 5) {
     .replace(/(^|[^\w'"`])#[^\n]*/g, '$1 ');
 }
 
-function _hasSsrfHostGuard(ctx) { return _SSRF_HOST_GUARD_RE.test(_guardWindow(ctx)); }
+// PRD R15: a guard-shaped token anywhere in the -25/+5 window used to be
+// sufficient — an allow-list built for an unrelated purpose, or even the
+// tainted variable's OWN declaration line, sitting in the same screenful of
+// code as a genuinely-unguarded sink, silently killed a real finding. This
+// does not require full dataflow correlation, only a cheap positional one:
+// the sink's own argument identifier(s) must appear WITHIN A FEW LINES of
+// the specific line the guard-shaped text actually matched on — not merely
+// somewhere in the whole window, which is true of almost any variable used
+// nearby (its own declaration, an unrelated helper, the sink line itself).
+// Falls back to permissive (unable to correlate → don't break existing
+// recall protection) when the sink line yields no usable identifier.
+const _GUARD_STOPWORDS = new Set(['var', 'let', 'const', 'function', 'return', 'new', 'await', 'async',
+  'if', 'else', 'for', 'while', 'require', 'import', 'from', 'true', 'false', 'null', 'undefined',
+  'this', 'self', 'req', 'res', 'request', 'response']);
+function _sinkLineIdentifiers(ctx) {
+  const line = (ctx && Array.isArray(ctx.lines) && ctx.lines[(ctx.line || 1) - 1]) || '';
+  const ids = new Set();
+  // Excludes call-target identifiers (name immediately followed by `(`) —
+  // `fetch(target)` must correlate on the ARGUMENT `target`, not on `fetch`
+  // itself, which incidentally appears anywhere the module imports fetch
+  // (e.g. `const fetch = require('node-fetch')`) and would trivially
+  // "correlate" with any guard window in the same file.
+  const re = /\b[A-Za-z_$][\w$]*\b(?!\s*\()/g;
+  let m;
+  while ((m = re.exec(line))) {
+    const id = m[0];
+    // No minimum length: short variable names (`u`, `p`, `f`) are common,
+    // legitimate taint carriers in real code — excluding them left the
+    // ONLY correlating identifier out entirely for sinks like
+    // `File.ReadAllText(p)` or `axios.get(u.toString())`, defeating
+    // correlation with a guard that genuinely protects that exact
+    // variable (a corpus regression caught this: CVE-2021-22054-ssrf-shape,
+    // CVE-2022-26049-cs-path).
+    if (id.length >= 1 && !_GUARD_STOPWORDS.has(id)) ids.add(id);
+  }
+  return ids;
+}
+// Runs guardRe against the window and, for each match, checks whether any
+// sink-line identifier appears within `span` lines of that match's own line
+// (excluding the sink line itself, which trivially contains its own
+// argument). Tries every match, not just the first, since a window can
+// contain several guard-shaped lines and only one need actually correlate.
+function _guardMatchNearSinkIdentifier(ctx, guardRe, span = 2) {
+  const w = _guardWindow(ctx);
+  const re = new RegExp(guardRe.source, guardRe.flags.includes('g') ? guardRe.flags : guardRe.flags + 'g');
+  const ids = _sinkLineIdentifiers(ctx);
+  if (!ids.size) return re.test(w); // can't correlate — fall back to the old shape-only check
+  const wLines = w.split('\n');
+  const sinkLineText = (ctx.lines && ctx.lines[(ctx.line || 1) - 1]) || '';
+  let m;
+  while ((m = re.exec(w))) {
+    const guardLineIdx = w.slice(0, m.index).split('\n').length - 1; // 0-based within window
+    const lo = Math.max(0, guardLineIdx - span);
+    const hi = Math.min(wLines.length, guardLineIdx + span + 1);
+    const local = wLines.slice(lo, hi).filter((l) => l !== sinkLineText).join('\n');
+    for (const id of ids) {
+      if (new RegExp(`\\b${id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`).test(local)) return true;
+    }
+  }
+  return false;
+}
+
+function _hasSsrfHostGuard(ctx) { return _guardMatchNearSinkIdentifier(ctx, _SSRF_HOST_GUARD_RE); }
 
 // A path-traversal containment guard near the file sink: a basename/strip
 // helper that removes directory components, a framework safe-join, or a
 // canonicalize-then-startsWith containment check.
 const _PATH_GUARD_RE = /\b(?:basename|GetFileName|secure_filename|sanitize_filename|send_from_directory|safe_join)\s*\(|\b(?:startsWith|startswith|StartsWith|HasPrefix)\s*\(|\bgetCanonicalPath\b|\btoRealPath\b|\bfilepath\s*\.\s*(?:Clean|Base|Abs)\b/;
-function _hasPathGuard(ctx) { return _PATH_GUARD_RE.test(_guardWindow(ctx)); }
+function _hasPathGuard(ctx) { return _guardMatchNearSinkIdentifier(ctx, _PATH_GUARD_RE); }
 
 // Reflected-XSS output-encoding guard: an HTML escaper applied near the sink.
 const _XSS_ESCAPER = String.raw`(?:escapeHtml|escape_html|escape-html|sanitizeHtml|sanitize_html|DOMPurify\.sanitize|he\.encode|he\.escape|_\.escape|validator\.escape|bleach\.clean|markupsafe|htmlspecialchars|htmlentities|html\.escape|escapeHTML|encodeURIComponent|escape)\s*\(`;
@@ -2214,7 +2276,13 @@ const IAC_PATTERNS = [
   { match: /\$\{\{\s*github\.event\.(?:issue|pull_request)\.title|\$\{\{\s*github\.event\.comment\.body/i,
     fileTypes: /\.github\/workflows\/.*\.ya?ml$/i,
     severity: 'high', cwe: 'CWE-78', vuln: 'GitHub Actions: untrusted github.event input interpolated into shell',
-    fix: 'Pass user-controlled fields via env vars and reference them as $VARNAME in the script body, not via ${{ }} interpolation.' },
+    fix: 'Pass user-controlled fields via env vars and reference them as $VARNAME in the script body, not via ${{ }} interpolation.',
+    // Same false-positive as src/sast/pipeline.js's overlapping rule: a pure
+    // `KEY: ${{ github.event.… }}` mapping line assigns to an env var at the
+    // workflow-engine level (the fix's own recommended pattern), not into a
+    // shell command string — only a match embedded in a larger line (a run:
+    // script body) is actually dangerous.
