@clear-capabilities/agentic-security-scanner 0.195.23 → 0.195.25

package/CHANGELOG.md

@@ -9,6 +9,37 @@
 > make the history less accurate, not more.
 
 
+## 0.195.25 - GA programme, release E: the lineage graph joins a queue publish to its receive and a store write to its read
+
+**Measured, 0.195.24:** `TIMINGS preflight=3s push=7s pr=4s checks=355s merge=6s verify=6s tag=2s release=162s npm=267s total=812s release-clock=176s`, shipped from the merge to the published release in 176 s; the npm listing lagged the publish and `ship --resume` confirmed it.
+
+GA-03.3 of the GA plan asked for the existing cross-service boundary joins to reach the documented opt-in scan path, with producer and consumer schemas validated, arguments mapped, and unknown dynamic edges left unknown. The multi-service fixture of `bench/dag` (HTTP api to queue worker to storage to HTTP reporting) found 3 of its 8 labelled positives: the queue consumer and both reporting handlers reported nothing, because the field-identity engine saw a publish as an escape and a receive as an unrelated call result. It now finds 6 of 8: every flow label (6 of 6 positive, 3 of 3 negative); the two site labels it still misses are a stored value written into HTML, which needs a storage-read source in the taint engine, not in the lineage graph. Nothing moved a maturity.
+
+- **Handoffs are joined from code or from a contract** (`scanner/src/lineage/boundary-join.js`, opt-in: `AGENTIC_SECURITY_LINEAGE_BOUNDARIES=1` with `AGENTIC_SECURITY_LINEAGE_DEEP=1`, or `boundaries: { enabled: true }` on the lineage build). A producer is a queue publish (the v2 `sendMessage`/`publish` shapes and the AWS SDK v3 `client.send(new SendMessageCommand(input))`) or a store write (`collection('<literal>').insertOne` and friends); a consumer is an assignment from `client.send(new ReceiveMessageCommand(input))` or from `collection('<literal>').find(q).toArray()` / `.findOne(q)`. The two sides join when both name the same identity by a literal the parser can read (a string, or a `process.env` name followed through up to three module-scope constants) or when a DAG-08 boundary contract in `.agentic-security/boundary-contracts.json` declares the edge. A computed identity is reported unjoined with `dynamic-identity`; an identity with no partner in the scanned tree is `no-producer-in-scope`; two sites that share only a field name are never joined, and two collections with different literal database names are not the same store.
+- **The fields that cross are the fields that reached the producer.** The record's object-literal keys are mapped to the data-element ids whose contributing state key the key's value expression references (`{note: body.note, total: body.qty * PRICE}` hands `note` to `note` and `qty` to `total`); a record that is not an object literal hands every reaching id to the record as a whole, disclosed as `whole-record`. The consumer is seeded on the parsed record's fields (`out.Messages.Body.note` for SQS, `rows.note` for a Mongo read) after the call that received it, carrying the producer's element id, so an element keeps its collection point's name and classes and gains one source location per consumer. A declared contract seeds the handler parameter the contract binds, with its field renames applied; a contract without a producer site is a gap, never a guess.
+- **A chain resolves in bounded rounds.** The producer must be analysed before its consumer can be seeded, and a store reader needs the queue consumer analysed with its own seeds first, so the builder re-runs the field analysis while a round mints new seeds, at most four rounds; a still-productive last round is reported as `truncated`, the graph `partial`, never read as convergence. The source node of a joined flow is the producer's sink node, so the graph reads as one chain, and the edge carries `provenance: 'code'` or `'manual'` and a `boundaryCrossings` entry with `modeledInput: true, observed: false`: nothing here saw a message or a row.
+- **A JSON round trip keeps structure.** `JSON.stringify(v)` and `JSON.parse(s)` forward the argument's field structure in the resolver and count as aliases in the seed planner; before, `body = JSON.parse(m.Body)` collapsed to the whole record's flat union and every key crossed under every field. Any other call still flattens.
