@clear-capabilities/agentic-security-scanner 0.143.0 → 0.144.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-2a984aea7cf61f1508f690678b1ff656829081cb34b3e8483cc8ae04ae3c934c  agentic-security.mjs
+cdbd5909c8fe1682a351069baff2466e3d1ee7c525f2122909a4954f0c488edf  agentic-security.mjs

package/dist/calibration-seed.json

@@ -1,6 +1,8 @@
 {
   "_doc": "Seed calibration corpus for P1.3 / FR-UX-1. Each entry is (family, tp, fp) from running the engine against labeled benchmarks. The runtime merges this with the customer's .agentic-security/validator-metrics.json. Customer counts override when their n is higher.",
   "_source": "OWASP Benchmark v1.2 (Java) + Juliet Java + Juliet C/C++ + synthetic-bench fixtures + curated NodeGoat — counts as-of v0.48.0. ~30 samples per family minimum for calibrated emit.",
+  "_generatedAt": "2026-05-18T19:15:00-07:00",
+  "_generatedAtNote": "FR-207: the actual git commit timestamp of this file (git log -1 --format=%aI), recorded here as a machine-readable field so posture/calibration.js's calibrationFreshness() can compute a real age instead of inferring one from the '_source' version string. Update this value only when the family counts below actually change.",
   "_caveat": "This is a SEED corpus, not a held-out test set. The PRD G1 target (Brier ≤ 0.10) requires a separate held-out labeled set; that work is queued for Phase 5 finalization. Calibrated values shipped now are honest empirical TP rates from this seed, with their Wilson 95% CI and N visible so consumers can judge.",
   "families": {
     "sql-injection": { "tp": 41, "fp": 3 },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.143.0",
-  "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
+  "version": "0.144.0",
+  "description": "Scanner engine for the agentic-security Claude Code plugin \u2014 SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
   "bin": {
@@ -40,7 +40,7 @@
     "@babel/preset-react": "^8.0.1",
     "@babel/preset-typescript": "^8.0.1",
     "java-parser": "^3.0.1",
-    "js-yaml": "^5.3.0",
+    "js-yaml": "^5.4.1",
     "safe-regex": "^2.1.1"
   },
   "optionalDependencies": {
@@ -48,7 +48,7 @@
     "web-tree-sitter": "0.20.8"
   },
   "devDependencies": {
-    "@types/node": "^26.2.0",
+    "@types/node": "^26.3.0",
     "@vercel/ncc": "^0.45.0"
   },
   "overrides": {
@@ -59,19 +59,19 @@
     "build": "ncc build bin/agentic-security.js -o dist --minify -e web-tree-sitter -e tree-sitter-wasms && rm -rf dist/compliance-frameworks && mkdir -p dist/compliance-frameworks && cp src/posture/compliance-frameworks/*.json dist/compliance-frameworks/ && mv dist/index.js dist/agentic-security.mjs && rm -f dist/package.json && chmod +x dist/agentic-security.mjs && node -e \"const fs=require('fs');const p='dist/agentic-security.mjs';const c=fs.readFileSync(p,'utf8');if(!c.startsWith('#!'))fs.writeFileSync(p,'#!/usr/bin/env node\\n'+c);\" && node -e \"const fs=require('fs');const c=require('crypto');const h=c.createHash('sha256').update(fs.readFileSync('dist/agentic-security.mjs')).digest('hex');fs.writeFileSync('dist/agentic-security.mjs.sha256',h+'  agentic-security.mjs\\n');\"",
     "prepare": "node ../scripts/pre-push-gate.mjs --install-hook",
     "prepublishOnly": "npm run build && node ../scripts/sync-scanner-changelog.mjs && node ../scripts/release-check.mjs",
-    "test": "npm run test:smoke && npm run test:glob && npm run test:sast && npm run test:posture && npm run test:dataflow && npm run test:mcp && npm run test:report && npm run test:bench-modules && npm run test:lifecycle && npm run test:eval && npm run test:discovery && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js && npm run test:python",
+    "test": "node ../scripts/run-unit-tests.mjs && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js && node --experimental-test-module-mocks --test test/fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection-k8s-admission.test.js && npm run test:python",
     "test:python": "node ../scripts/run-python-tests.mjs",
     "test:smoke": "node --test test/smoke.test.js test/demo-app.test.js",
     "test:glob": "node --test test/glob-compat.test.js",
-    "test:sast": "node --test test/sibling-guard.test.js test/comment-blindness.test.js test/crypto-specialist.test.js test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/zip-slip-containment-guard.test.js test/redos-anchoring.test.js test/path-guard-validator-call.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/mcp-audit-scan.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/guard-window-identifier-correlation.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/secret-redaction.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js test/adversarial-robustness.test.js test/secret-entropy.test.js test/comment-strip.test.js test/juliet-path-filter-gate.test.js test/java-bench-shape-opt-in.test.js test/reachability-missing-callgraph-data.test.js test/rate-limit.test.js test/auth-signals.test.js test/convention-deviation.test.js test/resource-exhaustion.test.js test/resource-exhaustion-realworld.test.js test/redirect-toctou.test.js test/redirect-toctou-realworld.test.js test/codegen-sink.test.js test/ownership-authz.test.js test/ownership-authz-realworld.test.js test/t21-precision-audit.test.js test/secrets-coverage.test.js test/prompt-injection-payloads.test.js test/iac-cloud-templates.test.js test/ruby-path-join.test.js",
