@oculum/scanner 1.0.14 → 1.0.15

package/src/__tests__/score/adjustments.test.ts

@@ -5,10 +5,12 @@
 import {
   FILE_CONTEXT_RULES,
   AUTO_DISMISS_RULES,
+  DEPTH_GATED_RULES,
   ALL_ADJUSTMENT_RULES,
   TAINT_RULES,
   ROUTE_RULES,
   FRAMEWORK_RULES,
+  SEVERITY_BOOST_RULES,
 } from '../../score/adjustments'
 import type { AdjustmentContext } from '../../score/types'
 import type { Vulnerability } from '../../shared/types'
@@ -209,23 +211,43 @@ describe('Auto-Dismiss Equivalent Rules', () => {
     expect(rule.applies(finding, ctx)).toBe(true)
   })
 
-  it('info_severity_low_priority applies for info + high base confidence', () => {
+  it('info_severity_low_priority applies for info + partial evidence', () => {
     const rule = findRule('info_severity_low_priority')!
-    expect(rule.delta).toBe(-0.15)
+    expect(rule.delta).toBe(-0.25)
 
     const finding = makeFinding({
       severity: 'info',
-      baseConfidence: 0.70,
+      evidenceLevel: 'partial',
     })
     const ctx = makeContext()
     expect(rule.applies(finding, ctx)).toBe(true)
   })
 
-  it('info_severity_low_priority does not apply for low base confidence', () => {
+  it('info_severity_low_priority applies for info + proven evidence', () => {
     const rule = findRule('info_severity_low_priority')!
     const finding = makeFinding({
       severity: 'info',
-      baseConfidence: 0.20,
+      evidenceLevel: 'proven',
+    })
+    const ctx = makeContext()
+    expect(rule.applies(finding, ctx)).toBe(true)
+  })
+
+  it('info_severity_low_priority does not apply for pattern_only evidence', () => {
+    const rule = findRule('info_severity_low_priority')!
+    const finding = makeFinding({
+      severity: 'info',
+      evidenceLevel: 'pattern_only',
+    })
+    const ctx = makeContext()
+    expect(rule.applies(finding, ctx)).toBe(false)
+  })
+
+  it('info_severity_low_priority does not apply for non-info severity', () => {
+    const rule = findRule('info_severity_low_priority')!
+    const finding = makeFinding({
+      severity: 'medium',
+      evidenceLevel: 'partial',
     })
     const ctx = makeContext()
     expect(rule.applies(finding, ctx)).toBe(false)
@@ -324,21 +346,17 @@ describe('Auto-Dismiss Equivalent Rules', () => {
 })
 
 describe('Context Engine Rules', () => {
-  it('TAINT_RULES has 4 taint adjustment rules', () => {
-    expect(TAINT_RULES).toHaveLength(4)
-    const ruleNames = TAINT_RULES.map(r => r.name)
-    expect(ruleNames).toContain('confirmed_taint_unsanitised')
-    expect(ruleNames).toContain('confirmed_taint_sanitised')
-    expect(ruleNames).toContain('no_taint_path')
-    expect(ruleNames).toContain('low_confidence_taint')
+  it('TAINT_RULES is empty (absorbed into evidence-based scoring in Phase 7)', () => {
+    expect(TAINT_RULES).toHaveLength(0)
   })
 
-  it('ROUTE_RULES has 5 rules', () => {
-    expect(ROUTE_RULES).toHaveLength(5)
+  it('ROUTE_RULES has 6 rules', () => {
+    expect(ROUTE_RULES).toHaveLength(6)
     const ruleNames = ROUTE_RULES.map(r => r.name)
     expect(ruleNames).toContain('no_auth_on_route')
     expect(ruleNames).toContain('has_auth_on_route')
     expect(ruleNames).toContain('public_route')
+    expect(ruleNames).toContain('readonly_route')
     expect(ruleNames).toContain('mutation_route')
     expect(ruleNames).toContain('rate_limited_route')
   })
@@ -353,9 +371,9 @@ describe('Context Engine Rules', () => {
 })
 
