@clear-capabilities/agentic-security-scanner 0.145.0 → 0.147.5

package/dist/frontend/styles/tokens.css

@@ -0,0 +1,128 @@
+/*
+ * Data Flow Explorer design tokens (PRD §8.1). Dark is the reference theme.
+ * Values are copied verbatim from the PRD — do not adjust without a
+ * deliberate, separately-reviewed change.
+ */
+
+:root {
+  /* Surfaces */
+  --surface-canvas: #061625;
+  --surface-panel: #0B1E2F;
+  --surface-elevated: #102A40;
+  --border-default: #28445A;
+
+  /* Text */
+  --text-primary: #F3F7FA;
+  --text-secondary: #9FB3C5;
+
+  /* Selection / focus */
+  --accent-selection: #3DA9FF;
+
+  /* Protection verdict status */
+  --status-protected: #59D17D;
+  --status-unprotected: #FF625C;
+  --status-unknown: #F5B83D;
+
+  /* Text color for content painted directly on a status token background
+     (e.g. the coverage banner). NOT the same as --text-primary, which is
+     sized against --surface-canvas/--surface-panel, not against a status
+     color. Verified with lib/contrast.js's contrastRatio(): #061625 on
+     dark --status-unknown (#F5B83D) is 10.27:1. See the light-theme block
+     below for the light-theme value and its own verified ratio. */
+  --status-banner-text: #061625;
+
+  /* AI processing context */
+  --context-ai: #B47AFF;
+
+  /* Data class overlays */
+  --class-pii: #28D1C5;
+  --class-phi: #A97BFF;
+  --class-pci: #4CA7FF;
+
+  /* Spacing (8px grid, PRD §7.7) */
+  --space-1: 8px;
+  --space-2: 16px;
+  --space-3: 24px;
+  --space-4: 32px;
+
+  /* Radius / border (PRD §8.2) */
+  --radius-default: 8px;
+  --border-width: 1px;
+
+  /* Typography (PRD §8.2) — bundled system stack; never a remote/CDN font */
+  --font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+  --font-mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  --font-size-view-title: 23px;
+  --font-size-panel-title: 15px;
+  --font-size-node-title: 14px;
+  --font-size-body: 13px;
+  --font-size-code: 12.5px;
+
+  /* Motion (PRD §8.2 — focus/topology change only, no ambient animation) */
+  --motion-duration: 200ms;
+  --motion-duration-reduced: 0ms;
+
+  /* Shell region sizing (PRD §7.7) */
+  --header-height: 56px;
+  --view-tabs-height: 44px;
+  --left-rail-width: 248px;
+  --left-rail-collapsed-width: 56px;
+  --right-inspector-width: 360px;
+  --context-rail-height: 72px;
+}
+
+/* Light theme — same semantic tokens, WCAG-AA-equivalent contrast (PRD §8.1/§23) */
+:root[data-theme="light"] {
+  --surface-canvas: #FFFFFF;
+  --surface-panel: #F4F7FA;
+  --surface-elevated: #E7EEF3;
+  --border-default: #C7D3DC;
+
+  --text-primary: #0B1E2F;
+  --text-secondary: #3E5568;
+
+  --accent-selection: #1B6FC2;
+
+  /* status-protected and status-unknown darkened slightly from their
+     original values (#1E8A4C, #9A6B00) — Milestone 3, sub-project A11y,
+     found via test/tokens-contrast.test.js that both originals failed
+     WCAG AA (4.5:1) against --surface-panel (#F4F7FA): 4.07:1 and 4.36:1
+     respectively. Verified with lib/contrast.js's contrastRatio() against
+     BOTH backgrounds a status color plausibly renders on: --status-
+     protected (#1C8047) is 4.97:1 on --surface-canvas / 4.62:1 on
+     --surface-panel; --status-unknown (#956700) is 4.98:1 / 4.63:1. Both
+     now clear AA with margin (>=4.6) rather than sitting at the exact
+     4.50 boundary, which is fragile against hex-rounding. --status-
+     unprotected was already compliant (5.26:1 / 4.89:1), unchanged. */
+  --status-protected: #1C8047;
+  --status-unprotected: #C7362D;
+  --status-unknown: #956700;
+
+  /* Verified with lib/contrast.js's contrastRatio(): #FFFFFF on light
+     --status-unknown (#956700) is 4.98:1 (>= 4.5:1 AA). The dark-block
+     value (#061625, --surface-canvas's own dark value) is 3.90:1 here --
+     below AA -- which is the bug this token pair fixes: shell.css must
+     never hardcode dark theme's value and expect it to also work in
+     light theme. */
+  --status-banner-text: #FFFFFF;
+
+  --context-ai: #6E38B8;
+
+  --class-pii: #0E7C73;
+  --class-phi: #6E44B8;
+  --class-pci: #1C63A8;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  :root {
+    --motion-duration: var(--motion-duration-reduced);
+  }
+}
+
+body {
+  background: var(--surface-canvas);
+  color: var(--text-primary);
+  font-family: var(--font-family);
+  font-size: var(--font-size-body);
+  margin: 0;
+}

package/dist/frontend/styles/trace-view.css

@@ -0,0 +1,95 @@
+.trace-view {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-2);
+  max-width: 640px;
+}
+
+.trace-step {
+  display: flex;
+  gap: var(--space-2);
+  padding: var(--space-2);
+  background: var(--surface-panel);
+  border: var(--border-width) solid var(--border-default);
+  border-radius: var(--radius-default);
+}
+
+.trace-step-number {
+  flex: 0 0 auto;
+  width: 24px;
+  height: 24px;
+  border-radius: 50%;
+  background: var(--surface-elevated);
+  color: var(--text-primary);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: var(--font-size-code);
+  font-weight: 600;
+}
+
+.trace-step-body {
+  flex: 1 1 auto;
+}
+
+.trace-step-kind {
+  color: var(--text-secondary);
+  font-size: var(--font-size-code);
+  text-transform: uppercase;
+}
+
+.trace-step-mapping {
+  font-family: var(--font-mono);
+  font-size: var(--font-size-code);
+  color: var(--text-primary);
+  margin: 4px 0;
+}
+
+.trace-step-node {
+  color: var(--text-secondary);
+  font-size: var(--font-size-body);
+}
+
+.trace-step-boundary {
+  display: inline-block;
+  border: 1px solid var(--status-unprotected);
+  color: var(--status-unprotected);
+  border-radius: var(--radius-default);
+  padding: 1px 6px;
+  font-size: var(--font-size-code);
+  margin-top: 4px;
+}
+
+.trace-branch-group {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-2);
+  padding-left: var(--space-2);
+  border-left: 2px solid var(--accent-selection);
+}
+
+.trace-branch-label {
+  color: var(--text-secondary);
+  font-size: var(--font-size-code);