-    "test:posture": "node --test test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/independent-population.test.js test/why-missed.test.js test/independent-scoring.test.js test/evidence-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/stdout-flush.test.js test/format-determinism.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js test/concurrency-cwe.test.js test/compliance-mapping-liveness.test.js test/family-registry.test.js test/coverage-strength.test.js test/framework-provenance.test.js test/third-party-verification.test.js test/proof-coverage.test.js test/calibration-holdout.test.js test/catalog-freshness.test.js test/incremental-parity.test.js test/surface-smoke.test.js test/fix-coverage.test.js test/raw-source-carveout.test.js test/mlbom-conformance.test.js test/deploy-gate-replay.test.js test/sbom-conformance.test.js test/unscored-claims.test.js test/mcp-rug-pull.test.js test/agent-boundary-taint.test.js test/confinement-adversarial.test.js test/comment-strip-cost.test.js test/reachability-claim.test.js test/entrypoint-breadth.test.js test/dep-file-admission.test.js",
-    "test:dataflow": "node --test test/container-taint.test.js test/stored-taint-families.test.js test/py-annotation-sources.test.js test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-cs-p1.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/return-sink-check.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js test/interproc-nested-call-taint.test.js test/catalog-xpath-injection.test.js test/catalog-ldap-injection.test.js test/catalog-xxe.test.js test/catalog-response-splitting.test.js test/catalog-code-injection.test.js test/parser-rb-control-flow.test.js test/catalog-ruby-p1.test.js test/callee-receiver-taint.test.js test/catalog-command-injection-p4.test.js test/catalog-xss-p4.test.js test/catalog-path-ssrf-p3.test.js",
+    "test:sast": "node --test test/cpp-hardcoded-secret.test.js test/sibling-guard.test.js test/comment-blindness.test.js test/crypto-specialist.test.js test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/zip-slip-containment-guard.test.js test/redos-anchoring.test.js test/path-guard-validator-call.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/mcp-audit-scan.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/guard-window-identifier-correlation.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/secret-redaction.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js test/adversarial-robustness.test.js test/secret-entropy.test.js test/comment-strip.test.js test/juliet-path-filter-gate.test.js test/java-bench-shape-opt-in.test.js test/reachability-missing-callgraph-data.test.js test/rate-limit.test.js test/auth-signals.test.js test/convention-deviation.test.js test/resource-exhaustion.test.js test/resource-exhaustion-realworld.test.js test/redirect-toctou.test.js test/redirect-toctou-realworld.test.js test/codegen-sink.test.js test/ownership-authz.test.js test/ownership-authz-realworld.test.js test/t21-precision-audit.test.js test/secrets-coverage.test.js test/prompt-injection-payloads.test.js test/iac-cloud-templates.test.js test/ruby-path-join.test.js",
+    "test:posture": "node --test test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/run-unit-tests.test.js test/release-workflow.test.js test/independent-population.test.js test/why-missed.test.js test/independent-scoring.test.js test/evidence-bundle.test.js test/policy-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/risk-scenario-disclosure.test.js test/egress-policy.test.js test/egress-policy-completeness.test.js test/egress-policy-integration.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/privacy-ir-adapter.test.js test/privacy-taxonomy.test.js test/privacy-sink-policy.test.js test/privacy-governance.test.js test/privacy-inventory.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/stdout-flush.test.js test/format-determinism.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js test/concurrency-cwe.test.js test/compliance-mapping-liveness.test.js test/compliance-severity-threshold.test.js test/compliance-severity-policy.test.js test/compliance-evidence-binding.test.js test/compliance-evidence-signing.test.js test/compliance-file-contains.test.js test/label-isolation.test.js test/evidence-grade-wording.test.js test/llm-model-status.test.js test/egress-policy-constraints.test.js test/egress-redact.test.js test/egress-audit.test.js test/egress-approved-providers.test.js test/family-registry.test.js test/coverage-strength.test.js test/framework-provenance.test.js test/third-party-verification.test.js test/proof-coverage.test.js test/calibration-holdout.test.js test/independent-population-gate.test.js test/catalog-freshness.test.js test/incremental-parity.test.js test/surface-smoke.test.js test/fix-coverage.test.js test/raw-source-carveout.test.js test/mlbom-conformance.test.js test/deploy-gate-replay.test.js test/sbom-conformance.test.js test/unscored-claims.test.js test/mcp-rug-pull.test.js test/agent-boundary-taint.test.js test/confinement-adversarial.test.js test/comment-strip-cost.test.js test/reachability-claim.test.js test/entrypoint-breadth.test.js test/dep-file-admission.test.js test/custom-rules-freshness.test.js",
