@oddessentials/odd-ai-reviewers 1.10.0 → 1.10.1

package/dist/report/finding-validator.js

@@ -22,13 +22,52 @@ import { buildLineResolver, normalizeFindingsForDiff, computeDriftSignal, comput
 export function normalizeUnicode(text) {
     return text.replace(/[\u200B-\u200F\u2028\u2029\uFEFF]/g, '');
 }
+/**
+ * Patterns that indicate a finding is self-dismissing.
+ *
+ * IMPORTANT: Pattern match alone NEVER suppresses a finding.
+ * All three gates must pass for suppression:
+ *   1. Finding severity must be 'info' (NEVER warning/error)
+ *   2. Finding message must match one of these patterns
+ *   3. Finding must have NO actionable suggestion in residual text
+ *
+ * This three-gate architecture is a deliberate security boundary.
+ * Do NOT relax any gate without a spec amendment.
+ */
 const DISMISSIVE_PATTERNS = [
     /\bno action required\b/i,
     /\bacceptable as[- ]is\b/i,
     /\bnot blocking\b/i,
     /\bno change needed\b/i,
     /\bcan be ignored\b/i,
+    /\bworking as intended\b/i,
+    /\bno issues found\b/i,
+    /\bnon-critical\b/i,
+    /\blow priority\b/i,
 ];
+/**
+ * Patterns that indicate a finding is cautionary hedging advice
+ * rather than identifying an actual defect. Common in gpt-4o outputs
+ * where the model flags code as "ensure X is properly set" or
+ * "consider Y to prevent potential issues" without a concrete bug.
+ *
+ * Suppression requires ALL gates:
+ *   1. Finding severity must be 'info'
+ *   2. Combined message+suggestion must match one of these patterns
+ *   3. Combined text must NOT contain security-related terms
+ */
+const CAUTIONARY_ADVICE_PATTERNS = [
+    // "Ensure/Verify/Make sure (that) X is properly/correctly Y"
+    /\b(?:ensure|verify|make\s+sure|double[- ]?check)\s+(?:that\b|the\b|all\b)/i,
+    // "Consider X to prevent non-obvious/potential/unexpected issues"
+    /\bconsider\b.*\b(?:to\s+prevent|to\s+avoid|for\s+safety)\b/i,
+];
+/**
+ * Security-related terms that BLOCK cautionary advice suppression.
+ * If the combined message+suggestion contains any of these, the finding
+ * is treated as a legitimate concern, not hedging advice.
+ */
+const SECURITY_BLOCKLIST = /\b(?:sql|injection|xss|cross.?site|sanitiz|escap|authenti|authoriz|csrf|ssrf|path.?traversal|command.?inject|exec\s*\(|eval\s*\(|deseria|privilege|encrypt|password|credential|secret|vulnerab|exploit|attack|malicious|buffer.?overflow|bypass|jwt|token|signature|session|cors|cookie|rate.?limit(?:ing)?|redirect)\b/i;
 /**
  * Check if a suggestion is actionable (contains concrete guidance beyond dismissive language).
  */
@@ -180,6 +219,7 @@ export function validateFindingsSemantics(findings, prDescription) {
         valid: 0,
         filteredByLine: 0,
         filteredBySelfContradiction: 0,
+        filteredByCautionaryAdvice: 0,
         filteredByPRIntent: 0,
         byClassification: {
             inline: 0,
@@ -236,6 +276,34 @@ export function validateFindingsSemantics(findings, prDescription) {
             reason: result.filterReason,
         });
     }
+    // Pass 3.5: Cautionary advice detection
+    // Catches info-severity findings where the LLM hedges with "ensure/verify/consider"
+    // without identifying a concrete defect. Blocked for security-related findings.