+- **The v3 send command is a queue sink and the receive is not a sink.** The general catalog's bare `send` entry (a koa-send path sink) had claimed `sqs.send(new SendMessageCommand(...))` as an unresolved file sink; it now resolves through the privacy catalog's queue entry, and `ReceiveMessageCommand` is a read.
+- **`bench/dag` forces the joins on**, as it forces deep mode, and its baseline is re-recorded after a full run. The re-record also absorbs differences on the pinned real units that predate this release and were never recorded because the bench is in no gate (express/examples 7 to 9 flows, scotty/examples 0 to 2, yesod-core 1 to 3 call-statement sites, from the 0.195.24 seeding changes), and two `yesod:yesod-auth` `unsafe-boundary` labels that went TP to FN because `hs-unsafe-io-boundary` now reports that documented `unsafePerformIO` nonce generator at `info` and the bench counts `info` as not reported. The rule still fires; the severity move is a Haskell precision decision made earlier, listed under "Open items" in `docs/implementation-status/dag-improvements.md` so it is not read as a detection loss. Each of those was checked by measuring `main` itself with the bench's own unit runner, not inferred. One reported fixture flow matches no label (`qty` into `orders.total`, a derived numeric write the label set does not list); it stays unlabelled rather than relabelled.
+- **Off by default, byte-identical off.** A build without the option produces the same graph, ledger and limitations as 0.195.24; `test/lineage/boundary-join.test.js` BJ/9 pins it, and the self-scan, mutation and layer-recall baselines did not move.
+
+What it does not do, stated in `scanner/src/lineage/CLAUDE.md`: a queue consumed through a callback, a store read through an ORM model, a batch send's per-entry bodies, an identity built from a template string or concatenation, and a producer in another repository (that remains the declared cross-repo link).
+
+Gates, from the runs recorded for this entry: `test:lineage` 1582/1582 (one new file, `boundary-join.test.js`, wired into the scope), full `npm test` 12676 pass, 0 fail, 35 skipped; `bench:mutation:check` 460/460; `bench:self-scan:check` no drift (683/106/21/0); `check-doc-drift --gate` exit 0 after the inventory refresh (one new environment variable); `node bench/dag-demand/run.mjs` parity on 30 of 30 sampled queries on both workloads, 7 fallbacks on this repository's source, all named (recorded as `graph-precision:DEMAND-PARITY`, GA-03.5); `node bench/dag/run.mjs` full run on the pinned units and the fixture, re-baselined (recorded as `code-boundaries:BOUNDARY-JOIN`, GA-03.3).
+
+## 0.195.24 - GA programme, release D: lineage sources the taint engine does not own, seeds that survive an alias and a call
+
+GA-03.1 of the GA plan asked for the lineage corpus to be re-run on today's source, each failure classified, the source-category omissions closed without broadening the main taint catalog incorrectly, and aliasing and field identity fixed across calls. The corpus (`bench/data-lineage/`) now passes 24 of 24, all regression-tier, from 17 of 24 with seven capability-tier failures. Nothing moved a maturity: Code Boundaries stays Preview, because the real-code graph precision and recall of the frozen protocol (GA-02) are still unmeasured.
+
+- **A lineage-only source catalog** (`scanner/src/lineage/lineage-source-catalog.js`). Four of the fourteen reachable source categories had no JavaScript entry in the taint catalog (`cli-argument`, `http-upload`, `storage-read`, `user-input`), so the four corpus fixtures naming them were written in Python syntax and could never mint a source node. Six JavaScript entries now serve them (`process.argv`, `req.file`, `req.files`, `fs.readFileSync`, bare `prompt()`, `readlineSync.question()`), consulted by `source-seeding.js` after the main matcher, for JavaScript and TypeScript files only. They live beside the taint catalog, not in it, the way the privacy sink catalog does: a file's contents and a console prompt are where personal data enters a program, which the lineage graph records, but treating them as attacker-controlled would turn every configuration read into a taint source. A test pins that the main matcher returns null for every shape, and the self-scan, mutation and layer-recall gates are unchanged.