+    lineSafeRe: /^[\w.-]+\s*:\s*\$\{\{[^}]*\}\}\s*$/ },
 ];
 
 function scanIaC(fp, raw){
@@ -2227,6 +2295,7 @@ function scanIaC(fp, raw){
     let m;
     while ((m = re.exec(raw))) {
       const line = raw.substring(0, m.index).split('\n').length;
+      if (p.lineSafeRe && p.lineSafeRe.test((lines[line - 1] || '').trim())) continue;
       findings.push({
         id: `iac:${fp}:${line}:${p.vuln.replace(/\s/g, '_').slice(0, 60)}`,
         kind: 'iac', severity: p.severity, vuln: p.vuln,
@@ -2747,10 +2816,24 @@ function scanLogicVulns(fp,raw){
     while((m=re.exec(haystack))){
       const line=lineAt(haystack,m.index);
       const snippet=lines[line-1]?.trim()||"";
+      let outSnippet=snippet;
       // FP-2: credential FP filter
       if(pat.vuln==='Hardcoded Secret'||pat.vuln==='Hardcoded Credential Check'){
         const fpCheck=_isFalsePositiveCredential(fp,snippet,m[0]);
         if(fpCheck.skip){_suppressionLog.push({vuln:pat.vuln,file:fp,line,snippet,reason:fpCheck.reason});continue;}
+        // Stage 4 correctness audit (coverage breadth, secrets): same
+        // unredacted-snippet leak found in engine.js's scanEntropySecrets/
+        // scanCredentials and sast/secret-concat.js — this is a THIRD,
+        // separate detector (LOGIC_PATTERNS' own "Hardcoded Secret" rule)
+        // that also stored the raw source line, with no masking at all.
+        // The regex captures the quoted value inside `m[0]`; mask just
+        // that value within the reported snippet.
+        const valMatch=m[0].match(/['"]([^'"]{3,})['"]/);
+        if(valMatch){
+          const val=valMatch[1];
+          const masked=val.length>8?val.substring(0,4)+"…"+val.substring(val.length-4):"••••";
+          outSnippet=snippet.split(val).join(masked);
+        }
       }
       // FP-6: operational-context gate for selected logic patterns
       if (predicate) {
@@ -2760,7 +2843,7 @@ function scanLogicVulns(fp,raw){
           continue;
         }
       }
-      results.push({vuln:pat.vuln,severity:pat.severity,cwe:pat.cwe,stride:pat.stride,kind:pat.kind,fix:pat.fix,code:pat.code,file:fp,line,snippet});
+      results.push({vuln:pat.vuln,severity:pat.severity,cwe:pat.cwe,stride:pat.stride,kind:pat.kind,fix:pat.fix,code:pat.code,file:fp,line,snippet:outSnippet});
     }
   }
   const routeRe=/(?:app|router)\s*\.\s*(?:get|post|all)\s*\(\s*['"`](\/(?:debug|admin|test|internal|__)[^'"`]*)/gi;let rm;
@@ -2987,15 +3070,17 @@ const JAVA_FAMILY_RULES = [
         return !isWeak(resolved);  // strong → suppress; weak → fire
       }
       // 2) OWASP Benchmark fallback — hardcoded answer-key for OWASP's own
-      //    benchmark.properties file. Pure label leakage; disabled under
-      //    blind bench so the F1 reflects the production engine alone.
-      const _blindHere = process.env.AGENTIC_SECURITY_BLIND_BENCH === '1';
-      const OWASP_BENCH_PROPS = _blindHere ? {} : {
+      //    benchmark.properties file. Pure label leakage. PRD R5: was
+      //    opt-out (disabled only under BLIND_BENCH=1) — inverted to opt-in,
+      //    enabled only under explicit BENCH_SHAPE=1, matching the
+      //    documented default every other bench-shape mechanism follows.
+      const _benchShapeHere = process.env.AGENTIC_SECURITY_BENCH_SHAPE === '1' && process.env.AGENTIC_SECURITY_BLIND_BENCH !== '1';
+      const OWASP_BENCH_PROPS = _benchShapeHere ? {
         cryptoAlg1: 'DES/ECB/PKCS5Padding',
         cryptoAlg2: 'AES/CCM/NoPadding',
         hashAlg1: 'MD5',
         hashAlg2: 'SHA-256',
-      };
+      } : {};
       if (OWASP_BENCH_PROPS[propKey]) {
         return !isWeak(OWASP_BENCH_PROPS[propKey]);
       }
@@ -4443,8 +4528,10 @@ function scanJavaSAST(fp, raw) {
   // 72/73/74/.../82 where the receiving file has no local source — the
   // tainted Vector/List/Map arrives via a method parameter from a sibling
   // file. Gated tightly to avoid FPs on real apps.
-  if (!hasSource && process.env.AGENTIC_SECURITY_BLIND_BENCH !== '1') {
-    // Juliet-shape signal — disabled under blind bench (answer-key leakage).
+  if (!hasSource && process.env.AGENTIC_SECURITY_BENCH_SHAPE === '1' && process.env.AGENTIC_SECURITY_BLIND_BENCH !== '1') {
+    // PRD R5: was opt-out (disabled only under BLIND_BENCH=1) — inverted to
+    // opt-in, matching the documented default every other bench-shape
+    // mechanism in this file follows. Juliet-shape signal.
     const _isJulietShape = /\bjuliet\.(?:testcases|support)\b/.test(cleaned)
       || /\b(?:badSink|badSource|goodG2B|goodB2G)\s*\(/.test(cleaned);
     if (_isJulietShape && /\b(?:Vector|ArrayList|LinkedList|List|Set|HashSet|Map|HashMap|Hashtable|Properties|Queue|Deque|Stack|Optional)\s*<[^>]*>\s+[A-Za-z_]\w*\s*[,)]/.test(cleaned)) {
@@ -4464,15 +4551,18 @@ function scanJavaSAST(fp, raw) {
     let pm;
     // OWASP_BENCH_PROPS is the OWASP Benchmark answer-key for its own
     // benchmark.properties file (hashAlg1 → MD5, cryptoAlg1 → DES/ECB). Pure
-    // label leakage. Disabled under blind bench; real apps use the
-    // properties index loaded from the filesystem instead.
-    const _blindHere = process.env.AGENTIC_SECURITY_BLIND_BENCH === '1';
-    const OWASP_BENCH_PROPS = _blindHere ? {} : {
+    // label leakage. PRD R5: was opt-out (disabled only under
+    // BLIND_BENCH=1) — inverted to opt-in, enabled only under explicit
+    // BENCH_SHAPE=1; real apps use the properties index loaded from the
+    // filesystem instead (the `resolved`/`getJavaProperty` path above this
+    // fallback).
+    const _benchShapeHere = process.env.AGENTIC_SECURITY_BENCH_SHAPE === '1' && process.env.AGENTIC_SECURITY_BLIND_BENCH !== '1';
+    const OWASP_BENCH_PROPS = _benchShapeHere ? {
       cryptoAlg1: 'DES/ECB/PKCS5Padding',
       cryptoAlg2: 'AES/CCM/NoPadding',
       hashAlg1: 'MD5',
       hashAlg2: 'SHA-256',
-    };
+    } : {};
     const isWeak = (v) =>
       /\b(?:MD2|MD4|MD5|SHA-?1|SHA1|DES|DESede|3DES|RC2|RC4|Blowfish|HmacMD5|HmacSHA1)\b|AES\s*\/\s*ECB/i.test(v || '');
     while ((pm = propUseRe.exec(cleaned)) !== null) {
@@ -4803,7 +4893,13 @@ function annotateReachability(findings,routes,callGraph,fc){
     // Within 60 lines of a route declaration we consider this source route-rooted
     const routeRooted=rl.some(l=>Math.abs(l-srcLine)<60);
     f.routeRooted=routeRooted;
-    // Cheap function-of-source lookup via callGraph
+    // Cheap function-of-source lookup via callGraph. buildCallGraph only
+    // ever populates entries for .js/.jsx/.ts/.tsx/.mjs/.cjs files (PRD
+    // R15) — callGraph[fp] being absent for every other language is an
+    // ABSENCE OF EVIDENCE, not evidence the finding is unreachable, and
+    // must not be conflated with a JS file whose call graph genuinely has
+    // no incoming edge.
