@clear-capabilities/agentic-security-scanner 0.188.0 → 0.190.0

package/src/language/haskell-reachability.js

@@ -0,0 +1,84 @@
+// Project-reachability adjudication of Haskell taint findings.
+//
+// `haskell-ir.js` `projectReachability` stamps every function with `hs.reachability {status, rootKind, holeReason}`: could any caller exist, judged from
+// the project's entry points over the call graph? This module reads that verdict for the function a taint finding was found in and records it on the
+// finding as `reachability {status, reason, premise, roots, holeReason}`. It is a SEPARATE record from `trustBoundary`: that one answers who controls
+// the input, this one answers whether a caller can exist, and either may be `unknown` independently.
+//
+//   status        entrypoint-reachable | unreachable-in-project | external-api | unknown
+//   premise       what the finding's own claim rests on:
+//                   caller-controlled-parameter   the only origin recorded is the assumption that an untrusted caller supplies a parameter of
+//                                                 an exported function (the weak label, `hs:caller-controlled`)
+//                   recorded-read                 a real environment, command-line, file, standard-input, socket or request read is on the chain
+//
+// What the verdict does to the finding:
+//   unreachable-in-project and premise caller-controlled-parameter   the premise is withdrawn (an entry-point-rooted walk over a hole-free graph says
+//                                                 there is no caller at all): lowered to `info`, never dropped (`lowerFinding`, `_reachLowered`)
+//   unreachable-in-project and premise recorded-read   NOT lowered. "Nothing calls this" is a claim about a call graph in a language where typeclass
+//                                                 dispatch, re-exports and point-free aliasing routinely defeat call graphs; being wrong costs a real
+//                                                 vulnerability, so it may cost rank (`posture/relevance.js` reads `f.reachability`) and not visibility
+//   unknown, external-api, entrypoint-reachable   nothing happens to the severity
+//
+// Nothing here reads a comment, a name or a path: the inputs are the call-graph verdict and the origins the taint engine recorded.
+
+import { lowerFinding, originClasses } from './haskell-trust.js';
+
+const HS_FILE = /\.(?:l?hs|hsc)$/i;
+
+const fnByQid = (perFile, qid) => {
+  if (!qid) return null;
+  const file = String(qid).split('::')[0];
+  const ir = perFile && perFile[file];
+  return ir ? ir.functions.find((x) => x.qid === qid) || null : null;
+};
+
+const REASONS = Object.freeze({
+  'entrypoint-reachable': 'a call path from a project entry point reaches the function',
+  'external-api': 'the function belongs to a module the package exposes, so its callers are outside the analysed code',
+  'unreachable-in-project': 'no entry point of the project reaches the function through the call graph (complete scan, hole-free graph, a main and a manifest present, module not exposed)',
+});
+const HOLE_TEXT = Object.freeze({
+  'partial-scan': 'the scan covered only part of the project',
+  'policy-excluded': 'Haskell sources were kept out of the scan by the path policy',
+  'size-skipped': 'Haskell sources were too large to read',
+  'no-entrypoint': 'the analysed files contain no `main`, so there is no entry point to walk from',
+  'no-manifest': 'no manifest says which modules the package exposes',
+  'parse-failure': 'a declaration could not be read, so its calls are missing from the graph',
+  'function-cap': 'functions past the per-file cap are not in the graph',
+  'opaque-boundary': 'Template Haskell, a quasi-quote, a foreign export, a build step that generates code or a source format the IR does not read can call functions the graph does not show',
+  'unresolved-call': 'a function reachable from an entry point makes a call the IR could not resolve',
+  'instance-method': 'an instance method can be invoked by anything that can see its type',
+  'unresolved-route': 'a route registration could not be resolved',
+});
+
+/** What the finding's own claim rests on (see the header). `null` when the recorded origins do not settle it. */
+function premiseOf(f) {
+  const { roots, classes } = originClasses(f);
+  if (!roots.length) return null;
+  if ([...classes].every((c) => c === 'weak-param')) return 'caller-controlled-parameter';
+  if ([...classes].some((c) => c === 'operator' || c === 'external' || c === 'data')) return 'recorded-read';
+  return null;
+}
+
+/**
+ * Stamps `reachability` on every Haskell IR-TAINT finding that has a verdict for its function, and lowers to `info` the ones whose only premise
+ * (a caller-controlled parameter) the verdict withdraws. Mutates the findings; returns counts.
+ */
+export function applyHaskellReachability(findings, perFile) {
+  const stats = { 'entrypoint-reachable': 0, 'unreachable-in-project': 0, 'external-api': 0, unknown: 0, lowered: 0, rankOnly: 0, unstamped: 0 };
+  for (const f of findings || []) {
+    if (!f || f.parser !== 'IR-TAINT' || !HS_FILE.test(String(f.file || ''))) continue;
+    const fn = fnByQid(perFile, f._funcQid);
+    const r = fn && fn.hs && fn.hs.reachability;
+    if (!r || !r.status) { stats.unstamped++; continue; }
+    const premise = premiseOf(f);
+    const reason = r.status === 'unknown' ? (HOLE_TEXT[r.holeReason] || 'the call graph cannot settle it') : REASONS[r.status];
+    f.reachability = { status: r.status, reason, premise, roots: r.rootKind ? [r.rootKind] : [], holeReason: r.holeReason || null };
+    stats[r.status] = (stats[r.status] || 0) + 1;
+    if (r.status !== 'unreachable-in-project') continue;
+    if (premise === 'caller-controlled-parameter') {
+      if (lowerFinding(f, { kind: 'unreachable-in-project', reason: 'the finding rests on a caller of an exported function supplying a parameter, and nothing in the project can call it', controlKind: 'no-caller-in-project', guard: '_reachLowered', keepNote: true })) stats.lowered++;
+    } else if (premise === 'recorded-read') stats.rankOnly++;
+  }
+  return stats;
+}

