@clear-capabilities/agentic-security-scanner 0.195.23 → 0.195.25

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-c99c86a3f8172dcc3f6f1a23f6de0b955859ef9d8ea709e6d744e536f5676a15  agentic-security.mjs
+ea2e63293cf62b7a65de89db1da0f32c8490a8b41c5d9bbfd20fba1c3acb284f  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.195.23",
+  "version": "0.195.25",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -90,7 +90,7 @@
     "test:dataflow": "node --test test/privacy-catalog.test.js test/privacy-deep-walker.test.js test/privacy-deep-e2e.test.js test/container-taint.test.js test/stored-taint-families.test.js test/py-annotation-sources.test.js test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/chrome-probe.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-rust.test.js test/rust-taint-flow.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-cs-p1.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/return-sink-check.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js test/interproc-nested-call-taint.test.js test/catalog-xpath-injection.test.js test/catalog-ldap-injection.test.js test/catalog-xxe.test.js test/catalog-response-splitting.test.js test/catalog-code-injection.test.js test/parser-rb-control-flow.test.js test/catalog-ruby-p1.test.js test/callee-receiver-taint.test.js test/catalog-command-injection-p4.test.js test/catalog-xss-p4.test.js test/catalog-path-ssrf-p3.test.js test/catalog-ai-model-provider-precision.test.js test/catalog-orm-write.test.js test/dataflow/provenance-pipeline-integration.test.js test/dataflow-progress.test.js test/scan-progress.test.js test/sard-leakage-pipeline.test.js test/sard-split-scoring.test.js test/sard-llm-isolation.test.js test/sard-mutation-adversarial.test.js test/sard-baseline-adaptive-tolerance.test.js test/sard-independent-holdout.test.js test/sard-flow-aware-scoring.test.js test/sard-macro-score-support-floor.test.js test/sard-php-split.test.js test/parser-java-nary-concat.test.js test/sard-naive-baseline.test.js test/field-taint-cross-method.test.js test/field-taint-engine-unit.test.js test/coercion-sanitizer-kill.test.js test/constant-propagation-path-sensitivity.test.js test/parser-java-assignments.test.js test/catalog-java-sard.test.js test/parser-cs-juliet-shapes.test.js test/catalog-cs-sard-p2.test.js test/sard-cwe-key-merge.test.js test/parser-php-backtick.test.js test/parser-php-include.test.js test/php-include-merge.test.js test/parser-php-array-field-taint.test.js test/parser-php-cond-assign.test.js test/parser-rust-redos.test.js test/multi-sink-taint-chain.test.js test/static-field-cross-class-call-string.test.js test/regex-guard-narrowing.test.js test/object-instance-field-taint.test.js test/param-type-inference.test.js test/smt-path-feasibility.test.js test/cross-service-taint.test.js test/dataflow-expr-taint-scaling.test.js test/evaluation/guard-dominance.test.js test/evaluation/engine-mechanisms.test.js test/rx-exec-receiver.test.js test/incremental-dependency.test.js test/incremental-integrity.test.js test/demand-query.test.js test/ir-cache.test.js test/canonicalize-parity.test.js test/dataflow-source-attribution.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-apply-fix-multifile.test.js test/mcp-protocol-smoke.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js test/lsp-server.test.js test/mcp-dataflow-tools.test.js test/cli/governance-propose-edit.test.js test/cli/remediation-open-update.test.js test/cli/remediation-verify-reopen.test.js test/cli/dataflow-observations.test.js test/cli/federate-declare-list.test.js test/capabilities/tools.test.js",
     "test:report": "node --test test/report-scan-invariants.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/git-history-batch.test.js test/default-scan-drift.test.js test/bundle-optional-deps.test.js test/scan-health.test.js test/finding-schema.test.js test/pipeline/finding-schema-provenance.test.js test/evidence-provenance.test.js test/report/provenance-output.test.js test/report/provenance-format-parity.test.js test/legacy-compat.test.js test/annotator-runner.test.js test/detector-runner.test.js test/detector-errors.test.js test/analyzer-supervisor.test.js test/cascade-worker-pool.test.js test/cascade-pool-wiring.test.js test/coverage-ledger.test.js test/coverage-ledger-completeness.test.js test/assurance-mode.test.js test/artifact-registry.test.js test/artifact-registry-completeness.test.js test/retention-policy.test.js test/state-lifecycle-report.test.js test/legal-hold.test.js test/production-feedback.test.js test/calibration-feedback.test.js test/encryption-provider.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js test/oscal-conformance.test.js test/cli-fix-apply.test.js test/apply-fix-service.test.js test/high-impact-approval-gate.test.js test/approver-registry.test.js test/suppression-exceptions.test.js test/fix-history.test.js test/producer-registry.test.js test/producer-collector.test.js test/enrichment-completion.test.js",
-    "test:lineage": "node --test test/lineage/analysis-completion.test.js test/lineage/schema.test.js test/lineage/ids.test.js test/lineage/protection.test.js test/lineage/classification.test.js test/lineage/validate.test.js test/lineage/json-schema-parity.test.js test/lineage/flagship-fixture.test.js test/lineage/flagship-fixture-semantics.test.js test/lineage/field-identity.test.js test/lineage/engine-expr-resolver.test.js test/lineage/engine-walker.test.js test/lineage/engine-integration.test.js test/lineage/engine-receiver-identity.test.js test/lineage/summaries.test.js test/lineage/driver.test.js test/lineage/engine-provenance.test.js test/lineage/engine-provenance-interprocedural.test.js test/lineage/path-store.test.js test/lineage/path-query.test.js test/lineage/flow-grade.test.js test/lineage/source-registry.test.js test/lineage/sink-registry.test.js test/lineage/transform-catalog.test.js test/lineage/handling-analyzer.test.js test/lineage/registry-real-code.test.js test/lineage/source-seeding.test.js test/lineage/graph-builder.test.js test/lineage/coverage.test.js test/lineage/resolve-destination.test.js test/lineage/queue-detail.test.js test/lineage/index.test.js test/lineage/obligation-mapping.test.js test/lineage/obligation-predicates.test.js test/lineage/obligation-predicates-walkthrough.test.js test/lineage/transit-protection.test.js test/lineage/at-rest-protection.test.js test/lineage/protection-summary.test.js test/lineage/ac01-multi-sink.test.js test/lineage/policy-verdict.test.js test/lineage/governance-refs.test.js test/lineage/export-privacy.test.js test/lineage/export-json.test.js test/lineage/export-csv.test.js test/lineage/decision-story.test.js test/lineage/export-briefing.test.js test/lineage/graph-snapshot.test.js test/lineage/graph-diff.test.js test/lineage/drift-policy.test.js test/lineage/recipient-profile.test.js test/lineage/recipient-registry.test.js test/lineage/recipient-wiring.test.js test/lineage/redact-graph.test.js test/lineage-scan-wiring.test.js test/lineage-artifact-write.test.js test/bench-data-lineage-runner.test.js test/bundle-frontend.test.js test/bundle-frontend-golden.test.js test/generate-html-report.test.js test/export-image.test.js test/lineage/scenario.test.js test/lineage/scenario-engine.test.js test/lineage/scenario-diff.test.js test/lineage/scenario-no-obligation-wiring.test.js test/lineage/impact-assessment.test.js test/lineage/impact-engine.test.js test/lineage/impact-no-obligation-wiring.test.js test/lineage/governance-edit.test.js test/lineage/remediation.test.js test/lineage/runtime-observation.test.js test/lineage/observation-correlation.test.js test/lineage/observation-adapters.test.js test/lineage/observation-store.test.js test/lineage/runtime-corroboration-wiring.test.js test/lineage/cross-repo-link.test.js test/lineage/federation-loader.test.js test/lineage/cross-repo-link-wiring.test.js test/lineage/runtime-assurance.test.js test/lineage/runtime-edge-states.test.js test/lineage/runtime-explorer-view.test.js test/cli/runtime-explorer-cli.test.js test/cli/runtime-identity-cli.test.js test/cli/runtime-twin-cli.test.js test/lineage/cut-planner.test.js test/lineage/scc.test.js test/lineage/scc-solver.test.js test/graph/graph-views.test.js test/lineage/dag07-completion.test.js test/lineage/owned-build.test.js test/dataflow/boundary-propagation.test.js test/lineage/boundary-contract.test.js test/lineage/correlation-v2.test.js test/lineage/path-control-evidence.test.js test/lineage/smt-z3-backend.test.js test/cli/dag-commands.test.js",
+    "test:lineage": "node --test test/lineage/analysis-completion.test.js test/lineage/schema.test.js test/lineage/ids.test.js test/lineage/protection.test.js test/lineage/classification.test.js test/lineage/validate.test.js test/lineage/json-schema-parity.test.js test/lineage/flagship-fixture.test.js test/lineage/flagship-fixture-semantics.test.js test/lineage/field-identity.test.js test/lineage/engine-expr-resolver.test.js test/lineage/engine-walker.test.js test/lineage/engine-integration.test.js test/lineage/engine-receiver-identity.test.js test/lineage/summaries.test.js test/lineage/driver.test.js test/lineage/engine-provenance.test.js test/lineage/engine-provenance-interprocedural.test.js test/lineage/path-store.test.js test/lineage/path-query.test.js test/lineage/flow-grade.test.js test/lineage/source-registry.test.js test/lineage/sink-registry.test.js test/lineage/transform-catalog.test.js test/lineage/handling-analyzer.test.js test/lineage/registry-real-code.test.js test/lineage/source-seeding.test.js test/lineage/seeding-across-calls.test.js test/lineage/boundary-join.test.js test/lineage/graph-builder.test.js test/lineage/coverage.test.js test/lineage/resolve-destination.test.js test/lineage/queue-detail.test.js test/lineage/index.test.js test/lineage/obligation-mapping.test.js test/lineage/obligation-predicates.test.js test/lineage/obligation-predicates-walkthrough.test.js test/lineage/transit-protection.test.js test/lineage/at-rest-protection.test.js test/lineage/protection-summary.test.js test/lineage/ac01-multi-sink.test.js test/lineage/policy-verdict.test.js test/lineage/governance-refs.test.js test/lineage/export-privacy.test.js test/lineage/export-json.test.js test/lineage/export-csv.test.js test/lineage/decision-story.test.js test/lineage/export-briefing.test.js test/lineage/graph-snapshot.test.js test/lineage/graph-diff.test.js test/lineage/drift-policy.test.js test/lineage/recipient-profile.test.js test/lineage/recipient-registry.test.js test/lineage/recipient-wiring.test.js test/lineage/redact-graph.test.js test/lineage-scan-wiring.test.js test/lineage-artifact-write.test.js test/bench-data-lineage-runner.test.js test/bundle-frontend.test.js test/bundle-frontend-golden.test.js test/generate-html-report.test.js test/export-image.test.js test/lineage/scenario.test.js test/lineage/scenario-engine.test.js test/lineage/scenario-diff.test.js test/lineage/scenario-no-obligation-wiring.test.js test/lineage/impact-assessment.test.js test/lineage/impact-engine.test.js test/lineage/impact-no-obligation-wiring.test.js test/lineage/governance-edit.test.js test/lineage/remediation.test.js test/lineage/runtime-observation.test.js test/lineage/observation-correlation.test.js test/lineage/observation-adapters.test.js test/lineage/observation-store.test.js test/lineage/runtime-corroboration-wiring.test.js test/lineage/cross-repo-link.test.js test/lineage/federation-loader.test.js test/lineage/cross-repo-link-wiring.test.js test/lineage/runtime-assurance.test.js test/lineage/runtime-edge-states.test.js test/lineage/runtime-explorer-view.test.js test/cli/runtime-explorer-cli.test.js test/cli/runtime-identity-cli.test.js test/cli/runtime-twin-cli.test.js test/lineage/cut-planner.test.js test/lineage/scc.test.js test/lineage/scc-solver.test.js test/graph/graph-views.test.js test/lineage/dag07-completion.test.js test/lineage/owned-build.test.js test/dataflow/boundary-propagation.test.js test/lineage/boundary-contract.test.js test/lineage/correlation-v2.test.js test/lineage/path-control-evidence.test.js test/lineage/smt-z3-backend.test.js test/cli/dag-commands.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js test/proof-corpus-lib.test.js test/proof-corpus-runner.test.js",
     "test:server": "node --test test/server/graph-loader.test.js test/server/security.test.js test/server/routes.test.js test/server/http-server.test.js test/server/cmd-explore.test.js test/server/cmd-dataflow-export.test.js test/server/static-assets.test.js test/server/dataflow-scenario-cli.test.js test/server/dataflow-impact-cli.test.js",
     "test:haskell": "node --test test/haskell/haskell-reachability.test.js test/haskell/haskell-real-code-shapes.test.js test/haskell/haskell-unseen-v5-shapes.test.js test/haskell/haskell-unseen-v4-shapes.test.js test/haskell/haskell-alias-taint.test.js test/haskell/haskell-weak-hash-names.test.js test/haskell/haskell-models-extended.test.js test/haskell/haskell-rules-extended.test.js test/haskell/haskell-injection.test.js test/haskell/haskell-ir.test.js test/haskell/haskell-manifests.test.js test/haskell/haskell-parser.test.js test/haskell/haskell-remediation.test.js test/haskell/haskell-remediation-0190.test.js test/haskell/haskell-remediation-kdf.test.js test/haskell/haskell-remediation-html-text.test.js test/haskell/haskell-remediation-scotty-body.test.js test/haskell/haskell-remediation-entropy.test.js test/haskell/haskell-remediation-text-command.test.js test/haskell/haskell-remediation-path-contain.test.js test/haskell/haskell-remediation-0195-16.test.js test/haskell/haskell-taint-shapes.test.js test/haskell/haskell-real-advisory-shapes.test.js test/haskell/haskell-discovery-shapes.test.js test/haskell/haskell-quasiquote-interp.test.js test/haskell/haskell-record-dot.test.js test/haskell/haskell-global-cell.test.js test/haskell/haskell-syntax-extensions.test.js test/haskell/haskell-rule-precision.test.js test/haskell/haskell-resolved-graph.test.js test/haskell/haskell-sca.test.js test/haskell/haskell-sca-severity.test.js test/haskell/haskell-web-guards.test.js test/haskell/haskell-advisory-feed.test.js test/haskell/haskell-security-rules.test.js test/haskell/haskell-taint.test.js test/haskell/haskell-boundaries.test.js test/haskell/haskell-live-feed-scan.test.js test/haskell/haskell-supply-bounds.test.js test/haskell/haskell-ir-scaling.test.js test/haskell/haskell-boundary-propagation.test.js test/haskell/haskell-generalization.test.js test/haskell/haskell-trust-boundary.test.js test/haskell/haskell-trust-fixed-file.test.js test/haskell/haskell-predictable-random-flow.test.js test/haskell/haskell-comment-invariance.test.js test/haskell/haskell-remediation-classes.test.js test/haskell/haskell-trust-boundary-frameworks.test.js test/haskell/haskell-generic-detectors.test.js",

package/src/dataflow/CLAUDE.md

@@ -118,7 +118,7 @@ Tests: `test/evaluation/engine-mechanisms.test.js`.
 
