@clear-capabilities/agentic-security-scanner 0.172.0 → 0.173.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-edcc9e08f076b2bc50946c512557c15038e337fa568bc490586fc882ca1c11bc  agentic-security.mjs
+eab94f59f539296c01e17e2d914f419e131e2b4d1234865c011f755f11a64441  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.172.0",
+  "version": "0.173.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -43,13 +43,13 @@
     "@babel/core": "^8.0.5",
     "@babel/preset-react": "^8.0.1",
     "@babel/preset-typescript": "^8.0.1",
-    "js-yaml": "^5.4.2",
+    "js-yaml": "^5.5.0",
     "safe-regex": "^2.1.1"
   },
   "optionalDependencies": {
     "tree-sitter-wasms": "0.1.13",
     "web-tree-sitter": "0.20.8",
-    "z3-solver": "^5.3.0"
+    "z3-solver": "^5.3.1"
   },
   "devDependencies": {
     "@types/node": "^26.6.5",
@@ -67,6 +67,17 @@
     "test": "node ../scripts/run-unit-tests.mjs",
     "test:extras": "AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js && node --experimental-test-module-mocks --test test/fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection-k8s-admission.test.js && node --experimental-test-module-mocks --test test/lineage-fault-injection.test.js && npm run test:python",
     "loop": "node ../scripts/loop-engineering/run.mjs",
+    "test:engineering-excellence": "node --test --test-concurrency=1 test/engineering-excellence/e0-01-inventory.test.js test/engineering-excellence/e0-02-baseline.test.js test/engineering-excellence/e0-03-contract.test.js test/engineering-excellence/e0-04-task-manifest.test.js test/engineering-excellence/e0-05-status-runner.test.js test/engineering-excellence/e0-06-backlog.test.js test/engineering-excellence/e1-01-dataset-provenance.test.js test/engineering-excellence/e1-02-splits.test.js test/engineering-excellence/e1-03-scoring.test.js test/engineering-excellence/e1-04-baseline-run.test.js test/engineering-excellence/e1-05-forensics.test.js test/engineering-excellence/e1-05-baseline-forensics.test.js test/engineering-excellence/e1-06-adversarial-controls.test.js test/engineering-excellence/e1-07-realcode-policy.test.js test/engineering-excellence/e1-07-baseline-gate.test.js test/engineering-excellence/e2-06-cross-language.test.js test/engineering-excellence/e2-08-suppression-attribution.test.js test/engineering-excellence/e2-09-semantic-gates.test.js test/engineering-excellence/e4-06-dci-real-app.test.js test/engineering-excellence/e6-08-perf-budget.test.js test/engineering-excellence/e8-02-e2e-demo.test.js test/engineering-excellence/e8-03-regression-report.test.js test/engineering-excellence/e8-04-docs.test.js test/engineering-excellence/e8-05-handoff.test.js test/engineering-excellence/e8-06-release-decision.test.js test/engineering-excellence/u01-ruby-path-resolver.test.js test/engineering-excellence/e1-08-scorecard.test.js test/engineering-excellence/e3-01-patch-routes.test.js test/engineering-excellence/e3-02-fix-verification-record.test.js test/engineering-excellence/e3-03-central-verifier.test.js test/engineering-excellence/e3-04-exploit-replay.test.js test/engineering-excellence/e3-05-functional-preservation.test.js test/engineering-excellence/e3-06-patch-policy.test.js test/engineering-excellence/e3-07-rollback-crash-safety.test.js test/engineering-excellence/e3-08-fix-benchmark.test.js test/engineering-excellence/e2-01-semantic-graph.test.js test/engineering-excellence/e2-02-cross-file-resolution.test.js test/engineering-excellence/e2-03-heap-fields-aliases.test.js test/engineering-excellence/e2-04-async-callbacks-frameworks.test.js test/engineering-excellence/e2-05-interprocedural-contexts.test.js test/engineering-excellence/e2-07-service-edges.test.js test/engineering-excellence/e4-01-dci-audit.test.js test/engineering-excellence/e4-02-invariants.test.js test/engineering-excellence/e4-03-cross-route.test.js test/engineering-excellence/e4-04-counterexample.test.js test/engineering-excellence/e4-05-llm-safeguards.test.js test/engineering-excellence/e4-07-dci-findings.test.js test/engineering-excellence/e6-01-telemetry.test.js test/engineering-excellence/e5-01-runtime-audit.test.js test/engineering-excellence/e5-02-build-identity.test.js test/engineering-excellence/e5-03-privacy-ingest.test.js test/engineering-excellence/e5-04-graph-reconciliation.test.js test/engineering-excellence/e5-05-exploitability-evidence.test.js test/engineering-excellence/e5-06-service-chain-graph.test.js test/engineering-excellence/e5-07-runtime-explanation.test.js test/engineering-excellence/e6-05-supervised-analyzers.test.js test/engineering-excellence/e6-06-determinism.test.js test/engineering-excellence/e6-07-adversarial-boundaries.test.js test/engineering-excellence/e6-03-shared-preprocessing.test.js test/engineering-excellence/e6-04-analysis-cache.test.js test/engineering-excellence/e7-01-evidence-contracts.test.js test/engineering-excellence/e7-03-release-package.test.js test/engineering-excellence/e7-04-compliance-truth.test.js test/engineering-excellence/e7-05-waivers-tenancy.test.js test/engineering-excellence/e7-02-provenance-coverage.test.js test/engineering-excellence/e7-06-fleet-exposure.test.js test/engineering-excellence/e7-07-perspectives.test.js test/engineering-excellence/e7-08-assurance-e2e.test.js test/engineering-excellence/e6-02-completion.test.js",
+    "ee:status": "node ../scripts/engineering-excellence/status.mjs --once",
+    "ee:init": "node ../scripts/engineering-excellence/init.mjs",
+    "ee:inventory": "node ../scripts/engineering-excellence/inventory.mjs",
+    "ee:contract": "node ../scripts/engineering-excellence/contract.mjs",
+    "ee:backlog": "node ../scripts/engineering-excellence/backlog.mjs",
+    "ee:dataset-audit": "node ../scripts/engineering-excellence/dataset-audit.mjs",
+    "ee:independent-baseline": "node ../scripts/engineering-excellence/independent-baseline.mjs",
+    "ee:dci-audit": "node ../scripts/engineering-excellence/dci-audit.mjs",
+    "ee:runtime-audit": "node ../scripts/engineering-excellence/runtime-audit.mjs",
+    "ee:ir-matrix": "node ../scripts/engineering-excellence/ir-matrix.mjs",
     "test:loop-real-prd": "node --test ../scripts/loop-engineering/test/loop-real-prd.test.js",
     "test:loop": "node --test --test-concurrency=1 ../scripts/loop-engineering/test/loop-manifest.test.js ../scripts/loop-engineering/test/loop-watchdog.test.js ../scripts/loop-engineering/test/loop-background.test.js ../scripts/loop-engineering/test/loop-dashboard.test.js ../scripts/loop-engineering/test/loop-evidence.test.js ../scripts/loop-engineering/test/loop-recovery.test.js ../scripts/loop-engineering/test/loop-remote.test.js ../scripts/loop-engineering/test/loop-runbook.test.js ../scripts/loop-engineering/test/loop-assurance-profile.test.js ../scripts/loop-engineering/test/loop-assurance-runtime.test.js ../scripts/loop-engineering/test/loop-bounds.test.js ../scripts/loop-engineering/test/loop-spend.test.js ../scripts/loop-engineering/test/loop-ci-attest.test.js",