+  text-transform: uppercase;
+}
+
+.trace-alternates {
+  margin-top: var(--space-2);
+}
+
+.trace-alternate-item {
+  padding: var(--space-1) 0;
+  cursor: pointer;
+  color: var(--text-secondary);
+}
+
+.trace-alternate-item:hover {
+  color: var(--text-primary);
+}
+
+.trace-empty {
+  color: var(--text-secondary);
+  font-style: italic;
+  padding: var(--space-2);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.145.0",
+  "version": "0.147.5",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -56,19 +56,21 @@
     "lodash-es": "^4.18.1"
   },
   "scripts": {
-    "build": "ncc build bin/agentic-security.js -o dist --minify -e web-tree-sitter -e tree-sitter-wasms && rm -rf dist/compliance-frameworks && mkdir -p dist/compliance-frameworks && cp src/posture/compliance-frameworks/*.json dist/compliance-frameworks/ && mv dist/index.js dist/agentic-security.mjs && rm -f dist/package.json && chmod +x dist/agentic-security.mjs && node -e \"const fs=require('fs');const p='dist/agentic-security.mjs';const c=fs.readFileSync(p,'utf8');if(!c.startsWith('#!'))fs.writeFileSync(p,'#!/usr/bin/env node\\n'+c);\" && node -e \"const fs=require('fs');const c=require('crypto');const h=c.createHash('sha256').update(fs.readFileSync('dist/agentic-security.mjs')).digest('hex');fs.writeFileSync('dist/agentic-security.mjs.sha256',h+'  agentic-security.mjs\\n');\"",
+    "build": "ncc build bin/agentic-security.js -o dist --minify -e web-tree-sitter -e tree-sitter-wasms && rm -rf dist/compliance-frameworks && mkdir -p dist/compliance-frameworks && cp src/posture/compliance-frameworks/*.json dist/compliance-frameworks/ && node scripts/copy-frontend.mjs && mv dist/index.js dist/agentic-security.mjs && rm -f dist/package.json && chmod +x dist/agentic-security.mjs && node -e \"const fs=require('fs');const p='dist/agentic-security.mjs';const c=fs.readFileSync(p,'utf8');if(!c.startsWith('#!'))fs.writeFileSync(p,'#!/usr/bin/env node\\n'+c);\" && node -e \"const fs=require('fs');const c=require('crypto');const h=c.createHash('sha256').update(fs.readFileSync('dist/agentic-security.mjs')).digest('hex');fs.writeFileSync('dist/agentic-security.mjs.sha256',h+'  agentic-security.mjs\\n');\"",
     "prepare": "node ../scripts/pre-push-gate.mjs --install-hook",
     "prepublishOnly": "npm run build && node ../scripts/sync-scanner-changelog.mjs && node ../scripts/release-check.mjs",
-    "test": "node ../scripts/run-unit-tests.mjs && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js && node --experimental-test-module-mocks --test test/fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection-k8s-admission.test.js && npm run test:python",
+    "test": "node ../scripts/run-unit-tests.mjs && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js && node --experimental-test-module-mocks --test test/fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection-k8s-admission.test.js && node --experimental-test-module-mocks --test test/lineage-fault-injection.test.js && npm run test:python",
     "test:python": "node ../scripts/run-python-tests.mjs",
     "test:smoke": "node --test test/smoke.test.js test/demo-app.test.js",
     "test:glob": "node --test test/glob-compat.test.js",
     "test:sast": "node --test test/cpp-hardcoded-secret.test.js test/sibling-guard.test.js test/comment-blindness.test.js test/crypto-specialist.test.js test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/zip-slip-containment-guard.test.js test/redos-anchoring.test.js test/path-guard-validator-call.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/mcp-audit-scan.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/guard-window-identifier-correlation.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/secret-redaction.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js test/adversarial-robustness.test.js test/secret-entropy.test.js test/comment-strip.test.js test/juliet-path-filter-gate.test.js test/java-bench-shape-opt-in.test.js test/reachability-missing-callgraph-data.test.js test/rate-limit.test.js test/auth-signals.test.js test/convention-deviation.test.js test/resource-exhaustion.test.js test/resource-exhaustion-realworld.test.js test/redirect-toctou.test.js test/redirect-toctou-realworld.test.js test/codegen-sink.test.js test/ownership-authz.test.js test/ownership-authz-realworld.test.js test/t21-precision-audit.test.js test/secrets-coverage.test.js test/prompt-injection-payloads.test.js test/iac-cloud-templates.test.js test/ruby-path-join.test.js test/sast/manifest-line-tracking.test.js",
-    "test:posture": "node --test test/git-hardening.test.js test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/run-unit-tests.test.js test/release-workflow.test.js test/independent-population.test.js test/why-missed.test.js test/independent-scoring.test.js test/evidence-bundle.test.js test/policy-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/risk-scenario-disclosure.test.js test/egress-policy.test.js test/egress-policy-completeness.test.js test/egress-policy-integration.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/privacy-ir-adapter.test.js test/privacy-taxonomy.test.js test/privacy-sink-policy.test.js test/privacy-governance.test.js test/privacy-inventory.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/stdout-flush.test.js test/format-determinism.