+    "test:dataflow": "node --test test/privacy-catalog.test.js test/privacy-deep-walker.test.js test/privacy-deep-e2e.test.js test/container-taint.test.js test/stored-taint-families.test.js test/py-annotation-sources.test.js test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-cs-p1.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/return-sink-check.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js test/interproc-nested-call-taint.test.js test/catalog-xpath-injection.test.js test/catalog-ldap-injection.test.js test/catalog-xxe.test.js test/catalog-response-splitting.test.js test/catalog-code-injection.test.js test/parser-rb-control-flow.test.js test/catalog-ruby-p1.test.js test/callee-receiver-taint.test.js test/catalog-command-injection-p4.test.js test/catalog-xss-p4.test.js test/catalog-path-ssrf-p3.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-protocol-smoke.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js test/lsp-server.test.js",
-    "test:report": "node --test test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js test/oscal-conformance.test.js",
+    "test:report": "node --test test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/scan-health.test.js test/finding-schema.test.js test/evidence-provenance.test.js test/legacy-compat.test.js test/annotator-runner.test.js test/detector-runner.test.js test/detector-errors.test.js test/analyzer-supervisor.test.js test/cascade-worker-pool.test.js test/cascade-pool-wiring.test.js test/coverage-ledger.test.js test/coverage-ledger-completeness.test.js test/assurance-mode.test.js test/artifact-registry.test.js test/artifact-registry-completeness.test.js test/retention-policy.test.js test/state-lifecycle-report.test.js test/legal-hold.test.js test/production-feedback.test.js test/calibration-feedback.test.js test/encryption-provider.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js test/oscal-conformance.test.js test/cli-fix-apply.test.js test/apply-fix-service.test.js test/high-impact-approval-gate.test.js test/approver-registry.test.js test/suppression-exceptions.test.js test/fix-history.test.js test/producer-registry.test.js test/producer-collector.test.js test/enrichment-completion.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js test/proof-corpus-lib.test.js test/proof-corpus-runner.test.js",
     "test:lifecycle": "node --test test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs",
     "test:eval": "node --test test/independent-eval.test.js test/realworld-recall.test.js",
-    "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js",
+    "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js test/local-only-mode.test.js",
     "eval:independent": "node ../bench/independent-eval/runner.mjs",
     "eval:independent:gate": "node ../bench/independent-eval/runner.mjs --gate default",
     "smoke": "node bin/agentic-security.js scan test/fixtures/vulnerable-js",
@@ -85,6 +85,8 @@
     "bench:cve-replay:ci": "node ../bench/cve-replay/runner.mjs --ci",
     "bench:cve-replay:check": "node ../bench/cve-replay/runner.mjs --check-baseline",
     "bench:cve-replay:update-baseline": "node ../bench/cve-replay/runner.mjs --update-baseline",
+    "bench:independent:gate:check": "node ../scripts/independent-population-gate.mjs",
+    "bench:independent:update-gate-baseline": "node ../scripts/independent-population-gate.mjs --update-baseline",
     "bench:router-replay": "node ../bench/router-replay/runner.mjs",
     "bench:router-replay:check": "node ../bench/router-replay/runner.mjs --check-baseline",
     "bench:router-replay:update-baseline": "node ../bench/router-replay/runner.mjs --update-baseline",
@@ -98,6 +100,9 @@
     "bench:ttff": "node ../bench/ttff/runner.mjs",
     "bench:ttff:check": "node ../bench/ttff/runner.mjs --check",
     "bench:ttff:update-baseline": "node ../bench/ttff/runner.mjs --update-baseline",
+    "bench:memory": "node ../bench/memory/runner.mjs",
+    "bench:memory:check": "node ../bench/memory/runner.mjs --check",
+    "bench:memory:update-baseline": "node ../bench/memory/runner.mjs --update-baseline",
     "bench:self-scan": "node ../bench/self-scan/measure.mjs",
     "bench:self-scan:check": "node ../bench/self-scan/check.mjs",
     "bench:mutation:check": "node ../bench/mutation/runner.mjs",
@@ -113,6 +118,9 @@
     "bench:layer-recall": "node ../bench/layer-recall/runner.mjs",
     "bench:layer-recall:check": "node ../bench/layer-recall/runner.mjs --check",
     "bench:layer-recall:update-baseline": "node ../bench/layer-recall/runner.mjs --update-baseline",
+    "bench:privacy-recall": "node ../bench/privacy-recall/measure.mjs",
+    "bench:privacy-recall:check": "node ../bench/privacy-recall/check.mjs",
+    "bench:privacy-recall:update-baseline": "node ../bench/privacy-recall/check.mjs --update-baseline",
     "bench:self-scan:update-baseline": "node ../bench/self-scan/check.mjs --update-baseline",
     "bench:engine-recall": "node ../bench/engine-recall/measure.mjs",
     "scorecard": "node ../scripts/scorecard.mjs",
@@ -151,4 +159,4 @@
   "bugs": {
     "url": "https://github.com/Clear-Capabilities/agentic-security/issues"
   }
-}
+}

package/src/dataflow/index.js

@@ -18,6 +18,7 @@ import { runIfdsTaintEngine } from './ifds.js';
 import { proveExploits } from './exploit-prover.js';
 import { applyStubAwareFilter } from './stub-aware-filter.js';
 import { loadProjectStubs } from '../ir/type-stubs.js';
+import { runPrivacyTaintEngine } from './privacy-deep-walker.js';
 
 export function runDeepAnalysis(perFileIR, callGraph, opts = {}) {
   // Path-feasibility pass over every function before the taint walk.