+    for (const result of results) {
+        if (!result.valid)
+            continue;
+        // Gate 1: Only info severity — NEVER filter warning/error
+        if (result.finding.severity !== 'info')
+            continue;
+        const combinedText = normalizeUnicode(result.finding.message + ' ' + (result.finding.suggestion ?? ''));
+        // Gate 2: Must match a cautionary advice pattern
+        const matchedCautionary = CAUTIONARY_ADVICE_PATTERNS.find((p) => p.test(combinedText));
+        if (!matchedCautionary)
+            continue;
+        // Gate 3: BLOCK suppression if security-related terms are present
+        if (SECURITY_BLOCKLIST.test(combinedText))
+            continue;
+        // All gates passed — suppress this cautionary advice finding
+        result.valid = false;
+        result.filterReason = `Cautionary advice: info severity with hedging language (${matchedCautionary.source}) and no security concern`;
+        result.filterType = 'cautionary_advice';
+        stats.filteredByCautionaryAdvice++;
+        console.log('[router] [finding-validator] [filtered:cautionary]', {
+            file: result.finding.file,
+            line: result.finding.line,
+            reason: result.filterReason,
+        });
+    }
     // Build final arrays
     let validFindings = [];
     const filtered = [];
@@ -278,6 +346,7 @@ export function validateNormalizedFindings(findings, lineResolver, diffFiles) {
         valid: 0,
         filteredByLine: 0,
         filteredBySelfContradiction: 0,
+        filteredByCautionaryAdvice: 0,
         filteredByPRIntent: 0,
         byClassification: {
             inline: 0,
@@ -352,6 +421,28 @@ export function validateNormalizedFindings(findings, lineResolver, diffFiles) {
             reason: result.filterReason,
         });
     }
+    // Pass 3.5: Cautionary advice detection (same as in validateFindingsSemantics)
+    for (const result of results) {
+        if (!result.valid)
+            continue;
+        if (result.finding.severity !== 'info')
+            continue;
+        const combinedText = normalizeUnicode(result.finding.message + ' ' + (result.finding.suggestion ?? ''));
+        const matchedCautionary = CAUTIONARY_ADVICE_PATTERNS.find((p) => p.test(combinedText));
+        if (!matchedCautionary)
+            continue;
+        if (SECURITY_BLOCKLIST.test(combinedText))
+            continue;
+        result.valid = false;
+        result.filterReason = `Cautionary advice: info severity with hedging language (${matchedCautionary.source}) and no security concern`;
+        result.filterType = 'cautionary_advice';
+        stats.filteredByCautionaryAdvice++;
+        console.log('[router] [finding-validator] [filtered:cautionary]', {
+            file: result.finding.file,
+            line: result.finding.line,
+            reason: result.filterReason,
+        });
+    }
     // Build final arrays
     const validFindings = [];
     const filtered = [];
@@ -379,7 +470,8 @@ export function normalizeAndValidateFindings(findings, diffFiles, platform) {
     if (stage2Result.filtered.length > 0) {
         console.log(`[${platform}] Stage 2 validation: ${stage2Result.stats.valid} valid, ` +
             `${stage2Result.stats.filteredByLine} filtered by line, ` +
-            `${stage2Result.stats.filteredBySelfContradiction} self-contradicting`);
+            `${stage2Result.stats.filteredBySelfContradiction} self-contradicting, ` +
+            `${stage2Result.stats.filteredByCautionaryAdvice} cautionary advice`);
     }
     const driftSignal = computeDriftSignal(normalizationResult.stats, normalizationResult.invalidDetails);
     const inlineDriftSignal = computeInlineDriftSignal(normalizationResult.stats, normalizationResult.invalidDetails);

