@clear-capabilities/agentic-security-scanner 0.84.1 → 0.118.2

package/src/.agentic-security/threat-model.md

@@ -0,0 +1,118 @@
+# Threat Model (auto-generated)
+
+Generated by agentic-security on 2026-06-01.
+
+This threat model is derived from static analysis of the current codebase and is regenerated on every scan. It is intended as a working artifact, not a finished compliance document.
+
+## Entities + boundaries
+
+```mermaid
+flowchart TB
+  subgraph External
+    route_GET__api_endpoint["http-route: GET /api/endpoint"]
+    route_GET__api_users_2["http-route: GET /api/users/2"]
+    route_GET__api_admin_users["http-route: GET /api/admin/users"]
+    route_GET__api_health["http-route: GET /api/health"]
+    route_GET___________________________________________________["http-route: GET                                                                                                                                   
+      parser: "]
+    queue_sast_sensitive_data_logging_js_67["queue-consumer:  sast/sensitive-data-logging.js:67"]
+  end
+  subgraph Application
+  end
+  External --> route_GET__api_endpoint
+  External --> route_GET__api_users_2
+  External --> route_GET__api_admin_users
+  External --> route_GET__api_health
+  External --> route_GET___________________________________________________
+  External --> queue_sast_sensitive_data_logging_js_67
+```
+
+## Assets
+
+
+## STRIDE threats
+
+### Information Disclosure (27)
+
+- [medium] **ssrf** (CWE-918) at `poc-video.js:98` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `posture/attack-playbooks.js:72` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **crypto-weak-cipher** (CWE-327) at `sast/crypto-protocol.js:141` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
+- [low] **crypto-weak-cipher** (CWE-327) at `sast/crypto-protocol.js:143` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
+- [low] **crypto-weak-cipher** (CWE-327) at `sast/crypto-protocol.js:145` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
+- [low] **crypto-weak-cipher** (CWE-327) at `sast/crypto-protocol.js:149` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
+- [low] **pqc-migration** (CWE-327) at `sast/post-quantum-crypto.js:136` — Pre-quantum RSA (rsa-encrypt) — replace with ML-KEM-768 before CRQC arrives
+- [low] **zip-slip** (CWE-22) at `sast/zip-slip.js:192` — Zip Slip: archive entry.path written to filesystem without sanitization
+- [low] **ssrf** (CWE-918) at `pr-comment.js:41` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `dataflow/catalog.js:547` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `dataflow/exploit-prover.js:33` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **crypto-weak-hash** (CWE-327) at `ir/parser-py.helper.py:68` — Weak hash algorithm (MD5 / SHA-1 / MD2 / MD4) used
+- [low] **ssrf** (CWE-918) at `posture/defender-agent.js:41` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `posture/flow-narration.js:24` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **pqc-migration** (CWE-327) at `posture/rule-pack-signing.js:187` — Pre-quantum ED25519 (ed25519) — replace with ML-DSA-65 before CRQC arrives
+- [low] **ssrf** (CWE-918) at `posture/verifier.js:55` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/csharp-structural.js:60` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/go-extended.js:39` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/java-structural.js:76` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/js-framework-structural.js:69` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/kotlin.js:136` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/php.js:111` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/python-sinks.js:186` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/ssrf-cloud-metadata.js:61` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/ssrf-cloud-metadata.js:86` — SSRF: explicit reference to cloud instance-metadata endpoint
+- … and 2 more
+
+### Elevation of Privilege (22)
+
+- [medium] **ssrf** (CWE-918) at `poc-video.js:98` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `posture/attack-playbooks.js:72` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **unsafe-deserialization-user-controlled-j** (CWE-502) at `sca/sigstore-verify.js:undefined` — Unsafe Deserialization (User-Controlled JSON)
+- [low] **prototype-pollution** (CWE-1321) at `posture/adversarial-self-test.js:60` — Prototype Pollution: Direct write to __proto__ / constructor.prototype
+- [low] **llm-app-security** (CWE-502) at `sast/llm-app.js:163` — Untrusted Model Load — model file loaded from a non-literal path
+- [low] **llm-app-security** (CWE-502) at `sast/model-load.js:45` — Untrusted Model Load — model file loaded from a non-literal path
+- [low] **ssrf** (CWE-918) at `pr-comment.js:41` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `dataflow/catalog.js:547` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `dataflow/exploit-prover.js:33` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `posture/defender-agent.js:41` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `posture/flow-narration.js:24` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `posture/verifier.js:55` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/csharp-structural.js:60` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/go-extended.js:39` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/java-structural.js:76` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/js-framework-structural.js:69` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/kotlin.js:136` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/php.js:111` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/python-sinks.js:186` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/ssrf-cloud-metadata.js:61` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/ssrf-cloud-metadata.js:86` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `sast/ssrf-cloud-metadata.js:15` — SSRF: explicit reference to cloud instance-metadata endpoint
+
+### Tampering (236)
+
+- [medium] **dos-sync-io** (CWE-400) at `posture/deploy-platform.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **mass-assignment** (CWE-915) at `ir/parser-cs.js:undefined` — Mass Assignment (req.body Direct to Model)
+- [low] **mass-assignment** (CWE-915) at `ir/parser-go.js:undefined` — Mass Assignment (req.body Direct to Model)
+- [low] **mass-assignment** (CWE-915) at `ir/parser-kt.js:undefined` — Mass Assignment (req.body Direct to Model)
+- [low] **mass-assignment** (CWE-915) at `ir/parser-php.js:undefined` — Mass Assignment (req.body Direct to Model)
+- [low] **mass-assignment** (CWE-915) at `ir/parser-rb.js:undefined` — Mass Assignment (req.body Direct to Model)
+- [low] **mass-assignment** (CWE-915) at `posture/integrity.js:undefined` — Mass Assignment (req.body Direct to Model)
+- [low] **dos-sync-io** (CWE-400) at `badge.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `history-scan.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `leaderboard.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `dataflow/cross-service-taint.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `dataflow/ifds-precise.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `dataflow/incremental.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `integrations/index.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `integrations/tickets.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `ir/cpp-preprocessor.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `ir/type-stubs.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `llm-validator/consistency.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `llm-validator/index.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `mcp/audit.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `mcp/server.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `mcp/tools.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `posture/agents-memory.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `posture/api-contract.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [low] **dos-sync-io** (CWE-400) at `posture/auditor-walkthrough.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- … and 211 more
+
+## Attack trees