 ## Boundary-contract consumer seeding (DAG-08)
 
-`cross-service-taint.js` still only ANNOTATES findings for `consumes` declarations. The separate `runBoundaryTaint(perFileIR, callGraph, contracts)` seeds bound boundary contracts (see `../lineage/boundary-contract.js`): it sets `fn.boundarySeeds` (access paths such as `evt.customerId`, read by `_unionAnnotationTaint`) for one seed per engine run and always removes it afterwards. Findings new relative to an unseeded baseline carry `boundary` evidence (`modeledInput: true`, `observed: false`) and the consumer field that reached them. A contract that does not bind yields a coverage gap, no finding. Cost is one `runTaintEngine` pass per seed, capped by `maxRuns` (default 64, reported as a `budget` gap when hit).
+`cross-service-taint.js` still only ANNOTATES findings for `consumes` declarations. The separate `runBoundaryTaint(perFileIR, callGraph, contracts)` seeds bound boundary contracts (see `../lineage/boundary-contract.js`): it sets `fn.boundarySeeds` (access paths such as `evt.customerId`, read by `_unionAnnotationTaint`) for one seed per engine run and always removes it afterwards. Findings new relative to an unseeded baseline carry `boundary` evidence (`modeledInput: true`, `observed: false`) and the consumer field that reached them. A contract that does not bind yields a coverage gap, no finding. Cost is one `runTaintEngine` pass per seed, capped by `maxRuns` (default 64, reported as a `budget` gap when hit). The LINEAGE graph has its own, separate consumer of the same contracts since 0.195.25 (`../lineage/boundary-join.js`, opt-in with `AGENTIC_SECURITY_LINEAGE_BOUNDARIES=1`): it seeds field identity, not taint, so nothing here, and no SAST finding, changes when it runs.
 ## Demand-driven sink queries (DAG-02, `demand-query.js`)
 
 Opt-in (`AGENTIC_SECURITY_DEMAND=1` plus an explicit query list or the `runDemandSinkQuery` API; the default scan never calls it). A query is keyed by exact sink site (file, line, optional node id, callee, sink id), argument index, field/access path inside that argument, context (only `whole-program` is supported; anything else is `unavailable`), rule family (CWE or family name) and the graph and configuration digests (`graphDigest`, `configDigest`, `sinkQueryKey`).

package/src/engine.js

@@ -9774,6 +9774,9 @@ function _deterministicFileTimings(timings) {
         deterministic: isDeterministic(),
         perFile,
         fileContents,
+        // GA-03.3 (0.195.25): cross-service handoff joins in the lineage
+        // graph, opt-in. Off, the graph is the one 0.195.24 built.
+        ...(process.env.AGENTIC_SECURITY_LINEAGE_BOUNDARIES === '1' ? { boundaries: { enabled: true } } : {}),
       };
       // DAG-07 R07.7: with AGENTIC_SECURITY_LINEAGE_DEADLINE_MS set, the build runs in an
       // owned worker with a watchdog. Unset: the in-process call, exactly as before.

package/src/lineage/CLAUDE.md

@@ -1328,3 +1328,28 @@ report would read as a real-code measurement. No taint-recall tier is borrowed.
 ## Runtime twin additions (PRD 2 gap closure)
 