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js test/concurrency-cwe.test.js test/compliance-mapping-liveness.test.js test/compliance-severity-threshold.test.js test/compliance-severity-policy.test.js test/compliance-evidence-binding.test.js test/compliance-evidence-signing.test.js test/compliance-file-contains.test.js test/label-isolation.test.js test/evidence-grade-wording.test.js test/llm-model-status.test.js test/egress-policy-constraints.test.js test/egress-redact.test.js test/egress-audit.test.js test/egress-approved-providers.test.js test/family-registry.test.js test/coverage-strength.test.js test/framework-provenance.test.js test/framework-provenance-controlrefs.test.js test/third-party-verification.test.js test/proof-coverage.test.js test/calibration-holdout.test.js test/independent-population-gate.test.js test/catalog-freshness.test.js test/incremental-parity.test.js test/surface-smoke.test.js test/fix-coverage.test.js test/raw-source-carveout.test.js test/mlbom-conformance.test.js test/deploy-gate-replay.test.js test/sbom-conformance.test.js test/unscored-claims.test.js test/mcp-rug-pull.test.js test/agent-boundary-taint.test.js test/confinement-adversarial.test.js test/comment-strip-cost.test.js test/reachability-claim.test.js test/entrypoint-breadth.test.js test/dep-file-admission.test.js test/custom-rules-freshness.test.js test/posture/provenance-schema.test.js test/posture/provenance-cache.test.js test/helpers/build-git-fixture.test.js test/posture/provenance-git-evidence.test.js test/posture/provenance-dag-walk.test.js test/posture/provenance-confidence.test.js test/posture/provenance-predicate-replay.test.js test/posture/provenance-origin-resolver.test.js test/posture/provenance-ai-authorship.test.js test/posture/provenance-branch-entry.test.js test/posture/provenance-evidence-attribution.test.js test/posture/provenance-lifecycle.test.js test/posture/provenance-missing-control-resolver.test.js test/posture/provenance-missing-control-wiring.test.js test/posture/provenance-coordinator.test.js test/posture/provenance-sca-origin.test.js test/posture/provenance-transitive-sca.test.js test/posture/provenance-coordinator-sca.test.js test/posture/provenance-providers.test.js test/posture/provenance-evidence-bundle.test.js test/posture/provenance-repo-lineage.test.js test/posture/provenance-secrets-logic.test.js test/cli/provenance-flags.test.js test/cli/attest-provenance.test.js test/security/provenance-safety.test.js test/security/provenance-injection.test.js",
-    "test:dataflow": "node --test test/privacy-catalog.test.js test/privacy-deep-walker.test.js test/privacy-deep-e2e.test.js test/container-taint.test.js test/stored-taint-families.test.js test/py-annotation-sources.test.js test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-cs-p1.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/return-sink-check.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js test/interproc-nested-call-taint.test.js test/catalog-xpath-injection.test.js test/catalog-ldap-injection.test.js test/catalog-xxe.test.js test/catalog-response-splitting.test.js test/catalog-code-injection.test.js test/parser-rb-control-flow.test.js test/catalog-ruby-p1.test.js test/callee-receiver-taint.test.js test/catalog-command-injection-p4.test.js test/catalog-xss-p4.test.js test/catalog-path-ssrf-p3.test.js test/dataflow/provenance-pipeline-integration.test.js",
-    "test:mcp": "node --test test/mcp.test.js test/mcp-protocol-smoke.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js test/lsp-server.test.js",
+    "test:posture": "node --test test/git-hardening.test.js test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/run-unit-tests.test.js test/release-workflow.test.js test/independent-population.test.js test/why-missed.test.js test/independent-scoring.test.js test/evidence-bundle.test.js test/obligation-evidence-pack.test.js test/policy-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/risk-scenario-disclosure.test.js test/egress-policy.test.js test/egress-policy-completeness.test.js test/egress-policy-integration.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/privacy-ir-adapter.test.js test/privacy-taxonomy.test.js test/privacy-sink-policy.test.js test/privacy-governance.test.js test/privacy-inventory.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/stdout-flush.test.js test/format-determinism.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js test/concurrency-cwe.test.js test/compliance-mapping-liveness.test.js test/compliance-severity-threshold.test.js test/compliance-severity-policy.test.js test/compliance-evidence-binding.test.js test/compliance-evidence-signing.test.js test/compliance-file-contains.test.js test/label-isolation.test.js test/evidence-grade-wording.test.js test/llm-model-status.test.js test/egress-policy-constraints.test.js test/egress-redact.test.js test/egress-audit.test.js test/egress-approved-providers.test.js test/family-registry.test.js test/coverage-strength.test.js test/framework-provenance.test.js test/framework-provenance-controlrefs.test.js test/third-party-verification.test.js test/proof-coverage.test.js test/calibration-holdout.test.js test/independent-population-gate.test.js test/catalog-freshness.test.js test/incremental-parity.test.js test/surface-smoke.test.js test/fix-coverage.test.js test/raw-source-carveout.test.js test/mlbom-conformance.test.js test/deploy-gate-replay.test.js test/sbom-conformance.test.js test/unscored-claims.test.js test/mcp-rug-pull.test.js test/agent-boundary-taint.test.js test/confinement-adversarial.test.js test/comment-strip-cost.test.js test/reachability-claim.test.js test/entrypoint-breadth.test.js test/dep-file-admission.test.js test/custom-rules-freshness.test.js test/posture/provenance-schema.test.js test/posture/provenance-cache.test.js test/helpers/build-git-fixture.test.js test/posture/provenance-git-evidence.test.js test/posture/provenance-dag-walk.test.js test/posture/provenance-confidence.test.js test/posture/provenance-predicate-replay.test.js test/posture/provenance-origin-resolver.test.js test/posture/provenance-ai-authorship.test.js test/posture/provenance-branch-entry.test.js test/posture/provenance-evidence-attribution.test.js test/posture/provenance-lifecycle.test.js test/posture/provenance-missing-control-resolver.test.js test/posture/provenance-missing-control-wiring.test.js test/posture/provenance-coordinator.test.js test/posture/provenance-sca-origin.test.js test/posture/provenance-transitive-sca.test.js test/posture/provenance-coordinator-sca.test.js test/posture/provenance-providers.test.js test/posture/provenance-evidence-bundle.test.js test/posture/provenance-repo-lineage.test.js test/posture/provenance-secrets-logic.test.js test/cli/provenance-flags.test.js test/cli/attest-provenance.test.js test/cli/attest-obligations.test.js test/cli/compliance-walkthrough-lineage.test.js test/cli/dataflow-export-privacy.test.js test/cli/dataflow-export-briefing.test.js test/cli/lineage-snapshot-persist.test.js test/cli/dataflow-diff.test.js test/cli/dataflow-watch.test.js test/cli/dataflow-recipients.test.js test/cli/dataflow-coverage.test.js test/security/provenance-safety.test.js test/security/provenance-injection.test.js test/posture/remediation-ledger.test.js",