+    const hasCallGraphData=Object.prototype.hasOwnProperty.call(callGraph,fp);
     const funcs=callGraph[fp]||{};
     let enclosing=null;
     for(const[fn,info] of Object.entries(funcs))
@@ -4812,6 +4908,7 @@ function annotateReachability(findings,routes,callGraph,fc){
     // Reachable when route-rooted OR enclosingFunction is called from any function
     // declared near a route in the same file
     if(routeRooted){f.reachable=true;continue;}
+    if(!hasCallGraphData){f.reachable=null;continue;}
     let reachable=false;
     if(enclosing){
       for(const rLine of rl){
@@ -5409,17 +5506,29 @@ function scanEntropySecrets(fp,raw){
     // FP-5: structural / doc-context suppression
     const surrounding=lines.slice(Math.max(0,line-3),Math.min(lines.length,line+1)).join("\n");
     const nonSecretReason=_isLikelyNonSecret(v, ctx, surrounding);
+    const masked=v.substring(0,4)+"…"+v.substring(v.length-4);
     if (nonSecretReason) {
-      _suppressionLog.push({vuln:"High-Entropy Credential Candidate",file:fp,line,snippet:ctx.trim(),reason:'entropy-'+nonSecretReason});
+      // Same redaction concern as the main finding below applies to the
+      // suppression log — it's exposed via --include-suppressed, and a
+      // heuristic "probably not a real secret" call can be wrong.
+      _suppressionLog.push({vuln:"High-Entropy Credential Candidate",file:fp,line,snippet:ctx.trim().split(v).join(masked),reason:'entropy-'+nonSecretReason});
       continue;
     }
-    const masked=v.substring(0,4)+"…"+v.substring(v.length-4);
+    // Stage 4 correctness audit (coverage breadth, secrets): `snippet` used
+    // to carry the RAW, unmasked source line — including the full secret
+    // value — even though `masked` right next to it was correctly
+    // redacted. Nothing downstream (normalizeFindings, toHTML, toCSV,
+    // toJUnit) ever redacts `snippet` again, so the plaintext credential
+    // this detector exists to find flowed straight into every report
+    // format this scanner emits, including last-scan.json. Redact the
+    // exact matched value out of the snippet at the source, the same way
+    // `masked` already is.
     out.push({
       vuln:"High-Entropy Credential Candidate",
       severity:"high",cwe:"CWE-798",stride:"Information Disclosure",
       fix:"Replace with environment variable or secrets manager reference; rotate the value immediately.",
       code:`// BEFORE\nconst secret = "${masked}";\n\n// AFTER\nconst secret = process.env.APP_SECRET;`,
-      file:fp,line,snippet:ctx.trim(),masked,entropy:e.toFixed(2)
+      file:fp,line,snippet:ctx.trim().split(v).join(masked),masked,entropy:e.toFixed(2)
     });
   }
   return out;
@@ -5459,12 +5568,21 @@ function scanConfigFiles(fc){
         const[,k,v]=m;
         if(!v||v==='""'||v==="''"||/^(?:change.?me|your[_-]|placeholder|example|xxx+|todo|<|\$\{)/i.test(v))continue;
         if(/(?:password|secret|key|token|api)/i.test(k)){
+          // Stage 6 correctness audit: this was the one secrets-adjacent
+          // detector still shipping the RAW, unmasked source line as
+          // `snippet` — its siblings (scanCredentials/scanEntropySecrets)
+          // were already fixed for this exact leak in the Stage 4 audit.
+          // Nothing downstream re-redacts `snippet`, and the MCP redact.js
+          // catch-all requires a QUOTED value, which standard `.env`
+          // KEY=value syntax never has — so the plaintext committed
+          // secret flowed straight through explain_finding unredacted.
+          const masked=v.length>8?v.substring(0,4)+"…"+v.substring(v.length-4):"…";
           out.push({
             vuln:`Committed .env with Real-Looking ${k}`,
             severity:"high",cwe:"CWE-538",stride:"Information Disclosure",
             fix:`Remove ${k} from committed env files. Use .env.example with placeholders and ignore .env in VCS.`,
             code:`# In .gitignore\n.env\n\n# .env.example (commit)\n${k}=<your-${k.toLowerCase()}>`,
-            file:fp,line:i+1,snippet:ln
+            file:fp,line:i+1,snippet:ln.split(v).join(masked),masked
           });
         }
       }
@@ -5780,15 +5898,26 @@ function dedupeFindingsWithEvidence(findings){
     const key=`${file}:${sinkLine}:${fam}`;
     if(!buckets.has(key)){buckets.set(key,f);continue;}
     const kept=buckets.get(key);
-    // Winner selection: an interprocedural flow finding (carries source→sink
-    // attribution) is the better carrier than a flat structural/regex match at
-    // the same sink — keep its chain/source-line attribution. When neither or
-    // both carry flow, fall back to severity. The winner keeps its own severity
-    // (we must not resurrect a rating that ownership/reachability analysis
-    // deliberately downgraded on one of the two findings).
+    // Winner selection: an IR-TAINT finding (the deep engine's real
+    // interprocedural taint walk) is the best carrier at a shared sink,
+    // ahead of everything else — PRD R3: it carries taint-walk-only evidence
+    // (sanitizer observations keyed off the actual value reaching the sink,
+    // chain, LLM-validation state) that a flat pattern/AST match has no
+    // equivalent for, and that evidence would silently vanish if a
+    // same-severity pattern-layer duplicate won the tie instead. Below that,
+    // an interprocedural flow finding (carries source→sink attribution) is
+    // the better carrier than a flat structural/regex match — keep its
+    // chain/source-line attribution. When neither or both carry flow, fall
+    // back to severity. The winner keeps its own severity (we must not
+    // resurrect a rating that ownership/reachability analysis deliberately
+    // downgraded on one of the two findings).
+    const fIsIrTaint = f.parser === 'IR-TAINT';
+    const kIsIrTaint = kept.parser === 'IR-TAINT';
     const fHasFlow = !!(f.source && f.sink);
     const kHasFlow = !!(kept.source && kept.sink);
-    const keepNew = (fHasFlow !== kHasFlow)
+    const keepNew = (fIsIrTaint !== kIsIrTaint)
+      ? fIsIrTaint
+      : (fHasFlow !== kHasFlow)
       ? fHasFlow
       : (SEV_RANK[f.severity]??9) < (SEV_RANK[kept.severity]??9);
     const winner = keepNew ? f : kept;
@@ -6369,7 +6498,11 @@ function scanCredentials(fp,raw){
       if(seen.has(key))continue;seen.add(key);
       const severity=pat.s==="c"?"critical":pat.s==="h"?"high":"medium";
       const masked=val.length>12?val.substring(0,6)+"••••••"+val.substring(val.length-4):val.substring(0,3)+"•••";
-      results.push({vuln:pat.n,severity,cwe:"CWE-798",stride:"Information Disclosure",file:fp,line,snippet,masked,fix:"Remove the hardcoded credential. Store secrets in environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager). Rotate the exposed credential immediately, treat it as compromised.",code:`// Remove hardcoded value:\n// const secret = "${masked}";\n\n// Use environment variable instead:\nconst secret = process.env.${pat.n.toUpperCase().replace(/[^A-Z0-9]/g,"_")};`});
+      // Stage 4 correctness audit (coverage breadth, secrets): same
+      // unredacted-snippet leak as scanEntropySecrets — `snippet` carried
+      // the raw source line (full credential value) straight through to
+      // every report format. Redact the exact matched value here too.