 `runtime-edge-states.js` derives the six edge states and the identity / absent-from-static queries from the existing correlation, as a pure read: nothing is written into the static graph. `RUNTIME_EXPLOIT_CORRELATED` is never inferred from observation; it needs validated operator evidence. `identity-token.js` supplies a keyed-hash tokenizer injected into the adapters through `context.tokenizeIdentity`; the adapters stay zero-import and drop identity when no tokenizer is given. The attribute allowlist test pins `identity.token`; widen it deliberately, never by loosening the grammar.
+
+## Lineage sources across aliases and calls (GA-03.1, 0.195.24)
+
+The data-lineage corpus (`bench/data-lineage/`) went from 17 of 24 to 24 of 24, every fixture regression-tier, through three engine changes and one runner change. Each is measured by `test/lineage/seeding-across-calls.test.js`.
+
+| Module | Responsibility |
+|---|---|
+| `lineage-source-catalog.js` | Six JavaScript collection points that are lineage sources but NOT taint sources: `process.argv` (`cli-argument`), `req.file`/`req.files` (`http-upload`), `fs.readFileSync` (`storage-read`), bare `prompt()` and `readlineSync.question()` (`user-input`). The main taint catalog had no JavaScript entry for those four categories, and adding them there would make a file's contents or a console prompt attacker-controlled for every SAST finding. Same isolation as `dataflow/privacy-catalog.js`; imports nothing from `dataflow/`. `matchLineageSource(expr, file)` is consulted by `source-seeding.js` after `matchSource` and only for a JavaScript or TypeScript file; `LINEAGE_SOURCE_DECISIONS` proves at load time that every entry's `provenance` resolves through `source-registry.js`. The test pins that `matchSource` returns null for every shape here. |
+| `source-seeding.js` (extended) | Two seed kinds (`SEED_KINDS`). `entry` is §3's mechanism unchanged. `after-node` is a CALL-shaped source assigned straight to a variable (`const record = fs.readFileSync(p)`, `const data = res.json()`): the call has no access path, so the seed lands on the assignment target in the state LEAVING that CFG node, applied by `engine.js`'s worklist through `ctx.seedAfterNode(qid, nodeId)` (`seedAfterNodeFactory`). A call-shaped source anywhere else is still `unseedable[]`. `extendThroughAliases` follows a container alias within one function (`const body = req.body; body.card_number`): the alias assignment names `body`, every outermost pure member read rooted at an alias mints the field seed on the ORIGINAL path (`req.body.card_number`, classified `PCI`), sited where the data entered; chained aliases are followed for at most four rounds, a wildcard segment is never seeded, a parameter is never an alias. |
+| `summaries.js` (extended) | `createCallSummaryResolver(cache, lookupCallee, { seedEntryState })` joins the callee's OWN seeds onto the entry state derived from the call arguments: `req.body.card_number` read inside `extractCard` is a source wherever it is called from, so the caller's resolution of `extractCard(req)` returns the PCI element and the `call-resolved` hop joins the caller's path to the callee's return node. The cache key is the joined state, so the driver's analysis of the callee and a clean call site share one key; §3.6's rule (no seeded summary under the empty-entry key) stands, see `DESIGN_GRAPH_BUILDER.md` §3.8. Bind hops and the cap-degradation loss hops enumerate only the call-derived half. `ctx.seedAfterNode` is forwarded to the callee's ctx. `driver.js` memoises the hook per function and passes it to the resolver. |
+| `engine.js` (extended) | After `step()`, the worklist adds that node's `after-node` seeds to the outgoing state (idempotent on revisit, no hop: the first read creates the path node with no in-edges, an origin, as for an entry seed). **Disclosed gap:** a bare call statement is still never resolved through the summary, so a sink inside the callee never sees an argument's identity; resolving it was tried and reverted (it consumes a summary context per call site and under a tight cap degrades a later resolution, moving seven pinned provenance measurements). Pinned by `seeding-across-calls.test.js` IP/2. |
+| `bench/data-lineage/runner.mjs` (extended) | `expectUnsupportedSink: true` asserts a `kind: 'process'`, `subtype: null`, `coverageStatus: 'unsupported'` node with a reason (the `exec` fixture). An EMPTY `dataClass` label matches the flow on the two categories alone (a file's contents, a positional argument); a non-empty label is unchanged. |
+
+## Cross-service handoffs (GA-03.3, 0.195.25)
+
+A value leaving one function through a queue publish or a store write and re-entering another through a queue receive or a store read is a HANDOFF. The engine sees an escape and an unrelated call result; nothing in the hop stream connects them, so the multi-service fixture of `bench/dag` reported 3 of its 8 labelled positives (the two site labels it still misses are for the taint engine, not for a flow). `boundary-join.js` joins the two halves, opt-in: `buildDataFlowGraph(callGraph, { boundaries: { enabled: true, contracts } })`, `AGENTIC_SECURITY_LINEAGE_BOUNDARIES=1` on a scan. Off, a build is byte-identical to 0.195.24 (`test/lineage/boundary-join.test.js` BJ/9).
+
+| Module | Responsibility |
+|---|---|
+| `boundary-join.js` | Pure (imports `node:crypto`, `dataflow/access-paths.js`, `source-seeding.js`'s walkers, `boundary-contract.js`, `classification.js`). `collectBoundaryEndpoints(callGraph, sites)`: producers are the sink sites of category `queue` (including the AWS SDK v3 shape `client.send(new SendMessageCommand(input))`) and the store writes `collection('<literal>').insertOne|insertMany|replaceOne(record)`; consumers are assignments whose source is `client.send(new ReceiveMessageCommand(input))` (record path `Messages.Body`, JSON) or `collection('<literal>').find(q).toArray()` / `.findOne(q)`. An identity is a string or number literal, or `process.env.NAME`, read through at most three module-scope constants (`resolveIdentityExpr`); a store identity is the collection literal, and two sides with different literal `db('<name>')` names never join. A computed identity is `unjoined` with `dynamic-identity`; an identity with no partner is `no-producer-in-scope`. Two sites that share only a field name are never joined. `recordShape(recordExpr, siteHops)`: the ids that reached the producer site (`write-out/call-arg` hops) keyed by the record's object-literal keys, each key taking the ids whose contributing state key (`production/ident` and `selection/member` hops) its value expression references through its OUTERMOST access paths; a record that is not an object literal is `whole-record`; nothing reached is `none`. `planBoundaryJoins`: a discovered join seeds the consumer's assignment target under `target.recordPath.key` as an `after-node` seed carrying the PRODUCER's data-element id; a declared DAG-08 contract (bound by `bindBoundaryContracts`) seeds the handler parameter in the entry state under the contract's `fieldMappings` (renames applied), from the producer site the contract names, and a contract without a producer site is a gap (`producer-site-required`). Every seed carries `boundary: { joinId, kind, identity, provenance: 'code' \| 'manual', contractId, basis, producer, modeledInput: true, observed: false, exploited: false }`. |
+| `graph-builder.js` (extended) | Sites are enumerated before the analysis so the producers exist for the rounds. With boundaries on, a round plans the joins the current hop stream supports and, when it minted seeds, re-runs the field analysis (`MAX_BOUNDARY_ROUNDS` = 4, each round one full `runFieldIdentityAnalysis`); a still-productive last round is `truncated` and the graph `partial` with `analysisCompletion.boundaries` (BJ/10), never read as convergence. The source node of a flow from a boundary seed is the PRODUCER's sink node, so the graph reads as one chain (HTTP to queue to store to HTTP response); the edge carries `provenance: 'code'` or `'manual'` and one `boundaryCrossings` entry; the flow's limitations say the handoff is modeled, not observed. A data element seeded in several functions keeps the name and classes of its collection point (`{contact: email}` is still `email`) and gains one `sourceLocations` entry per consumer; `seedForPath` picks the seed in the function the path's terminal node lives in. `enumerateSinkSites` resolves the v3 send command through the privacy catalog's queue entry (the general catalog's bare `send` entry had claimed it as a koa-send path sink) and skips the receive command (a read, not a sink). `coverage.boundaries` (also in `coverage.js`'s ledger, only when enabled): rounds, joins, joined fields, declared vs discovered, every unjoined endpoint with its reason, contract gaps. |
+| `engine.js` (extended) | `JSON.parse(x)` and `JSON.stringify(x)` are structure-preserving: the call forwards its first argument's `{flat, byPath, widened}` the way `assign-expr` forwards its source, and records no hop of its own. Without this the consumer's `body = JSON.parse(m.Body)` collapsed to the whole record's flat union and every key crossed under every field. `source-seeding.js`'s alias extension unwraps the same pair (`const back = JSON.parse(s)` is an alias of the container `s` was serialized from). |
+| `index.js` / `engine.js` (scan) | `AGENTIC_SECURITY_LINEAGE_BOUNDARIES=1` sets `boundaries.enabled`; `index.js` reads `.agentic-security/boundary-contracts.json` (the file `dataflow contracts` reads) once, existence-gated, a malformed file printed and treated as no contracts. `bench/dag/lib/scan-unit.mjs` forces the variable on, as it does deep mode. |
+
+Measured on the multi-service fixture, scan path (`node bench/dag/run.mjs --only=fixture`): flow labels 6 of 6 positive and 3 of 3 negative, where 0.195.24 found 3 of 6; the two site labels (stored value into HTML) stay FN, they need a storage-read source in the taint engine; one reported flow matches no label (`qty` into `orders.total`, a derived numeric write the label set does not list; left unlabelled under the no-relabelling rule). Precision of the join rests on three things stated above: a literal identity on both sides, the ids that really reached the producer site, and outermost-path field mapping. What it does not do: a queue consumed through a callback (`consumer.on('message', cb)`), a store read through an ORM model, a batch send's per-entry bodies, an identity that is a template string or a concatenation, and a producer in another repository (that is `cross-repo-link.js`'s declared edge, unchanged).

package/src/lineage/DESIGN_GRAPH_BUILDER.md

@@ -215,6 +215,29 @@ empty one.
 `E1/driver-3` proves **both** directions: a local replica of the pre-fix loop
 (the mutant) fabricates; the shipped driver does not.
 