+- **Seeds after a call-shaped assignment.** A source that is a call (`const record = fs.readFileSync(p)`, `const data = res.json()`) has no access path, and until now was recorded as unseedable. It is seeded on the assignment target in the state leaving that node (`after-node` seeds, applied by the engine's worklist), so the value exists where the program puts it. A call-shaped source nested in another call's arguments is still unseedable, and still recorded.
+- **Seeds across an alias.** `const body = req.body; body.card_number` seeded the container and minted an unclassified element named `body`. The planner now follows the alias within the function and mints the field seed on the original path, so the flow carries `card_number` as PCI. Chained aliases are followed for at most four rounds; a dynamic key is never seeded; a parameter is never an alias.
+- **Seeds under every call context.** A field read in a helper and returned to the caller produced the right nodes and element and zero flows, because the caller resolved the helper under the state its arguments bound and the helper's own seed was absent from it. The call-summary resolver now joins the callee's own seeds onto that state: a source read inside a function is a fact about that function wherever it is called from. The cache rule of `DESIGN_GRAPH_BUILDER.md` section 3.6 stands, keyed by the joined state so nothing is ever stored under the empty-entry key for a seeded function; section 3.8 records the revision and the driver test pins both directions.
+- **The runner's contract** gained `expectUnsupportedSink` (the `exec` fixture's process-kind node with a reason, AC-11) and reads an empty `dataClass` label as "match on the categories alone" (a positional argument, a file's contents). The user-input fixture was renamed `js-user-input-to-log-pii` once its element had a name to classify. Every fixture's notes record what changed and how it was measured.
+- **Open, measured and pinned:** a sink inside a callee never sees an argument's identity, because a bare call statement is not resolved through the summary. Resolving it was tried and reverted: it consumes a summary context per call site and under a tight context cap degrades a later resolution, which moved seven pinned provenance measurements. `seeding-across-calls.test.js` pins the zero so the gap is measured, not assumed.
+
+Gates, from the runs recorded for this entry: `test:lineage` 1570/1570 (one new file, `seeding-across-calls.test.js`, wired into the scope), `test:lifecycle` 491/491, `bench:data-lineage:check` 24/24, `bench:self-scan:check` no drift (683/106/21/0), `bench:mutation:check` every verdict correct, `bench:layer-recall:check` unchanged. The 0.195.23 ship stopped once in the checks phase: the hosted macOS runner never picked up `determinism-attest (macos-latest)` on three attempts during a GitHub Actions incident (every other job green); after GitHub's mitigation a resume passed it on the next attempt. Measured 0.195.23 `TIMINGS`: `preflight=4s push=7s pr=6s checks=77s merge=6s verify=6s tag=2s release=255s npm=756s total=1119s release-clock=269s` (the checks figure is the resumed run; the first attempt spent 3644 s waiting on the runner).
+
 ## 0.195.23 - GA programme, release C: one model transport, reviewed rule promotion, metrics with a scope, provenance that proves absence, fleet results that age
 
 **Measured, 0.195.22:** `TIMINGS preflight=3s push=6s pr=4s checks=398s merge=5s verify=6s tag=2s release=161s npm=206s total=791s release-clock=174s`, shipped in 14 min 56 s on the second attempt (the first was stopped by the background gate's `ci-parity` check: a new deep-mode pin skipped under the hosted-CI switches until it set `DEEP_IN_CI` like the existing helper).