package/src/dataflow/.agentic-security/dpia.md

@@ -0,0 +1,26 @@
+# Data Protection Impact Assessment (DPIA)
+
+Generated by agentic-security scanner on 2026-05-31.
+
+This is an automated DPIA scaffold derived from static analysis.
+It must be reviewed and completed by a privacy officer before use.
+
+## Data classes identified
+
+## Privacy-related findings
+
+| Severity | File:Line | Class → Sink | Description |
+|---|---|---|---|
+
+## Regulatory framework mapping
+
+- **GDPR Art. 35** — DPIA required when processing is likely to result in high risk to data subjects.
+- **CCPA §1798.130** — Notice + access rights for collected personal information.
+
+## Reviewer checklist
+
+- [ ] Confirm each PII field's collection has a documented lawful basis
+- [ ] Confirm retention period for each class is documented
+- [ ] Confirm DSAR (data subject access request) workflow exists
+- [ ] Confirm encryption at rest + in transit for each class
+- [ ] Confirm logging of PII access for audit (where applicable)

package/src/dataflow/.agentic-security/sbom-history/15d7c4d20f9d968ebec29445c9e9b3fc6f74e6a1.json

@@ -0,0 +1,6 @@
+{
+  "sha": "15d7c4d20f9d968ebec29445c9e9b3fc6f74e6a1",
+  "ts": "2026-05-31T15:22:34.931Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/dataflow/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json