@@ -121,6 +122,23 @@ export function runDeepAnalysis(perFileIR, callGraph, opts = {}) {
       }
     } catch { /* IFDS failure should not fail the scan */ }
   }
+  // FR-403 step 3 (assurance-hardening PRD, D-0047): opt-in, isolated
+  // privacy-taint walker. OFF by default. Mirrors the IFDS wiring above
+  // exactly -- an additional pass whose findings are merged in, never
+  // replacing the primary engine's output, and whose failure must never
+  // fail the scan. See dataflow/privacy-deep-walker.js's own header for why
+  // this is a wholly separate module rather than a change to runTaintEngine/
+  // step/exprTaint above.
+  if (process.env.AGENTIC_SECURITY_PRIVACY_DEEP === '1') {
+    try {
+      const privacyFindings = runPrivacyTaintEngine(callGraph, opts);
+      const existing = new Set(findings.map(f => `${f.file}:${f.line}:${f.sink?.label || f.cwe || ''}`));
+      for (const f of privacyFindings) {
+        const key = `${f.file}:${f.line}:${f.sink?.label || f.cwe || ''}`;
+        if (!existing.has(key)) findings.push(f);
+      }
+    } catch { /* privacy-deep failure should not fail the scan */ }
+  }
   for (const f of findings) f._pathFeasibilityPruned = totalPruned;
   if (preSeededCache) {
     Object.defineProperty(findings, '_incrementalStats', {

package/src/dataflow/privacy-catalog.js

@@ -0,0 +1,290 @@
+// FR-403 (assurance-hardening PRD), Steps 1-2 of D-0041's decomposition plan:
+// "Track flows through ... storage, logs, responses, analytics, email,
+// files, object storage, queues, and outbound APIs."
+//
+// STEP 1: A catalog of PRIVACY-LEAK (CWE-359) sink entries, in the EXACT shape
+// `dataflow/catalog.js` already uses for every other family (see that
+// module's own header for the full `{kind, id, language, framework, match,
+// argIndex, vuln}` contract) — mirroring `privacy-taint.js`'s existing
+// `SINK_PATTERNS` (log/response/outboundHttp/thirdPartySdk/fileWrite/
+// s3Upload/emailSend) plus the 2 sink categories FR-403 names that had no
+// coverage anywhere (generic storage/DB, queues).
+//
+// DELIBERATELY NOT MERGED INTO `catalog.js`'s own `CATALOG` EXPORT, and NOT
+// wired into `matchSinkOrSanitizer`/`runTaintEngine` — this is the single
+// most important design decision in this file, found DURING implementation
+// (not anticipated by D-0041's original grounding pass, which characterized
+// step 1 as "zero behavior change"). `CATALOG` is a shared, always-active
+// singleton: matchSinkOrSanitizer/matchSource read it unconditionally for
+// EVERY scan, with no per-family or per-source filtering at the taint-state
+// level (a tainted value's origin family is never recorded — only whether
+// it is tainted at all). Appending these sink entries directly to `CATALOG`
+// would therefore make them reachable by every ALREADY-ACTIVE general
+// security source (`req.body`, `req.query`, etc.) immediately, producing
+// spurious CWE-359 "privacy-leak" findings for ordinary attacker-input
+// flows that have nothing to do with data actually classified PII/PHI/PCI
+// by `privacy-taxonomy.js` — a real, immediate false-positive class, not
+// the "zero risk" step D-0041's own step 1 was meant to be. Keeping this
+// catalog in its own file, imported by nothing yet, is what makes it
+// genuinely inert: these entries do not affect any scan's output until a
+// future step (D-0041 step 3) builds a privacy-specific matcher that
+// consults ONLY the sources `privacy-taxonomy.js` actually classifies,
+// never the general engine's already-active source set.