     "test:python": "node ../scripts/run-python-tests.mjs",
@@ -121,7 +132,7 @@
     "verification:replay-example": "node ../scripts/verification-replay-example.mjs",
     "test:lifecycle": "node --test test/ci-hang-protection.test.js test/ci-test-shards.test.js test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/trust-boundary.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs test/workflow-confinement.test.js test/check-bundle-source.test.js test/ship.test.js",
     "test:eval": "node --test test/independent-eval.test.js test/realworld-recall.test.js",
-    "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js test/local-only-mode.test.js test/context-intelligence/build-js.test.js test/context-intelligence/build-python-haskell.test.js test/context-intelligence/hie-adapter.test.js test/context-intelligence/store.test.js test/context-intelligence/review-queue.test.js test/context-intelligence/packer-egress.test.js test/context-intelligence/evaluation.test.js test/context-intelligence/queue-diff.test.js test/context-intelligence/cli.test.js test/context-intelligence/resilience.test.js test/context-intelligence/frameworks.test.js test/context-intelligence/skew-git-rls.test.js test/context-intelligence/git-diff-candidates.test.js",
+    "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js test/local-only-mode.test.js test/context-intelligence/build-js.test.js test/context-intelligence/build-python-haskell.test.js test/context-intelligence/hie-adapter.test.js test/context-intelligence/store.test.js test/context-intelligence/review-queue.test.js test/context-intelligence/packer-egress.test.js test/context-intelligence/evaluation.test.js test/context-intelligence/queue-diff.test.js test/context-intelligence/cli.test.js test/context-intelligence/resilience.test.js test/context-intelligence/frameworks.test.js test/context-intelligence/skew-git-rls.test.js test/context-intelligence/premortem.test.js test/context-intelligence/git-diff-candidates.test.js",
     "eval:independent": "node ../bench/independent-eval/runner.mjs",
     "eval:independent:gate": "node ../bench/independent-eval/runner.mjs --gate default",
     "smoke": "node bin/agentic-security.js scan test/fixtures/vulnerable-js",
@@ -137,6 +148,9 @@
     "bench:cve-replay:ci": "node ../bench/cve-replay/runner.mjs --ci",
     "bench:cve-replay:check": "node ../bench/cve-replay/runner.mjs --check-baseline",
     "bench:cve-replay:update-baseline": "node ../bench/cve-replay/runner.mjs --update-baseline",
+    "bench:realcode:report": "node ../bench/independent/realcode.mjs report",
+    "bench:realcode:check": "node ../bench/independent/realcode.mjs check --tier release",
+    "bench:realcode:check:quick": "node ../bench/independent/realcode.mjs check --tier quick",
     "bench:independent:gate:check": "node ../scripts/independent-population-gate.mjs",
     "bench:independent:update-gate-baseline": "node ../scripts/independent-population-gate.mjs --update-baseline",
     "bench:router-replay": "node ../bench/router-replay/runner.mjs",
@@ -163,9 +177,12 @@
     "bench:self-scan": "node ../bench/self-scan/measure.mjs",
     "bench:self-scan:check": "node ../bench/self-scan/check.mjs",
     "bench:nist-800-171-labels:check": "node ../bench/nist-800-171-labels/check.mjs",
-    "bench:mutation:check": "node ../bench/mutation/runner.mjs",
+    "bench:dci-real-app": "node ../bench/dci-real-app/runner.mjs", "bench:dci-real-app:check": "node ../bench/dci-real-app/runner.mjs --check", "ee:perf-budget": "node ../scripts/engineering-excellence/perf-budget.mjs", "ee:perf-budget:check": "node ../scripts/engineering-excellence/perf-budget.mjs --check", "ee:e2e-demo": "node ../scripts/engineering-excellence/e2e-demo.mjs", "ee:e2e-demo:check": "node ../scripts/engineering-excellence/e2e-demo.mjs --check", "ee:doc-captures": "node ../scripts/engineering-excellence/doc-captures.mjs", "ee:doc-captures:check": "node ../scripts/engineering-excellence/doc-captures.mjs --check", "ee:regression-report": "node ../scripts/engineering-excellence/regression-report.mjs", "ee:regression-report:check": "node ../scripts/engineering-excellence/regression-report.mjs --check", "ee:final-report": "node ../scripts/engineering-excellence/final-report.mjs", "ee:final-report:check": "node ../scripts/engineering-excellence/final-report.mjs --check", "bench:mutation:check": "node ../bench/mutation/runner.mjs",
     "baseline:capture": "node ../scripts/baseline-capture.mjs",
     "bench:protection-verdict:check": "node ../bench/protection-verdict/runner.mjs",
+    "bench:independent:forensics": "node ../bench/independent/forensics.mjs",
+    "bench:fix-verify": "node ../bench/fix-verification/runner.mjs",
+    "bench:fix-verify:check": "node ../bench/fix-verification/runner.mjs --check",
     "bench:fix-correctness": "node ../bench/fix-correctness/runner.mjs",
     "bench:iac-coverage": "node ../bench/iac-coverage/runner.mjs",
     "bench:prompt-injection": "node ../bench/prompt-injection/runner.mjs",
@@ -241,7 +258,15 @@
     "test:nixos-host": "node --test test/nix/nixos-host-runtime.test.js",
     "test:language-gates": "node --test --test-concurrency=1 test/language/language-benchmark-gates.test.js",
     "test:language-slow": "node --test --test-concurrency=1 test/language/language-doc-examples-metrics.test.js test/language/language-end-to-end.test.js test/language/language-package-ci.test.js test/language/language-scan-modes.test.js",
-    "test:chrome": "AGENTIC_SECURITY_CHROME_TESTS=1 node --test test/export-image.test.js test/server/cmd-dataflow-export.test.js"
+    "test:chrome": "AGENTIC_SECURITY_CHROME_TESTS=1 node --test test/export-image.test.js test/server/cmd-dataflow-export.test.js",
+    "ee:parse-reuse": "node ../scripts/engineering-excellence/parse-reuse-measure.mjs",
+    "ee:analysis-cache": "node ../scripts/engineering-excellence/analysis-cache-measure.mjs",
+    "ee:evidence-contracts": "node ../scripts/engineering-excellence/evidence-inventory.mjs",
+    "release:verify-package": "node ../scripts/verify-release-package.mjs",
+    "ee:completion": "node ../scripts/engineering-excellence/completion-analysis.mjs",
+    "ee:reproduce-timeouts": "node ../scripts/engineering-excellence/reproduce-timeouts.mjs",
+    "ee:provenance-measure": "node ../scripts/engineering-excellence/provenance-measure.mjs",
+    "ee:provenance-baseline": "node ../scripts/engineering-excellence/provenance-baseline.mjs"
   },
   "author": "Ross Young <ross@clearcapabilities.com>",
   "license": "PolyForm-Internal-Use-1.0.0",