package/dist/report/finding-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"finding-validator.js","sourceRoot":"","sources":["../../src/report/finding-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,GAIzB,MAAM,oBAAoB,CAAC;AAsC5B;;;;GAIG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,mBAAmB,GAAa;IACpC,yBAAyB;IACzB,0BAA0B;IAC1B,mBAAmB;IACnB,uBAAuB;IACvB,qBAAqB;CACtB,CAAC;AAEF;;GAEG;AACH,SAAS,uBAAuB,CAAC,UAA8B;IAC7D,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,GAAG,CACjD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAC9C,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE5C,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAmB;SACjC,MAAM,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC;SAC1E,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;SAC1B,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IAEV,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AAE9E;;;GAGG;AACH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,eAAe;IACf,OAAO;IACP,UAAU;IACV,aAAa;CACd,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,6BAA6B,GAA6B;IAC9D,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACzB,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,MAAM,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAmB,EACnB,aAAqB,EACrB,mBAAmB,GAAG,IAAI;IAE1B,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;IAE/D,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,SAAS,GAAc,EAAE,CAAC;IAEhC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,6BAA6B;QAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,mGAAmG;QACnG,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC1D,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;gBAAE,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAEnD,6EAA6E;QAC7E,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtE,MAAM,eAAe,GACnB,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxD,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,wDAAwD;QACxD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,2CAA2C;QAC3C,OAAO,CAAC,GAAG,CAAC,mDAAmD,EAAE;YAC/D,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ;YACR,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7B,iBAAiB,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC/E,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC9C,CAAC,CAAC;QAEH,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO;YACP,cAAc,EAAE,OAAO,CAAC,IAAI;gBAC1B,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;oBAC1B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,YAAY;gBAChB,CAAC,CAAC,QAAQ;YACZ,KAAK,EAAE,KAAK;YACZ,YAAY,EAAE,qCAAqC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iCAAiC;YAChH,UAAU,EAAE,yBAAyB;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAmB,EACnB,aAAsB;IAEtB,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,KAAK,EAAE,CAAC;QACR,cAAc,EAAE,CAAC;QACjB,2BAA2B,EAAE,CAAC;QAC9B,kBAAkB,EAAE,CAAC;QACrB,gBAAgB,EAAE;YAChB,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;SACyB;KAC3C,CAAC;IAEF,mFAAmF;IACnF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,cAAqC,CAAC;QAE1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,cAAc,GAAG,YAAY,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC;QAEzC,OAAO,CAAC,IAAI,CAAC;YACX,OAAO;YACP,cAAc;YACd,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAE9E,uCAAuC;IACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QAE5B,yDAAyD;QACzD,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,SAAS;QAEjD,mFAAmF;QACnF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,cAAc;YAAE,SAAS;QAE9B,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU;YACpD,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,uBAAuB,CAAC,oBAAoB,CAAC;YAAE,SAAS;QAE5D,qEAAqE;QACrE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,YAAY,GAAG,+DAA+D,cAAc,CAAC,MAAM,GAAG,CAAC;QAC9G,MAAM,CAAC,UAAU,GAAG,oBAAoB,CAAC;QACzC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,kDAAkD,EAAE;YAC9D,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,MAAM,CAAC,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,IAAI,aAAa,GAAc,EAAE,CAAC;IAClC,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,cAAc,GAAG,4BAA4B,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QAClF,aAAa,GAAG,cAAc,CAAC,SAAS,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAmB,EACnB,YAAiC,EACjC,SAAoB;IAEpB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,KAAK,EAAE,CAAC;QACR,cAAc,EAAE,CAAC;QACjB,2BAA2B,EAAE,CAAC;QAC9B,kBAAkB,EAAE,CAAC;QACrB,gBAAgB,EAAE;YAChB,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;SACyB;KAC3C,CAAC;IAEF,gCAAgC