+    "test:dataflow": "node --test test/privacy-catalog.test.js test/privacy-deep-walker.test.js test/privacy-deep-e2e.test.js test/container-taint.test.js test/stored-taint-families.test.js test/py-annotation-sources.test.js test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/chrome-probe.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-cs-p1.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/return-sink-check.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js test/interproc-nested-call-taint.test.js test/catalog-xpath-injection.test.js test/catalog-ldap-injection.test.js test/catalog-xxe.test.js test/catalog-response-splitting.test.js test/catalog-code-injection.test.js test/parser-rb-control-flow.test.js test/catalog-ruby-p1.test.js test/callee-receiver-taint.test.js test/catalog-command-injection-p4.test.js test/catalog-xss-p4.test.js test/catalog-path-ssrf-p3.test.js test/catalog-ai-model-provider-precision.test.js test/catalog-orm-write.test.js test/dataflow/provenance-pipeline-integration.test.js",
+    "test:mcp": "node --test test/mcp.test.js test/mcp-protocol-smoke.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js test/lsp-server.test.js test/mcp-dataflow-tools.test.js test/cli/governance-propose-edit.test.js test/cli/remediation-open-update.test.js test/cli/remediation-verify-reopen.test.js test/cli/dataflow-observations.test.js test/cli/federate-declare-list.test.js",
     "test:report": "node --test test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/scan-health.test.js test/finding-schema.test.js test/pipeline/finding-schema-provenance.test.js test/evidence-provenance.test.js test/report/provenance-output.test.js test/report/provenance-format-parity.test.js test/legacy-compat.test.js test/annotator-runner.test.js test/detector-runner.test.js test/detector-errors.test.js test/analyzer-supervisor.test.js test/cascade-worker-pool.test.js test/cascade-pool-wiring.test.js test/coverage-ledger.test.js test/coverage-ledger-completeness.test.js test/assurance-mode.test.js test/artifact-registry.test.js test/artifact-registry-completeness.test.js test/retention-policy.test.js test/state-lifecycle-report.test.js test/legal-hold.test.js test/production-feedback.test.js test/calibration-feedback.test.js test/encryption-provider.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js test/oscal-conformance.test.js test/cli-fix-apply.test.js test/apply-fix-service.test.js test/high-impact-approval-gate.test.js test/approver-registry.test.js test/suppression-exceptions.test.js test/fix-history.test.js test/producer-registry.test.js test/producer-collector.test.js test/enrichment-completion.test.js",
+    "test:lineage": "node --test test/lineage/schema.test.js test/lineage/ids.test.js test/lineage/protection.test.js test/lineage/classification.test.js test/lineage/validate.test.js test/lineage/json-schema-parity.test.js test/lineage/flagship-fixture.test.js test/lineage/flagship-fixture-semantics.test.js test/lineage/field-identity.test.js test/lineage/engine-expr-resolver.test.js test/lineage/engine-walker.test.js test/lineage/engine-integration.test.js test/lineage/engine-receiver-identity.test.js test/lineage/summaries.test.js test/lineage/driver.test.js test/lineage/engine-provenance.test.js test/lineage/engine-provenance-interprocedural.test.js test/lineage/path-store.test.js test/lineage/path-query.test.js test/lineage/flow-grade.test.js test/lineage/source-registry.test.js test/lineage/sink-registry.test.js test/lineage/transform-catalog.test.js test/lineage/handling-analyzer.test.js test/lineage/registry-real-code.test.js test/lineage/source-seeding.test.js test/lineage/graph-builder.test.js test/lineage/coverage.test.js test/lineage/resolve-destination.test.js test/lineage/queue-detail.test.js test/lineage/index.test.js test/lineage/obligation-mapping.test.js test/lineage/obligation-predicates.test.js test/lineage/obligation-predicates-walkthrough.test.js test/lineage/transit-protection.test.js test/lineage/at-rest-protection.test.js test/lineage/protection-summary.test.js test/lineage/ac01-multi-sink.test.js test/lineage/policy-verdict.test.js test/lineage/governance-refs.test.js test/lineage/export-privacy.test.js test/lineage/export-json.test.js test/lineage/export-csv.test.js test/lineage/decision-story.test.js test/lineage/export-briefing.test.js test/lineage/graph-snapshot.test.js test/lineage/graph-diff.test.js test/lineage/drift-policy.test.js test/lineage/recipient-profile.test.js test/lineage/recipient-registry.test.js test/lineage/recipient-wiring.test.js test/lineage/redact-graph.test.js test/lineage-scan-wiring.test.js test/lineage-artifact-write.test.js test/bench-data-lineage-runner.test.js test/bundle-frontend.test.js test/bundle-frontend-golden.test.js test/generate-html-report.test.js test/export-image.test.js test/lineage/scenario.test.js test/lineage/scenario-engine.test.js test/lineage/scenario-diff.test.js test/lineage/scenario-no-obligation-wiring.test.js test/lineage/impact-assessment.test.js test/lineage/impact-engine.test.js test/lineage/impact-no-obligation-wiring.test.js test/lineage/governance-edit.test.js test/lineage/remediation.test.js test/lineage/runtime-observation.test.js test/lineage/observation-correlation.test.js test/lineage/observation-adapters.test.js test/lineage/observation-store.test.js test/lineage/runtime-corroboration-wiring.test.js test/lineage/cross-repo-link.test.js test/lineage/federation-loader.test.js test/lineage/cross-repo-link-wiring.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js test/proof-corpus-lib.test.js test/proof-corpus-runner.test.js",