package/dist/3596.index.js

@@ -10,7 +10,7 @@ export const modules = {
 /* harmony export */ });
 /* unused harmony export HS_SWEEP_VERSION */
 /* harmony import */ var _dataflow_catalog_haskell_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7225);
-/* harmony import */ var _lineage_source_seeding_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(88383);
+/* harmony import */ var _lineage_source_seeding_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(95174);
 // Root-cause sweep for Haskell (X-008). The generic sweep anchors on a `callee(args)` text shape, which Haskell's
 // juxtaposition syntax never produces, so a confirmed Haskell finding swept nothing. This sweep works on the IR: for
 // each confirmed finding it takes the RESOLVED sink callee from the model catalog and lists every other call of that

package/dist/5752.index.js

@@ -347,7 +347,7 @@ async function witnessBuild(args) {
   if (!f.out && !f['list-sinks']) { err(`Usage: ${who} [path] --out <dir> [--sink <pnodeId>] | --list-sinks`); return 2; }
 
   const program = await loadProgram(root);
-  const { buildDataFlowGraph } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 37746));
+  const { buildDataFlowGraph } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 36201));
   const { sinkCandidates, reconstructPaths } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 444));
   const { buildWitnessBundle, signWitnessBundle, exportProvenanceArtifact } = await __webpack_require__.e(/* import() */ 1128).then(__webpack_require__.bind(__webpack_require__, 91128));
   if (!program.callGraph || !program.callGraph.functions || program.callGraph.functions.size === 0) {

package/dist/{01087ded263953062654.json → 809c900a90284017aaff.json}

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.195.23",
+  "version": "0.195.25",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -90,7 +90,7 @@
     "test:dataflow": "node --test test/privacy-catalog.test.js test/privacy-deep-walker.test.js test/privacy-deep-e2e.test.js test/container-taint.test.js test/stored-taint-families.test.js test/py-annotation-sources.test.js test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/chrome-probe.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-rust.test.js test/rust-taint-flow.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-cs-p1.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/return-sink-check.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js test/interproc-nested-call-taint.test.js test/catalog-xpath-injection.test.js test/catalog-ldap-injection.test.js test/catalog-xxe.test.js test/catalog-response-splitting.test.js test/catalog-code-injection.test.js test/parser-rb-control-flow.test.js test/catalog-ruby-p1.test.js test/callee-receiver-taint.test.js test/catalog-command-injection-p4.test.js test/catalog-xss-p4.test.js test/catalog-path-ssrf-p3.test.js test/catalog-ai-model-provider-precision.test.js test/catalog-orm-write.test.js test/dataflow/provenance-pipeline-integration.test.js test/dataflow-progress.test.js test/scan-progress.test.js test/sard-leakage-pipeline.test.js test/sard-split-scoring.test.js test/sard-llm-isolation.test.js test/sard-mutation-adversarial.test.js test/sard-baseline-adaptive-tolerance.test.js test/sard-independent-holdout.test.js test/sard-flow-aware-scoring.test.js test/sard-macro-score-support-floor.test.js test/sard-php-split.test.js test/parser-java-nary-concat.test.js test/sard-naive-baseline.test.js test/field-taint-cross-method.test.js test/field-taint-engine-unit.test.js test/coercion-sanitizer-kill.test.js test/constant-propagation-path-sensitivity.test.js test/parser-java-assignments.test.js test/catalog-java-sard.test.js test/parser-cs-juliet-shapes.test.js test/catalog-cs-sard-p2.test.js test/sard-cwe-key-merge.test.js test/parser-php-backtick.test.js test/parser-php-include.test.js test/php-include-merge.test.js test/parser-php-array-field-taint.test.js test/parser-php-cond-assign.test.js test/parser-rust-redos.test.js test/multi-sink-taint-chain.test.js test/static-field-cross-class-call-string.test.js test/regex-guard-narrowing.test.js test/object-instance-field-taint.test.js test/param-type-inference.test.js test/smt-path-feasibility.test.js test/cross-service-taint.test.js test/dataflow-expr-taint-scaling.test.js test/evaluation/guard-dominance.test.js test/evaluation/engine-mechanisms.test.js test/rx-exec-receiver.test.js test/incremental-dependency.test.js test/incremental-integrity.test.js test/demand-query.test.js test/ir-cache.test.js test/canonicalize-parity.test.js test/dataflow-source-attribution.