+### 3.8 Revision (GA-03.1, 0.195.24): a callee's seeds are facts about its body
+
+§3.6's table read "`[]` — correct" for the caller's local after
+`const v = helper(o)`. That was the right KEY and the wrong CONSEQUENCE.
+`helper`'s seed is `req.body.secret`, a source expression inside `helper`'s
+own body; it is read whoever calls `helper`, so the honest answer at every
+call site is that `v` carries it. Under the shipped resolver the caller
+resolved `helper` under the call-derived state alone, the seed was absent
+from it, and the lineage corpus's interprocedural fixture produced the right
+nodes, the right data element and zero flows.
+
+`createCallSummaryResolver` now joins the callee's own seeds
+(`seedEntryState(fn)`, the same hook the driver uses, memoised per function)
+onto the call-derived entry state before computing the summary. The rule
+§3.6 established is untouched: the cache key is the JOINED state, so nothing
+is ever written under the empty-entry key for a seeded function, and the
+driver's own analysis of the callee and a clean call site share one key and
+one summary. `E1/driver-3` now pins exactly that in both directions (the
+mutant still stores the seeded answer under the empty key; the shipped
+driver never does, and the caller receives the seed). Bind hops and the
+cap-degradation loss hops enumerate only the call-derived half: a seed is
+not an argument.
+
 ### 3.7 What real seeding measures
 