+    "test:server": "node --test test/server/graph-loader.test.js test/server/security.test.js test/server/routes.test.js test/server/http-server.test.js test/server/cmd-explore.test.js test/server/cmd-dataflow-export.test.js test/server/static-assets.test.js test/server/dataflow-scenario-cli.test.js test/server/dataflow-impact-cli.test.js",
     "test:lifecycle": "node --test test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs",
     "test:eval": "node --test test/independent-eval.test.js test/realworld-recall.test.js",
     "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js test/local-only-mode.test.js",
@@ -81,6 +83,8 @@
     "prebench:realworld": "npm run build",
     "bench:realworld": "node test/benchmark/realworld/bench-realworld.js",
     "bench:llm-goats": "node test/benchmark/llm-goats/bench-llm-goats.js",
+    "bench:data-lineage": "node ../bench/data-lineage/runner.mjs",
+    "bench:data-lineage:check": "node ../bench/data-lineage/runner.mjs --check",
     "bench:cve-replay": "node ../bench/cve-replay/runner.mjs",
     "bench:cve-replay:ci": "node ../bench/cve-replay/runner.mjs --ci",
     "bench:cve-replay:check": "node ../bench/cve-replay/runner.mjs --check-baseline",
@@ -109,6 +113,7 @@
     "bench:self-scan": "node ../bench/self-scan/measure.mjs",
     "bench:self-scan:check": "node ../bench/self-scan/check.mjs",
     "bench:mutation:check": "node ../bench/mutation/runner.mjs",
+    "bench:protection-verdict:check": "node ../bench/protection-verdict/runner.mjs",
     "bench:fix-correctness": "node ../bench/fix-correctness/runner.mjs",
     "bench:iac-coverage": "node ../bench/iac-coverage/runner.mjs",
     "bench:prompt-injection": "node ../bench/prompt-injection/runner.mjs",
@@ -125,12 +130,14 @@
     "bench:provenance-accuracy:check": "node ../bench/provenance-accuracy/runner.mjs --check",
     "bench:provenance-accuracy:update-baseline": "node ../bench/provenance-accuracy/runner.mjs --update-baseline",
     "bench:privacy-recall": "node ../bench/privacy-recall/measure.mjs",
+    "bench:privacy-recall:compare-lineage": "node ../bench/privacy-recall/compare-lineage.mjs",
     "bench:privacy-recall:check": "node ../bench/privacy-recall/check.mjs",
     "bench:privacy-recall:update-baseline": "node ../bench/privacy-recall/check.mjs --update-baseline",
     "bench:self-scan:update-baseline": "node ../bench/self-scan/check.mjs --update-baseline",
     "bench:engine-recall": "node ../bench/engine-recall/measure.mjs",
     "scorecard": "node ../scripts/scorecard.mjs",
     "check-doc-drift": "node ../scripts/check-doc-drift.mjs",
+    "docs:verify-examples": "node ../scripts/verify-doc-examples.mjs",
     "harness-score": "node ../scripts/harness-score.cjs",
     "corpus:enroll": "node ../scripts/enroll-proven-finding.mjs",
     "corpus:provenance": "node ../scripts/corpus-provenance-check.mjs",

package/src/dataflow/CLAUDE.md

@@ -6,7 +6,7 @@ Layer-2 taint engine. Walks the Layer-1 IR (`../ir/`) with field-sensitive forwa
 
 - **Intra-procedural field-sensitive taint** with access-path lattice (`access-paths.js`). `user.email` is distinguishable from `user.password`.
 - **Value-context-sensitive interprocedural taint (FR-SEM-2).** `SummaryCache` (`summaries.js`) holds a distinct summary per distinct entry-taint-state. A pre-pass computes the empty-entry base for every function; call sites then lazily compute the summary under their actual tainted-arg context (at both assign-from-call and plain-call sites) so a helper that is clean with clean args but tainted with user input is detected per call site. Bounded by a per-function context cap (`AGENTIC_SECURITY_KCFA_MAX_CONTEXTS`, default 16; 0 = monovariant). Over the cap → reuse the empty-entry summary.
-- **Catalog-driven source/sink matching.** Add entries in `catalog.js`. Each entry: `kind` ∈ {source, sink, sanitizer}, plus language + framework + match shape. `match.type` ∈ {`call`, `member`, `global`, `annotation`} — 655 entries (149 source, 124 sink, 382 sanitizer — re-derive via `CATALOG.length` / a per-`kind` count rather than trusting a hardcoded number here again; this has already drifted once) spanning Express/Flask/FastAPI/Django/Rails/PHP/Go-net-http/Gin/Echo.
+- **Catalog-driven source/sink matching.** Add entries in `catalog.js`. Each entry: `kind` ∈ {source, sink, sanitizer}, plus language + framework + match shape. `match.type` ∈ {`call`, `member`, `global`, `annotation`} — 655 entries (149 source, 124 sink, 382 sanitizer — re-derive via `CATALOG.length` / a per-`kind` count rather than trusting a hardcoded number here again; this has already drifted once) **— and it has now drifted a SECOND time: as of 2026-08-31 the real figures are 756 (180 source, 194 sink, 382 sanitizer). See `../lineage/DESIGN_REGISTRIES.md` §7.3 item 1 — originally measured and pinned by the design-phase PoC, since deleted; the 180-source and 194-sink figures are now pinned as shipped, permanent equality tests in the lineage package's own source-registry.test.js and sink-registry.test.js (see `../lineage/CLAUDE.md`'s module table for their exact paths). The stale numbers are left in place above rather than hand-patched a third time, because nothing in this file can keep them true; trust `CATALOG.length`, not this sentence — and it HAS drifted a third time already, predictably: Sub-project H's AC-07 closure (2026-08-31) added 4 sink entries, so the real sink-entry count is now 198, not 194** — spanning Express/Flask/FastAPI/Django/Rails/PHP/Go-net-http/Gin/Echo.