@@ -0,0 +1,6 @@
+{
+  "sha": "3852ad2aa0e50951bed0c930c29d1861aa13d048",
+  "ts": "2026-05-31T18:39:51.074Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/dataflow/.agentic-security/sbom-history/73166872888d9ddcbe98645af818ecc7d8917b07.json

@@ -0,0 +1,6 @@
+{
+  "sha": "73166872888d9ddcbe98645af818ecc7d8917b07",
+  "ts": "2026-05-31T15:37:46.482Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/dataflow/.agentic-security/sbom-history/8869fe64035bec0152d92ece961e9369d8637076.json

@@ -0,0 +1,6 @@
+{
+  "sha": "8869fe64035bec0152d92ece961e9369d8637076",
+  "ts": "2026-05-31T13:34:26.146Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/dataflow/.agentic-security/sbom-history/9c93b15e8cf3ff2ddb8cdae92371b82e178b463c.json

@@ -0,0 +1,6 @@
+{
+  "sha": "9c93b15e8cf3ff2ddb8cdae92371b82e178b463c",
+  "ts": "2026-05-31T04:45:23.979Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/dataflow/.agentic-security/sbom-history/b7ac2dada4a9216ccfe8969fc57f988c83f46975.json

@@ -0,0 +1,6 @@
+{
+  "sha": "b7ac2dada4a9216ccfe8969fc57f988c83f46975",
+  "ts": "2026-05-31T05:26:44.996Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/dataflow/.agentic-security/threat-model.json

@@ -0,0 +1,161 @@
+{
+  "entities": [],
+  "boundaries": [],
+  "assets": [],
+  "threats": [
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "medium",
+      "file": "cross-service-taint.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:cross-service-taint.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "medium",
+      "file": "ifds-precise.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:ifds-precise.js:177:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "medium",
+      "file": "incremental.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:incremental.js:50:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "medium",
+      "file": "catalog.js",
+      "line": 547,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:catalog.js:547",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "medium",
+      "file": "catalog.js",
+      "line": 547,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:catalog.js:547",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "medium",
+      "file": "cross-service-taint.js",
+      "line": 53,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:cross-service-taint.js:53",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "medium",
+      "file": "cross-service-taint.js",
+      "line": 97,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:cross-service-taint.js:97",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "medium",
+      "file": "exploit-prover.js",
+      "line": 33,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:exploit-prover.js:33",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "medium",
+      "file": "exploit-prover.js",
+      "line": 33,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:exploit-prover.js:33",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "medium",
+      "file": "ifds-precise.js",
+      "line": 177,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:ifds-precise.js:177",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "medium",
+      "file": "incremental.js",
+      "line": 50,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:incremental.js:50",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "medium",
+      "file": "incremental.js",
+      "line": 68,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:incremental.js:68",
+      "affectsAsset": null,
+      "atEntity": null
+    }
+  ],
+  "attackTrees": []
+}