package/src/language/haskell-security-rules.js

@@ -162,6 +162,26 @@ function snippetOf(text, line) {
 // socket or connection handle is filled by the peer. A read of standard input is the operator's in a program's own control flow, and
 // the caller's only in an entry point nothing in the analysed code calls (a library function handing back whatever its caller pipes in).
 const NETWORK_HANDLE_CALL = /(?:^|\.)(?:socketToHandle|connectTo|accept|acceptOn|openTCPConnection)$/;
+
+/**
+ * Are this function's callers outside the analysed code? With no project-reachability verdict, or an `unknown` one, the answer is exactly what it
+ * has always been (nothing in the analysed code calls or references it). A function no caller can reach (`unreachable-in-project`) has none. One
+ * reached from an entry point takes its parameters from that path, EXCEPT a root nothing in the analysed code calls (a framework handler, a foreign
+ * export, code the parser withheld): its caller is outside.
+ *
+ * A function of an exposed module (`external-api`) is DELIBERATELY answered as today: the plan for this change said "a public API's callers are
+ * external, so true", but for an exposed function that something in the project also calls that turns on the partial-function and unbounded-read
+ * rules for every such function, and on the development set it added seven flagged sites and no true positive (precision 35.7% -> 23.8%). The
+ * status is still recorded and still keeps the taint finding at full severity; it just does not widen these two rules. Flipping it is the one line
+ * below, with that measurement as the cost.
+ */
+export function callersUnknown(fn) {
+  const hs = (fn && fn.hs) || {};
+  const r = hs.reachability || null;
+  if (!r || r.status === 'unknown' || r.status === 'external-api') return !hs.reached;
+  if (r.status === 'entrypoint-reachable') return !hs.reached && r.rootKind !== 'main';
+  return false;
+}
 function readsOutsideInput(fn, callee, args, importsNetwork) {
   const h = args && args[0];
   const isStdin = !!h && h.kind === 'ident' && /(?:^|\.)stdin$/.test(h.name || '');
@@ -169,7 +189,7 @@ function readsOutsideInput(fn, callee, args, importsNetwork) {
   // the networking packages are not all in the model registry, so a call keeps its bare name; the module imports say which library it is
   if (handleRead) return !!importsNetwork && (fn.calls || []).some((x) => typeof x.callee === 'string' && NETWORK_HANDLE_CALL.test(x.callee));
   const hs = fn.hs || {};
-  return !hs.reached && !/(?:^|\.)main$/.test(fn.name || '');
+  return callersUnknown(fn) && !/(?:^|\.)main$/.test(fn.name || '');
 }
 
 const EQUALITY_OPS = new Set(['==', '/=', '!=']);
@@ -244,7 +264,7 @@ export function analyzeHaskellRules(files, opts = {}) {
   const notes = [];
   if (!Object.keys(hs).length) return { findings, controls, notes };
 