+      results.push({vuln:pat.n,severity,cwe:"CWE-798",stride:"Information Disclosure",file:fp,line,snippet:snippet.split(val).join(masked),masked,fix:"Remove the hardcoded credential. Store secrets in environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager). Rotate the exposed credential immediately, treat it as compromised.",code:`// Remove hardcoded value:\n// const secret = "${masked}";\n\n// Use environment variable instead:\nconst secret = process.env.${pat.n.toUpperCase().replace(/[^A-Z0-9]/g,"_")};`});
     }
   }
   return results;
@@ -6534,7 +6667,7 @@ function _makePurl(ecosystem,name,version,group){
   const t={npm:'npm',pypi:'pypi'}[ecosystem]||ecosystem;
   if(!t)return'';
   const ns=group?`${encodeURIComponent(group)}/`:'';
-  return`pkg:${t}/${ns}${encodeURIComponent(name)}${version?'@'+version:''}`;
+  return`pkg:${t}/${ns}${encodeURIComponent(name)}${version?'@'+encodeURIComponent(version):''}`;
 }
 
 function _parsePackageJson(text,filePath){
@@ -7508,7 +7641,7 @@ async function queryRegistries(components){
 
 // Node port: takes { fileContents, depFileContents } maps directly instead of a JSZip object.
 // fileContents = code files keyed by relative path; depFileContents = manifest/lockfiles keyed by relative path.
-async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null, resume=undefined}, setProgress=()=>{}){_resetSuppressions();_buildProjectIndex(fileContents);await _loadCustomRules(scanRoot);
+async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null, resume=undefined, deep=undefined, deepInCi=undefined}, setProgress=()=>{}){_resetSuppressions();_buildProjectIndex(fileContents);await _loadCustomRules(scanRoot);
   // Pre-pass: build cross-file Java tainted-method index so per-file taint
   // analysis can recognize calls to user-input-returning helper methods
   // defined in OTHER files (Juliet's DataflowThruInnerClass / Vector / Stream
@@ -7771,7 +7904,15 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
     const c = fc[p];
     if (!c) continue;
     // Path-based category for Juliet test cases: `juliet-cweN/.../...java`.
-    const julietMatch = p.match(/(?:^|\/)juliet-cwe(\d+)\//i);
+    // PRD R5: this reads a path-embedded answer key (the directory name
+    // declares the CWE) exactly like _javaWebServletCategory's @WebServlet
+    // annotation reading below — off by default, enabled only when
+    // BENCH_SHAPE=1. This branch previously had no gate at all, so a real
+    // repository with a directory that happens to be named `juliet-cweNN/`
+    // would silently lose off-family findings in the default pipeline.
+    const julietMatch = (process.env.AGENTIC_SECURITY_BENCH_SHAPE === '1'
+      && process.env.AGENTIC_SECURITY_BLIND_BENCH !== '1')
+      ? p.match(/(?:^|\/)juliet-cwe(\d+)\//i) : null;
     if (julietMatch && _JULIET_CWE_TO_FAMILY[julietMatch[1]]) {
       _benchCategoryByFile.set(p, _JULIET_CWE_TO_FAMILY[julietMatch[1]]);
       continue;
@@ -7854,6 +7995,11 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // R8 (PRD §5): OS packages from an extracted container image's package DBs
   // (dpkg/apk) — baked-in deps the Dockerfile never names. Feed the OSV/SBOM pipeline.
   try{const{extractImagePackages}=await import('./sca/image-packages.js');for(const ip of extractImagePackages(allFileContents)){if(!components.some(c=>c.ecosystem===ip.ecosystem&&c.name===ip.name&&c.version===ip.version))components.push(ip);}}catch(_){}
+  // Dockerfile-declared apt/apk install-line packages — complementary to
+  // extractImagePackages above (which reads an actually scanned filesystem's
+  // installed-package DB, a different signal: build-time-declared vs.
+  // actually-installed).
+  try{const{extractContainerPackages}=await import('./sca/container.js');for(const cp of extractContainerPackages(allFileContents)){if(!components.some(c=>c.ecosystem===cp.ecosystem&&c.name===cp.name&&c.version===cp.version))components.push(cp);}}catch(_){}
   try{const{detectVendoredLibraries}=await import('./sca/vendor-detect.js');const vendored=detectVendoredLibraries(fc);for(const v of vendored){const key=`${v.ecosystem}:${v.name}:${v.version}`;if(!components.some(c=>`${c.ecosystem}:${c.name}:${c.version}`===key))components.push({...v,group:'',purl:`pkg:${v.ecosystem}/${v.name}@${v.version}`,filePath:v.file,isUnpinned:false,reachable:true});}}catch(_){}
   const reach=buildReachabilitySet(fc);
   const reachabilitySet=reach.imported;
@@ -7979,6 +8125,169 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // Roadmap #8 — tree-sitter sinks for long-tail languages (opt-in,
   // AGENTIC_SECURITY_TREE_SITTER=1; degrades to no-op without the optional dep).
   if(process.env.AGENTIC_SECURITY_TREE_SITTER==='1'){try{aF.push(...await scanTreeSitterSinks(fc));}catch(_){}}
+  // Phase 3 (Sentinel-parity FR-L1, FR-L2) — IR + interprocedural taint.
+  // R1 (PRD §5): the CLI entry (bin/agentic-security.js#cmdScan) now sets
+  // AGENTIC_SECURITY_DEEP=1 by default for local/interactive scans, so deep mode
+  // runs on the default `/scan --all` path. This gate is the enforcement +
+  // CI-safety point: it honors an explicit opt-out (DEEP=0) and keeps deep off in
+  // CI unless DEEP_IN_CI=1. In-process callers (tests, the cve-replay corpus) invoke
+  // runScan()/runFullScan() directly without the CLI default, so they stay deep-off
+  // and remain deterministic regression gates.
+  //
+  // PRD R3: IR-TAINT findings are appended into `aF` HERE, before dedup, so
+  // they dedupe against a pattern-layer duplicate of the same sink and then
+  // ride through the exact same annotator pipeline every other finding does
+  // (stable IDs, clustering, reachability, family backfill, confidence,
+  // calibration, exploitability, sanitizer/proof gate, mitigation, composite
+  // risk, LLM validation...) below. Previously this block ran AFTER that
+  // entire pipeline and pushed straight into the post-dedup `finalFindings`
+  // array, so a sink caught by both the regex layer and deep mode produced
+  // two findings (one with no family and no calibrated confidence) instead
+  // of one deduped, fully-annotated finding.