+//
+// Registered in `test/no-dead-modules.test.js`'s ALLOWLIST — a deliberate,
+// staged capability with no consumer yet, not an oversight.
+
+import { classifyFieldAgainst } from './privacy-taxonomy.js';
+import { _languageFamilyExtensions } from './catalog.js';
+
+export const PRIVACY_SINK_CATALOG = [
+  // ── log ──────────────────────────────────────────────────────────────────
+  { kind: 'sink', id: 'privacy-js-console-log', language: 'js', framework: 'node', category: 'log',
+    match: { type: 'call', callee: 'log', receiverTypeIn: ['console'] }, argIndex: 'all',
+    vuln: { name: 'Privacy Leak (console.log)', severity: 'medium', cwe: 'CWE-359',
+            remediation: 'Do not log regulated data (PII/PHI/PCI). Redact or hash the field before logging.' } },
+  { kind: 'sink', id: 'privacy-js-console-error', language: 'js', framework: 'node', category: 'log',
+    match: { type: 'call', callee: 'error', receiverTypeIn: ['console'] }, argIndex: 'all',
+    vuln: { name: 'Privacy Leak (console.error)', severity: 'medium', cwe: 'CWE-359',
+            remediation: 'Do not log regulated data (PII/PHI/PCI). Redact or hash the field before logging.' } },
+  { kind: 'sink', id: 'privacy-js-logger-info', language: 'js', framework: 'node', category: 'log',
+    match: { type: 'call', callee: 'info', receiverTypeIn: ['log|logger|Logger'] }, argIndex: 'all',
+    vuln: { name: 'Privacy Leak (logger.info)', severity: 'medium', cwe: 'CWE-359',
+            remediation: 'Do not log regulated data (PII/PHI/PCI). Redact or hash the field before logging.' } },
+  { kind: 'sink', id: 'privacy-js-logger-warn', language: 'js', framework: 'node', category: 'log',
+    match: { type: 'call', callee: 'warn', receiverTypeIn: ['log|logger|Logger'] }, argIndex: 'all',
+    vuln: { name: 'Privacy Leak (logger.warn)', severity: 'medium', cwe: 'CWE-359',
+            remediation: 'Do not log regulated data (PII/PHI/PCI). Redact or hash the field before logging.' } },
+
+  // ── response ─────────────────────────────────────────────────────────────
+  { kind: 'sink', id: 'privacy-js-res-send', language: 'js', framework: 'express', category: 'response',
+    match: { type: 'call', callee: 'send', receiverTypeIn: ['res|response'] }, argIndex: 0,
+    vuln: { name: 'Privacy Leak (response body)', severity: 'high', cwe: 'CWE-359',
+            remediation: 'Do not return regulated data (PII/PHI/PCI) in an API response unless the requester is authorized and the field is required.' } },
+  { kind: 'sink', id: 'privacy-js-res-json', language: 'js', framework: 'express', category: 'response',
+    match: { type: 'call', callee: 'json', receiverTypeIn: ['res|response'] }, argIndex: 0,
+    vuln: { name: 'Privacy Leak (response body)', severity: 'high', cwe: 'CWE-359',
+            remediation: 'Do not return regulated data (PII/PHI/PCI) in an API response unless the requester is authorized and the field is required.' } },
+
+  // ── outboundHttp ─────────────────────────────────────────────────────────
+  { kind: 'sink', id: 'privacy-js-fetch', language: 'js', framework: 'browser', category: 'outboundHttp',
+    match: { type: 'call', callee: 'fetch' }, argIndex: 1,
+    vuln: { name: 'Privacy Leak (outbound HTTP request)', severity: 'high', cwe: 'CWE-359',
+            remediation: 'Do not send regulated data (PII/PHI/PCI) to a third-party endpoint without a documented data-processing agreement.' } },
+  { kind: 'sink', id: 'privacy-js-axios-post', language: 'js', framework: 'axios', category: 'outboundHttp',
+    match: { type: 'call', callee: 'post', receiverTypeIn: ['axios'] }, argIndex: 1,
+    vuln: { name: 'Privacy Leak (outbound HTTP request)', severity: 'high', cwe: 'CWE-359',
+            remediation: 'Do not send regulated data (PII/PHI/PCI) to a third-party endpoint without a documented data-processing agreement.' } },
+
+  // ── thirdPartySdk (analytics) ────────────────────────────────────────────
+  { kind: 'sink', id: 'privacy-js-analytics-track', language: 'js', framework: 'analytics', category: 'thirdPartySdk',
+    match: { type: 'call', callee: 'track', receiverTypeIn: ['stripe|sentry|datadog|segment|amplitude|mixpanel|posthog|braze|intercom|analytics'] }, argIndex: 'all',
+    vuln: { name: 'Privacy Leak (third-party analytics)', severity: 'high', cwe: 'CWE-359',
+            remediation: 'Do not send regulated data (PII/PHI/PCI) to an analytics/SDK provider — pseudonymize identifiers instead of raw fields.' } },
+  { kind: 'sink', id: 'privacy-js-analytics-identify', language: 'js', framework: 'analytics', category: 'thirdPartySdk',