   - **`match.type: 'call'`/`'member'`/`'global'`** are matched against an *expression* the taint-walker encounters while visiting a CFG node (`matchSource` / `matchSinkOrSanitizer`) — `call` against a call expression's callee, `member` against a property-access chain (`match.object` + `match.prop`), `global` against a bare identifier read.
   - **`match.type: 'annotation'`** (R14(a): Spring `@RequestParam`/`@PathVariable`/`@RequestBody`/`@RequestHeader`, ASP.NET Core `[FromQuery]`/`[FromBody]`/`[FromForm]`/`[FromRoute]`/`[FromHeader]`, NestJS `@Query()`/`@Body()`/`@Param()`/`@Headers()`) works differently from the other three, and this is the one fact worth internalizing before touching it: **it is not consulted during the CFG walk.** There is no CFG node for "this function's own declared parameter list." Instead `matchAnnotationParams` (`catalog.js`) is called once per function — by `engine.js`'s `_unionAnnotationTaint`, before `analyzeFunction` runs — against the IR's `fn.paramAnnotations` side-channel (`{index, name, decorator}[]`, populated by `parser-cs.js`/`parser-js.js`/`parser-java.js`; see `../ir/CLAUDE.md`), and the resulting tainted param names are unioned into the entry taint-state for that function/call-site. A reader who assumes `annotation` entries get matched against expressions mid-walk, the way `call`/`member`/`global` do, will be wrong.
   - **Sanitizer entries are RECORDED, never trusted to kill taint.** `_sanitizersForExpr()` collects the sanitizer callees applied to the value reaching each sink argument — inline in the argument, or inherited from the variable it reads (`_sanitizersByVar`, updated on every assignment and cleared when the RHS is clean). They are stamped on the finding as `_sanitizersOnPath` and consumed by `sanitizer-gate.js`, which sets `sanitized` + `sanitizerProof` **only when the sanitizer's `appliesTo` family covers the finding's threat class** (`*` covers everything). The proof gate then demotes. Taint itself still dies only on clean re-assignment (`removePathAndDescendants`).

package/src/dataflow/catalog.js

@@ -606,6 +606,48 @@ export const CATALOG = [
     vuln: { name: 'SSRF (axios/http.get)', severity: 'high', cwe: 'CWE-918',
             remediation: 'Validate the target URL against an allow-list before fetching; reject RFC1918 + metadata endpoints.' } },
 
+  // ─── SINKS (AI model provider) ────────────────────────────────────────────
+  // AC-07 closure (Data Flow Explorer, Sub-project H). Regulated data
+  // (PCI/PHI/PII) reaching a hosted third-party AI model provider is a real
+  // data-exposure concern the same way any other third-party API call is —
+  // CWE-201 (Insertion of Sensitive Information Into Sent Data), NOT CWE-359
+  // (reserved exclusively for privacy-catalog.js's own "Privacy Leak" family
+  // — sink-registry.js's completeness/1c test enforces this).
+  //
+  // Precision comes from `receiver`/`receiverBase`: CALLEE_INDEX is keyed on
+  // the bare name `create`, so every `X.create(...)` in the tree is a
+  // candidate. Every receiver-bearing entry below constrains BOTH the
+  // property chain AND the receiver's own name/alias — `receiver` alone
+  // (checked via `_receiverAllowed`'s `.some()` over the whole member
+  // chain) is not enough: a first cut of `js-anthropic-messages-create`/
+  // `js-openai-responses-create` shipped with only `receiver` set, and a
+  // task review found it matched ordinary `db.messages.create()`/
+  // `prisma.messages.create()` (Sequelize/Prisma's idiomatic row-insert
+  // shape) — a real false-attribution SAST finding, not a hypothetical.
+  // `receiverBase: '^chat$'` on the OpenAI chat-completions entry is what
+  // separates it from the legacy `anthropic.completions.create` shape
+  // (deliberately not cataloged here — AC-07 names only OpenAI/Anthropic/
+  // Bedrock).
+  { kind: 'sink', id: 'js-openai-chat-completions-create', language: 'js', framework: 'openai',
+    match: { type: 'call', callee: 'create', receiver: '^completions$', receiverBase: '^chat$' }, argIndex: 0,
+    vuln: { name: 'Regulated Data to AI Model Provider (OpenAI chat.completions.create)', severity: 'medium', cwe: 'CWE-201',
+            remediation: 'Confirm the request payload carries no PCI/PHI/PII before sending to a third-party model provider, or route through an approved DPA / redaction layer.' } },
+  { kind: 'sink', id: 'js-openai-responses-create', language: 'js', framework: 'openai',
+    match: { type: 'call', callee: 'create', receiver: '^responses$', receiverBase: '^(?:openai|client|oai)$' }, argIndex: 0,
+    vuln: { name: 'Regulated Data to AI Model Provider (OpenAI responses.create)', severity: 'medium', cwe: 'CWE-201',
+            remediation: 'Confirm the request payload carries no PCI/PHI/PII before sending to a third-party model provider, or route through an approved DPA / redaction layer.' } },
+  { kind: 'sink', id: 'js-anthropic-messages-create', language: 'js', framework: 'anthropic',
+    match: { type: 'call', callee: 'create', receiver: '^messages$', receiverBase: '^(?:anthropic|client|claude)$' }, argIndex: 0,
+    vuln: { name: 'Regulated Data to AI Model Provider (Anthropic messages.create)', severity: 'medium', cwe: 'CWE-201',
+            remediation: 'Confirm the request payload carries no PCI/PHI/PII before sending to a third-party model provider, or route through an approved DPA / redaction layer.' } },
+  // Bare, constructor-shaped call with no fixed receiver — safe to match on the
+  // bare name alone, the same precedent `js-fetch` already uses, because
+  // `InvokeModelCommand` is a distinctive, unambiguous identifier.