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-apply-fix-multifile.test.js test/mcp-protocol-smoke.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js test/lsp-server.test.js test/mcp-dataflow-tools.test.js test/cli/governance-propose-edit.test.js test/cli/remediation-open-update.test.js test/cli/remediation-verify-reopen.test.js test/cli/dataflow-observations.test.js test/cli/federate-declare-list.test.js test/capabilities/tools.test.js",
     "test:report": "node --test test/report-scan-invariants.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/git-history-batch.test.js test/default-scan-drift.test.js test/bundle-optional-deps.test.js test/scan-health.test.js test/finding-schema.test.js test/pipeline/finding-schema-provenance.test.js test/evidence-provenance.test.js test/report/provenance-output.test.js test/report/provenance-format-parity.test.js test/legacy-compat.test.js test/annotator-runner.test.js test/detector-runner.test.js test/detector-errors.test.js test/analyzer-supervisor.test.js test/cascade-worker-pool.test.js test/cascade-pool-wiring.test.js test/coverage-ledger.test.js test/coverage-ledger-completeness.test.js test/assurance-mode.test.js test/artifact-registry.test.js test/artifact-registry-completeness.test.js test/retention-policy.test.js test/state-lifecycle-report.test.js test/legal-hold.test.js test/production-feedback.test.js test/calibration-feedback.test.js test/encryption-provider.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js test/oscal-conformance.test.js test/cli-fix-apply.test.js test/apply-fix-service.test.js test/high-impact-approval-gate.test.js test/approver-registry.test.js test/suppression-exceptions.test.js test/fix-history.test.js test/producer-registry.test.js test/producer-collector.test.js test/enrichment-completion.test.js",
-    "test:lineage": "node --test test/lineage/analysis-completion.test.js test/lineage/schema.test.js test/lineage/ids.test.js test/lineage/protection.test.js test/lineage/classification.test.js test/lineage/validate.test.js test/lineage/json-schema-parity.test.js test/lineage/flagship-fixture.test.js test/lineage/flagship-fixture-semantics.test.js test/lineage/field-identity.test.js test/lineage/engine-expr-resolver.test.js test/lineage/engine-walker.test.js test/lineage/engine-integration.test.js test/lineage/engine-receiver-identity.test.js test/lineage/summaries.test.js test/lineage/driver.test.js test/lineage/engine-provenance.test.js test/lineage/engine-provenance-interprocedural.test.js test/lineage/path-store.test.js test/lineage/path-query.test.js test/lineage/flow-grade.test.js test/lineage/source-registry.test.js test/lineage/sink-registry.test.js test/lineage/transform-catalog.test.js test/lineage/handling-analyzer.test.js test/lineage/registry-real-code.test.js test/lineage/source-seeding.test.js test/lineage/graph-builder.test.js test/lineage/coverage.test.js test/lineage/resolve-destination.test.js test/lineage/queue-detail.test.js test/lineage/index.test.js test/lineage/obligation-mapping.test.js test/lineage/obligation-predicates.test.js test/lineage/obligation-predicates-walkthrough.test.js test/lineage/transit-protection.test.js test/lineage/at-rest-protection.test.js test/lineage/protection-summary.test.js test/lineage/ac01-multi-sink.test.js test/lineage/policy-verdict.test.js test/lineage/governance-refs.test.js test/lineage/export-privacy.test.js test/lineage/export-json.test.js test/lineage/export-csv.test.js test/lineage/decision-story.test.js