-  const ir = buildHaskellIR(hs);
+  const ir = buildHaskellIR(hs, opts.reachability || {});
 
   // project-level facts
   let requestLimit = null;
@@ -291,7 +311,7 @@ export function analyzeHaskellRules(files, opts = {}) {
       // calls cannot say the text comes from outside.
       const fnHs = fn.hs || {};
       const strongParam = new Set((fnHs.paramSources || []).filter((p) => /^hs:handler-param:/.test(p.decorator || '')).map((p) => p.name));
-      const entryLike = !fnHs.reached;
+      const entryLike = callersUnknown(fn);
       const derivedText = new Set([...(fnHs.textParams || []).filter((n) => strongParam.has(n) || entryLike), ...(entryLike ? (fnHs.inputParams || []) : [])]);
       if (derivedText.size) {
         for (let round = 0; round < 8; round++) {

package/src/language/haskell-syntax.js

@@ -840,7 +840,8 @@ export function parseSyntax(src, opts = {}) {
           // `foreign import ccall unsafe "string.h strlen" c_strlen :: ...` names the Haskell-side function.
           let fname = null;
           for (let q = a; q < b; q++) if (isRop(T[q], '::')) { if (q > a && T[q - 1].t === 'var') fname = T[q - 1].v; break; }
-          res.boundaries.push({ kind: 'ffi', line: t0.line, detail: 'foreign declaration; the foreign code is not analyzed', ...(fname ? { name: fname } : {}) });
+          const dir = T[a + 1] && (T[a + 1].v === 'import' || T[a + 1].v === 'export') ? T[a + 1].v : null;
+          res.boundaries.push({ kind: 'ffi', line: t0.line, detail: 'foreign declaration; the foreign code is not analyzed', ...(dir ? { direction: dir } : {}), ...(fname ? { name: fname } : {}) });
           continue;
         }
         if (t0.v === 'class' || t0.v === 'instance') {

package/src/language/haskell-trust.js

@@ -217,6 +217,28 @@ function findCallsTo(fn, target) {
   return out;
 }
 
+/**
+ * Lower a finding to `info` and say why, without dropping it: the severity it would have had is kept (`originalSeverity`), a control records the
+ * reason (`controls`), and `guardNote` is set (with `keepNote`, only when no earlier pass set one). Idempotent per `guard` (a finding is lowered once by each reason), and two
+ * reasons compose: the second finds the severity already `info`, keeps the original severity the first recorded, and adds its own control.
+ * Used by the trust-boundary pass (`_trustLowered`) and the reachability pass (`_reachLowered`).
+ */
+export function lowerFinding(f, { kind, reason, controlKind, guard, keepNote = false }) {
+  if (!f || !guard || f[guard]) return false;
+  f[guard] = true;
+  f.originalSeverity = f.originalSeverity || f.severity;
+  f.severity = 'info';
+  f.controls = [...(f.controls || []), { kind: controlKind, evidenceKind: 'source' }];
+  if (!keepNote || !f.guardNote) f.guardNote = { kind, reason };
+  return true;
+}
+
+/** The classes of origin a finding's recorded roots fall in (`operator`, `external`, `data`, `weak-param`, `other`), and the roots themselves. */
+export function originClasses(f) {
+  const roots = rootsOf(f);
+  return { roots, classes: new Set(roots.map(classOf)) };
+}
+
 /**
  * Stamps `trustBoundary` on every Haskell IR-TAINT finding and lowers to `info` the verdicts that name no boundary crossed
  * (`operator-controlled`, `api-contract`). Mutates the findings; returns counts.
@@ -256,12 +278,8 @@ export function applyTrustBoundary(findings, perFile) {
     f.trustBoundary = { verdict, reason, role, ...(inferred ? { inferred: true } : {}), roots: roots.slice(0, 5) };
     const key = verdict.replace(/-(\w)/g, (_, c) => c.toUpperCase());
     stats[key] = (stats[key] || 0) + 1;
-    if ((verdict === 'operator-controlled' || verdict === 'api-contract') && !f._trustLowered) {
-      f._trustLowered = true;
-      f.originalSeverity = f.originalSeverity || f.severity;
-      f.severity = 'info';
-      f.controls = [...(f.controls || []), { kind: verdict === 'operator-controlled' ? 'operator-controlled-input' : 'api-contract-wrapper', evidenceKind: 'source' }];
-      f.guardNote = { kind: verdict, reason };
+    if (verdict === 'operator-controlled' || verdict === 'api-contract') {
+      lowerFinding(f, { kind: verdict, reason, controlKind: verdict === 'operator-controlled' ? 'operator-controlled-input' : 'api-contract-wrapper', guard: '_trustLowered' });
     }
   }
   return stats;