package/src/context-intelligence/CLAUDE.md

@@ -10,6 +10,10 @@ Deterministic Context Intelligence (the `context` command). Opt-in and additive:
 - Model output cannot set severity. A citation outside the bundle invalidates the review. Severity comes from the existing confirmation tier.
 - Store writes are atomic and refuse links and unsafe paths. Stored packages are re-checked against their hashes.
 - A job with no verified result is missing coverage, never a clean result.
+- Names from the repository (route strings, file names) are data: sanitised before they are printed, never placed in prompt text outside the fence.
+- Source reaches a non-loopback endpoint only with an explicit approval, and the egress policy still applies after it.
+- A citation is checked for range AND for being about the cited lines. `no_issue_observed` needs a control the deterministic pass also found.
+- Orderings that reach a hashed value use `cmpCodeUnit`, never the locale.
 - Evaluation is synthetic. Scorecards must say so and must not state an accuracy claim. Holdout use is ledgered.
 
 ## Where things are

package/src/context-intelligence/adapters/haskell-hie.js

@@ -85,15 +85,42 @@ export function loadHieMetadata(rootReal, hieDir, { fileContents }) {
   return { status: 'ok', tool: doc.tool, compiler: doc.compiler, declarations, references, exportHash: hashOf({ declarations, references }) };
 }
 
+function uncorroboratedReferences(graph, references, fileContents) {
+  const byName = new Map();
+  for (const sym of graph.symbols) {
+    if (sym.kind !== 'function' || sym.id.includes('::<anon>@')) continue;
+    if (!byName.has(sym.name)) byName.set(sym.name, []);
+    byName.get(sym.name).push(sym);
+  }
+  const bad = [];
+  for (const r of references) {
+    const owners = byName.get(r.from) || [];
+    if (owners.length !== 1) continue; // an ambiguous or unknown name is already counted as unmatched and adds nothing
+    const sym = owners[0];
+    const text = fileContents[sym.file];
+    const callee = String(r.to).split(/[.:]/).pop();
+    const lineText = typeof text === 'string' ? text.split('\n')[r.line - 1] : undefined;
+    const inside = r.line >= sym.startLine && r.line <= sym.endLine;
+    if (!inside || lineText === undefined || !callee || !lineText.includes(callee)) bad.push(`${r.from}->${r.to}@${r.line}`);
+  }
+  return bad;
+}
+
 /**
  * Merge an imported export into the static graph. Returns { graph, semantic } where `semantic` carries the provenance
  * and the static-versus-compiler difference report.
  */
 export function mergeHieIntoGraph(graph, meta, fileContents) {
-  void fileContents;
   if (meta.status !== 'ok') {
     return { graph, semantic: { source: ['static-ir'], status: meta.status, reason: meta.reason || null, detail: meta.detail || null, diff: null } };
   }
+  // The export is untrusted even when its file hashes match: it is checked into the repository it describes. A reference
+  // is accepted only if the line it names, inside the declaration it names, actually mentions the callee. One that does
+  // not degrades the whole import, so a crafted export cannot add edges that the source does not contain.
+  const uncorroborated = uncorroboratedReferences(graph, meta.references, fileContents || {});
+  if (uncorroborated.length) {
+    return { graph, semantic: { source: ['static-ir'], status: 'degraded', reason: 'reference-not-in-source', detail: uncorroborated.slice(0, 5).join(', '), diff: null } };
+  }
   const idsByName = new Map();
   for (const s of graph.symbols) {
     if (s.kind !== 'function' || s.id.includes('::<anon>@')) continue;

package/src/context-intelligence/candidates.js

@@ -101,7 +101,8 @@ export async function adjudicate(candidates, opts = {}) {
         origin: 'context-intelligence', questionPack: c.questionPack, witnesses: c.witnesses, witnessCount: c.witnesses.length,
         sourceSpanEvidence: c.sourceSpanEvidence, scopeIntegrity: c.scopeIntegrity, reviewStatus: c.reviewStatus,
         uncertainties: c.uncertainties, recommendedValidation: c.recommendedValidation,
-        note: 'A model hypothesis checked for citations, not a proof. Severity comes from the confirmation tier only.',
+        ...(c.deterministic ? { deterministic: c.deterministic } : {}),
+        note: c.deterministic ? 'Derived from the code analysis and a deterministic counterexample attempt; no model produced this. Severity comes from the confirmation tier only.' : 'A model hypothesis checked for citations, not a proof. Severity comes from the confirmation tier only.',
       },
     };
   };

package/src/context-intelligence/canonical.js

@@ -14,6 +14,31 @@ export function sha256(text) {
   return crypto.createHash('sha256').update(text).digest('hex');
 }
 