 describe('ALL_ADJUSTMENT_RULES', () => {
-  it('contains all file context, auto-dismiss, taint, route, and framework rules', () => {
+  it('contains all file context, auto-dismiss, taint, route, framework, and severity boost rules', () => {
     expect(ALL_ADJUSTMENT_RULES.length).toBe(
-      FILE_CONTEXT_RULES.length + AUTO_DISMISS_RULES.length + TAINT_RULES.length + ROUTE_RULES.length + FRAMEWORK_RULES.length
+      FILE_CONTEXT_RULES.length + AUTO_DISMISS_RULES.length + DEPTH_GATED_RULES.length + TAINT_RULES.length + ROUTE_RULES.length + FRAMEWORK_RULES.length + SEVERITY_BOOST_RULES.length
     )
   })
 

package/src/__tests__/score/confidence.test.ts

@@ -1,9 +1,12 @@
 /**
  * Unit tests for computeConfidence()
+ *
+ * After Phase 7, base score is determined by evidence level classification,
+ * not by baseConfidence. Tests use evidenceLevel to control the base score.
  */
 
 import { computeConfidence } from '../../score/confidence'
-import type { Vulnerability } from '../../shared/types'
+import type { Vulnerability, TaintPathOutput } from '../../shared/types'
 import type { AdjustmentRule, AdjustmentContext, DepthConfig } from '../../score/types'
 
 // Helper to create a minimal finding
@@ -19,7 +22,9 @@ function makeFinding(overrides: Partial<Vulnerability> = {}): Vulnerability {
     description: 'Found a hardcoded secret',
     confidence: 'medium',
     layer: 1,
-    baseConfidence: 0.70,
+    source: 'secrets',
+    // Default: contextual evidence → base 0.45
+    evidenceLevel: 'contextual',
     ...overrides,
   }
 }
@@ -69,18 +74,18 @@ const DEPTH_DEEP: DepthConfig = {
 
 describe('computeConfidence', () => {
   describe('basic score computation', () => {
-    it('returns base confidence when no rules match', () => {
-      const finding = makeFinding({ baseConfidence: 0.70 })
+    it('returns evidence-based base confidence when no rules match', () => {
+      const finding = makeFinding({ evidenceLevel: 'partial' })
       const context = makeContext()
       const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
 
-      expect(result.score).toBe(0.70)
-      expect(result.base).toBe(0.70)
+      expect(result.score).toBe(0.60)
+      expect(result.base).toBe(0.60)
       expect(result.adjustments).toEqual([])
     })
 
     it('applies a single negative adjustment', () => {
-      const finding = makeFinding({ baseConfidence: 0.70 })
+      const finding = makeFinding({ evidenceLevel: 'proven' })
       const context = makeContext()
       const rules: AdjustmentRule[] = [{
         name: 'test_file',
@@ -91,13 +96,14 @@ describe('computeConfidence', () => {
       }]
 
       const result = computeConfidence(finding, context, rules, DEPTH_VERIFIED)
-      expect(result.score).toBe(0.35)
+      // proven base 0.90 - 0.35 = 0.55
+      expect(result.score).toBeCloseTo(0.55, 10)
       expect(result.adjustments).toHaveLength(1)
       expect(result.adjustments[0].delta).toBe(-0.35)
     })
 
     it('applies multiple adjustments', () => {
-      const finding = makeFinding({ baseConfidence: 0.50 })
+      const finding = makeFinding({ evidenceLevel: 'partial' })
       const context = makeContext()
       const rules: AdjustmentRule[] = [
         { name: 'a', source: 'file_context', applies: () => true, delta: -0.10, reason: 'A' },
@@ -105,12 +111,13 @@ describe('computeConfidence', () => {
       ]
 