package/src/language/haskell-web.js

@@ -83,9 +83,9 @@ const strLit = (e) => { e = unparen(e); return e && e.t === 'lit' && e.kind ===
 
 // ── analysis context ─────────────────────────────────────────────────────────
 class Ctx {
-  constructor(files) {
+  constructor(files, reachability) {
     this.files = files;
-    this.ir = buildHaskellIR(files);
+    this.ir = buildHaskellIR(files, reachability || {});
     this.project = this.ir.project;
     this.modules = [...this.ir.modules.values()];
     this.fnByQid = new Map();
@@ -837,7 +837,7 @@ export function analyzeHaskellWeb(files, opts = {}) {
   for (const [f, t] of Object.entries(files || {})) if (/\.hs$/i.test(f) && typeof t === 'string') hs[f] = t;
   const result = { routes: [], findings: [], middleware: [], frameworks: [], coverage: {}, gaps: [], modelVersion: HS_WEB_MODEL_VERSION, rulesetVersion: HS_WEB_RULES_VERSION, versionStatus: {} };
   if (!Object.keys(hs).length) return result;
-  const ctx = new Ctx(hs);
+  const ctx = new Ctx(hs, opts.reachability);
   const pending = [];
   const add = (r) => pending.push(r);
 

package/src/language/witness.js

@@ -26,6 +26,7 @@ import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { runConfined, sandboxAvailable } from '../sandbox/index.js';
 import { analyzeNixScripts, SHELL_PLACEHOLDER } from './nix-script-taint.js';
+import { bootModuleSet } from '../posture/proof-fabric/generate-haskell.js';
 