package/src/dataflow/.agentic-security/threat-model.md

@@ -0,0 +1,43 @@
+# Threat Model (auto-generated)
+
+Generated by agentic-security on 2026-05-31.
+
+This threat model is derived from static analysis of the current codebase and is regenerated on every scan. It is intended as a working artifact, not a finished compliance document.
+
+## Entities + boundaries
+
+```mermaid
+flowchart TB
+  subgraph External
+  end
+  subgraph Application
+  end
+```
+
+## Assets
+
+
+## STRIDE threats
+
+### Tampering (8)
+
+- [medium] **dos-sync-io** (CWE-400) at `cross-service-taint.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [medium] **dos-sync-io** (CWE-400) at `ifds-precise.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [medium] **dos-sync-io** (CWE-400) at `incremental.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [medium] **toctou-file-existence-permission-check-b** (CWE-367) at `cross-service-taint.js:53` — TOCTOU: file existence/permission check before open
+- [medium] **toctou-file-existence-permission-check-b** (CWE-367) at `cross-service-taint.js:97` — TOCTOU: file existence/permission check before open
+- [medium] **toctou-file-existence-permission-check-b** (CWE-367) at `ifds-precise.js:177` — TOCTOU: file existence/permission check before open
+- [medium] **toctou-file-existence-permission-check-b** (CWE-367) at `incremental.js:50` — TOCTOU: file existence/permission check before open
+- [medium] **toctou-file-existence-permission-check-b** (CWE-367) at `incremental.js:68` — TOCTOU: file existence/permission check before open
+
+### Information Disclosure (2)
+
+- [medium] **ssrf** (CWE-918) at `catalog.js:547` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [medium] **ssrf** (CWE-918) at `exploit-prover.js:33` — SSRF: explicit reference to cloud instance-metadata endpoint
+
+### Elevation of Privilege (2)
+
+- [medium] **ssrf** (CWE-918) at `catalog.js:547` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [medium] **ssrf** (CWE-918) at `exploit-prover.js:33` — SSRF: explicit reference to cloud instance-metadata endpoint
+
+## Attack trees

package/src/dataflow/CLAUDE.md

@@ -5,23 +5,34 @@ Layer-2 taint engine. Walks the Layer-1 IR (`../ir/`) with field-sensitive forwa
 ## Scope — what we actually model
 
 - **Intra-procedural field-sensitive taint** with access-path lattice (`access-paths.js`). `user.email` is distinguishable from `user.password`.
-- **k=1 monovariant interprocedural return-taint.** `SummaryCache` (`summaries.js`) holds one summary per function under empty entry state. At an assign-from-call site, if the resolved callee's summary says `returnTainted`, the LHS becomes tainted. Premortem-derived; was previously dead code.
+- **Value-context-sensitive interprocedural taint (FR-SEM-2).** `SummaryCache` (`summaries.js`) holds a distinct summary per distinct entry-taint-state. A pre-pass computes the empty-entry base for every function; call sites then lazily compute the summary under their actual tainted-arg context (at both assign-from-call and plain-call sites) so a helper that is clean with clean args but tainted with user input is detected per call site. Bounded by a per-function context cap (`AGENTIC_SECURITY_KCFA_MAX_CONTEXTS`, default 16; 0 = monovariant). Over the cap → reuse the empty-entry summary.
 - **Catalog-driven source/sink/sanitizer matching.** Add entries in `catalog.js`. Each entry: `kind` ∈ {source, sink, sanitizer}, plus language + framework + match shape. 200+ entries spanning Express/Flask/FastAPI/Django/Rails/PHP/Go-net-http/Gin/Echo.
 - **Path feasibility.** Constant-folds `if` conditions to prune unreachable branches.
 - **Per-flow source attribution.** Sources reported on a finding are the ones actually reaching the sink argument (via free-var matching in the sink expression), NOT the first source the worklist happened to see. Premortem-derived.
 
-## Scope — what we do NOT model (today)
+## Scope — now modelled (was previously listed as gaps; closed in v0.66)
 