       const result = computeConfidence(finding, context, rules, DEPTH_VERIFIED)
-      expect(result.score).toBeCloseTo(0.20, 10)
+      // partial base 0.60 - 0.10 - 0.20 = 0.30
+      expect(result.score).toBeCloseTo(0.30, 10)
       expect(result.adjustments).toHaveLength(2)
     })
 
     it('skips rules that do not apply', () => {
-      const finding = makeFinding({ baseConfidence: 0.50 })
+      const finding = makeFinding({ evidenceLevel: 'partial' })
       const context = makeContext()
       const rules: AdjustmentRule[] = [
         { name: 'matches', source: 'file_context', applies: () => true, delta: -0.10, reason: 'yes' },
@@ -118,104 +125,137 @@ describe('computeConfidence', () => {
       ]
 
       const result = computeConfidence(finding, context, rules, DEPTH_VERIFIED)
-      expect(result.score).toBe(0.40)
+      // partial base 0.60 - 0.10 = 0.50
+      expect(result.score).toBe(0.50)
       expect(result.adjustments).toHaveLength(1)
     })
   })
 
   describe('score clamping', () => {
     it('clamps score at 0.0 when adjustments drive it negative', () => {
-      const finding = makeFinding({ baseConfidence: 0.20 })
+      const finding = makeFinding({ evidenceLevel: 'pattern_only' })
       const context = makeContext()
       const rules: AdjustmentRule[] = [
         { name: 'big_negative', source: 'file_context', applies: () => true, delta: -0.50, reason: 'large penalty' },
       ]
 
       const result = computeConfidence(finding, context, rules, DEPTH_VERIFIED)
+      // pattern_only base 0.30 - 0.50 = -0.20 → clamped to 0.0
       expect(result.score).toBe(0.0)
     })
 
     it('clamps score at 1.0 when adjustments exceed maximum', () => {
-      const finding = makeFinding({ baseConfidence: 0.80 })
+      const finding = makeFinding({ evidenceLevel: 'proven' })
       const context = makeContext()
       const rules: AdjustmentRule[] = [
         { name: 'big_positive', source: 'detector', applies: () => true, delta: 0.50, reason: 'boost' },
       ]
 
       const result = computeConfidence(finding, context, rules, DEPTH_VERIFIED)
+      // proven base 0.90 + 0.50 = 1.40 → clamped to 1.0
       expect(result.score).toBe(1.0)
     })
   })
 
-  describe('default base confidence', () => {
-    it('uses 0.35 when baseConfidence is undefined', () => {
-      const finding = makeFinding({ baseConfidence: undefined })
+  describe('evidence-based base confidence', () => {
+    it('uses pattern_only base when no source or evidenceLevel', () => {
+      const finding = makeFinding({ source: undefined, evidenceLevel: undefined })
       const context = makeContext()
       const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
 
-      expect(result.score).toBe(0.35)
-      expect(result.base).toBe(0.35)
+      expect(result.score).toBe(0.30)
+      expect(result.base).toBe(0.30)
+    })
+
+    it('uses partial base for structural source findings', () => {
+      const finding = makeFinding({ source: 'structural', evidenceLevel: undefined })
+      const context = makeContext()
+      const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
+
+      expect(result.base).toBe(0.60)
+    })
+
+    it('uses contextual base for secrets source findings', () => {
+      const finding = makeFinding({ source: 'secrets', evidenceLevel: undefined })
+      const context = makeContext()
+      const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
+
+      expect(result.base).toBe(0.45)
+    })
+
+    it('uses proven base for findings with taintPath', () => {
+      const taintPath: TaintPathOutput = {
+        sourceType: 'http_body', sourceLine: 1, sinkType: 'sql_query', sinkLine: 10,
+        taintKinds: ['sql'], sanitized: false,
+        steps: [{ line: 1, variable: 'x', taintKinds: ['sql'], description: 'src', stepType: 'source' }],
+      }
+      const finding = makeFinding({ taintPath, evidenceLevel: undefined })
+      const context = makeContext()
+      const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
+
+      expect(result.base).toBe(0.90)
     })
   })
 
   describe('routing thresholds', () => {
     it('routes to surface when score >= surfaceThreshold', () => {
-      const finding = makeFinding({ baseConfidence: 0.70 })
+      const finding = makeFinding({ evidenceLevel: 'proven' })
       const context = makeContext()
       const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
 