test/lineage/export-briefing.test.js test/lineage/graph-snapshot.test.js test/lineage/graph-diff.test.js test/lineage/drift-policy.test.js test/lineage/recipient-profile.test.js test/lineage/recipient-registry.test.js test/lineage/recipient-wiring.test.js test/lineage/redact-graph.test.js test/lineage-scan-wiring.test.js test/lineage-artifact-write.test.js test/bench-data-lineage-runner.test.js test/bundle-frontend.test.js test/bundle-frontend-golden.test.js test/generate-html-report.test.js test/export-image.test.js test/lineage/scenario.test.js test/lineage/scenario-engine.test.js test/lineage/scenario-diff.test.js test/lineage/scenario-no-obligation-wiring.test.js test/lineage/impact-assessment.test.js test/lineage/impact-engine.test.js test/lineage/impact-no-obligation-wiring.test.js test/lineage/governance-edit.test.js test/lineage/remediation.test.js test/lineage/runtime-observation.test.js test/lineage/observation-correlation.test.js test/lineage/observation-adapters.test.js test/lineage/observation-store.test.js test/lineage/runtime-corroboration-wiring.test.js test/lineage/cross-repo-link.test.js test/lineage/federation-loader.test.js test/lineage/cross-repo-link-wiring.test.js test/lineage/runtime-assurance.test.js test/lineage/runtime-edge-states.test.js test/lineage/runtime-explorer-view.test.js test/cli/runtime-explorer-cli.test.js test/cli/runtime-identity-cli.test.js test/cli/runtime-twin-cli.test.js test/lineage/cut-planner.test.js test/lineage/scc.test.js test/lineage/scc-solver.test.js test/graph/graph-views.test.js test/lineage/dag07-completion.test.js test/lineage/owned-build.test.js test/dataflow/boundary-propagation.test.js test/lineage/boundary-contract.test.js test/lineage/correlation-v2.test.js test/lineage/path-control-evidence.test.js test/lineage/smt-z3-backend.test.js test/cli/dag-commands.test.js",
+    "test:lineage": "node --test test/lineage/analysis-completion.test.js test/lineage/schema.test.js test/lineage/ids.test.js test/lineage/protection.test.js test/lineage/classification.test.js test/lineage/validate.test.js test/lineage/json-schema-parity.test.js test/lineage/flagship-fixture.test.js test/lineage/flagship-fixture-semantics.test.js test/lineage/field-identity.test.js test/lineage/engine-expr-resolver.test.js test/lineage/engine-walker.test.js test/lineage/engine-integration.test.js test/lineage/engine-receiver-identity.test.js test/lineage/summaries.test.js test/lineage/driver.test.js test/lineage/engine-provenance.test.js test/lineage/engine-provenance-interprocedural.test.js test/lineage/path-store.test.js test/lineage/path-query.test.js test/lineage/flow-grade.test.js test/lineage/source-registry.test.js test/lineage/sink-registry.test.js test/lineage/transform-catalog.test.js test/lineage/handling-analyzer.test.js test/lineage/registry-real-code.test.js test/lineage/source-seeding.test.js test/lineage/seeding-across-calls.test.js test/lineage/boundary-join.test.js test/lineage/graph-builder.test.js test/lineage/coverage.test.js test/lineage/resolve-destination.test.js test/lineage/queue-detail.test.js test/lineage/index.test.js test/lineage/obligation-mapping.test.js test/lineage/obligation-predicates.test.js test/lineage/obligation-predicates-walkthrough.test.js test/lineage/transit-protection.test.js test/lineage/at-rest-protection.test.js test/lineage/protection-summary.test.js test/lineage/ac01-multi-sink.test.js test/lineage/policy-verdict.test.js test/lineage/governance-refs.test.js test/lineage/export-privacy.test.js test/lineage/export-json.test.js test/lineage/export-csv.test.js test/lineage/decision-story.test.js test/lineage/export-briefing.test.js test/lineage/graph-snapshot.test.js test/lineage/graph-diff.test.js test/lineage/drift-policy.test.js test/lineage/recipient-profile.test.js test/lineage/recipient-registry.test.js test/lineage/recipient-wiring.test.js test/lineage/redact-graph.test.js test/lineage-scan-wiring.test.js test/lineage-artifact-write.test.js test/bench-data-lineage-runner.test.js test/bundle-frontend.test.js test/bundle-frontend-golden.test.js