 | Project | seeds | hops | pnodes / pedges | node kinds reached |

package/src/lineage/boundary-join.js

@@ -0,0 +1,384 @@
+//
+// boundary-join.js: cross-service handoffs in the lineage graph (GA plan,
+// GA-03.3: "integrate existing cross-service boundary joins into the
+// documented opt-in scan path; validate producer/consumer schemas, argument
+// mapping and field protection; unknown dynamic edges must remain unknown").
+//
+// A HANDOFF is a value leaving one function through a queue publish or a
+// storage write and re-entering another function through a queue receive or
+// a storage read. The field-identity engine sees the two halves as an escape
+// and an unrelated call result; nothing in the hop stream connects them, so
+// before this module the multi-service fixture's queue consumer and its
+// reporting handlers reported no flow at all (3 of 8 labelled positives).
+//
+// What a join IS, and what it is not:
+//   * A join is a MODELED connection: the producer and the consumer name the
+//     SAME identity by a literal the parser can read (the same string literal
+//     or the same `process.env` name for a queue, the same collection literal
+//     for a store), or an operator declared the edge in a boundary contract
+//     (boundary-contract.js, DAG-08). Nothing here observes a message on the
+//     wire or a row in a table: every seed carries `modeledInput: true,
+//     observed: false`, exactly the vocabulary DAG-08 fixed.
+//   * Two sites that share only a FIELD NAME are never joined. Two sites whose
+//     identity is computed (`QueueUrl: makeUrl(env)`, `collection(name)`) are
+//     reported as `unjoined` with the reason `dynamic-identity`; an identity
+//     with no partner in the scanned tree is `no-producer-in-scope`.
+//   * The fields that cross are the fields that REACHED the producer site in
+//     the analysis: the record expression's object-literal keys are mapped to
+//     the data-element ids whose contributing state keys the key's value
+//     expression references (`{note: body.note, total: body.qty * PRICE}`
+//     hands `note` to the key `note` and `qty` to the key `total`). A record
+//     that is not an object literal hands every reaching id to the record as
+//     a whole, disclosed as `basis: 'whole-record'`.
+//   * The consumer is seeded on the parsed record's FIELDS, after the call
+//     that received it (`source-seeding.js`'s `after-node` placement), under
+//     the consumer-side record path the receive shape implies (an SQS
+//     `ReceiveMessageCommand` result is `Messages[].Body`; a Mongo `find()`
+//     result is the record itself). A declared contract seeds the handler
+//     parameter the contract binds, in the function's entry state.
+//
+// The join needs the producer's analysis before the consumer can be seeded,
+// and a chain (HTTP to queue to store to HTTP response) needs the store
+// writer analysed WITH its queue seeds before the store reader can be
+// joined. graph-builder.js therefore re-runs the field analysis in bounded
+// rounds (`MAX_BOUNDARY_ROUNDS`) while a round mints new seeds, and reports
+// `truncated` when the last round still would.
+//
+// Pure: no file access, no engine import. graph-builder.js owns the rounds;
+// index.js loads the contracts file; engine.js reads the opt-in variable.
+
+import { createHash } from 'node:crypto';
+import { accessPathOf } from '../dataflow/access-paths.js';
+import { exprRoots, walkExpr } from './source-seeding.js';
+import { bindBoundaryContracts } from './boundary-contract.js';
+import { classifyDataElementName } from './classification.js';
+
+export const MAX_BOUNDARY_ROUNDS = 4;
+export const BOUNDARY_JOIN_KINDS = Object.freeze(['queue', 'storage']);
+
+// AWS SDK v3 command classes: `client.send(new <Command>(input))`. The input
+// object carries the identity (`QueueUrl`/`TopicArn`) and the record.
+export const QUEUE_SEND_COMMANDS = Object.freeze({
+  SendMessageCommand: { provider: 'sqs', record: 'MessageBody', entry: 'privacy-js-queue-sendMessage' },
+  SendMessageBatchCommand: { provider: 'sqs', record: 'Entries', entry: 'privacy-js-queue-sendMessage' },
+  PublishCommand: { provider: 'sns', record: 'Message', entry: 'privacy-js-queue-publish' },
+});
+export const QUEUE_RECEIVE_COMMANDS = Object.freeze({
+  ReceiveMessageCommand: { provider: 'sqs', recordPath: 'Messages.Body', encoding: 'json' },
+});
+const QUEUE_IDENTITY_KEYS = Object.freeze(['QueueUrl', 'TopicArn', 'topic', 'queueName']);
+// Record-bearing keys for the v2 shapes `sqs.sendMessage({...})` / `sns.publish({...})`.
+const QUEUE_RECORD_KEYS = Object.freeze(['MessageBody', 'Message']);
+
+// MongoDB driver shapes on a `collection('<literal>')` handle.
+const STORAGE_WRITE_METHODS = Object.freeze({ insertOne: 0, replaceOne: 1, insertMany: 0 });
+const STORAGE_READ_METHODS = Object.freeze({ find: 'many', findOne: 'one', findMany: 'many' });
+const STORAGE_READ_CHAIN_TAIL = Object.freeze(['toArray']);
+
+const isObj = (v) => v !== null && typeof v === 'object';
+const propOf = (objExpr, key) => (objExpr && objExpr.kind === 'object' ? (objExpr.props || []).find((p) => !p.spread && p.key === key) : null);
+
+/** The file's module-scope function (`<file>::top::<module>@N`), when the call graph has one. */
+function moduleFunctionOf(callGraph, file) {
+  for (const fn of callGraph.functions.values()) {
+    if (fn.file === file && /::top::<module>@/.test(String(fn.qid))) return fn;
+  }
+  return null;
+}
+
+/** The single module-scope assignment to `name` in `file`, or null (none, or more than one). */
+function moduleConstant(callGraph, file, name) {
+  const fn = moduleFunctionOf(callGraph, file);
+  if (!fn) return null;
+  let found = null; let count = 0;
+  for (const node of Object.values(fn.cfg?.nodes ?? {})) {
+    if (node.kind === 'assign' && node.target === name && node.source) { found = node.source; count += 1; }
+  }
+  return count === 1 ? found : null;
+}
+
+/**
+ * Resolve an identity-bearing expression to a literal the parser can read:
+ * `{kind: 'literal', value}` for a string/number literal, `{kind: 'env',
+ * value: NAME}` for `process.env.NAME`, following a module-scope constant up
+ * to three hops. Anything else is null: a computed identity is unknown.
+ */
+export function resolveIdentityExpr(expr, callGraph, file, depth = 0) {
+  if (!isObj(expr) || depth > 3) return null;
+  if (expr.kind === 'literal' && (typeof expr.value === 'string' || typeof expr.value === 'number')) return { kind: 'literal', value: String(expr.value) };
+  if (expr.kind === 'member' && typeof expr.prop === 'string' && expr.object?.kind === 'member'
+    && expr.object.prop === 'env' && expr.object.object?.kind === 'ident' && expr.object.object.name === 'process') {
+    return { kind: 'env', value: expr.prop };
+  }
+  if (expr.kind === 'ident' && callGraph) {
+    const c = moduleConstant(callGraph, file, expr.name);
+    return c ? resolveIdentityExpr(c, callGraph, file, depth + 1) : null;
+  }
+  return null;
+}
+
+const identityKey = (kind, r) => (r ? `${kind}:${r.kind}:${r.value}` : null);
+
+/** `client.send(new SendMessageCommand({...}))` and friends: the command descriptor, or null. */
+export function queueCommandOf(calleeExpr, args) {
+  if (!isObj(calleeExpr) || calleeExpr.kind !== 'member' || calleeExpr.prop !== 'send') return null;
+  const a0 = Array.isArray(args) ? args[0] : null;
+  if (!isObj(a0) || a0.kind !== 'call' || !a0.isNew || a0.callee?.kind !== 'ident') return null;
+  const name = a0.callee.name;
+  if (QUEUE_SEND_COMMANDS[name]) return { role: 'send', command: name, ...QUEUE_SEND_COMMANDS[name], input: a0.args?.[0] ?? null };
+  if (QUEUE_RECEIVE_COMMANDS[name]) return { role: 'receive', command: name, ...QUEUE_RECEIVE_COMMANDS[name], input: a0.args?.[0] ?? null };