-- **Arbitrary entry-taint-state context-sensitivity.** Each function gets ONE summary, computed under empty entry. A function that's pure when called with clean args but vulnerable when called with tainted args is modelled as the empty-state result. Track FR-SEM-2 to lift this.
-- **Mutated-parameter taint at call sites.** The `SummaryCache.applyAtCallSite` helper exists for it; the engine doesn't consult it yet. If you want a helper that mutates its argument (`Object.assign(target, tainted)`) to taint the caller's `target`, this is the modelling gap.
-- **Higher-order taint flow** — partial. `higher-order.js` propagates taint into `arr.map(fn)` / `promise.then(fn)` callbacks at the IR level, but the recorded `_higherOrderInvocations` aren't fed back into the worklist yet.
+- **Mutated-parameter taint at call sites.** `engine.js` consults `SummaryCache.applyAtCallSite` at both assign-from-call and plain-call sites: a callee that mutates a param (e.g. `Object.assign(target, tainted)`, `_.merge`) taints the caller's argument variable. Covered by `test/interproc-k2.test.js`.
+- **Higher-order taint flow.** `_higherOrderInvocations` recorded during `analyzeFunction` are consumed in `runTaintEngine`: the callback is resolved, analyzed with a tainted parameter, and its findings merged back into the caller (`_via: 'higher-order'`, capped at `HO_CAP`). Covered by `test/closure-capture.test.js` and `test/phase6-taint.test.js`.
+- **Recursion via fixed point.** `runTaintEngine` runs a multi-pass fixed-point loop (`MAX_FP_ITERS=3`) until the summary cache stabilizes, so recursive cycles and call chains converge instead of under-approximating on a single pass.
+
+## Scope — what we still do NOT model (today)
+
+- **Call-string (k>1) context-sensitivity.** Context is the *value* abstraction — which params are tainted at entry — not the call stack. Two call paths that reach a helper with the same tainted-arg shape share a summary. Entry-state granularity is also param-level, not arbitrary access paths (`f(obj)` with `obj.a` tainted ≡ `obj.b` tainted).
+- **Contexts beyond the per-function cap.** Once a function has been computed under `AGENTIC_SECURITY_KCFA_MAX_CONTEXTS` distinct tainted-arg shapes, further shapes fall back to the empty-entry summary (an under-approximation, bounded on purpose).
 - **Implicit flow.** `implicit-flow.js` exists for `if (tainted) { x = "yes" }` propagation but is conservative-by-default.
 
+## Precision: centralized SSRF/path guard recognition
+
+`engine.js` `dropGuardedFindings(findings, fc)` runs after all detectors and drops a CWE-918 (SSRF) finding when the sink window has a host allow/deny check (deny/allow-list, `getHost`/`hostname` comparison, RFC1918/`169.254.169.254` prefix check, `ipaddress`/`getaddrinfo`/`ssrf-req-filter`), or a CWE-22 (path) finding when the window has a containment guard (`basename`/`GetFileName`/`secure_filename`/`send_from_directory`, or canonicalize+`startsWith`). It's the single source of truth so every emitter (regex, structural, per-language flow, PY-SAST, CSHARP, GO) is treated uniformly. The window is **comment-stripped** (a "no allow-list / 169.254…" vuln comment must not read as a guard). Opt out: `AGENTIC_SECURITY_NO_GUARD_RECOGNITION=1`.
+
 ## Entry points
 
 - `runTaintEngine(perFileIR, callGraph, opts)` — the public entry. Called from `engine.js` when `AGENTIC_SECURITY_DEEP=1` (or auto-enabled outside CI).
 - `applyPathFeasibility` — constant-fold pass that runs before the worklist.
 - `annotateBackwardSlices` — backward-slice annotation for already-emitted findings.
+- `annotateProvenClean(findings, perFileIR)` (`proven-clean.js`) — proves a SQL sink is reached only through a parameterizer; sets `provenClean`. Wired by default in `runDeepAnalysis` (opt out: `AGENTIC_SECURITY_NO_PROOF_GATE=1`).
+- `annotateProofGate(findings)` (`proof-gate.js`) — the precision gate. Consolidates `provenClean` + `_provenUnreachable` into one `finding.proof = { verdict, reasons }` and applies a **recall-preserving demotion** (lowers `confidence` + `confidenceTier` + `exploitabilityTier`, never `severity`). Runs in `engine.js` after confidence/exploitability, before mitigation/composite-risk. Default on.
 