 export const WITNESS_VERSION = 'language-witness/1';
 export const PROOF_MARKER = 'PROVEN';
@@ -185,3 +186,98 @@ export function nixFixWitness(finding, opts = {}) {
     return judgeFixWitness(witnessNixFlow(nixOnly(files), target, opts), witnessNixFlow(nixOnly(patched), target, opts));
   };
 }
+
+// ── Haskell: the fix witness ──────────────────────────────────────────────────
+// `haskellFixWitness(finding)` is the `witness` hook of `runFixLifecycle` for a Haskell fix, the counterpart of `nixFixWitness`. It runs the ORIGINAL
+// and the PATCHED file under GHC's interpreter inside the confinement sandbox (`ghc -e ':load *File' -e 'fn "<payload>"'`, every top-level name in
+// scope, so the function need not be exported) and judges them with `judgeFixWitness`: verified only when the original reproduced the effect and the
+// patched code ran without reproducing it.
+//
+// Where it can honestly be built: a command-injection fix (`behavior.kind === 'process'`) in a top-level function whose parameters are all
+// String/FilePath and whose result is IO, in a file whose imports are all modules of the packages that ship with GHC (`bootModuleSet`, the same
+// decision the proof fabric makes before it runs anything). The payload makes the shell create `PROVEN`; the marker is the only thing that proves.
+// Every other class is REFUSED with the reason (never faked): the effect is not observable by a program GHC can run alone (a TLS peer, a response
+// header of a web framework, a database), not an exploit at all (a digest, a log line), or a property of a distribution (randomness).
+const WITNESS_REFUSALS = Object.freeze({
+  tls: 'certificate validation is observable only against a TLS server presenting an untrusted certificate, and the confinement environment denies the network',
+  cookie: 'a cookie attribute is a property of a response header produced by a web framework (wai, scotty, servant) that GHC does not ship, so no program can run it here',
+  random: 'unpredictability is a property of a distribution; no single run reproduces or refutes it',
+  'body-limit': 'the effect needs a wai Request with a streamed body, and wai is not a package GHC ships',
+  sql: 'the effect is observable only in a database driver, which GHC does not ship',
+  html: 'the effect is observable only in the rendering library, which GHC does not ship',
+  hash: 'a weaker digest is not an exploitable effect a program can demonstrate',
+  log: 'the effect is a value appearing in a log, which depends on the logging setup the file does not state',
+  path: 'the base directory is the program\'s own and is not present in the sandbox, so a traversal out of it cannot be planted and observed',
+});
+
+/** The top-level function around `line`: {name, params:[{name,type}], result} from its signature and first clause, or null. */
+export function haskellFunctionAt(text, line) {
+  const lines = String(text).split('\n');
+  let clause = -1;
+  for (let i = Math.min(line - 1, lines.length - 1); i >= 0; i--) if (/^[a-z_][\w']*\b[^:\n]*=/.test(lines[i]) && !/^[a-z_][\w']*\s*::/.test(lines[i])) { clause = i; break; }
+  if (clause < 0) return null;
+  const m = /^([a-z_][\w']*)([^=]*)=/.exec(lines[clause]);
+  if (!m) return null;
+  const params = m[2].trim() ? m[2].trim().split(/\s+/) : [];
+  if (params.some((p) => !/^[a-z_][\w']*$/.test(p))) return null;
+  const sigLine = lines.findIndex((l) => new RegExp(`^${m[1]}\\s*::`).test(l));
+  if (sigLine < 0) return null;
+  let sig = lines[sigLine].replace(/^[^:]*::/, '');
+  for (let j = sigLine + 1; j < lines.length && /^\s+\S/.test(lines[j]) && !/^[a-z_][\w']*\s*(::|=)/.test(lines[j]); j++) sig += ` ${lines[j].trim()}`;
+  if (/=>/.test(sig)) return null;                       // a constrained signature: the argument types are not concrete
+  const types = []; let depth = 0; let cur = '';
+  for (let i = 0; i < sig.length; i++) {
+    const c = sig[i];
+    if (c === '(' || c === '[') depth++; else if (c === ')' || c === ']') depth--;
+    if (depth === 0 && sig.startsWith('->', i)) { types.push(cur.trim()); cur = ''; i++; continue; }
+    cur += c;
+  }
+  types.push(cur.trim());
+  if (types.length !== params.length + 1) return null;
+  return { name: m[1], params: params.map((p, i) => ({ name: p, type: types[i] })), result: types[types.length - 1] };
+}
+