+  return null;
+}
+
+function queueIdentityOf(inputExpr, callGraph, file) {
+  if (!isObj(inputExpr) || inputExpr.kind !== 'object') return { identity: null, reason: 'no-literal-input' };
+  for (const key of QUEUE_IDENTITY_KEYS) {
+    const p = propOf(inputExpr, key);
+    if (!p) continue;
+    const r = resolveIdentityExpr(p.value, callGraph, file);
+    return r ? { identity: identityKey('queue', r), detail: { key, ...r } } : { identity: null, reason: 'dynamic-identity', detail: { key } };
+  }
+  return { identity: null, reason: 'no-identity-key' };
+}
+
+/** `JSON.stringify(x)` → x; anything else unchanged. */
+function unwrapSerialization(e) {
+  if (isObj(e) && e.kind === 'call' && e.callee?.kind === 'member' && e.callee.prop === 'stringify'
+    && e.callee.object?.kind === 'ident' && e.callee.object.name === 'JSON' && e.args?.length) return e.args[0];
+  return e;
+}
+
+/** `<handle>.collection('<literal>')` → `{table, handleExpr}`, or null. */
+function collectionCallOf(e) {
+  if (!isObj(e) || e.kind !== 'call' || e.callee?.kind !== 'member' || e.callee.prop !== 'collection') return null;
+  const a0 = e.args?.[0];
+  if (!isObj(a0)) return { table: null, handleExpr: e.callee.object, reason: 'dynamic-identity' };
+  if (a0.kind !== 'literal' || typeof a0.value !== 'string') return { table: null, handleExpr: e.callee.object, reason: 'dynamic-identity' };
+  return { table: a0.value, handleExpr: e.callee.object };
+}
+
+/** The database name behind a collection handle when it is `x.db('<literal>')` reachable through module constants. */
+function databaseOf(handleExpr, callGraph, file) {
+  let cur = handleExpr; let depth = 0;
+  while (isObj(cur) && depth++ < 4) {
+    if (cur.kind === 'ident') { cur = moduleConstant(callGraph, file, cur.name); continue; }
+    if (cur.kind === 'call' && cur.callee?.kind === 'member' && cur.callee.prop === 'db') {
+      const a0 = cur.args?.[0];
+      return isObj(a0) && a0.kind === 'literal' && typeof a0.value === 'string' ? a0.value : null;
+    }
+    return null;
+  }
+  return null;
+}
+
+function storageIdentity(coll, callGraph, file) {
+  if (!coll || !coll.table) return { identity: null, reason: coll ? coll.reason : 'no-collection', detail: null };
+  const database = databaseOf(coll.handleExpr, callGraph, file);
+  return { identity: `storage:collection:${coll.table}`, detail: { table: coll.table, database } };
+}
+
+/** A storage WRITE site: `<handle>.collection('<lit>').insertOne(record)` and friends. */
+function storageWriteOf(calleeExpr, args) {
+  if (!isObj(calleeExpr) || calleeExpr.kind !== 'member') return null;
+  const argIndex = STORAGE_WRITE_METHODS[calleeExpr.prop];
+  if (argIndex === undefined) return null;
+  const coll = collectionCallOf(calleeExpr.object);
+  if (!coll) return null;
+  return { method: calleeExpr.prop, coll, recordExpr: Array.isArray(args) ? args[argIndex] ?? null : null };
+}
+
+/** A storage READ expression: `<handle>.collection('<lit>').find(q).toArray()` / `.findOne(q)`. */
+export function storageReadOf(expr) {
+  if (!isObj(expr) || expr.kind !== 'call' || expr.callee?.kind !== 'member') return null;
+  let e = expr;
+  if (STORAGE_READ_CHAIN_TAIL.includes(e.callee.prop)) e = e.callee.object;
+  if (!isObj(e) || e.kind !== 'call' || e.callee?.kind !== 'member') return null;
+  const cardinality = STORAGE_READ_METHODS[e.callee.prop];
+  if (!cardinality) return null;
+  const coll = collectionCallOf(e.callee.object);
+  if (!coll) return null;
+  return { method: e.callee.prop, cardinality, coll };
+}
+
+/**
+ * Every producer (a sink site that publishes to a queue or writes a store)
+ * and every consumer (an assignment whose source receives from a queue or
+ * reads a store) in the call graph. `sites` is graph-builder.js's
+ * `enumerateSinkSites(callGraph).sites`. Endpoints whose identity cannot be
+ * read are listed in `unjoined` with the reason, never silently dropped.
+ */
+export function collectBoundaryEndpoints(callGraph, sites) {
+  const producers = []; const consumers = []; const unjoined = [];
+  for (const site of sites || []) {
+    const cat = site.decision?.category;
+    if (cat === 'queue') {
+      const cmd = queueCommandOf(site.calleeExpr, site.args);
+      let input = cmd ? cmd.input : (site.args?.[0] ?? null);
+      let recordExpr = null;
+      if (cmd && cmd.role === 'send') recordExpr = propOf(input, cmd.record)?.value ?? null;
+      else for (const k of QUEUE_RECORD_KEYS) { const p = propOf(input, k); if (p) { recordExpr = p.value; break; } }
+      const id = queueIdentityOf(input, callGraph, site.file);
+      // A producer is kept whether or not its identity resolved: a declared
+      // contract names its producer by site, not by identity. Only a
+      // discovered join needs the identity, and only an identified
+      // producer takes part in one.
+      producers.push({ kind: 'queue', site, identity: id.identity, detail: id.detail ?? null, recordExpr: unwrapSerialization(recordExpr), provider: cmd?.provider ?? null });
+      if (!id.identity) unjoined.push({ side: 'producer', kind: 'queue', file: site.file, line: site.line, reason: id.reason });
+    } else if (cat === 'database') {
+      const w = storageWriteOf(site.calleeExpr, site.args);
+      if (!w) continue;
+      const id = storageIdentity(w.coll, callGraph, site.file);
+      producers.push({ kind: 'storage', site, identity: id.identity, detail: id.detail, recordExpr: w.recordExpr, method: w.method });
+      if (!id.identity) unjoined.push({ side: 'producer', kind: 'storage', file: site.file, line: site.line, reason: id.reason });
+    }
+  }
+  for (const fn of callGraph.functions.values()) {
+    for (const [nid, node] of Object.entries(fn.cfg?.nodes ?? {})) {
+      if (node.kind !== 'assign' || typeof node.target !== 'string' || node.target.includes('.') || !isObj(node.source) || node.source.kind !== 'call') continue;
+      const base = { file: fn.file, qid: fn.qid, nodeId: nid, line: node.line ?? null, target: node.target };
+      const cmd = queueCommandOf(node.source.callee, node.source.args);
+      if (cmd && cmd.role === 'receive') {
+        const id = queueIdentityOf(cmd.input, callGraph, fn.file);
+        const ep = { ...base, kind: 'queue', identity: id.identity, detail: id.detail ?? null, recordPath: cmd.recordPath, encoding: cmd.encoding, provider: cmd.provider };
+        if (id.identity) consumers.push(ep); else unjoined.push({ side: 'consumer', kind: 'queue', file: fn.file, line: base.line, reason: id.reason });
+        continue;
+      }
+      const r = storageReadOf(node.source);
+      if (r) {
+        const id = storageIdentity(r.coll, callGraph, fn.file);
+        const ep = { ...base, kind: 'storage', identity: id.identity, detail: id.detail, recordPath: '', cardinality: r.cardinality, method: r.method };
+        if (id.identity) consumers.push(ep); else unjoined.push({ side: 'consumer', kind: 'storage', file: fn.file, line: base.line, reason: id.reason });
+      }
+    }
+  }
+  return { producers, consumers, unjoined };
+}
+
+const pathCovers = (a, b) => a === b || a.startsWith(`${b}.`) || b.startsWith(`${a}.`);
+
+/**
+ * Which data-element ids crossed at a producer site, per record key.
+ * `siteHops` are the hops stamped with the site's scope and node id: the
+ * `write-out/call-arg` hops say which ids reached the call at all, the
+ * `production`/`selection` hops say which state key each id came from. A
+ * key's ids are the reaching ids whose contributing key its value expression
+ * references.
+ */
+export function recordShape(recordExpr, siteHops) {
+  const reached = new Set();
+  const byKey = new Map();
+  const contributions = [];
+  for (const h of siteHops || []) {