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,cAAqC,CAAC;QAE1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;aAAM,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,cAAc,GAAG,YAAY,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,uDAAuD,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,cAAc,GAAG,YAAY,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC;QAEzC,OAAO,CAAC,IAAI,CAAC;YACX,OAAO;YACP,cAAc;YACd,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5E,MAAM,UAAU,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACvF,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACtB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,YAAY,GAAG,QAAQ,MAAM,CAAC,OAAO,CAAC,IAAI,0BAA0B,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjG,MAAM,CAAC,UAAU,GAAG,cAAc,CAAC;gBACnC,KAAK,CAAC,cAAc,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE;oBACjE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;oBACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;oBACzB,MAAM,EAAE,MAAM,CAAC,YAAY;iBAC5B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QAE5B,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,SAAS;QAEjD,mFAAmF;QACnF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,cAAc;YAAE,SAAS;QAE9B,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU;YACpD,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,uBAAuB,CAAC,oBAAoB,CAAC;YAAE,SAAS;QAE5D,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,YAAY,GAAG,+DAA+D,cAAc,CAAC,MAAM,GAAG,CAAC;QAC9G,MAAM,CAAC,UAAU,GAAG,oBAAoB,CAAC;QACzC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,kDAAkD,EAAE;YAC9D,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,MAAM,CAAC,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,MAAM,aAAa,GAAc,EAAE,CAAC;IACpC,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAkBD,MAAM,UAAU,4BAA4B,CAC1C,QAAmB,EACnB,SAAqB,EACrB,QAAgB;IAEhB,MAAM,cAAc,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACvD,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAE7E,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACtF,OAAO,CAAC,GAAG,CACT,IAAI,QAAQ,sBAAsB,mBAAmB,CAAC,KAAK,CAAC,KAAK,UAAU;YACzE,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,gBAAgB,mBAAmB,CAAC,KAAK,CAAC,OAAO,UAAU,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,0BAA0B,CAC7C,mBAAmB,CAAC,QAAQ,EAC5B,YAAY,EACZ,aAAa,CACd,CAAC;IAEF,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CACT,IAAI,QAAQ,yBAAyB,YAAY,CAAC,KAAK,CAAC,KAAK,UAAU;YACrE,GAAG,YAAY,CAAC,KAAK,CAAC,cAAc,qBAAqB;YACzD,GAAG,YAAY,CAAC,KAAK,CAAC,2BAA2B,qBAAqB,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CACpC,mBAAmB,CAAC,KAAK,EACzB,mBAAmB,CAAC,cAAc,CACnC,CAAC;IAEF,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,mBAAmB,CAAC,KAAK,EACzB,mBAAmB,CAAC,cAAc,CACnC,CAAC;IAEF,OAAO;QACL,iBAAiB,EAAE,YAAY,CAAC,aAAa;QAC7C,cAAc;QACd,WAAW;QACX,iBAAiB;QACjB,kBAAkB,EAAE,mBAAmB,CAAC,KAAK;QAC7C,cAAc,EAAE,mBAAmB,CAAC,cAAc;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAmB,EACnB,YAAiC,EACjC,SAAoB;IAEpB,OAAO,0BAA0B,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC"}
+{"version":3,"file":"finding-validator.js","sourceRoot":"","sources":["../../src/report/finding-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,GAIzB,MAAM,oBAAoB,CAAC;AA2C5B;;;;GAIG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,mBAAmB,GAAa;IACpC,yBAAyB;IACzB,0BAA0B;IAC1B,mBAAmB;IACnB,uBAAuB;IACvB,qBAAqB;IACrB,0BAA0B;IAC1B,sBAAsB;IACtB,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,0BAA0B,GAAa;IAC3C,6DAA6D;IAC7D,4EAA4E;IAC5E,kEAAkE;IAClE,6DAA6D;CAC9D,CAAC;AAEF;;;;GAIG;AACH,MAAM,kBAAkB,GACtB,0TAA0T,CAAC;AAE7T;;GAEG;AACH,SAAS,uBAAuB,CAAC,UAA8B;IAC7D,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,GAAG,CACjD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAC9C,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE5C,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAmB;SACjC,MAAM,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC;SAC1E,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;SAC1B,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IAEV,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AAE9E;;;GAGG;AACH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,eAAe;IACf,OAAO;IACP,UAAU;IACV,aAAa;CACd,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,6BAA6B,GAA6B;IAC9D,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACzB,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,MAAM,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAmB,EACnB,aAAqB,EACrB,mBAAmB,GAAG,IAAI;IAE1B,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;IAE/D,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,SAAS,GAAc,EAAE,CAAC;IAEhC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,6BAA6B;QAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,mGAAmG;QACnG,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC1D,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;gBAAE,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAEnD,6EAA6E;QAC7E,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtE,MAAM,eAAe,GACnB,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxD,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,wDAAwD;QACxD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,2CAA2C;QAC3C,OAAO,CAAC,GAAG,CAAC,mDAAmD,EAAE;YAC/D,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ;YACR,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7B,iBAAiB,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC/E,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC9C,CAAC,CAAC;QAEH,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO;YACP,cAAc,EAAE,OAAO,CAAC,IAAI;gBAC1B,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;oBAC1B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,YAAY;gBAChB,CAAC,CAAC,QAAQ;YACZ,KAAK,EAAE,KAAK;YACZ,YAAY,EAAE,qCAAqC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iCAAiC;YAChH,UAAU,EAAE,yBAAyB;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAmB,EACnB,aAAsB;IAEtB,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,KAAK,EAAE,CAAC;QACR,cAAc,EAAE,CAAC;QACjB,2BAA2B,EAAE,CAAC;QAC9B,0BAA0B,EAAE,CAAC;QAC7B,kBAAkB,EAAE,CAAC;QACrB,gBAAgB,EAAE;YAChB,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;SACyB;KAC3C,CAAC;IAEF,mFAAmF;IACnF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,cAAqC,CAAC;QAE1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,cAAc,GAAG,YAAY,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC;QAEzC,OAAO,CAAC,IAAI,CAAC;YACX,OAAO;YACP,cAAc;YACd,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAE9E,uCAAuC;IACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QAE5B,yDAAyD;QACzD,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,SAAS;QAEjD,mFAAmF;QACnF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,cAAc;YAAE,SAAS;QAE9B,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU;YACpD,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,uBAAuB,CAAC,oBAAoB,CAAC;YAAE,SAAS;QAE5D,qEAAqE;QACrE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,YAAY,GAAG,+DAA+D,cAAc,CAAC,MAAM,GAAG,CAAC;QAC9G,MAAM,CAAC,UAAU,GAAG,oBAAoB,CAAC;QACzC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,kDAAkD,EAAE;YAC9D,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,MAAM,CAAC,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,oFAAoF;IACpF,gFAAgF;IAChF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QAE5B,0DAA0D;QAC1D,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,SAAS;QAEjD,MAAM,YAAY,GAAG,gBAAgB,CACnC,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CACjE,CAAC;QAEF,iDAAiD;QACjD,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,iBAAiB;YAAE,SAAS;QAEjC,kEAAkE;QAClE,IAAI,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAEpD,6DAA6D;QAC7D,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,YAAY,GAAG,2DAA2D,iBAAiB,CAAC,MAAM,2BAA2B,CAAC;QACrI,MAAM,CAAC,UAAU,GAAG,mBAAmB,CAAC;QACxC,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,oDAAoD,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,MAAM,CAAC,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,IAAI,aAAa,GAAc,EAAE,CAAC;IAClC,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,cAAc,GAAG,4BAA4B,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QAClF,aAAa,GAAG,cAAc,CAAC,SAAS,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAmB,EACnB,YAAiC,EACjC,SAAoB;IAEpB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,KAAK,EAAE,CAAC;QACR,