+/** Runs `expr` in the interpreter with `file` loaded (all its top-level names in scope), confined. Never throws. */
+export function runHaskellEval(tree, file, expr, { timeoutMs = 60_000, force } = {}) {
+  const base = { witness: WITNESS_VERSION, lang: 'haskell', ran: false, backend: null, marker: PROOF_MARKER };
+  const ghc = which('ghc');
+  if (!ghc) return { ...base, status: 'unavailable', reason: 'no GHC on PATH; the Haskell witness cannot run here' };
+  if (!sandboxAvailable()) return { ...base, status: 'invalid', reason: 'no confinement primitive available; refusing to execute' };
+  let root;
+  try {
+    root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'witness-hs-')));
+    for (const [f, t] of Object.entries(tree)) if (/\.l?hs$/i.test(f) && typeof t === 'string') { fs.mkdirSync(path.dirname(path.join(root, f)), { recursive: true }); fs.writeFileSync(path.join(root, f), t); }
+    const r = runConfined([ghc, '-isrc', '-i.', '-e', `:load *${file}`, '-e', expr], { root, timeoutMs, force });
+    if (r.status === 'disabled' || r.status === 'error') return { ...base, backend: r.backend, status: 'invalid', reason: `the sandbox could not execute it: ${String(r.stderr || '').trim() || r.status}` };
+    if (r.timedOut) return { ...base, backend: r.backend, status: 'invalid', reason: 'the witness exceeded its time budget', timedOut: true };
+    const proven = fs.existsSync(path.join(root, PROOF_MARKER));
+    if (!proven && /\[GHC-\d+\]|Could not find module|parse error|error:\s/.test(String(r.stderr || ''))) return { ...base, backend: r.backend, status: 'invalid', reason: `the module did not load or run: ${String(r.stderr).trim().split('\n').find((l) => l.trim()) || 'GHC rejected it'}` };
+    return { ...base, ran: true, backend: r.backend, status: proven ? 'reproduced' : 'not-reproduced', exitCode: r.exitCode, reason: proven ? null : 'the function ran and the marker was not created' };
+  } catch (e) {
+    return { ...base, status: 'invalid', reason: `witness harness error: ${String((e && e.message) || e)}` };
+  } finally { if (root) fs.rmSync(root, { recursive: true, force: true }); }
+}
+
+const importsOf = (text) => [...String(text).matchAll(/^import\s+(?:safe\s+)?(?:qualified\s+)?([A-Z][\w.']*)/gm)].map((m) => m[1]);
+
+/** A `witness` hook for runFixLifecycle over a Haskell fix. See the block comment above for what is and is not supported. */
+export function haskellFixWitness(finding, opts = {}) {
+  return (plan, files, patched) => {
+    const kind = plan && plan.behavior && plan.behavior.kind;
+    const no = (reason) => ({ ok: false, verified: false, reason });
+    if (kind !== 'process') return no(`no controlled witness can be built for ${kind || 'this'} fixes: ${WITNESS_REFUSALS[kind] || 'the class has no observable effect a program GHC runs alone could produce'}`);
+    const fn = haskellFunctionAt(plan.before, plan.fixedAtLine || finding.line);
+    if (!fn || !fn.params.length || !/^IO\b/.test(fn.result) || fn.params.some((p) => !/^(?:String|FilePath)$/.test(p.type))) return no('the flagged call is not in a top-level function of String/FilePath parameters returning IO, so there is no argument to put a payload in');
+    const ghc = opts.ghc || which('ghc');
+    if (!ghc) return { ok: false, verified: false, status: 'unavailable', reason: 'no GHC on PATH; the Haskell witness is unavailable here' };
+    const boot = bootModuleSet(ghc);
+    if (!boot) return no('the modules the installed GHC provides could not be listed, so whether the file can be loaded is unknown');
+    const external = [...new Set([...importsOf(plan.before), ...importsOf(plan.after)])].filter((m) => !boot.has(m));
+    if (external.length) return no(`the file imports ${external.slice(0, 4).join(', ')}, which GHC's boot packages do not provide, so it cannot be loaded for a witness`);
+    if (/\{-#\s*LANGUAGE[^#]*\b(?:TemplateHaskell|QuasiQuotes|CPP)\b/.test(plan.before)) return no('the file uses Template Haskell, quasi-quotes or CPP, which run code at load time');
+    const payload = `x; touch ${PROOF_MARKER}`;
+    const expr = `${fn.name} ${fn.params.map(() => JSON.stringify(payload)).join(' ')}`;
+    const only = (t) => Object.fromEntries(Object.entries(t).filter(([p, x]) => p === plan.file && typeof x === 'string'));
+    return judgeFixWitness(runHaskellEval(only(files), plan.file, expr, opts), runHaskellEval(only(patched), plan.file, expr, opts));
+  };
+}