+      // 0.90 >= 0.70
       expect(result.routing).toBe('surface')
     })
 
     it('routes to validate when score >= validateThreshold and AI enabled', () => {
-      const finding = makeFinding({ baseConfidence: 0.50 })
+      const finding = makeFinding({ evidenceLevel: 'contextual' })
       const context = makeContext()
       const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
 
+      // 0.45 < 0.70 and 0.45 >= 0.30 → validate
       expect(result.routing).toBe('validate')
     })
 
     it('routes to suppress when score < validateThreshold', () => {
-      const finding = makeFinding({ baseConfidence: 0.20 })
+      const finding = makeFinding({ evidenceLevel: 'pattern_only' })
       const context = makeContext()
       const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
 
-      expect(result.routing).toBe('suppress')
+      // 0.30 >= 0.30 → validate (borderline, inclusive)
+      expect(result.routing).toBe('validate')
     })
 
     it('routes to suppress in local mode even when score could validate', () => {
-      const finding = makeFinding({ baseConfidence: 0.50 })
+      const finding = makeFinding({ evidenceLevel: 'partial' })
       const context = makeContext()
       const result = computeConfidence(finding, context, [], DEPTH_LOCAL)
 
-      // 0.50 < surfaceThreshold(0.70), validateThreshold(1.0) unreachable, aiEnabled=false
+      // 0.60 < surfaceThreshold(0.70), validateThreshold(1.0) unreachable, aiEnabled=false
       expect(result.routing).toBe('suppress')
     })
 
     it('routes to validate in deep mode with very low threshold', () => {
-      const finding = makeFinding({ baseConfidence: 0.15 })
+      const finding = makeFinding({ evidenceLevel: 'pattern_only' })
       const context = makeContext()
       const result = computeConfidence(finding, context, [], DEPTH_DEEP)
 
-      // 0.15 >= validateThreshold(0.10) and aiEnabled=true
+      // 0.30 >= validateThreshold(0.10) and aiEnabled=true
       expect(result.routing).toBe('validate')
     })
   })
 
   describe('worked examples', () => {
-    // Example 1: Known API key in production code (high confidence, surfaces directly)
-    it('surfaces a known API key in production code', () => {
-      const finding = makeFinding({ baseConfidence: 0.70, category: 'hardcoded_secret' })
+    it('surfaces a proven finding in production code', () => {
+      const finding = makeFinding({ evidenceLevel: 'proven', category: 'sql_injection' })
       const context = makeContext()
       const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
 
-      expect(result.score).toBe(0.70)
+      expect(result.score).toBe(0.90)
       expect(result.routing).toBe('surface')
     })
 
-    // Example 2: Known API key in test file (adjusted down, validate or suppress)
-    it('adjusts down a known API key in test file', () => {
-      const finding = makeFinding({ baseConfidence: 0.70, category: 'hardcoded_secret' })
+    it('adjusts down a proven finding in test file', () => {
+      const finding = makeFinding({ evidenceLevel: 'proven', category: 'sql_injection' })
       const context = makeContext()
       const rules: AdjustmentRule[] = [{
         name: 'test_file',
@@ -226,14 +266,13 @@ describe('computeConfidence', () => {
       }]
 
       const result = computeConfidence(finding, context, rules, DEPTH_VERIFIED)
-      // 0.70 - 0.35 = 0.35 → validate
-      expect(result.score).toBe(0.35)
+      // 0.90 - 0.35 = 0.55 → validate
+      expect(result.score).toBeCloseTo(0.55, 10)
       expect(result.routing).toBe('validate')
     })
 