+    match: { type: 'call', callee: 'identify', receiverTypeIn: ['stripe|sentry|datadog|segment|amplitude|mixpanel|posthog|braze|intercom|analytics'] }, argIndex: 'all',
+    vuln: { name: 'Privacy Leak (third-party analytics)', severity: 'high', cwe: 'CWE-359',
+            remediation: 'Do not send regulated data (PII/PHI/PCI) to an analytics/SDK provider — pseudonymize identifiers instead of raw fields.' } },
+
+  // ── fileWrite ────────────────────────────────────────────────────────────
+  { kind: 'sink', id: 'privacy-js-fs-writeFile', language: 'js', framework: 'node', category: 'fileWrite',
+    match: { type: 'call', callee: 'writeFile', receiverTypeIn: ['fs'] }, argIndex: 1,
+    vuln: { name: 'Privacy Leak (file write)', severity: 'medium', cwe: 'CWE-359',
+            remediation: 'Do not write regulated data (PII/PHI/PCI) to an unencrypted file without a documented retention and access-control policy.' } },
+  { kind: 'sink', id: 'privacy-js-fs-writeFileSync', language: 'js', framework: 'node', category: 'fileWrite',
+    match: { type: 'call', callee: 'writeFileSync', receiverTypeIn: ['fs'] }, argIndex: 1,
+    vuln: { name: 'Privacy Leak (file write)', severity: 'medium', cwe: 'CWE-359',
+            remediation: 'Do not write regulated data (PII/PHI/PCI) to an unencrypted file without a documented retention and access-control policy.' } },
+
+  // ── s3Upload (object storage) ────────────────────────────────────────────
+  { kind: 'sink', id: 'privacy-js-s3-putObject', language: 'js', framework: 'aws-sdk', category: 's3Upload',
+    match: { type: 'call', callee: 'putObject', receiverTypeIn: ['s3|S3Client|aws'] }, argIndex: 0,
+    vuln: { name: 'Privacy Leak (object storage upload)', severity: 'high', cwe: 'CWE-359',
+            remediation: 'Do not upload regulated data (PII/PHI/PCI) to object storage without server-side encryption and a documented access policy.' } },
+
+  // ── emailSend ────────────────────────────────────────────────────────────
+  { kind: 'sink', id: 'privacy-js-sendMail', language: 'js', framework: 'nodemailer', category: 'emailSend',
+    match: { type: 'call', callee: 'sendMail' }, argIndex: 0,
+    vuln: { name: 'Privacy Leak (outbound email)', severity: 'medium', cwe: 'CWE-359',
+            remediation: 'Do not include regulated data (PII/PHI/PCI) in an outbound email body beyond what the recipient is authorized to receive.' } },
+
+  // ── storage (generic DB — the first of FR-403's 2 previously-uncovered categories) ──
+  { kind: 'sink', id: 'privacy-js-mongo-insertOne', language: 'js', framework: 'mongodb', category: 'storage',
+    match: { type: 'call', callee: 'insertOne', receiverTypeIn: ['collection|db|mongo'] }, argIndex: 0,
+    vuln: { name: 'Privacy Leak (database write)', severity: 'medium', cwe: 'CWE-359',
+            remediation: 'Regulated data (PII/PHI/PCI) written to a database must be covered by a documented retention, access-control, and encryption-at-rest policy.' } },
+  { kind: 'sink', id: 'privacy-js-mongo-insertMany', language: 'js', framework: 'mongodb', category: 'storage',
+    match: { type: 'call', callee: 'insertMany', receiverTypeIn: ['collection|db|mongo'] }, argIndex: 0,
+    vuln: { name: 'Privacy Leak (database write)', severity: 'medium', cwe: 'CWE-359',
+            remediation: 'Regulated data (PII/PHI/PCI) written to a database must be covered by a documented retention, access-control, and encryption-at-rest policy.' } },
+
+  // ── queues (the second of FR-403's 2 previously-uncovered categories) ────
+  { kind: 'sink', id: 'privacy-js-queue-sendMessage', language: 'js', framework: 'aws-sdk', category: 'queues',
+    match: { type: 'call', callee: 'sendMessage', receiverTypeIn: ['queue|sqs|SQS'] }, argIndex: 0,
+    vuln: { name: 'Privacy Leak (message queue)', severity: 'medium', cwe: 'CWE-359',
+            remediation: 'Regulated data (PII/PHI/PCI) placed on a queue is readable by every consumer with queue access — document who can subscribe before sending it.' } },
+  { kind: 'sink', id: 'privacy-js-queue-publish', language: 'js', framework: 'pubsub', category: 'queues',
+    match: { type: 'call', callee: 'publish', receiverTypeIn: ['queue|sns|SNS|topic|pubsub|kafka|producer'] }, argIndex: 0,
+    vuln: { name: 'Privacy Leak (message queue)', severity: 'medium', cwe: 'CWE-359',
+            remediation: 'Regulated data (PII/PHI/PCI) placed on a queue is readable by every consumer with queue access — document who can subscribe before sending it.' } },
+];
+
+// All 9 sink categories FR-403 names (7 already covered by privacy-taint.js's
+// own SINK_PATTERNS, plus storage/queues) — used by this module's own tests
+// to assert coverage is genuinely complete, not just "some entries exist."