 ## Configuration / opt-in
 
@@ -29,6 +40,7 @@ Layer-2 taint engine. Walks the Layer-1 IR (`../ir/`) with field-sensitive forwa
 - `AGENTIC_SECURITY_DEEP_TIMEOUT_MS` — global walltime budget (default 300_000).
 - `AGENTIC_SECURITY_DEEP_FN_LIMIT` — function-count budget (default 5000).
 - `AGENTIC_SECURITY_DEEP_IN_CI=1` — also enable in CI (off by default; CI runs are time-bounded).
+- `AGENTIC_SECURITY_KCFA_MAX_CONTEXTS` — distinct non-empty entry contexts kept per function (default 16; 0 = monovariant).
 
 ## Gotchas
 

package/src/dataflow/catalog.js

@@ -99,6 +99,15 @@ export const CATALOG = [
   { kind: 'sanitizer', id: 'js-String-coerce',       language: 'js', match: { type: 'call', callee: 'String'              }, effect: 'strip', appliesTo: ['mongo-operator'] },
   { kind: 'sanitizer', id: 'js-validator-escape',    language: 'js', match: { type: 'call', callee: 'escape'              }, effect: 'strip', appliesTo: ['xss'] },
   { kind: 'sanitizer', id: 'js-strip_tags',          language: 'js', match: { type: 'call', callee: 'stripTags'            }, effect: 'strip', appliesTo: ['xss'] },
+  // Schema-validation libraries (#7). Scoped to NoSQL/operator injection ONLY:
+  // validating that input matches a typed shape defeats operator injection
+  // (a `{$gt:''}` object can't satisfy `z.string()`). It does NOT sanitize the
+  // value for XSS/SQL/cmd — a validated string is still a payload — so these
+  // are deliberately NOT tagged for those families (doing so would cause false
+  // negatives). Only distinctive callees, to avoid colliding with JSON.parse.
+  { kind: 'sanitizer', id: 'js-zod-safeParse',     language: 'js', match: { type: 'call', callee: 'safeParse'         }, effect: 'strip', appliesTo: ['mongo-operator'] },
+  { kind: 'sanitizer', id: 'js-zod-parseAsync',    language: 'js', match: { type: 'call', callee: 'parseAsync'        }, effect: 'strip', appliesTo: ['mongo-operator'] },
+  { kind: 'sanitizer', id: 'js-class-validator',   language: 'js', match: { type: 'call', callee: 'validateOrReject'  }, effect: 'strip', appliesTo: ['mongo-operator'] },
 
   // ─── SOURCES (Python — Flask / FastAPI / Django) ──────────────────────────
   { kind: 'source', id: 'py-flask-request-args',   language: 'py', framework: 'flask',   match: { type: 'member', object: 'request', prop: 'args'    }, label: 'request.args' },