-    // Example 3: Entropy finding in scanner code (suppressed)
-    it('suppresses entropy finding in scanner code', () => {
-      const finding = makeFinding({ baseConfidence: 0.30, category: 'high_entropy_string' })
+    it('suppresses pattern_only finding in scanner code', () => {
+      const finding = makeFinding({ evidenceLevel: 'pattern_only', category: 'high_entropy_string' })
       const context = makeContext()
       const rules: AdjustmentRule[] = [{
         name: 'scanner_code',
@@ -249,34 +288,22 @@ describe('computeConfidence', () => {
       expect(result.routing).toBe('suppress')
     })
 
-    // Example 4: Comment finding (experimental equivalent, suppressed)
-    it('suppresses a comment finding (low base confidence)', () => {
-      const finding = makeFinding({ baseConfidence: 0.15, category: 'ai_pattern' })
-      const context = makeContext()
-      const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
-
-      // 0.15 < validateThreshold(0.30) → suppress
-      expect(result.routing).toBe('suppress')
-    })
-
-    // Example 5: SSRF detection surfaces at verified depth
-    it('routes SSRF detection to validate at verified depth', () => {
-      const finding = makeFinding({ baseConfidence: 0.40, category: 'ssrf' })
+    it('validates contextual finding at verified depth', () => {
+      const finding = makeFinding({ evidenceLevel: 'contextual', category: 'ssrf' })
       const context = makeContext()
       const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
 
-      // 0.40 >= validateThreshold(0.30) → validate
+      // 0.45 >= validateThreshold(0.30) → validate
       expect(result.routing).toBe('validate')
     })
 
-    // Example 6: XXE detection surfaces directly
-    it('routes XXE detection to surface when base is high enough', () => {
-      const finding = makeFinding({ baseConfidence: 0.55, category: 'xxe' })
+    it('routes partial finding to surface with custom low threshold', () => {
+      const finding = makeFinding({ evidenceLevel: 'partial', category: 'xxe' })
       const context = makeContext()
-      // With a surface threshold of 0.55:
       const customDepth: DepthConfig = { surfaceThreshold: 0.55, validateThreshold: 0.30, aiEnabled: true }
       const result = computeConfidence(finding, context, [], customDepth)
 
+      // 0.60 >= 0.55 → surface
       expect(result.routing).toBe('surface')
     })
   })