+  //
+  // SAFETY: Deep mode is gated for CI safety:
+  //   - Global timeout via AGENTIC_SECURITY_DEEP_TIMEOUT_MS (default 300_000 = 5 min)
+  //   - Auto-disabled in CI unless AGENTIC_SECURITY_DEEP_IN_CI=1 is also set,
+  //     so a pathological file can't hang the whole pipeline.
+  // ── IR parse-coverage sidecar (proof-corpus instrumentation, default off) ──
+  // Built ahead of the deep-mode gate so coverage is measurable without paying
+  // for taint analysis, and stashed in _sharedIR so the deep block below reuses
+  // it rather than parsing the project twice.
+  //
+  // NOTE (affects instrumented runs only, i.e. AGENTIC_SECURITY_IR_STATS set):
+  // when this block runs, buildProjectIR() happens here, BEFORE the deep-mode
+  // budget timer (t0) below is started. On an uninstrumented run, IR
+  // construction instead happens inside the timed block via the
+  // `_sharedIR || (_sharedIR = buildProjectIR(fc))` line, so its cost counts
+  // against AGENTIC_SECURITY_DEEP_TIMEOUT_MS. That means the deep budget does
+  // NOT account for parse time when stats are enabled — an instrumented run
+  // gets strictly more wall-clock for the taint analysis itself than an
+  // uninstrumented run with the same budget.
+  let _sharedIR = null;
+  // Java IR requires the ASYNC builder. `parser-java.js` exports an async
+  // `parseJavaFile` (java-parser needs a dynamic import), so the sync
+  // `buildProjectIR` has no Java branch at all — and both deep-path call sites
+  // used it. The result was that no .java file had ever produced an IR function
+  // in deep mode: `bench/layer-recall` measured java at 0/25 while the catalog
+  // carried 7 Java sources and 15 Java sinks that had nothing to run against.
+  // `buildProjectIRAsync` is a full mirror plus Java and had zero callers.
+  //
+  // Gated on the presence of .java rather than always awaiting: the async
+  // builder is a superset, but switching every scan in the product to it to fix
+  // one language would change the execution shape (and attempt the java-parser
+  // import) for projects that contain no Java. `runFullScan` is already async,
+  // so the await costs nothing structurally.
+  const _hasJava = Object.keys(fc || {}).some(f => /\.java$/i.test(f));
+  const _buildIR = async () => (_hasJava ? await buildProjectIRAsync(fc) : buildProjectIR(fc));
+  const _irStatsTarget = irStatsTarget();
+  if (_irStatsTarget) {
+    try {
+      _sharedIR = await _buildIR();
+      writeIrStats(_irStatsTarget, collectIrStats(fc, _sharedIR.perFile, _sharedIR.callGraph));
+    } catch (e) {
+      // Instrumentation must never fail a scan. Surface only when debugging.
+      if (process.env.AGENTIC_SECURITY_IR_STATS_DEBUG === '1') {
+        process.stderr.write(`ir-stats: ${e && e.message}\n`);
+      }
+    }
+  }
+  // `deep`/`deepInCi` come from runScan()'s options object (threaded through
+  // unchanged from runScan.js) — an explicit-opt-in override alongside the
+  // env vars, not a replacement for them. Added because `runScan(dir,
+  // {deep:true})` was a silent, total no-op: this options object was
+  // destructured for fileContents/depFileContents/scanRoot/resume only, so
+  // `deep` was dropped on the floor and deep mode stayed off regardless.
+  // Several interprocedural test files (interproc-k2.test.js,
+  // parser-cs-kt.test.js, points-to.test.js) pass exactly this option
+  // believing it enables deep mode — it never did, so those tests were
+  // exercising whatever coincidentally fires without the deep engine, not
+  // the interprocedural machinery they're named for.
+  const _deepRequested = deep === true || process.env.AGENTIC_SECURITY_DEEP === '1';
+  const _inCi = !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI ||
+                   process.env.BUILDKITE || process.env.CIRCLECI || process.env.JENKINS_URL);
+  const _deepInCiAllowed = deepInCi === true || process.env.AGENTIC_SECURITY_DEEP_IN_CI === '1';
+  const _deepEnabled = _deepRequested && (!_inCi || _deepInCiAllowed);
+  let _deepCallGraph = null;
+  if (_deepEnabled) {
+    const budgetMs = parseInt(process.env.AGENTIC_SECURITY_DEEP_TIMEOUT_MS || '300000', 10);
+    const t0 = Date.now();
+    try {
+      const { perFile, callGraph } = _sharedIR || (_sharedIR = await _buildIR());
+      _deepCallGraph = callGraph;
+      // The runDeepAnalysis call is synchronous in this codebase; we can't
+      // truly interrupt it without re-architecting the worklist. We pass a
+      // deadlineMs hint that the inner loops check; if absent, we still cap
+      // function count via fnLimit. Operators who suspect a hung run can
+      // kill the process and re-run with AGENTIC_SECURITY_DEEP=0.
+      const irFindings = runDeepAnalysis(perFile, callGraph, {
+        fnLimit: parseInt(process.env.AGENTIC_SECURITY_DEEP_FN_LIMIT || '5000', 10),
+        deadlineMs: t0 + budgetMs,
+        // v0.69 — incremental cache inputs (used when AGENTIC_SECURITY_INCREMENTAL=1).
+        scanRoot,
+        fileContents: fc,
+      });
+      const elapsed = Date.now() - t0;
+      if (elapsed > budgetMs) {
+        // We exceeded budget — surface a single info finding so operators see it.
+        aF.push({
+          id: `ir-taint-timeout:${scanRoot || ''}`,
+          file: '(deep-engine)', line: 0,
+          vuln: `IR-TAINT deep mode exceeded ${budgetMs}ms budget (${elapsed}ms used) — results may be incomplete`,
+          severity: 'info',
+          parser: 'IR-TAINT',
+          confidence: 0.5,
+        });
+      }
+      for (const f of irFindings) {
+        f.unvalidated = true;
+        f.validator_verdict = 'unvalidated';
+      }
+      aF.push(...irFindings);
+    } catch (e) {
+      // Deep mode is best-effort. A parser blowup in one file shouldn't kill
+      // the scan — fall back to the pattern-only result.
+    }
+  } else if (_deepRequested && _inCi) {
+    // Operator asked for deep but we're in CI — emit a non-blocking notice
+    // so they know it was skipped and how to override.