+/**
+ * Code-unit order, independent of the host locale. `localeCompare` orders by the process locale, so the same checkout
+ * could be sorted differently on two machines; every ordering that reaches a hashed value goes through this instead.
+ */
+export function cmpCodeUnit(a, b) {
+  const x = String(a); const y = String(b);
+  return x < y ? -1 : x > y ? 1 : 0;
+}
+
+// Control characters (C0, DEL, C1), the bidirectional override/isolate marks and the line/paragraph separators. A
+// repository controls the text of its own route strings and file names, so anything printed to a terminal or placed
+// in a prompt outside the untrusted fence must not be able to carry an escape sequence or reorder what a reader sees.
+const UNSAFE_DISPLAY = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069]/g;
+
+/** Make text safe to print: unsafe characters become '?'. Newline and tab are kept; use `safeLabel` for one-line values. */
+export function cleanForTerminal(text) {
+  return String(text).replace(UNSAFE_DISPLAY, '?');
+}
+
+/** A one-line, bounded, printable form of a name taken from source (a route path, a file name). */
+export function safeLabel(text, max = 120) {
+  const t = String(text).replace(/[\n\r\t]+/g, ' ').replace(UNSAFE_DISPLAY, '?').replace(/ {2,}/g, ' ').trim();
+  return t.length > max ? `${t.slice(0, max - 3)}...` : t;
+}
+
 /** CRLF/CR -> LF so a Windows checkout and a Unix one produce the same spans and hashes. */
 export function normalizeText(text) {
   return String(text).replace(/\r\n?/g, '\n');

package/src/context-intelligence/capabilities.js

@@ -16,7 +16,8 @@ const BUILD = [
   { language: 'javascript/typescript', kind: 'http', frameworks: 'Express-style call registration (get/post/put/patch/delete/all, router.use, app.use)', status: 'verified', evidence: [T('build-js.test.js')], limits: 'Router mounts in another file and middleware factories are not followed (reported as router-mount-not-resolved); destructured and named imports are followed, re-exports and tsconfig path aliases are not.' },
   { language: 'python', kind: 'http', frameworks: 'decorator registration (Flask/FastAPI-style @app.route / @router.get), FastAPI Depends()/Security() guards', status: 'experimental', evidence: [T('build-python-haskell.test.js'), T('frameworks.test.js')], limits: 'Decorator guards are read from the decorator lines and Depends() guards from the signature (only dependencies named like an auth or user provider bind the principal); framework-level before_request hooks and Django URL conf are not modelled.' },
   { language: 'haskell', kind: 'http', frameworks: 'Scotty, WAI, Servant, Yesod (through the existing web model)', status: 'verified', evidence: [T('build-python-haskell.test.js'), T('frameworks.test.js')], limits: 'Static source analysis; the existing web model decides what a route is. Dynamic routes are reported unresolved.' },
-  { language: 'java/kotlin/c#/go/php/ruby/rust', kind: 'http', frameworks: 'whatever the engine route scan recognises', status: 'unsupported', evidence: [], limits: 'No fixture proves this, so it is listed as unsupported even though some routes may resolve: Handlers are resolved only for decorator/annotation-style registration; no dedicated fixtures here.' },
+  { language: 'php', kind: 'http', frameworks: 'Laravel Route:: registration (the entry point only)', status: 'experimental', evidence: ['test/engineering-excellence/e4-01-dci-audit.test.js'], limits: 'Measured by the E4-01 audit on one fixture: the routes resolve, but no control or sensitive operation was extracted from the handlers.' },
+  { language: 'java/kotlin/c#/go/ruby/rust', kind: 'http', frameworks: 'whatever the engine route scan recognises', status: 'unsupported', evidence: [], limits: 'Measured by the E4-01 audit (docs/engineering-excellence/DCI_MATURITY.md) on one fixture per language (Spring, net/http, ASP.NET, Rails): no entry point was found, so no bundle is built.' },
   { language: 'any with a recognised surface', kind: 'webhook/queue/cron/upload/cli', frameworks: 'existing entry-point inventory', status: 'experimental', evidence: [T('build-js.test.js')], limits: 'Handler is the enclosing declaration of the surface; no framework wiring beyond that.' },
   { language: 'haskell', kind: 'compiler metadata import', frameworks: 'hie-export/1 JSON export of GHC declarations and references', status: 'experimental', evidence: [T('hie-adapter.test.js')], limits: 'Reads an export; never runs GHC or hiedb. The export is validated against the source snapshot. No export produced by a real GHC run is checked in.' },
   { language: 'any', kind: 'compiler metadata build', frameworks: 'automatic metadata generation', status: 'blocked', evidence: [], limits: 'Running a compiler on untrusted source needs a sandbox proof this build does not have (Template Haskell, custom Setup and plugins run code).' },

package/src/context-intelligence/cli.js

@@ -16,6 +16,7 @@ import { readStoreJson, writeStoreJson, readManifest, readPackageText, verifySto
 import { diffManifestSets, cacheReport } from './diff.js';
 import { readGitSnapshot, readSnapshot } from './files.js';
 import { QUESTION_PACKS, packById } from './prompts/packs.js';
+import { cleanForTerminal } from './canonical.js';
 import { describeModel, resolveInvoker, buildReviewPrompt, redactPackageText, checkEgressForFiles } from './review.js';
 import { planJobs, runQueue, exportBatch, importBatch, HARD_LIMITS } from './queue.js';
 import { reviewsToCandidates, adjudicate } from './candidates.js';
@@ -26,21 +27,24 @@ const flag = (a, k) => (a.flags[k] === undefined ? undefined : a.flags[k]);
 const truthy = (v) => v === true || (typeof v === 'string' && v !== 'false' && v !== '0');
 const num = (v) => (v === undefined || v === true ? undefined : Number(v));
 