package/src/__tests__/score/evidence-scoring.test.ts

@@ -0,0 +1,249 @@
+/**
+ * Integration tests for evidence-based scoring.
+ *
+ * Verifies that evidence levels produce correct base scores,
+ * routing decisions work with new DEPTH_CONFIGS, and removed
+ * taint rules no longer fire.
+ */
+
+import { computeConfidence } from '../../score/confidence'
+import { ALL_ADJUSTMENT_RULES, TAINT_RULES } from '../../score/adjustments'
+import { DEPTH_CONFIGS } from '../../score/index'
+import { EVIDENCE_BASE } from '../../score/evidence'
+import type { Vulnerability, TaintPathOutput } from '../../shared/types'
+import type { AdjustmentContext, DepthConfig } from '../../score/types'
+
+function makeFinding(overrides: Partial<Vulnerability> = {}): Vulnerability {
+  return {
+    id: 'test-1',
+    filePath: 'src/app.ts',
+    lineNumber: 10,
+    lineContent: 'db.query(userInput)',
+    severity: 'medium',
+    category: 'sql_injection',
+    title: 'Test finding',
+    description: 'Test',
+    confidence: 'medium',
+    layer: 2,
+    source: 'structural',
+    ...overrides,
+  }
+}
+
+function makeTaintPath(): TaintPathOutput {
+  return {
+    sourceType: 'http_body',
+    sourceLine: 5,
+    sinkType: 'sql_query',
+    sinkLine: 15,
+    taintKinds: ['sql'],
+    sanitized: false,
+    steps: [
+      { line: 5, variable: 'req.body', taintKinds: ['sql'], description: 'Source', stepType: 'source' },
+      { line: 15, variable: 'query', taintKinds: ['sql'], description: 'Sink', stepType: 'sink' },
+    ],
+  }
+}
+
+function makeContext(overrides: Partial<AdjustmentContext> = {}): AdjustmentContext {
+  return {
+    file: {
+      isTestFile: false,
+      isExampleFile: false,
+      isDocFile: false,
+      isScannerCode: false,
+      isToolingDir: false,
+      isServerOnly: false,
+      isClientBundled: false,
+    },
+    project: {
+      hasAuthMiddleware: false,
+      hasTypeScript: true,
+      orm: null,
+      validationLib: null,
+    },
+    lineContent: 'db.query(userInput)',
+    filePath: 'src/app.ts',
+    ...overrides,
+  }
+}
+
+describe('Evidence-Based Scoring Integration', () => {
+  describe('evidence level base scores', () => {
+    it('proven finding gets base 0.90', () => {
+      const finding = makeFinding({
+        taintPath: makeTaintPath(),
+        evidenceLevel: 'proven',
+      })
+      const ctx = makeContext()
+      const result = computeConfidence(finding, ctx, [], DEPTH_CONFIGS.verified)
+
+      expect(result.base).toBe(0.90)
+    })
+
+    it('partial finding gets base 0.60', () => {
+      const finding = makeFinding({
+        source: 'structural',
+        evidenceLevel: 'partial',
+      })
+      const ctx = makeContext()
+      const result = computeConfidence(finding, ctx, [], DEPTH_CONFIGS.verified)
+
+      expect(result.base).toBe(0.60)
+    })
+
+    it('contextual finding gets base 0.45', () => {
+      const finding = makeFinding({
+        source: 'secrets',
+        evidenceLevel: 'contextual',
+      })
+      const ctx = makeContext()
+      const result = computeConfidence(finding, ctx, [], DEPTH_CONFIGS.verified)
+
+      expect(result.base).toBe(0.45)
+    })
+
+    it('pattern_only finding gets base 0.30', () => {
+      const finding = makeFinding({
+        source: undefined,
+        evidenceLevel: 'pattern_only',
+      })
+      const ctx = makeContext()
+      const result = computeConfidence(finding, ctx, [], DEPTH_CONFIGS.verified)
+
+      expect(result.base).toBe(0.30)
+    })
+  })
+
+  describe('routing with new DEPTH_CONFIGS', () => {
+    it('proven finding surfaces at verified depth', () => {
+      const finding = makeFinding({
+        taintPath: makeTaintPath(),
+        evidenceLevel: 'proven',
+      })
+      const ctx = makeContext()
+      const result = computeConfidence(finding, ctx, [], DEPTH_CONFIGS.verified)
+
+      // 0.90 >= surfaceThreshold(0.80) → surface
+      expect(result.routing).toBe('surface')
+    })
+
+    it('proven finding surfaces at local depth', () => {
+      const finding = makeFinding({
+        taintPath: makeTaintPath(),
+        evidenceLevel: 'proven',
+      })
+      const ctx = makeContext()