package/src/dataflow/engine.js

@@ -215,7 +215,8 @@ function step(node, stateIn, callContext) {
       const calleeName = node.source && node.source.kind === 'call' && typeof node.source.callee === 'string'
         ? node.source.callee : null;
       if (target && calleeName && callContext._summaryCache && callContext._callGraph) {
-        const resolved = callContext._callGraph.resolve ? callContext._callGraph.resolve(calleeName) : null;
+        const _callerFile = (callContext._currentFnQid || '').split('::')[0] || undefined;
+        const resolved = callContext._callGraph.resolve ? callContext._callGraph.resolve(calleeName, _callerFile) : null;
         const fn  = resolved && resolved.qid ? resolved : null;
         const qid = resolved && (resolved.qid || resolved);
         if (typeof qid === 'string') {
@@ -322,8 +323,9 @@ function step(node, stateIn, callContext) {
       // Object.assign(target, tainted) → target becomes tainted in caller.
       if (callContext._summaryCache && callContext._callGraph
           && typeof node.callee === 'string') {
+        const _callerFile = (callContext._currentFnQid || '').split('::')[0] || undefined;
         const resolved = callContext._callGraph.resolve
-          ? callContext._callGraph.resolve(node.callee) : null;
+          ? callContext._callGraph.resolve(node.callee, _callerFile) : null;
         const fn  = resolved && resolved.qid ? resolved : null;
         const qid = resolved && (resolved.qid || resolved);
         if (typeof qid === 'string' && fn && Array.isArray(fn.params)) {
@@ -331,7 +333,31 @@ function step(node, stateIn, callContext) {
           const entry = paramNames.length
             ? entryStateFromCall(paramNames, node.args || [], state)
             : new Set();
-          const sum = callContext._summaryCache.get(qid, entry);
+          let sum = callContext._summaryCache.get(qid, entry);
+          // FR-SEM-2: context-sensitive lazy compute at the plain-call site,
+          // mirroring the assign-call site. On a miss for a NON-empty entry,
+          // compute the callee's summary UNDER that tainted-arg context so a
+          // param mutated only when called with user input is detected here
+          // too (not just when the call's result is assigned). Bounded by the
+          // SummaryCache context cap.
+          if (!sum && entry.size && fn && fn.cfg) {
+            sum = callContext._summaryCache.compute(qid, entry, () => {
+              const inner = {
+                _findings: [], _taintSources: [], _returnTainted: false,
+                _stack: new Set(), deadlineMs: callContext.deadlineMs,
+                _summaryCache: callContext._summaryCache,
+                _callGraph: callContext._callGraph,
+                _mutatedParamsOut: new Set(),
+              };
+              try { analyzeFunction(fn, entry, inner); } catch {}
+              return {
+                returnTainted: !!inner._returnTainted,
+                mutatedParams: inner._mutatedParamsOut || new Set(),
+                taintedGlobals: new Set(),
+                findings: [],
+              };
+            });
+          }
           if (sum && sum.mutatedParams && sum.mutatedParams.size) {
             const mutated = callContext._summaryCache.applyAtCallSite(
               sum, paramNames, node.args || [], state);
@@ -685,7 +711,7 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
       if (Date.now() > deadlineMs) break;
       const inv = hoInvocations[hi];
       if (!inv.callee || !inv.taintedParam) continue;
-      const resolved = callGraph.resolve ? callGraph.resolve(inv.callee) : null;
+      const resolved = callGraph.resolve ? callGraph.resolve(inv.callee, fn && fn.file) : null;
       const cbFn = resolved && resolved.qid ? resolved : null;
       if (!cbFn || !cbFn.params || !cbFn.params.length) continue;
       const cbEntry = new Set([cbFn.params[inv.paramIndex || 0]]);

package/src/dataflow/index.js

@@ -1,5 +1,6 @@
 // Layer 2 entry point.
 import { runTaintEngine } from './engine.js';
+import { annotateProvenClean } from './proven-clean.js';
 import { CATALOG, matchSource, matchSinkOrSanitizer, _catalogSize } from './catalog.js';
 import { applyPathFeasibility } from './path-feasibility.js';
 import { SummaryCache, entryStateFromCall } from './summaries.js';
@@ -114,6 +115,13 @@ export function runDeepAnalysis(perFileIR, callGraph, opts = {}) {
   if (process.env.AGENTIC_SECURITY_BACKWARD_SLICE === '1') {
     findings = annotateBackwardSlices(findings, perFileIR, callGraph);
   }
+  // Roadmap #6 — flow-proof: prove SQL sinks reached only through a
+  // parameterizer (`provenClean`). Runs by default in the deep pass; it only
+  // touches IR-TAINT SQL findings and never drops anything. The proof-gate
+  // annotator (engine.js) consolidates this into the demotion verdict.
+  if (process.env.AGENTIC_SECURITY_NO_PROOF_GATE !== '1') {
+    try { findings = annotateProvenClean(findings, perFileIR); } catch { /* proof failure must not fail the scan */ }
+  }
   // v0.70 #6 — probabilistic / soft taint. Walks each finding's trace +
   // chain, multiplies (1 - effectiveness) across sanitizers, demotes
   // below-threshold findings to lower severity (never drops).