+/** Everything this command prints goes through here: repository-supplied names must not carry escape sequences to a terminal. */
+function say(text) { console.log(cleanForTerminal(text)); }
+
 function out(format, text, obj) {
-  if (format === 'json') console.log(JSON.stringify(obj, null, 2));
-  else if (format === 'jsonl') console.log(JSON.stringify(obj));
-  else console.log(text);
+  if (format === 'json') say(JSON.stringify(obj, null, 2));
+  else if (format === 'jsonl') say(JSON.stringify(obj));
+  else say(text);
 }
 
 function usage() {
-  console.log([
+  say([
     'Usage: agentic-security context <subcommand> [--root <dir>] [--format text|json|jsonl]',
     '',
     '  build     Resolve entry points and write one inspectable context bundle each (no model, no network)',
     '            [--entrypoints http,webhook,queue,cron,upload,cli] [--profile compact|standard|extended] [--max-tokens N] [--route <label|id>] [--no-write]',
     '  inspect   Show one bundle: --route <label|id> | --hash <contextHash>  [--show-context] [--package N]',
     '  diff      Routes added/removed/changed between two refs: --from <ref> [--to <ref>]  (omit --to for the working tree)',
-    '  review    Focused one-call reviews over frozen bundles: --question <pack[,pack]> [--route x] [--local-only] [--concurrency N]',
+    '  review    Focused one-call reviews over frozen bundles: --question <pack[,pack]> [--route x] [--local-only] [--allow-remote] [--concurrency N]',
     '            [--max-calls N] [--max-wall-seconds N] [--max-cost-usd N --cost-per-call-usd N] [--retry-failed] [--refute] [--strict]',
     '            [--dry-run] [--export-batch] [--import-batch <results.jsonl> --batch-id <id>]',
     '  status    Coverage so far: entry points, bundles, review jobs',
@@ -62,7 +66,7 @@ async function doBuild(root, args, { write = true } = {}) {
   if (flag(args, 'max-tokens')) config.context.maxTokens = num(flag(args, 'max-tokens'));
   const events = [];
   const jsonl = flag(args, 'format') === 'jsonl';
-  const built = await buildContext(root, { config, route: entrypointFilter(flag(args, 'route')), onEvent: (e) => { events.push(e); if (jsonl) console.log(JSON.stringify(e)); } });
+  const built = await buildContext(root, { config, route: entrypointFilter(flag(args, 'route')), onEvent: (e) => { events.push(e); if (jsonl) say(JSON.stringify(e)); } });
   if (!built.ok) return { ok: false, built, config, problems };
   let persisted = null;
   if (write) persisted = persistBuild(root, built, config);
@@ -155,7 +159,7 @@ async function cmdInspect(root, args, format) {
     `  boundaries (calls into libraries, not first-party code): ${m.boundaries.length}`,
   ];
   if (text) lines.push('', text.ok ? text.text : `(context text unavailable: ${text.code})`);
-  console.log(lines.join('\n'));
+  say(lines.join('\n'));
   return 0;
 }
 
@@ -255,7 +259,7 @@ async function cmdExport(root, args, format) {
   if (!h || h === true) { out(format, 'context export: --hash <contextHash> is required', { ok: false }); return 1; }
   const r = exportBundle(root, String(h));
   if (!r.ok) { out(format, `context export: refused (${r.problems.join(', ')})`, { ok: false, problems: r.problems }); return 1; }
-  console.log(JSON.stringify(r.export, null, 2));
+  say(JSON.stringify(r.export, null, 2));
   return 0;
 }
 
@@ -303,7 +307,7 @@ async function cmdReview(root, args, format) {
   const r = await doBuild(root, args, { write: true });
   if (!r.ok) { out(format, `context review: build failed (${r.built.reason})`, { ok: false, reason: r.built.reason }); return r.built.reason === 'too-many-files' ? 2 : 1; }
   const { built } = r;
-  const model = describeModel();
+  const model = describeModel({ allowRemote: truthy(flag(args, 'allow-remote')) || r.config.review.allowRemote === true });
   const { jobs, droppedByJobLimit } = planJobs({ bundles: built.bundles, packs, model, maxJobs: Math.min(HARD_LIMITS.maxJobs, num(flag(args, 'max-jobs')) || HARD_LIMITS.maxJobs) });
   const loadJob = loadJobFrom(built, packs);
   const ctxBase = { root: built.root, fileContents: built.fileContents, model };
@@ -341,12 +345,14 @@ async function cmdReview(root, args, format) {
   try {
     result = await runQueue(jobs, {
       ...ctxBase, invoker, loadJob, signal: ac.signal, retryFailed: truthy(flag(args, 'retry-failed')),
-      onEvent: jsonl ? (e) => console.log(JSON.stringify(e)) : undefined,
+      onEvent: jsonl ? (e) => say(JSON.stringify(e)) : undefined,
       limits: {
         concurrency: num(flag(args, 'concurrency')) || config.review.concurrency,
         maxCalls: num(flag(args, 'max-calls')) || config.review.maxCalls,
         maxWallSeconds: num(flag(args, 'max-wall-seconds')) || config.review.maxWallSeconds,
         maxTokensPerJob: config.review.maxTokensPerJob,
+        maxTokensPerRepo: config.review.maxTokensPerRepo,
+        anonymizePrompts: config.review.anonymizePrompts,
         maxRetries: config.review.maxRetries,
         jobTimeoutMs: (num(flag(args, 'job-timeout-seconds')) || 120) * 1000,
         maxCostUsd: num(flag(args, 'max-cost-usd')) ?? config.review.maxCostUsd,

package/src/context-intelligence/config.js

@@ -22,7 +22,7 @@ export const DEFAULT_CONFIG = Object.freeze({
   maxFiles: 3000,
   semanticMetadata: { mode: 'off', haskellHieDir: null },
   context: { profile: 'standard', maxTokens: null, pruneLowValue: true, maxSymbols: 60, maxDepth: 12 },
-  review: { enabled: false, questionPacks: ['authz-idor'], concurrency: 2, maxCalls: 100, maxWallSeconds: 900, maxCostUsd: null, maxTokensPerJob: 40000, maxRetries: 3 },
+  review: { enabled: false, allowRemote: false, questionPacks: ['authz-idor'], concurrency: 2, maxCalls: 100, maxWallSeconds: 900, maxCostUsd: null, maxTokensPerJob: 40000, maxRetries: 3, maxTokensPerRepo: null, anonymizePrompts: false },
   replay: { contentAddressed: true, retention: 'inherit' },
 });
 