+  { kind: 'sink', id: 'js-bedrock-invoke-model-command', language: 'js', framework: 'bedrock',
+    match: { type: 'call', callee: 'InvokeModelCommand' }, argIndex: 0,
+    vuln: { name: 'Regulated Data to AI Model Provider (AWS Bedrock InvokeModelCommand)', severity: 'medium', cwe: 'CWE-201',
+            remediation: 'Confirm the request payload carries no PCI/PHI/PII before sending to a third-party model provider, or route through an approved DPA / redaction layer.' } },
+
   // ─── SINKS (command exec) ─────────────────────────────────────────────────
   { kind: 'sink', id: 'py-subprocess-run',      language: 'py', framework: 'subprocess', match: { type: 'call', callee: 'run', requireKeyword: { name: 'shell', pattern: '^(?:true|True|1)$' } }, argIndex: 0,
     vuln: { name: 'Command Injection (subprocess.run shell=True)', severity: 'critical', cwe: 'CWE-78',

package/src/dataflow/orm-write-catalog.js

@@ -0,0 +1,175 @@
+// Milestone 2, Sub-project E, increment 1 (ORM-write sink recognition).
+// Per docs/superpowers/plans/2026-08-31-data-flow-explorer-m2-subproject-e1-plan.md
+// and its own referenced scoping doc's Finding 3 (the precision-mechanism
+// gap): a catalog of ORM row-write call shapes (`Model.create({...})`,
+// `Model.save({...})`, `Model.update({...})`, `Model.upsert({...})`) for
+// `src/lineage/`'s Data Flow Explorer only.
+//
+// DELIBERATELY NOT ADDED TO `dataflow/catalog.js`'s own `CATALOG`, and NOT
+// wired into `matchSinkOrSanitizer`/`runTaintEngine` — the exact same
+// isolation reasoning `privacy-catalog.js`'s own header comment gives for
+// itself (see that file, lines 12-32), reapplied here for a stronger
+// reason: `CATALOG` is a shared, always-active singleton consulted for
+// EVERY scan, with no per-family filtering, so merging these entries in
+// would make every already-tainted general source (`req.body`, etc.)
+// immediately produce a new, unreviewed SAST finding class the moment it
+// reached an ORM `.create()`/`.save()`/`.update()`/`.upsert()` call — a
+// real, unintended expansion of the general SAST pipeline's output as a
+// side effect of a Data Flow Explorer feature, not something this
+// increment is chartered to decide. Unlike `privacy-catalog.js` (which
+// shares its entry shape with something that COULD wire into `CATALOG`
+// later), this catalog's own precision gate — "the call's first argument
+// must be an object-literal expression" — cannot be expressed inside
+// `matchSinkOrSanitizer`'s existing `(calleeExpr, file, receiverType)`
+// signature at all, since that signature never receives the call's
+// arguments. Making that check work requires a caller with `site.args`
+// (`src/lineage/graph-builder.js`'s own site enumeration), so the
+// isolation here is closer to structural than a mere policy choice.
+//
+// Keeping this catalog in its own file, imported ONLY by `src/lineage/`'s
+// own registry/graph-builder modules, is what makes it genuinely inert to
+// every other scan surface.
+//
+// TWO signals gate a real match, and only one lives in this file:
+//   1. Callee shape (HERE, in `ORM_WRITE_CATALOG` + `matchOrmWrite`):
+//      method name is one of create/save/update/upsert, receiver is a
+//      BARE, CAPITALIZED identifier (`^[A-Z]\w*$`) — the SAME shape
+//      `sast/mass-assignment.js` (line 27) and `posture/cross-lang-orm.js`
+//      (`findOrmWrites`) already use in production as real SAST
+//      detectors; this is not a new or untested heuristic, it is the
+//      established one, reused here for a lower-stakes (candidate-tier,
+//      disclosed) purpose than either of those two modules' own
+//      full-confidence findings.
+//   2. Argument shape (NOT here — lineage-side, in `graph-builder.js`'s
+//      site enumeration): the matched call's first argument must be an
+//      object-literal expression (`kind: 'object'`). A call whose first
+//      argument is not an object literal (a bare variable, a spread, a
+//      positional string — e.g. `User.create(req.body)`) never becomes an
+//      ORM-write sink candidate at all; this file cannot express that gate
+//      itself, since `matchOrmWrite`'s signature (mirroring
+//      `matchPrivacySink`'s) never receives the call's arguments.
+//
+// `coverageStatus` for every site this catalog recognizes is the literal
+// string 'candidate', unconditionally, computed nowhere — see
+// `sink-registry.js`'s `reclassifyOrmWrite`. Even with both signals
+// present, this is real, disclosed uncertainty: an arbitrary
+// capitalized-identifier receiver could still be a non-ORM builder
+// pattern that happens to take an object-literal argument.
+//
+// Scope boundary, disclosed rather than silently assumed: JS/TS only.
+// Python/Java/Go/Ruby/PHP ORM shapes (Django `.objects.create()`, GORM,
+// ActiveRecord, Eloquent) are real, common shapes this catalog does not
+// recognize — out of scope for this increment, per the plan's own
+// "Explicitly deferred" list. Table/column/operation extraction, and
+// Prisma's distinctive `data: {...}` wrapper form's own precise handling,
+// are likewise deferred (the object-literal-argument check as specified
+// sees Prisma's OUTER `{ data: {...} }` literal and passes, which is
+// consistent for the callee-match gate, but this file makes no claim
+// about extracting the inner Prisma shape — that's E2's job).
+//
+// `category: 'database'` reuses the existing `SINK_CATEGORIES` value
+// (schema.js) rather than minting a new `orm-write`-style category — a
+// genuine, lower-confidence detection of the same kind of destination a
+// raw-SQL sink already models. Whether a dedicated category is warranted
+// is an open question left to a future increment, not decided here.