package/src/mcp/tools.js

@@ -1219,7 +1219,7 @@ export const synthesize_fix = {
           if (lc.languageOfFinding(f)) {
             const proj = lc.loadLanguageProject(ctx.sessionRoot);
             const prev = await lc.languageFixPreview(f, proj.files);
-            languageFix = { status: prev.status, ok: prev.ok, label: prev.label || null, tier: prev.tier || null, reason: prev.reason || null, diff: prev.diff || null, explanation: prev.explanation || null, consequences: prev.consequences || [] };
+            languageFix = { status: prev.status, ok: prev.ok, label: prev.label || null, tier: prev.tier || null, reason: prev.reason || null, decision: prev.decision || null, diff: prev.diff || null, explanation: prev.explanation || null, consequences: prev.consequences || [] };
             // A fix that spans several files is applied with apply_fix + plan_digest (atomic, one history group); see _applyMultiFilePlan.
             if (prev.ok && prev.edits) {
               languageFix.multiFile = prev.edits.map((e) => e.file);

package/src/posture/proof-fabric/container.js

@@ -11,8 +11,19 @@
 // The container is named, and removed (`rm -f`) on every exit path including timeout and cancellation, because killing the `docker`
 // client does not by itself stop the container.
 //
-// HONEST LIMIT: this has been exercised against a fake engine that records the arguments and runs the command locally, which proves
-// the plumbing and the flags. It has not been run against a real Docker or Podman daemon in this repository's test environment.
+// WHAT HAS AND HAS NOT BEEN RUN. The arguments are pinned flag by flag against a fake engine that records them. Against a REAL engine it has
+// run: bench/proof-fabric/RESULT-linux-container.json records 72 container runs (36 vulnerable reproducers confirmed, 0 false confirmations, the
+// timeouts degraded as designed) on Docker 28.0.4 on a Linux x64 runner, over the gcc, eclipse-temurin:21, node:24-slim and python:3-slim images
+// (the Temurin run is what found the `javac: not found` PATH problem above), and the `proof-container` CI job runs it on every change. The
+// residual limits, none of them closed by that run:
+//   * ONE engine and ONE version on ONE host class. Other Docker versions, rootless Docker and other kernels are unmeasured.
+//   * Podman is not probed: it is a supported engine name, and no run against it exists.
+//   * macOS is unmeasured. Docker Desktop runs containers in a VM, so bind mounts, uids and file ownership behave differently from the Linux
+//     measurement; no macOS container run has been recorded.
+//   * The haskell:9 image is wired (CONTAINER_TOOLS, CONTAINER_PATH) but its toolchain layout for a non-root user was never run against a real
+//     engine; the measurement skips Haskell unless AGENTIC_SECURITY_PROOF_CONTAINER_HASKELL=1 (bench/proof-fabric/measure.mjs). The result file
+//     names no .NET image either, so the dotnet SDK image is unverified in the same way.
+//   * A reproducer that needs the loopback callback listener (SSRF) cannot run with `--network none` and is skipped, not measured.
 import { spawnSync } from 'node:child_process';
 import { superviseSpawn } from '../../sandbox/supervise.js';
 import { scrubEnv } from '../../sandbox/trust-domains.js';

package/src/posture/relevance.js

@@ -262,6 +262,21 @@ function _threatBonus(f, threatModel, factors) {
   return bonus;
 }
 
+// A language that reasons about its own call graph (Haskell: `language/haskell-reachability.js`) states `f.reachability = {status, reason, premise,
+// roots, holeReason}`. That verdict is a statement about the FUNCTION, from the project's entry points, so it outranks this module's file-level
+// import graph, which has no Haskell extraction. Only a POSITIVE verdict moves the tier; `unknown` (and any finding without one) falls through
+// to the file-level logic unchanged. It re-ranks only: severity is never touched here (a lowering, where one is justified, is the language
+// pass's own decision and is recorded on the finding).
+const LANGUAGE_STATUSES = new Set(['entrypoint-reachable', 'unreachable-in-project', 'external-api', 'unknown']);
+function languageVerdict(f) {
+  const r = f && f.reachability;
+  if (!r || typeof r !== 'object' || !LANGUAGE_STATUSES.has(r.status) || !Object.hasOwn(r, 'holeReason')) return null;
+  if (r.status === 'unreachable-in-project') return { tier: 'unreachable', reachable: false, factor: `no call path from any entry point of the project (${r.reason || 'call graph complete'})` };
+  if (r.status === 'entrypoint-reachable') return { tier: 'indirect', reachable: true, factor: 'reachable from a project entry point through the call graph' };
+  if (r.status === 'external-api') return { tier: 'indirect', reachable: true, factor: 'part of the package\'s exposed API: its callers are outside the analysed code' };
+  return null;
+}
+
 /**
  * Pure scorer. Does NOT mutate the finding.
  *
@@ -280,7 +295,12 @@ function scoreRelevance(f, graph, threatModel) {
 
   let tier;
   let reachable;
-  if (!file || entryFiles.size === 0) {
+  const lang = languageVerdict(f);
+  if (lang && !(lang.tier === 'indirect' && file && entryFiles.has(file))) {
+    tier = lang.tier;
+    reachable = lang.reachable;
+    factors.push(lang.factor);
+  } else if (!file || entryFiles.size === 0) {
     tier = 'unknown';
     reachable = null;
     factors.push(entryFiles.size === 0