@@ -63,6 +63,7 @@ export function normalizeConfig(raw) {
     },
     review: {
       enabled: rv.enabled === true,
+      allowRemote: rv.allowRemote === true,
       questionPacks: Array.isArray(rv.questionPacks) && rv.questionPacks.length ? rv.questionPacks.filter(x => typeof x === 'string') : d.review.questionPacks,
       concurrency: clamp(rv.concurrency, 1, 16, d.review.concurrency),
       maxCalls: clamp(rv.maxCalls, 1, 5000, d.review.maxCalls),
@@ -70,6 +71,8 @@ export function normalizeConfig(raw) {
       maxCostUsd: Number.isFinite(rv.maxCostUsd) && rv.maxCostUsd >= 0 ? rv.maxCostUsd : null,
       maxTokensPerJob: clamp(rv.maxTokensPerJob, 1000, 400000, d.review.maxTokensPerJob),
       maxRetries: clamp(rv.maxRetries, 0, 3, d.review.maxRetries),
+      maxTokensPerRepo: Number.isFinite(rv.maxTokensPerRepo) && rv.maxTokensPerRepo >= 1000 ? Math.trunc(rv.maxTokensPerRepo) : null,
+      anonymizePrompts: rv.anonymizePrompts === true,
     },
     replay: { contentAddressed: rp.contentAddressed !== false, retention: typeof rp.retention === 'string' ? rp.retention : 'inherit' },
   };

package/src/context-intelligence/controls.js

@@ -47,7 +47,46 @@ export function signatureText(lines, declLine, maxLines = 12) {
   for (let i = declLine - 1; i < Math.min(lines.length, declLine - 1 + maxLines); i++) { t += ' ' + lines[i]; if (/\)\s*(?:->[^:]*)?:\s*(?:#.*)?$/.test(lines[i])) break; }
   return t;
 }
-const OWNER_FIELD = /(?:owner|tenant|org(?:anization)?|account|created_?by|author|user_?id|userId|team|workspace)/i;
+// An owner/tenant FIELD NAME, not any word that merely contains one: `ownerId`, `owner_id`, `tenant`, `getOwnerId`
+// qualify; `owner_name` and `cols` do not (the trailing boundary rejects them).
+const OWNER_KEY = '\\w*?(?:[Oo]wner|[Tt]enant|[Oo]rg(?:ani[sz]ation)?|[Aa]ccount|[Cc]reated_?[Bb]y|[Aa]uthor|[Tt]eam|[Ww]orkspace)(?:_?(?:[Ii]d|ID))?\\b|[Uu]ser_?(?:[Ii]d|ID)\\b';
+const OWNER_KEY_RE = new RegExp(`(?<![\\w])(?:${OWNER_KEY})`);
+const TENANT_WORD = /tenant|org|workspace|team|account/i;
+// a SQL string comparing an owner column with a bound parameter: `owner_id = ?`, `owner_id = $1`, `tenant_id = :t`
+const SQL_OWNER_PLACEHOLDER = new RegExp(`(?<![\\w])(?:${OWNER_KEY})\\s*(?:=|\\bIN\\b|\\bin\\b)\\s*\\(?\\s*(?:\\?|\\$\\d+|:\\w+|%s|@\\w+)`);
+// an owner column compared with the principal written straight into the string: `owner_id = ${req.user.id}`
+const SQL_OWNER_INTERPOLATED = new RegExp(`(?<![\\w])(?:${OWNER_KEY})\\s*=\\s*(?:'?\\s*\\+\\s*|\\$\\{\\s*)(?:${QUALIFIED_PRINCIPAL.source}|${BARE_PRINCIPAL.source})`);
+const PRINCIPAL_GLOBAL = new RegExp(QUALIFIED_PRINCIPAL.source, 'g');
+const STRING_LITERAL = /(["'`])(?:\\.|(?!\1).)*\1/g;
+
+/**
+ * Is an owner/tenant FIELD actually tied to the principal in this text? The field and the principal must sit in the
+ * same clause (split on , ; && || braces), so `{ audit: req.user.id, cols: 'owner_name' }` is a decoy and
+ * `{ ownerId: req.user.id }` is a filter. A SQL string with an owner column against a bound placeholder counts when the
+ * principal is passed in the same call. Returns null or { level: 'qualified'|'bare', tenant }.
+ */
+export function ownerBinding(text, extra = null) {
+  let best = null;
+  const take = (level, tenant) => { if (!best || (level === 'qualified' && best.level !== 'qualified')) best = { level, tenant }; };
+  const code = text.replace(STRING_LITERAL, (m) => (SQL_OWNER_PLACEHOLDER.test(m) || SQL_OWNER_INTERPOLATED.test(m) ? m : '""'));
+  for (const clause of code.split(/[,;{}]|&&|\|\|/)) {
+    // the principal's own name (`req.user`, `current_user`) is not an owner field, so it is removed before looking for one
+    const forKey = clause.replace(STRING_LITERAL, ' ').replace(PRINCIPAL_GLOBAL, ' ');
+    if (!OWNER_KEY_RE.test(forKey)) continue;
+    const pr = principalIn(clause, extra);
+    if (pr) take(pr, TENANT_WORD.test(clause));
+  }
+  for (const m of text.match(STRING_LITERAL) || []) {
+    const placeholder = SQL_OWNER_PLACEHOLDER.test(m);
+    if (placeholder) {
+      const pr = principalIn(text, extra);
+      if (pr) take(pr, TENANT_WORD.test(m));
+    }
+    if (SQL_OWNER_INTERPOLATED.test(m)) take('qualified', TENANT_WORD.test(m));
+  }
+  return best;
+}
+
 const COMPARE = /(?:===|!==|==|!=|\.equals\(|\bis not\b|\bis\b|\bnot in\b|\bin\b|\.includes\(|\.has\()/;
 const REJECT = /(?:\breturn\b|\bthrow\b|\braise\b|\babort\b|\bexit\b|\b40[0-9]\b|\bforbidden\b|\bunauthori[sz]ed\b|\bHttpError\b|\breject\b|\bnot_?allowed\b|\bdeny\b|\bdenied\b|throwError|\bfinish\b|\bhalt\b|\bPermissionDenied\b|\bAccessDenied\b|status\()/i;
 