+      const result = computeConfidence(finding, ctx, [], DEPTH_CONFIGS.local)
+
+      // 0.90 >= surfaceThreshold(0.70) → surface
+      expect(result.routing).toBe('surface')
+    })
+
+    it('partial finding routes to validate at verified depth', () => {
+      const finding = makeFinding({
+        source: 'structural',
+        evidenceLevel: 'partial',
+      })
+      const ctx = makeContext()
+      const result = computeConfidence(finding, ctx, [], DEPTH_CONFIGS.verified)
+
+      // 0.60 < surfaceThreshold(0.80) and 0.60 >= validateThreshold(0.35) → validate
+      expect(result.routing).toBe('validate')
+    })
+
+    it('pattern_only finding is suppressed at verified depth (below validateThreshold)', () => {
+      const finding = makeFinding({
+        source: undefined,
+        evidenceLevel: 'pattern_only',
+      })
+      const ctx = makeContext()
+      const result = computeConfidence(finding, ctx, [], DEPTH_CONFIGS.verified)
+
+      // 0.30 < surfaceThreshold(0.80) and 0.30 < validateThreshold(0.35) → suppress
+      expect(result.routing).toBe('suppress')
+    })
+
+    it('pattern_only in local mode is suppressed', () => {
+      const finding = makeFinding({
+        source: undefined,
+        evidenceLevel: 'pattern_only',
+      })
+      const ctx = makeContext()
+      const result = computeConfidence(finding, ctx, [], DEPTH_CONFIGS.local)
+
+      // 0.30 < surfaceThreshold(0.70), validateThreshold=1.0, aiEnabled=false → suppress
+      expect(result.routing).toBe('suppress')
+    })
+
+    it('proven finding surfaces at deep depth', () => {
+      const finding = makeFinding({
+        taintPath: makeTaintPath(),
+        evidenceLevel: 'proven',
+      })
+      const ctx = makeContext()
+      const result = computeConfidence(finding, ctx, [], DEPTH_CONFIGS.deep)
+
+      // 0.90 >= surfaceThreshold(0.80) → surface
+      expect(result.routing).toBe('surface')
+    })
+  })
+
+  describe('removed taint adjustment rules', () => {
+    it('TAINT_RULES array is empty (4 rules absorbed into evidence levels)', () => {
+      expect(TAINT_RULES).toHaveLength(0)
+    })
+
+    it('no taint-source rules exist in ALL_ADJUSTMENT_RULES', () => {
+      const taintRules = ALL_ADJUSTMENT_RULES.filter(r => r.source === 'taint')
+      expect(taintRules).toHaveLength(0)
+    })
+
+    it('removed rule names do not exist in ALL_ADJUSTMENT_RULES', () => {
+      const ruleNames = ALL_ADJUSTMENT_RULES.map(r => r.name)
+      expect(ruleNames).not.toContain('confirmed_taint_unsanitised')
+      expect(ruleNames).not.toContain('confirmed_taint_sanitised')
+      expect(ruleNames).not.toContain('no_taint_path')
+      expect(ruleNames).not.toContain('low_confidence_taint')
+    })
+  })
+
+  describe('remaining adjustment rules still apply', () => {
+    it('test_file adjustment still applies on top of evidence base', () => {
+      const finding = makeFinding({
+        evidenceLevel: 'partial',
+        filePath: 'src/__tests__/app.test.ts',
+      })
+      const ctx = makeContext({
+        filePath: 'src/__tests__/app.test.ts',
+      })
+
+      const result = computeConfidence(finding, ctx, ALL_ADJUSTMENT_RULES, DEPTH_CONFIGS.verified)
+
+      // Base 0.60 + test_file(-0.35) = 0.25 → suppress (0.25 < 0.35)
+      expect(result.base).toBe(0.60)
+      expect(result.score).toBeCloseTo(0.25, 2)
+      expect(result.adjustments.some(a => a.factor === 'test_file')).toBe(true)
+    })
+  })
+
+  describe('DEPTH_CONFIGS structure', () => {
+    it('local has correct thresholds', () => {
+      expect(DEPTH_CONFIGS.local.surfaceThreshold).toBe(0.70)
+      expect(DEPTH_CONFIGS.local.validateThreshold).toBe(1.0)
+      expect(DEPTH_CONFIGS.local.aiEnabled).toBe(false)
+    })
+
+    it('verified has updated thresholds', () => {
+      expect(DEPTH_CONFIGS.verified.surfaceThreshold).toBe(0.80)
+      expect(DEPTH_CONFIGS.verified.validateThreshold).toBe(0.35)
+      expect(DEPTH_CONFIGS.verified.aiEnabled).toBe(true)
+    })
+
+    it('deep has updated thresholds', () => {
+      expect(DEPTH_CONFIGS.deep.surfaceThreshold).toBe(0.80)
+      expect(DEPTH_CONFIGS.deep.validateThreshold).toBe(0.10)
+      expect(DEPTH_CONFIGS.deep.aiEnabled).toBe(true)
+    })
+  })
+})