+    aF.push({
+      id: 'ir-taint-ci-skipped',
+      file: '(deep-engine)', line: 0,
+      vuln: 'IR-TAINT deep mode skipped in CI environment (set AGENTIC_SECURITY_DEEP_IN_CI=1 to opt in)',
+      severity: 'info',
+      parser: 'IR-TAINT',
+      confidence: 1.0,
+    });
+  }
+  // Java SCA enrichment: use deep-mode IR call graph to improve Java function reachability
+  if (_deepCallGraph) {
+    try {
+      for (const sc of supplyChain) {
+        if (sc.type !== 'vulnerable_dep' || sc.ecosystem !== 'maven') continue;
+        if (sc.functionReachable === 'reachable') continue;
+        const allFns = [...(sc.osvVulnFunctions || []), ...(VULN_FUNCTION_HINTS[sc.name] || [])];
+        if (!allFns.length) continue;
+        for (const fn of _deepCallGraph.functions ? _deepCallGraph.functions.values() : []) {
+          if (!fn.cfg || !fn.cfg.nodes) continue;
+          for (const node of Object.values(fn.cfg.nodes)) {
+            if (node.kind !== 'call') continue;
+            const callee = typeof node.callee === 'string' ? node.callee : null;
+            if (!callee) continue;
+            const shortCallee = callee.includes('.') ? callee.split('.').pop() : callee;
+            if (allFns.some(f => f === shortCallee || f === callee)) {
+              sc.functionReachable = 'reachable';
+              sc.reachabilityTier = 'function-reachable';
+              if (!sc.vulnerableFunctionCallSites) sc.vulnerableFunctionCallSites = [];
+              sc.vulnerableFunctionCallSites.push({ pkg: sc.name, fn: shortCallee, file: fn.file, line: node.line });
+              sc._javaIrEnriched = true;
+              break;
+            }
+          }
+          if (sc.functionReachable === 'reachable') break;
+        }
+      }
+    } catch { /* Java SCA enrichment is best-effort */ }
+  }
   let finalFindings;try{finalFindings=dedupeFindingsWithEvidence(aF);}catch(_){finalFindings=dd(aF,f=>f.id);}
   // Inline `agentic-security-ignore` pragmas, pass 1 of 2. This covers every
   // finding that exists BY THIS POINT — the pattern detectors, the cross-file
@@ -8104,7 +8413,13 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   };
   _runAnnotator('annotateStableIds', () => annotateStableIds(finalFindings));
   _runAnnotator("clusterByRootCause", () => { finalFindings = clusterByRootCause(finalFindings); });
-  _runAnnotator("demoteUnreachable", () => { demoteUnreachable(finalFindings, { routes: aR }); });
+  _runAnnotator("demoteUnreachable", () => {
+    demoteUnreachable(finalFindings, { routes: aR });
+    // `type: 'vulnerable_dep'` findings live in supplyChain, not finalFindings
+    // (src/sca/CLAUDE.md) — demoteUnreachable's SCA-tier branch needs this
+    // array passed explicitly or it never sees an SCA finding at all.
+    demoteUnreachable(supplyChain, { routes: aR });
+  });
   // Premortem #8: backfill parser/family BEFORE confidence and calibration,
   // because both consume those fields and silently no-op when they're null.
   _runAnnotator("backfillFindingDefaults", () => { backfillFindingDefaults(finalFindings); });
@@ -8124,22 +8439,25 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
     // Generalised sanitizer consumption (dataflow/sanitizer-gate.js): labels
     // findings whose flow passes a catalog sanitizer matching their family
     // (xss/url/cmd, not just sql) so the proof gate below can demote them the
-    // same way it demotes proven-clean SQL. `sanitizersOnPath` would need to
-    // be `{ [findingId]: string[] of sanitizer callees observed on that
-    // finding's flow }`. There is nothing to build that map from: the live
-    // taint walk in dataflow/engine.js does NOT consult sanitizer catalog
-    // entries at all. `matchSinkOrSanitizer()` returns every catalog hit for
-    // a callee, but every consumer in dataflow/*.js selects only
-    // `e.kind === 'sink'` — there is no `'sanitizer'` branch anywhere in that
-    // tree. Taint is killed only by clean re-assignment of a variable
-    // (removePathAndDescendants, engine.js:374), which happens regardless of
-    // whether the RHS call is a catalog sanitizer.
-    // So this is `{}` and the gate below is INERT — not "awaiting plumbing"
-    // but awaiting the sanitizer walk itself. Making it live needs two things:
-    // (1) dataflow/engine.js honouring `kind === 'sanitizer'` at a call site,
-    // and (2) that call site's callee name threaded onto the finding
-    // alongside the trace/chain that proven-clean.js already reads.
+    // same way it demotes proven-clean SQL.
+    //
+    // The taint walk now records the sanitizer callees observed on the value
+    // reaching each sink argument (`dataflow/engine.js` `_sanitizersForExpr`)
+    // and stamps them on the finding as `_sanitizersOnPath`. This rebuilds the
+    // `{ [findingId]: string[] }` shape the gate wants. Both `id` and
+    // `stableId` are keyed because the gate accepts either and stable ids are
+    // assigned by an earlier annotator.
+    //
+    // The sanitizer never kills the taint in the walk itself: a mislabelled
+    // sanitizer would then hide a real vulnerability outright, whereas a label
+    // only demotes confidence here. Recall-preserving, on purpose.
     const sanitizersOnPath = {};
+    for (const f of finalFindings) {
+      const names = f && f._sanitizersOnPath;
+      if (!Array.isArray(names) || !names.length) continue;
+      if (f.id) sanitizersOnPath[f.id] = names;
+      if (f.stableId) sanitizersOnPath[f.stableId] = names;
+    }
     _runAnnotator("applySanitizerGate", () => { applySanitizerGate(finalFindings, { sanitizersOnPath }); });
     _runAnnotator("annotateProofGate", () => { annotateProofGate(finalFindings); });
   }
@@ -8288,8 +8606,10 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // v3 next-gen: per-attacker-persona score matrix (FR-ADV-2). Must run AFTER
   // crown-jewels + mitigation composite so it sees those signals.
   _runAnnotator("annotatePersonaScores", () => { annotatePersonaScores(finalFindings); });
-  // v3 next-gen: SCA reverse-blast-radius enrichment (FR-ADV-5).
-  _runAnnotator("annotateScaReverseBlast", () => { annotateScaReverseBlast(finalFindings, fc); });
+  // v3 next-gen: SCA reverse-blast-radius enrichment (FR-ADV-5). Annotates
+  // SCA findings (package-name-keyed) — must run against supplyChain, not
+  // finalFindings (SAST), which has no package-name field at all.
+  _runAnnotator("annotateScaReverseBlast", () => { annotateScaReverseBlast(supplyChain, fc); });
   // v3 next-gen: bug-bounty payout prediction (FR-ADV-3). Composes with the
   // mitigation composite — gated/unreachable findings get the bounty scaled
   // down rather than zeroed.
@@ -8391,146 +8711,18 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // FR-LOGIC-6: LLM-driven flow narration (template fallback when no LLM endpoint).
   try { await annotateNarration(finalFindings); }
   catch (e) { _annotatorErrors.push({ phase: 'annotateNarration', err: String((e && e.message) || e) }); }
-  // Phase 3 (Sentinel-parity FR-L1, FR-L2) — IR + interprocedural taint.
-  // R1 (PRD §5): the CLI entry (bin/agentic-security.js#cmdScan) now sets
-  // AGENTIC_SECURITY_DEEP=1 by default for local/interactive scans, so deep mode
-  // runs on the default `/scan --all` path. This gate is the enforcement +
-  // CI-safety point: it honors an explicit opt-out (DEEP=0) and keeps deep off in
-  // CI unless DEEP_IN_CI=1. In-process callers (tests, the cve-replay corpus) invoke
-  // runScan()/runFullScan() directly without the CLI default, so they stay deep-off
-  // and remain deterministic regression gates. Findings ride through the standard
-  // dedup/cluster/confidence pipeline below and the LLM-validator stage that follows.