@@ -58,6 +97,13 @@ const DB_RECEIVER = /(?:^|\b)(?:db|database|conn|connection|pool|client|cursor|s
 const SQL_TEXT = /\b(?:select\s[\s\S]{1,120}\sfrom|insert\s+into|update\s+\w+\s+set|delete\s+from)\b/i;
 const HS_SENSITIVE = /(?:^|\.)(?:runDB|selectList|selectFirst|getBy|getJust|insert_?|insertEntity|update|updateWhere|delete|deleteWhere|replace|upsert|query|query_|execute|execute_|readFile|writeFile|callProcess|readProcess)$|^(?:Database\.|System\.Process\.|System\.Directory\.)/;
 
+// Names that answer a question rather than enforce a rule.
+const PREDICATE_NAME = /^(?:is|has|can|cannot|allow|owned|belongs)/i;
+function bareCallStatement(trimmedLine, name) {
+  const esc = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`^(?:await\\s+)?${esc}\\s*\\(`).test(trimmedLine) && /\)\s*;?\s*(?:\/\/.*|\/\*.*)?$/.test(trimmedLine);
+}
+
 const WRITE_VERB = /(?:insert|update|upsert|delete|remove|destroy|save|create|write|append|unlink|rm|exec|spawn|system|popen|post|put|patch|replace)/i;
 