+    if (h.kind === 'write-out' && h.subKind === 'call-arg') reached.add(h.dataElementId);
+    // An identifier read is a `production/ident` hop, a field read a
+    // `selection/member` hop; both carry the contributing state key.
+    if ((h.kind === 'production' || h.kind === 'selection') && typeof h.fromPath === 'string') contributions.push({ path: h.fromPath, id: h.dataElementId });
+  }
+  if (!reached.size) return { basis: 'none', byKey, whole: new Set() };
+  const props = isObj(recordExpr) && recordExpr.kind === 'object' ? recordExpr.props || [] : null;
+  if (!props || props.some((p) => p.spread) || !props.length) return { basis: 'whole-record', byKey, whole: new Set(reached) };
+  for (const p of props) {
+    if (typeof p.key !== 'string' || p.key === '*') continue;
+    const refs = new Set();
+    // Outermost access paths only: `body.note` references `body.note`, not
+    // `body`, or every sibling field the record carries would be joined too.
+    walkExpr(p.value, (e, parent) => {
+      if (e.kind !== 'ident' && e.kind !== 'member') return;
+      if (parent && parent.kind === 'member' && parent.object === e) return;
+      const ap = accessPathOf(e);
+      if (ap && !ap.includes('*')) refs.add(ap);
+    });
+    const ids = new Set();
+    for (const c of contributions) if (reached.has(c.id) && [...refs].some((r) => pathCovers(r, c.path))) ids.add(c.id);
+    if (ids.size) byKey.set(p.key, ids);
+  }
+  return { basis: 'object-literal', byKey, whole: new Set() };
+}
+
+const joinIdOf = (parts) => `join:${createHash('sha256').update(parts.join('\u0000')).digest('hex').slice(0, 12)}`;
+
+function mintSeed({ consumer, placement, seedPath, id, join }) {
+  const canonicalName = seedPath.slice(seedPath.lastIndexOf('.') + 1);
+  return {
+    file: consumer.file, qid: consumer.qid, nodeId: consumer.nodeId, line: consumer.line,
+    entryId: `boundary:${join.kind}`, seedPath, canonicalName, seedKind: placement,
+    category: join.kind === 'queue' ? 'queue-message' : 'database-read', coverageStatus: 'modeled', externality: 'unknown',
+    reason: `${join.kind} handoff ${join.provenance === 'manual' ? 'declared by contract ' + join.contractId : 'discovered from the literal identity ' + join.identity}; modeled, not observed`,
+    dataElementId: id, dataClasses: classifyDataElementName(canonicalName).classes,
+    boundary: {
+      joinId: join.joinId, kind: join.kind, identity: join.identity, provenance: join.provenance, contractId: join.contractId ?? null,
+      basis: join.basis, producer: join.producer, modeledInput: true, observed: false, exploited: false,
+    },
+  };
+}
+
+/**
+ * Plan the consumer seeds for every join the current hop stream supports.
+ * `minted` is the cross-round set of seed keys already handed out, so a
+ * round only reports what is new. Returns `{seeds, joins, unjoined, gaps}`.
+ */
+export function planBoundaryJoins({ endpoints, hops, contracts = [], callGraph, minted = new Set() }) {
+  const hopsBySite = new Map();
+  for (const h of hops || []) {
+    const k = `${h.scope}|${h.nodeId}`;
+    if (!hopsBySite.has(k)) hopsBySite.set(k, []);
+    hopsBySite.get(k).push(h);
+  }
+  const seeds = []; const joins = []; const unjoined = [...(endpoints.unjoined || [])]; const gaps = [];
+  const siteKey = (s) => `${s.qid}|${s.nodeId}`;
+  const shapeOf = (p) => recordShape(p.recordExpr, hopsBySite.get(siteKey(p.site)) ?? []);
+  const emit = (consumer, producer, placement, basePath, fieldMappings, join) => {
+    const shape = shapeOf(producer);
+    const fields = [];
+    const add = (path, id, from, to) => {
+      const key = `${consumer.qid}|${consumer.nodeId}|${path}|${id}`;
+      if (minted.has(key)) return;
+      minted.add(key);
+      seeds.push(mintSeed({ consumer, placement, seedPath: path, id, join: { ...join, basis: shape.basis } }));
+      fields.push({ from, to, dataElementId: id });
+    };
+    if (fieldMappings) {
+      for (const m of fieldMappings) {
+        const ids = shape.byKey.get(m.from) ?? (shape.basis === 'whole-record' ? shape.whole : new Set());
+        for (const id of ids) add([basePath, m.to].filter(Boolean).join('.'), id, m.from, m.to);
+      }
+    } else {
+      for (const [key, ids] of shape.byKey) for (const id of ids) add([basePath, key].filter(Boolean).join('.'), id, key, key);
+      for (const id of shape.whole) add(basePath, id, null, null);
+    }
+    joins.push({ ...join, basis: shape.basis, fields, consumer: { file: consumer.file, line: consumer.line, qid: consumer.qid, nodeId: consumer.nodeId }, reached: shape.whole.size + [...shape.byKey.values()].reduce((n, s) => n + s.size, 0) });
+  };
+
+  // Discovered joins: the same literal identity on both sides.
+  for (const c of endpoints.consumers) {
+    const partners = endpoints.producers.filter((p) => p.kind === c.kind && p.identity && p.identity === c.identity
+      && !(p.kind === 'storage' && p.detail?.database && c.detail?.database && p.detail.database !== c.detail.database));
+    if (!partners.length) { unjoined.push({ side: 'consumer', kind: c.kind, file: c.file, line: c.line, identity: c.identity, reason: 'no-producer-in-scope' }); continue; }
+    for (const p of partners) {
+      const producer = { file: p.site.file, line: p.site.line, qid: p.site.qid, nodeId: p.site.nodeId };
+      const join = { joinId: joinIdOf([c.kind, c.identity, siteKey(p.site), `${c.qid}|${c.nodeId}`]), kind: c.kind, identity: c.identity, provenance: 'code', contractId: null, producer };
+      emit(c, p, 'after-node', [c.target, c.recordPath].filter(Boolean).join('.'), null, join);
+    }
+  }
+  // Declared joins: a DAG-08 contract bound to a consumer parameter; the
+  // producer is the contract's producer site, matched by file and function.
+  const bound = contracts.length ? bindBoundaryContracts(contracts, callGraph) : { bindings: [], gaps: [], rejected: [] };
+  gaps.push(...bound.gaps.map((g) => ({ ...g, source: 'contract' })), ...bound.rejected.map((r) => ({ contractId: r.contractId, kind: 'rejected-contract', errors: r.errors, source: 'contract' })));
+  for (const b of bound.bindings) {
+    const contract = contracts.find((c) => c.id === b.contractId);
+    const psite = contract?.producer?.site;
+    if (!psite) { gaps.push({ contractId: b.contractId, kind: 'unbound-boundary', side: 'producer', reason: 'producer-site-required', detail: 'a lineage join needs the producer site to read which fields reached it', source: 'contract' }); continue; }
+    const norm = (f) => String(f || '').replace(/^\.\//, '').replace(/\\/g, '/');
+    const partners = endpoints.producers.filter((p) => p.kind === b.kind && norm(p.site.file) === norm(psite.file)
+      && (() => { const fn = callGraph.functions.get(p.site.qid) ?? [...callGraph.functions.values()].find((f) => f.qid === p.site.qid); return fn && (fn.name === psite.function || String(fn.name).endsWith(`.${psite.function}`)); })());
+    if (!partners.length) { gaps.push({ contractId: b.contractId, kind: 'unbound-boundary', side: 'producer', reason: 'producer-site-not-a-' + b.kind + '-site', detail: `${psite.function} in ${psite.file}`, source: 'contract' }); continue; }
+    const consumer = { file: b.file, qid: b.qid, nodeId: null, line: b.line, target: b.param };
+    const recordPath = contract.consumer.site.recordPath || '';
+    for (const p of partners) {
+      const producer = { file: p.site.file, line: p.site.line, qid: p.site.qid, nodeId: p.site.nodeId };
+      const join = { joinId: joinIdOf([b.kind, b.contractId, siteKey(p.site), b.qid]), kind: b.kind, identity: b.channel, provenance: 'manual', contractId: b.contractId, producer };
+      emit(consumer, p, 'entry', [b.param, recordPath].filter(Boolean).join('.'), b.mappedFields, join);
+    }
+  }
+  return { seeds, joins, unjoined, gaps };
+}