-  //
-  // SAFETY: Deep mode is gated for CI safety:
-  //   - Global timeout via AGENTIC_SECURITY_DEEP_TIMEOUT_MS (default 300_000 = 5 min)
-  //   - Auto-disabled in CI unless AGENTIC_SECURITY_DEEP_IN_CI=1 is also set,
-  //     so a pathological file can't hang the whole pipeline.
-  // ── IR parse-coverage sidecar (proof-corpus instrumentation, default off) ──
-  // Built ahead of the deep-mode gate so coverage is measurable without paying
-  // for taint analysis, and stashed in _sharedIR so the deep block below reuses
-  // it rather than parsing the project twice.
-  //
-  // NOTE (affects instrumented runs only, i.e. AGENTIC_SECURITY_IR_STATS set):
-  // when this block runs, buildProjectIR() happens here, BEFORE the deep-mode
-  // budget timer (t0) below is started. On an uninstrumented run, IR
-  // construction instead happens inside the timed block via the
-  // `_sharedIR || (_sharedIR = buildProjectIR(fc))` line, so its cost counts
-  // against AGENTIC_SECURITY_DEEP_TIMEOUT_MS. That means the deep budget does
-  // NOT account for parse time when stats are enabled — an instrumented run
-  // gets strictly more wall-clock for the taint analysis itself than an
-  // uninstrumented run with the same budget.
-  let _sharedIR = null;
-  const _irStatsTarget = irStatsTarget();
-  if (_irStatsTarget) {
-    try {
-      _sharedIR = buildProjectIR(fc);
-      writeIrStats(_irStatsTarget, collectIrStats(fc, _sharedIR.perFile, _sharedIR.callGraph));
-    } catch (e) {
-      // Instrumentation must never fail a scan. Surface only when debugging.
-      if (process.env.AGENTIC_SECURITY_IR_STATS_DEBUG === '1') {
-        process.stderr.write(`ir-stats: ${e && e.message}\n`);
-      }
-    }
-  }
-  const _deepRequested = process.env.AGENTIC_SECURITY_DEEP === '1';
-  const _inCi = !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI ||
-                   process.env.BUILDKITE || process.env.CIRCLECI || process.env.JENKINS_URL);
-  const _deepInCiAllowed = process.env.AGENTIC_SECURITY_DEEP_IN_CI === '1';
-  const _deepEnabled = _deepRequested && (!_inCi || _deepInCiAllowed);
-  if (_deepEnabled) {
-    const budgetMs = parseInt(process.env.AGENTIC_SECURITY_DEEP_TIMEOUT_MS || '300000', 10);
-    const t0 = Date.now();
-    try {
-      const { perFile, callGraph } = _sharedIR || (_sharedIR = buildProjectIR(fc));
-      // The runDeepAnalysis call is synchronous in this codebase; we can't
-      // truly interrupt it without re-architecting the worklist. We pass a
-      // deadlineMs hint that the inner loops check; if absent, we still cap
-      // function count via fnLimit. Operators who suspect a hung run can
-      // kill the process and re-run with AGENTIC_SECURITY_DEEP=0.
-      const irFindings = runDeepAnalysis(perFile, callGraph, {
-        fnLimit: parseInt(process.env.AGENTIC_SECURITY_DEEP_FN_LIMIT || '5000', 10),
-        deadlineMs: t0 + budgetMs,
-        // v0.69 — incremental cache inputs (used when AGENTIC_SECURITY_INCREMENTAL=1).
-        scanRoot,
-        fileContents: fc,
-      });
-      const elapsed = Date.now() - t0;
-      if (elapsed > budgetMs) {
-        // We exceeded budget — surface a single info finding so operators see it.
-        finalFindings.push({
-          id: `ir-taint-timeout:${scanRoot || ''}`,
-          file: '(deep-engine)', line: 0,
-          vuln: `IR-TAINT deep mode exceeded ${budgetMs}ms budget (${elapsed}ms used) — results may be incomplete`,
-          severity: 'info',
-          parser: 'IR-TAINT',
-          confidence: 0.5,
-        });
-      }
-      for (const f of irFindings) {
-        f.unvalidated = true;
-        f.validator_verdict = 'unvalidated';
-      }
-      finalFindings.push(...irFindings);
-      // Pragma pass 2 of 2 — see the pass-1 comment far above. Deep-mode IR
-      // findings land here, long after pass 1 ran, so without this an
-      // `agentic-security-ignore` on an ir-taint finding is inert. Deep mode is
-      // what the CLI uses outside CI and taint findings are the ones users most
-      // want to silence, so the documented feature did nothing in the case that
-      // mattered most.
-      //
-      // Re-running over the already-filtered array is safe and does not
-      // double-log: pass 1's removals are gone from `finalFindings`, so only the
-      // newly-appended IR findings can match here, and each suppression reaches
-      // the ledger exactly once.
-      try{ _applyIgnorePragmas(finalFindings, fc); }catch(_){}
-      // Java SCA enrichment: use deep-mode IR call graph to improve Java function reachability
-      try {
-        for (const sc of supplyChain) {
-          if (sc.type !== 'vulnerable_dep' || sc.ecosystem !== 'maven') continue;
-          if (sc.functionReachable === 'reachable') continue;
-          const allFns = [...(sc.osvVulnFunctions || []), ...(VULN_FUNCTION_HINTS[sc.name] || [])];
-          if (!allFns.length) continue;
-          for (const fn of callGraph.functions ? callGraph.functions.values() : []) {
-            if (!fn.cfg || !fn.cfg.nodes) continue;
-            for (const node of Object.values(fn.cfg.nodes)) {
-              if (node.kind !== 'call') continue;
-              const callee = typeof node.callee === 'string' ? node.callee : null;
-              if (!callee) continue;
-              const shortCallee = callee.includes('.') ? callee.split('.').pop() : callee;
-              if (allFns.some(f => f === shortCallee || f === callee)) {
-                sc.functionReachable = 'reachable';
-                sc.reachabilityTier = 'function-reachable';
-                if (!sc.vulnerableFunctionCallSites) sc.vulnerableFunctionCallSites = [];
-                sc.vulnerableFunctionCallSites.push({ pkg: sc.name, fn: shortCallee, file: fn.file, line: node.line });
-                sc._javaIrEnriched = true;
-                break;
-              }
-            }
-            if (sc.functionReachable === 'reachable') break;
-          }
-        }
-      } catch { /* Java SCA enrichment is best-effort */ }
-    } catch (e) {
-      // Deep mode is best-effort. A parser blowup in one file shouldn't kill
-      // the scan — fall back to the pattern-only result.
-    }
-  } else if (_deepRequested && _inCi) {
-    // Operator asked for deep but we're in CI — emit a non-blocking notice
-    // so they know it was skipped and how to override.