 function kindOfAuthName(name) {
@@ -93,6 +139,51 @@ function clip(s) { return s.trim().slice(0, 160); }
  *   lines   the FILE's lines (0-based array)
  * Returns [{ symbolId, line, category:'control'|'sensitive', kind, subkind, evidence, basis, rejectionSeen, text }]
  */
+/**
+ * Blank the comments (and Python docstrings) of a source file, keeping every character position and newline, so line numbers do not move.
+ * The analysis looks for calls and comparisons in code; a comment that SAYS `ownerId: req.user.id` or `requireUser(req)` is prose, and prose is the
+ * easiest thing for a hostile or merely careless author to write. Strings are left alone (the principal and SQL rules already read around them).
+ */
+export function blankComments(text, file = '') {
+  const src = String(text || '');
+  const hash = /\.(?:py|rb|sh|php|pl|r)$/i.test(file);
+  const dashes = /\.l?hs$/i.test(file);
+  const cLike = !dashes && !/\.(?:py|rb|sh|pl|r)$/i.test(file);
+  const out = src.split('');
+  const n = src.length;
+  let i = 0;
+  const blank = (a, b) => { for (let k = a; k < b && k < n; k++) if (out[k] !== '\n') out[k] = ' '; };
+  while (i < n) {
+    const c = src[i]; const d = src[i + 1];
+    if (c === '"' || c === "'" || c === '`') {
+      if (/\.py$/i.test(file) && src.startsWith(c.repeat(3), i)) {
+        const end = src.indexOf(c.repeat(3), i + 3); const stop = end < 0 ? n : end + 3;
+        blank(i, stop); i = stop; continue;           // a docstring or triple-quoted block is prose
+      }
+      let j = i + 1;
+      while (j < n && src[j] !== c && !(src[j] === '\n' && c !== '`')) { if (src[j] === '\\') j++; j++; }
+      i = j + 1; continue;
+    }
+    if (cLike && c === '/' && d === '*') { const end = src.indexOf('*/', i + 2); const stop = end < 0 ? n : end + 2; blank(i, stop); i = stop; continue; }
+    if (cLike && c === '/' && d === '/' && (i === 0 || /[\s;,)}{\]]/.test(src[i - 1]))) { let j = src.indexOf('\n', i); if (j < 0) j = n; blank(i, j); i = j; continue; }
+    if (hash && c === '#' && !(file.endsWith('.php') && d === '[')) { let j = src.indexOf('\n', i); if (j < 0) j = n; blank(i, j); i = j; continue; }
+    if (dashes && c === '-' && d === '-' && !/[!#$%&*+./<=>?@\\^|~:]/.test(src[i + 2] || ' ')) { let j = src.indexOf('\n', i); if (j < 0) j = n; blank(i, j); i = j; continue; }
+    if (dashes && c === '{' && d === '-') { const end = src.indexOf('-}', i + 2); const stop = end < 0 ? n : end + 2; blank(i, stop); i = stop; continue; }
+    i++;
+  }
+  return out.join('');
+}
+
+function bodyAfterSignature(raw) {
+  const arrow = raw.indexOf('=>');
+  let rest = null;
+  if (arrow >= 0) rest = raw.slice(arrow + 2);
+  else { const m = /\)\s*\{(.*)$/.exec(raw); if (m) rest = m[1]; }
+  if (rest === null) return '';
+  const brace = /^\s*\{(.*)$/.exec(rest);
+  return brace ? brace[1] : rest;
+}
+
 export function analyzeSymbolText(symbol, lines, { haskell = false } = {}) {
   const out = [];
   const seen = new Set();
@@ -125,15 +216,22 @@ export function analyzeSymbolText(symbol, lines, { haskell = false } = {}) {
     const calls = [];
     const re = /([A-Za-z_$][\w$]*(?:(?:\.|::)[A-Za-z_$][\w$]*)*)\s*\(/g;
     let m;
-    if (!isDeclLine) { while ((m = re.exec(raw))) calls.push(m[1]); }
+    // A one-line handler (`app.get('/x', guard, async (req, res) => { res.json(await db.docs.findOne({ id })); })`) is its own declaration
+    // line, so skipping the whole line also skipped its body. Only the SIGNATURE is skipped: the calls after the arrow or the opening brace count.
+    const scanText = isDeclLine ? bodyAfterSignature(raw) : raw;
+    while ((m = re.exec(scanText))) calls.push(m[1]);
     if (haskell && !isDeclLine) {
       const hre = /\b([A-Z][\w.]*\.[a-z][\w']*|[a-z][\w']*)\b/g;
       while ((m = hre.exec(raw))) if (AUTH_NAME.test(m[1]) || HS_SENSITIVE.test(m[1])) calls.push(m[1]);
     }
     for (const name of calls) {
       if (AUTH_NAME.test(name) && !/^(?:if|for|while|switch|catch|function)$/.test(name)) {
-        const rej = REJECT.test(lines.slice(ln - 1, ln + 3).join(' ')) || /^(?:require|ensure|enforce|assert|authori[sz]e|authenticate|protect)/i.test(name.split(/[.:]/).pop());
-        push({ line: ln, category: 'control', kind: kindOfAuthName(name), subkind: null, evidence: 'inferred', basis: 'call-name', rejectionSeen: rej, text: clip(raw) });
+        const lastSeg = name.split(/[.:]/).pop();
+        // A predicate (isOwner, hasRole, can) only returns an answer. Called as a bare statement its answer is thrown away,
+        // so it guards nothing, whatever the lines around it say.
+        const discarded = !haskell && PREDICATE_NAME.test(lastSeg) && bareCallStatement(t, name);
+        const rej = !discarded && (REJECT.test(lines.slice(ln - 1, ln + 3).join(' ')) || /^(?:require|ensure|enforce|assert|authori[sz]e|authenticate|protect)/i.test(lastSeg));
+        push({ line: ln, category: 'control', kind: kindOfAuthName(name), subkind: null, evidence: 'inferred', basis: discarded ? 'call-name-result-discarded' : 'call-name', rejectionSeen: rej, text: clip(raw) });
       }
       const last = name.split(/[.:]/).pop();
       const recv = name.includes('.') ? name.slice(0, name.lastIndexOf('.')) : '';
@@ -149,9 +247,9 @@ export function analyzeSymbolText(symbol, lines, { haskell = false } = {}) {
         push({ line: ln, category: 'sensitive', kind: sub, subkind: verb, evidence: 'observed', basis: 'call-name', rejectionSeen: null, text: clip(raw) });
         // a data operation whose own statement mentions the principal and an owner/tenant field is scoped by it
         const stmt = statementAt(lines, ln);
-        const pr = sub.startsWith('data-') && OWNER_FIELD.test(stmt) ? principalIn(stmt, extraPrincipal) : null;
+        const pr = sub.startsWith('data-') ? ownerBinding(stmt, extraPrincipal) : null;
         if (pr) {
-          push({ line: ln, category: 'control', kind: /tenant|org|workspace|team|account/i.test(stmt) ? 'tenant-scope' : 'ownership', subkind: null, evidence: pr === 'qualified' ? 'observed' : 'inferred', basis: pr === 'qualified' ? 'query-filter' : 'query-filter-bare-identifier', rejectionSeen: null, text: clip(raw) });
+          push({ line: ln, category: 'control', kind: pr.tenant ? 'tenant-scope' : 'ownership', subkind: null, evidence: pr.level === 'qualified' ? 'observed' : 'inferred', basis: pr.level === 'qualified' ? 'query-filter' : 'query-filter-bare-identifier', rejectionSeen: null, text: clip(raw) });
         }
       }
     }
@@ -159,17 +257,17 @@ export function analyzeSymbolText(symbol, lines, { haskell = false } = {}) {
       const verb = /\b(?:insert|update|delete)\b/i.test(raw) ? 'write' : 'read';
       push({ line: ln, category: 'sensitive', kind: `data-${verb}`, subkind: verb, evidence: 'observed', basis: 'sql-text', rejectionSeen: null, text: clip(raw) });
       const stmt = statementAt(lines, ln);
-      const pr = OWNER_FIELD.test(stmt) ? principalIn(stmt, extraPrincipal) : null;
+      const pr = ownerBinding(stmt, extraPrincipal);
       if (pr) {
-        push({ line: ln, category: 'control', kind: /tenant|org|workspace|team|account/i.test(stmt) ? 'tenant-scope' : 'ownership', subkind: null, evidence: pr === 'qualified' ? 'observed' : 'inferred', basis: pr === 'qualified' ? 'query-filter' : 'query-filter-bare-identifier', rejectionSeen: null, text: clip(raw) });
+        push({ line: ln, category: 'control', kind: pr.tenant ? 'tenant-scope' : 'ownership', subkind: null, evidence: pr.level === 'qualified' ? 'observed' : 'inferred', basis: pr.level === 'qualified' ? 'query-filter' : 'query-filter-bare-identifier', rejectionSeen: null, text: clip(raw) });
       }
     }
 
     // a resource field compared with the principal: the ownership check itself
-    const cmpPr = COMPARE.test(raw) && OWNER_FIELD.test(raw) && /\b(?:if|unless|assert|when|guard|require|expect|where|elif|&&|\|\|)\b|\?/.test(raw) ? principalIn(raw, extraPrincipal) : null;
+    const cmpPr = COMPARE.test(raw) && /\b(?:if|unless|assert|when|guard|require|expect|where|elif|&&|\|\|)\b|\?/.test(raw) ? ownerBinding(raw, extraPrincipal) : null;
     if (cmpPr) {
       const rej = REJECT.test(lines.slice(ln - 1, ln + 3).join(' '));
-      push({ line: ln, category: 'control', kind: /tenant|org|workspace|team|account/i.test(raw) ? 'tenant-scope' : 'ownership', subkind: null, evidence: cmpPr === 'qualified' ? 'observed' : 'inferred', basis: cmpPr === 'qualified' ? 'comparison' : 'comparison-bare-identifier', rejectionSeen: rej, text: clip(raw) });
+      push({ line: ln, category: 'control', kind: cmpPr.tenant ? 'tenant-scope' : 'ownership', subkind: null, evidence: cmpPr.level === 'qualified' ? 'observed' : 'inferred', basis: cmpPr.level === 'qualified' ? 'comparison' : 'comparison-bare-identifier', rejectionSeen: rej, text: clip(raw) });
     }
   }
   // A function whose NAME says it is a guard and whose BODY shows a rejection path is a guard function. This is