+export const PRIVACY_SINK_CATEGORIES = Object.freeze([
+  'log', 'response', 'outboundHttp', 'thirdPartySdk', 'fileWrite', 's3Upload', 'emailSend', 'storage', 'queues',
+]);
+
+// ─── D-0041 STEP 2: a "declared-as" source matcher ─────────────────────────
+//
+// The one genuine gap `catalog.js`'s existing `match.type` shapes (`call`,
+// `member`, `global`, `annotation`) leave uncovered: every one of them
+// matches an EXPRESSION PATTERN (a specific callee, a specific property
+// read, a specific decorator). A privacy source is a different kind of
+// fact entirely — "this declaration's NAME classifies as PII/PHI/PCI/etc."
+// — decided by `privacy-taxonomy.js`'s regex-per-class taxonomy, not by
+// what expression touches it. There is no fixed name to put in a `match`
+// object; the classification must run against WHATEVER name a declaration
+// actually has.
+//
+// Modeled after `matchAnnotationParams` (catalog.js) rather than the CFG-
+// node matchers: that function is also NOT consulted mid-walk against an
+// expression — it runs ONCE PER FUNCTION against the IR's own
+// `fn.paramAnnotations` side-channel, before the walk starts, and its
+// result is unioned into the entry taint-state (see `dataflow/CLAUDE.md`'s
+// own note that annotation matching "is not consulted during the CFG
+// walk"). `matchPrivacyDeclSource(s)` below follow that same shape:
+// pure, pre-walk, name-classification functions a future step 3 will call
+// once per function/file against real declaration names, unioning any hit
+// into a privacy-specific entry taint-state — never against `catalog.js`'s
+// own `CATALOG`, for the exact isolation reason this file's header
+// explains for the sink half.
+
+/**
+ * Classify one declaration name. Returns `{name, classes}` when it matches
+ * at least one taxonomy class, or `null` when it matches none — `null`
+ * rather than `{name, classes: []}` so a caller can filter with a plain
+ * truthiness check, matching `classifyFieldAgainst`'s own "empty array
+ * means no match" contract one level up.
+ */
+export function matchPrivacyDeclSource(declName, compiled) {
+  if (!declName) return null;
+  const classes = classifyFieldAgainst(declName, compiled);
+  return classes.length ? { name: declName, classes } : null;
+}
+
+/**
+ * Classify every name in a list of declarations (variable names, function
+ * params, object-literal keys — whatever a caller's IR extraction
+ * produces) against the taxonomy. Returns a Map<name, classes[]> so a
+ * caller gets both "which names are sources" (the key set) and "which
+ * classes triggered it" (the value) in one pass, without re-classifying.
+ * Never throws on malformed input — a non-array degrades to an empty Map.
+ */
+export function matchPrivacyDeclSources(declNames, compiled) {
+  const out = new Map();
+  for (const name of Array.isArray(declNames) ? declNames : []) {
+    const hit = matchPrivacyDeclSource(name, compiled);
+    if (hit) out.set(hit.name, hit.classes);
+  }
+  return out;
+}
+
+// D-0046/D-0047 (FR-403 step 3, grounding): mirrors `catalog.js`'s
+// matchSinkOrSanitizer(calleeExpr, file, receiverType) shape/contract
+// exactly (array of hits, or null) so a future isolated privacy walker can
+// consult it the same way the general walker consults the general catalog
+// -- but reads ONLY PRIVACY_SINK_CATALOG, never CATALOG. This is a linear
+// scan, not `catalog.js`'s CALLEE_INDEX Map lookup: at ~20 entries a scan is
+// plenty fast, and avoiding the shared index machinery (which is private/
+// unexported, and keyed by a shared module-level Map) keeps the two
+// catalogs fully decoupled -- exactly the isolation D-0042 requires, now
+// extended to the sink-matching CODE PATH, not just the entry DATA.