test/generate-html-report.test.js test/export-image.test.js test/lineage/scenario.test.js test/lineage/scenario-engine.test.js test/lineage/scenario-diff.test.js test/lineage/scenario-no-obligation-wiring.test.js test/lineage/impact-assessment.test.js test/lineage/impact-engine.test.js test/lineage/impact-no-obligation-wiring.test.js test/lineage/governance-edit.test.js test/lineage/remediation.test.js test/lineage/runtime-observation.test.js test/lineage/observation-correlation.test.js test/lineage/observation-adapters.test.js test/lineage/observation-store.test.js test/lineage/runtime-corroboration-wiring.test.js test/lineage/cross-repo-link.test.js test/lineage/federation-loader.test.js test/lineage/cross-repo-link-wiring.test.js test/lineage/runtime-assurance.test.js test/lineage/runtime-edge-states.test.js test/lineage/runtime-explorer-view.test.js test/cli/runtime-explorer-cli.test.js test/cli/runtime-identity-cli.test.js test/cli/runtime-twin-cli.test.js test/lineage/cut-planner.test.js test/lineage/scc.test.js test/lineage/scc-solver.test.js test/graph/graph-views.test.js test/lineage/dag07-completion.test.js test/lineage/owned-build.test.js test/dataflow/boundary-propagation.test.js test/lineage/boundary-contract.test.js test/lineage/correlation-v2.test.js test/lineage/path-control-evidence.test.js test/lineage/smt-z3-backend.test.js test/cli/dag-commands.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js test/proof-corpus-lib.test.js test/proof-corpus-runner.test.js",
     "test:server": "node --test test/server/graph-loader.test.js test/server/security.test.js test/server/routes.test.js test/server/http-server.test.js test/server/cmd-explore.test.js test/server/cmd-dataflow-export.test.js test/server/static-assets.test.js test/server/dataflow-scenario-cli.test.js test/server/dataflow-impact-cli.test.js",
     "test:haskell": "node --test test/haskell/haskell-reachability.test.js test/haskell/haskell-real-code-shapes.test.js test/haskell/haskell-unseen-v5-shapes.test.js test/haskell/haskell-unseen-v4-shapes.test.js test/haskell/haskell-alias-taint.test.js test/haskell/haskell-weak-hash-names.test.js test/haskell/haskell-models-extended.test.js test/haskell/haskell-rules-extended.test.js test/haskell/haskell-injection.test.js test/haskell/haskell-ir.test.js test/haskell/haskell-manifests.test.js test/haskell/haskell-parser.test.js test/haskell/haskell-remediation.test.js test/haskell/haskell-remediation-0190.test.js test/haskell/haskell-remediation-kdf.test.js test/haskell/haskell-remediation-html-text.test.js test/haskell/haskell-remediation-scotty-body.test.js test/haskell/haskell-remediation-entropy.test.js test/haskell/haskell-remediation-text-command.test.js test/haskell/haskell-remediation-path-contain.test.js test/haskell/haskell-remediation-0195-16.test.js test/haskell/haskell-taint-shapes.test.js test/haskell/haskell-real-advisory-shapes.test.js test/haskell/haskell-discovery-shapes.test.js test/haskell/haskell-quasiquote-interp.test.js test/haskell/haskell-record-dot.test.js test/haskell/haskell-global-cell.test.js test/haskell/haskell-syntax-extensions.test.js test/haskell/haskell-rule-precision.test.js test/haskell/haskell-resolved-graph.test.js test/haskell/haskell-sca.test.js test/haskell/haskell-sca-severity.test.js test/haskell/haskell-web-guards.test.js test/haskell/haskell-advisory-feed.test.js test/haskell/haskell-security-rules.test.js test/haskell/haskell-taint.test.js test/haskell/haskell-boundaries.test.js test/haskell/haskell-live-feed-scan.test.js test/haskell/haskell-supply-bounds.test.js test/haskell/haskell-ir-scaling.test.js test/haskell/haskell-boundary-propagation.test.js test/haskell/haskell-generalization.test.js test/haskell/haskell-trust-boundary.test.js test/haskell/haskell-trust-fixed-file.test.js test/haskell/haskell-predictable-random-flow.test.js test/haskell/haskell-comment-invariance.test.js test/haskell/haskell-remediation-classes.test.js test/haskell/haskell-trust-boundary-frameworks.test.js test/haskell/haskell-generic-detectors.test.js",