+
+import { _languageFamilyExtensions } from './catalog.js';
+
+// The method-name vocabulary is verified against `cross-lang-orm.js`'s own
+// `findOrmWrites` regex (`create|save|update|build|insert|upsert`) and
+// `mass-assignment.js`'s own JS pattern (`create|update|build|save`) —
+// this catalog uses the plan's suggested starting set (create/save/update/
+// upsert), a subset of both, not the full union: `build`/`insert` are
+// real ORM-adjacent method names too, but the plan's own "starting point,
+// not a mandate" framing leaves widening this list to a future increment.
+export const ORM_WRITE_CATALOG = [
+  { kind: 'sink', id: 'orm-write-js-create', language: 'js', framework: 'orm', category: 'database',
+    match: { type: 'call', callee: 'create' }, argIndex: 0,
+    vuln: { name: 'ORM Write (create)', severity: 'info', cwe: null,
+            remediation: 'Heuristic ORM row-write recognition for the Data Flow Explorer only — not a SAST finding. No remediation is implied.' } },
+  { kind: 'sink', id: 'orm-write-js-save', language: 'js', framework: 'orm', category: 'database',
+    match: { type: 'call', callee: 'save' }, argIndex: 0,
+    vuln: { name: 'ORM Write (save)', severity: 'info', cwe: null,
+            remediation: 'Heuristic ORM row-write recognition for the Data Flow Explorer only — not a SAST finding. No remediation is implied.' } },
+  { kind: 'sink', id: 'orm-write-js-update', language: 'js', framework: 'orm', category: 'database',
+    match: { type: 'call', callee: 'update' }, argIndex: 0,
+    vuln: { name: 'ORM Write (update)', severity: 'info', cwe: null,
+            remediation: 'Heuristic ORM row-write recognition for the Data Flow Explorer only — not a SAST finding. No remediation is implied.' } },
+  { kind: 'sink', id: 'orm-write-js-upsert', language: 'js', framework: 'orm', category: 'database',
+    match: { type: 'call', callee: 'upsert' }, argIndex: 0,
+    vuln: { name: 'ORM Write (upsert)', severity: 'info', cwe: null,
+            remediation: 'Heuristic ORM row-write recognition for the Data Flow Explorer only — not a SAST finding. No remediation is implied.' } },
+];
+
+function _ormLanguageAllowed(entry, file) {
+  if (!file) return true;
+  const res = _languageFamilyExtensions(entry.language);
+  if (!res.length) return true; // unmapped language stays permissive
+  return res.some((re) => re.test(file));
+}
+
+// Small, local copy of the callee-name extraction shape `privacy-catalog.js`'s
+// own `_privacyCalleeNames` establishes — not imported from that file (it's
+// private/unexported there), matching this package's established precedent
+// of a small local duplicate over an awkward cross-module dependency on
+// another module's private helper (see `src/lineage/handling-analyzer.js`'s
+// own disclosed `calleeDescriptorOf` duplicate).
+function _ormCalleeNames(calleeExpr) {
+  let last = null;
+  let full = null;
+  if (typeof calleeExpr === 'string') {
+    full = calleeExpr;
+    last = calleeExpr.includes('.') ? calleeExpr.slice(calleeExpr.lastIndexOf('.') + 1) : calleeExpr;
+  } else if (calleeExpr && calleeExpr.kind === 'member' && calleeExpr.prop) {
+    last = calleeExpr.prop;
+    if (calleeExpr.object && calleeExpr.object.kind === 'ident') full = `${calleeExpr.object.name}.${calleeExpr.prop}`;
+  } else if (calleeExpr && calleeExpr.kind === 'ident') {
+    last = calleeExpr.name || null;
+  }
+  return { last, full };
+}
+
+// Bare, capitalized receiver identifier — a SHAPE regex on the receiver's
+// own name, not a `receiverTypeIn` exact-alias lookup (unrelated to the
+// IR's CHA-resolved `receiverType`). Only a `kind: 'member'` calleeExpr
+// whose `object` is itself a plain `kind: 'ident'` can satisfy this — a
+// computed or chained receiver (`db.models.User.create(...)`) does not,
+// by design (the same conservative shape `mass-assignment.js`/
+// `cross-lang-orm.js` already use in production).
+const CAPITALIZED_IDENT_RE = /^[A-Z]\w*$/;
+
+function _ormReceiverIsCapitalizedIdent(calleeExpr) {
+  return Boolean(
+    calleeExpr && typeof calleeExpr === 'object' &&
+    calleeExpr.kind === 'member' &&
+    calleeExpr.object && calleeExpr.object.kind === 'ident' &&
+    typeof calleeExpr.object.name === 'string' &&
+    CAPITALIZED_IDENT_RE.test(calleeExpr.object.name),
+  );
+}
+
+/**
+ * Signal 1 only (callee shape) — the argument-shape signal (signal 2) is
+ * NOT checked here; see this file's own header for why it structurally
+ * cannot be. Mirrors `matchPrivacySink`'s `(calleeExpr, file, receiverType)`
+ * contract, minus the unused third parameter (this catalog's receiver
+ * constraint is a name-shape regex, not a `receiverTypeIn` lookup, so no
+ * `receiverType` input is ever consulted). Returns an array of hits, or
+ * `null` — same "array of hits, or null" contract `matchSinkOrSanitizer`/
+ * `matchPrivacySink` already establish.
+ */
+export function matchOrmWrite(calleeExpr, file) {
+  if (!calleeExpr) return null;
+  if (!_ormReceiverIsCapitalizedIdent(calleeExpr)) return null;
+  const { last, full } = _ormCalleeNames(calleeExpr);
+  if (!last && !full) return null;
+  const hits = ORM_WRITE_CATALOG.filter((e) => {
+    if (!e || e.kind !== 'sink') return false;
+    const cName = e.match && e.match.callee;
+    if (!cName) return false;
+    if (cName !== last && cName !== full) return false;
+    if (!_ormLanguageAllowed(e, file)) return false;
+    return true;
+  });
+  return hits.length ? hits : null;
+}