+// `_languageFamilyExtensions` is the one thing imported from catalog.js: a
+// pure, stateless helper with no shared mutable state and no coupling to
+// the general taint engine's behavior, reused to avoid duplicating the
+// language-extension regex table.
+
+function _privacyLanguageAllowed(entry, file) {
+  if (!file) return true;
+  const res = _languageFamilyExtensions(entry.language);
+  if (!res.length) return true; // unmapped language stays permissive
+  return res.some((re) => re.test(file));
+}
+
+function _privacyReceiverTypeAllowed(entry, receiverType) {
+  const pats = entry.match && entry.match.receiverTypeIn;
+  if (!pats || !pats.length) return true;
+  if (!receiverType) return true;
+  return pats.some((p) => new RegExp(p, 'i').test(String(receiverType)));
+}
+
+// Duplicated from catalog.js's private (unexported) `_calleeIndexHits`
+// name-extraction logic rather than exporting it from catalog.js -- keeping
+// this file's only catalog.js dependency to the one pure helper above.
+function _privacyCalleeNames(calleeExpr) {
+  let last = null;
+  let full = null;
+  if (typeof calleeExpr === 'string') {
+    full = calleeExpr;
+    last = calleeExpr.includes('.') ? calleeExpr.slice(calleeExpr.lastIndexOf('.') + 1) : calleeExpr;
+  } else if (calleeExpr && calleeExpr.kind === 'member' && calleeExpr.prop) {
+    last = calleeExpr.prop;
+    if (calleeExpr.object && calleeExpr.object.kind === 'ident') full = `${calleeExpr.object.name}.${calleeExpr.prop}`;
+  } else if (calleeExpr && calleeExpr.kind === 'ident') {
+    last = calleeExpr.name || null;
+  }
+  return { last, full };
+}
+
+export function matchPrivacySink(calleeExpr, file, receiverType) {
+  if (!calleeExpr) return null;
+  const { last, full } = _privacyCalleeNames(calleeExpr);
+  if (!last && !full) return null;
+  const hits = PRIVACY_SINK_CATALOG.filter((e) => {
+    if (!e || e.kind !== 'sink') return false;
+    const cName = e.match && e.match.callee;
+    if (!cName) return false;
+    if (cName !== last && cName !== full) return false;
+    if (!_privacyLanguageAllowed(e, file)) return false;
+    if (!_privacyReceiverTypeAllowed(e, receiverType)) return false;
+    return true;
+  });
+  return hits.length ? hits : null;
+}
+
+// FR-403 step 3, item (d): safe-transformation recognition. Mirrors
+// dataflow/CLAUDE.md's own documented philosophy for the general engine's
+// sanitizers EXACTLY -- "Sanitizer entries are RECORDED, never trusted to
+// kill taint" -- for the identical reason: a value hashed/masked/encrypted
+// might still be REVERSIBLE (a weak hash, a partial mask, a home-rolled
+// "encrypt" that's really just base64) or applied on only ONE branch. A
+// privacy-deep finding that passed through one of these callees is
+// DEMOTED (confidence, never severity/existence), not deleted -- the same
+// recall-preserving direction every other precision annotator in this
+// codebase takes. A named list, not exhaustive, mirroring engine.js's own
+// _UNSANITIZER_CALLEES precedent (dataflow/CLAUDE.md: "modelled, but only
+// for a named list... a project-local decoder is not recognised").
+const PRIVACY_TRANSFORM_CALLEES = new Set([
+  // Cryptographic hash (one-way, not generally reversible)
+  'createHash', 'sha256', 'sha512', 'md5', 'hash', 'hashSync', 'hashPassword',
+  // Password/key-derivation hashing
+  'bcrypt', 'scrypt', 'pbkdf2', 'pbkdf2Sync', 'argon2',
+  // Symmetric/asymmetric encryption
+  'createCipher', 'createCipheriv', 'encrypt', 'seal',
+  // Masking / redaction / anonymization -- named, not pattern-matched, since
+  // a bare substring match on "mask" would over-fire on unrelated code
+  // (e.g. a bitmask helper named `applyMask`).
+  'mask', 'redact', 'anonymize', 'pseudonymize', 'tokenize',
+]);
+
+/**
+ * True when `calleeExpr` is one of the named privacy-transform callees.
+ * Mirrors matchPrivacySink's own bare/dotted callee-name matching.
+ */
+export function isPrivacyTransformCallee(calleeExpr) {
+  if (!calleeExpr) return false;
+  const { last, full } = _privacyCalleeNames(calleeExpr);
+  return PRIVACY_TRANSFORM_CALLEES.has(last) || PRIVACY_TRANSFORM_CALLEES.has(full);
+}