-    finalFindings.push({
-      id: 'ir-taint-ci-skipped',
-      file: '(deep-engine)', line: 0,
-      vuln: 'IR-TAINT deep mode skipped in CI environment (set AGENTIC_SECURITY_DEEP_IN_CI=1 to opt in)',
-      severity: 'info',
-      parser: 'IR-TAINT',
-      confidence: 1.0,
-    });
-  }
-  // Phase 2 (Sentinel-parity): LLM validator stage. No-op unless the operator
-  // sets AGENTIC_SECURITY_LLM_VALIDATE=1 AND AGENTIC_SECURITY_LLM_ENDPOINT. When
-  // disabled, every finding gets unvalidated:true and the existing confidence
-  // pipeline accounts for that. When enabled, the validator emits accept/reject
-  // /escalate per finding; rejects are dropped into the suppression log.
+  // Phase 2 (Sentinel-parity): LLM validator stage. DEFAULT-ON whenever
+  // AGENTIC_SECURITY_LLM_ENDPOINT is configured — not gated on
+  // AGENTIC_SECURITY_LLM_VALIDATE=1 as this comment previously (and wrongly)
+  // said. Opt OUT with AGENTIC_SECURITY_LLM_VALIDATE=0; the legacy
+  // AGENTIC_SECURITY_LLM_VALIDATE=1 still works as an explicit-on no-op. With
+  // no endpoint configured the validator stays a no-op regardless — no
+  // surprise network calls from an unrelated env var. See
+  // llm-validator/index.js's own header, which states this correctly; this
+  // comment was the one that had drifted. When disabled, every finding gets
+  // unvalidated:true and the existing confidence pipeline accounts for that.
+  // When enabled, the validator emits accept/reject/escalate per finding;
+  // rejects are dropped into the suppression log.
   try {
     // Concurrency defaults to 1 (the validator's deterministic-default).
     // Operators raise via AGENTIC_SECURITY_LLM_CONCURRENCY at the cost of
@@ -8543,7 +8735,23 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
       vuln: d.vuln, file: d.file, line: d.line, snippet: d.snippet,
       reason: 'llm-validator:reject:' + (d.validator_reasoning || '').slice(0, 80),
     });
+    // Re-run: annotateVerifierVerdicts ran (~8335) before validator_verdict
+    // existed on any finding (set here, hundreds of lines later), so its
+    // 'verified-by-llm' verdict — documented as one of five possible
+    // outcomes in verifier.js's own header — could never be produced by the
+    // real pipeline. Cheap and idempotent; re-running is the fix, not
+    // moving the original call (confidence/exploitability annotators
+    // upstream of it still need to run before validation, same as before).
+    try { annotateVerifierVerdicts(finalFindings, { fileContents: fc }); } catch (_) {}
   } catch(_) {}
+  // Same ordering fix as annotateVerifierVerdicts above: annotateConfidence
+  // (~8111) computes f.confidence before f.unvalidated exists on any
+  // finding, so its 0.85x "LLM validator unavailable" penalty could never
+  // apply in the real pipeline. Runs unconditionally (outside the
+  // llmValidateMany try-block above) because f.unvalidated is also set
+  // directly on deep-mode IR findings appended earlier in this function,
+  // independent of whether the LLM validator itself ran.
+  try { applyUnvalidatedPenalty(finalFindings); } catch (_) {}
   try {
     const { kept, suppressed } = applyLearnedFeedback(scanRoot, finalFindings);
     finalFindings = kept;
@@ -8610,8 +8818,11 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
       /(?:^|\/)test_[^/]*\.py$/i.test(f) || /_test\.(?:py|go)$/i.test(f));
     annotateScaVerdicts(supplyChain, { testsDetected: _testsDetected });
   } catch (_) {}
-  // 0.9.0 Feat-15: dep confusion
-  try{const dc=detectDepConfusion(annotatedComponents,scanRoot);aF.push(...dc);}catch(_){}
+  // 0.9.0 Feat-15: dep confusion. These are supply-chain findings (kind:'sca',
+  // derived from `components` not source code) and belong in supplyChain, not
+  // aF — aF was already snapshotted into finalFindings at dedupeFindingsWithEvidence
+  // above, so pushing into aF here silently discards every result.
+  try{const dc=detectDepConfusion(annotatedComponents,scanRoot);supplyChain.push(...dc);}catch(_){}
   // Deployment-platform security checklist
   try{const dpf=scanDeployPlatform(scanRoot);aLogic.push(...dpf);}catch(_){}
   // Stack-specific security playbook
@@ -8814,8 +9025,22 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
     if (process.env.AGENTIC_SECURITY_NO_COMPLIANCE !== '1') {
       try {
         const policy = loadCompliancePolicy(scanRoot);
-        if (policy && !policy._error) {
+        if (policy && policy._error) {
+          // CMP-5: a malformed policy used to be silently treated the same
+          // as "no policy file" — the parse error (which names the exact
+          // problem) was computed and then discarded. verifyPolicy now
+          // reports it as a distinct 'error' status rather than staying
+          // silent, and it is surfaced here too so an interactive scan
+          // shows it.
           _complianceReport = verifyCompliancePolicy(policy, { scanRoot, findings: finalFindings });
+          process.stderr.write(`[compliance] ${policy._error}\n`);
+        } else if (policy) {
+          // CMP-5: pass every channel a real scan produces, not just SAST —
+          // a finding-family check for hardcoded-secret or vulnerable-dep
+          // was previously invisible to secrets/SCA findings entirely.
+          _complianceReport = verifyCompliancePolicy(policy, {
+            scanRoot, findings: finalFindings, secrets: aSecrets, logicVulns: aLogic, supplyChain,
+          });
           emitComplianceJsonLd(_complianceReport, scanRoot);
           emitComplianceMarkdown(_complianceReport, scanRoot);
         }
@@ -8895,7 +9120,16 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   let _analysisTier = null, _unmodeledSinks = null;
   try { _analysisTier = computeAnalysisTiers(Object.keys(fc)); } catch {}
   try { _unmodeledSinks = countUnmodeledSinkCandidates(fc, finalFindings); } catch {}
-  const _scanMeta={filesScanned:files.length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_fileTimings.sort((a,b)=>b.ms-a.ms).slice(0,20),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length},checkpoint:{enabled:!!(_ckpt&&_ckpt.enabled),resumed:_ckptResumed,total:files.length}};
+  // filesScanned counts files actually analyzed (Object.keys(fc), the same
+  // set computeAnalysisTiers above reads) — NOT files.length, the candidate
+  // list before the per-file loop's size/density skips run. Using the
+  // candidate count here double-counted skipped files: they were included
+  // in filesScanned AND separately reported in filesSkipped/filesDenseSkipped,
+  // so coverage-report.js's "scanned=N skipped=M" line implied N+M files were
+  // seen when only N-of-those-candidates were actually analyzed.
+  // checkpoint.total intentionally keeps files.length — that field means the
+  // full candidate set for resume bookkeeping, a different, correct meaning.
+  const _scanMeta={filesScanned:Object.keys(fc).length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_fileTimings.sort((a,b)=>b.ms-a.ms).slice(0,20),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length},checkpoint:{enabled:!!(_ckpt&&_ckpt.enabled),resumed:_ckptResumed,total:files.length}};
   // R8: the scan completed, so the checkpoint has been fully consumed — remove
   // it. Anything that threw before this point leaves it in place to resume from.
   try { closeCheckpoint(_ckpt, { complete: true }); } catch (_) {}