package/src/lineage/coverage.js

@@ -56,7 +56,7 @@
 
 import { reclassifySink } from './sink-registry.js';
 import { DEFAULTS as PATH_QUERY_DEFAULTS } from './path-query.js';
-import { buildDataFlowGraph } from './graph-builder.js';
+import { buildDataFlowGraph, boundaryCoverage } from './graph-builder.js';
 // Milestone 2, Sub-project A, increment 1: `resolveDestination` composes
 // with `resolveSiteDecision` below the same way it's imported here — a real
 // ES module cycle (resolve-destination.js imports THREE things back from
@@ -438,6 +438,9 @@ export function buildCoverageLedger(built, opts = {}) {
 
     degradedTerminals: built.degraded.length,
     unresolvedDestinations,
+    // GA-03.3: present only when the build opted into handoff joins, so a
+    // ledger from a build that did not is unchanged.
+    ...(built.boundaries ? { boundaries: boundaryCoverage(built.boundaries) } : {}),
 
     paths: { enumerated: built.stats.pathsEnumerated, projected: built.stats.pathsProjected, truncatedQueries: built.stats.truncatedQueries },
     budgets: { ...PATH_QUERY_DEFAULTS, ...(opts.budget ?? {}) },

package/src/lineage/driver.js

@@ -140,14 +140,31 @@ export function runFieldIdentityAnalysis(callGraph, opts = {}) {
   // seeding hook. `opts.seedEntryState(fn)` returns the entry state `fn` is
   // analyzed under; a falsy return means "no seed". With no hook, this IS
   // `emptyState()` and every output is byte-identical to the pre-hook driver.
-  const entryStateOf = (fn) => (opts.seedEntryState ? (opts.seedEntryState(fn) || emptyState()) : emptyState());
+  // GA-03.1 (0.195.24): the hook's answer is memoised per function, so it
+  // is still consulted exactly once per function even though the
+  // call-summary resolver below now reads it at every resolved call site.
+  const seedMemo = new Map();
+  const seedOf = opts.seedEntryState
+    ? (fn) => {
+        if (!seedMemo.has(fn.qid)) seedMemo.set(fn.qid, opts.seedEntryState(fn) || null);
+        return seedMemo.get(fn.qid);
+      }
+    : null;
+  const entryStateOf = (fn) => (seedOf ? (seedOf(fn) || emptyState()) : emptyState());
   const ctxFor = (fn) => {
     const lookupCallee = createCallGraphLookup(callGraph, fn.file);
-    const resolveCallSummary = createCallSummaryResolver(cache, lookupCallee);
+    // GA-03.1 (0.195.24): the resolver receives the same seeding hook the
+    // driver uses, so a callee's own source seeds hold under every call
+    // context (summaries.js, createCallSummaryResolver). Without a hook the
+    // resolver is built exactly as before.
+    const resolveCallSummary = createCallSummaryResolver(cache, lookupCallee, seedOf ? { seedEntryState: seedOf } : {});
     // Path provenance (Sub-project C, increment 3, section 13.7 item 14):
     // thread opts.recordHop CONDITIONALLY so a caller that supplies none gets
     // a byte-identical `{ resolveCallSummary }` object (Decision 7.2).
     const ctx = opts.recordHop ? { resolveCallSummary, recordHop: opts.recordHop } : { resolveCallSummary };
+    // GA-03.1: `opts.seedAfterNode(qid, nodeId)` (source-seeding.js's
+    // seedAfterNodeFactory), consulted by engine.js after every CFG node.
+    if (typeof opts.seedAfterNode === 'function') ctx.seedAfterNode = opts.seedAfterNode;
     // DAG-03: correlation version 2 labels hops with derivation, value-version
     // and invocation evidence. Off unless asked for; needs a recorder.
     if (opts.recordHop && resolveCorrelationVersion(opts.correlationVersion) === 2) ctx.correlationVersion = 2;