cAAc,EAAE,CAAC;QACjB,2BAA2B,EAAE,CAAC;QAC9B,0BAA0B,EAAE,CAAC;QAC7B,kBAAkB,EAAE,CAAC;QACrB,gBAAgB,EAAE;YAChB,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;SACyB;KAC3C,CAAC;IAEF,gCAAgC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,cAAqC,CAAC;QAE1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;aAAM,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,cAAc,GAAG,YAAY,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,uDAAuD,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,cAAc,GAAG,YAAY,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC;QAEzC,OAAO,CAAC,IAAI,CAAC;YACX,OAAO;YACP,cAAc;YACd,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5E,MAAM,UAAU,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACvF,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACtB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,YAAY,GAAG,QAAQ,MAAM,CAAC,OAAO,CAAC,IAAI,0BAA0B,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjG,MAAM,CAAC,UAAU,GAAG,cAAc,CAAC;gBACnC,KAAK,CAAC,cAAc,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE;oBACjE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;oBACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;oBACzB,MAAM,EAAE,MAAM,CAAC,YAAY;iBAC5B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QAE5B,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,SAAS;QAEjD,mFAAmF;QACnF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,cAAc;YAAE,SAAS;QAE9B,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU;YACpD,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,uBAAuB,CAAC,oBAAoB,CAAC;YAAE,SAAS;QAE5D,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,YAAY,GAAG,+DAA+D,cAAc,CAAC,MAAM,GAAG,CAAC;QAC9G,MAAM,CAAC,UAAU,GAAG,oBAAoB,CAAC;QACzC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,kDAAkD,EAAE;YAC9D,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,MAAM,CAAC,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QAC5B,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,SAAS;QAEjD,MAAM,YAAY,GAAG,gBAAgB,CACnC,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CACjE,CAAC;QAEF,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,iBAAiB;YAAE,SAAS;QAEjC,IAAI,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAEpD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,YAAY,GAAG,2DAA2D,iBAAiB,CAAC,MAAM,2BAA2B,CAAC;QACrI,MAAM,CAAC,UAAU,GAAG,mBAAmB,CAAC;QACxC,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,oDAAoD,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,MAAM,CAAC,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,MAAM,aAAa,GAAc,EAAE,CAAC;IACpC,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAkBD,MAAM,UAAU,4BAA4B,CAC1C,QAAmB,EACnB,SAAqB,EACrB,QAAgB;IAEhB,MAAM,cAAc,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACvD,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAE7E,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACtF,OAAO,CAAC,GAAG,CACT,IAAI,QAAQ,sBAAsB,mBAAmB,CAAC,KAAK,CAAC,KAAK,UAAU;YACzE,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,gBAAgB,mBAAmB,CAAC,KAAK,CAAC,OAAO,UAAU,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,0BAA0B,CAC7C,mBAAmB,CAAC,QAAQ,EAC5B,YAAY,EACZ,aAAa,CACd,CAAC;IAEF,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CACT,IAAI,QAAQ,yBAAyB,YAAY,CAAC,KAAK,CAAC,KAAK,UAAU;YACrE,GAAG,YAAY,CAAC,KAAK,CAAC,cAAc,qBAAqB;YACzD,GAAG,YAAY,CAAC,KAAK,CAAC,2BAA2B,uBAAuB;YACxE,GAAG,YAAY,CAAC,KAAK,CAAC,0BAA0B,oBAAoB,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CACpC,mBAAmB,CAAC,KAAK,EACzB,mBAAmB,CAAC,cAAc,CACnC,CAAC;IAEF,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,mBAAmB,CAAC,KAAK,EACzB,mBAAmB,CAAC,cAAc,CACnC,CAAC;IAEF,OAAO;QACL,iBAAiB,EAAE,YAAY,CAAC,aAAa;QAC7C,cAAc;QACd,WAAW;QACX,iBAAiB;QACjB,kBAAkB,EAAE,mBAAmB,CAAC,KAAK;QAC7C,cAAc,EAAE,mBAAmB,CAAC,cAAc;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAmB,EACnB,YAAiC,EACjC,SAAoB;IAEpB,OAAO,0BAA0B,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC"}

package/dist/report/framework-pattern-filter.d.ts

@@ -5,7 +5,7 @@
  * using a closed, default-deny matcher table. Runs in Stage 1 validation
  * (after self-contradiction filter, before Stage 2 diff-bound validation).
  *
- * The matcher table is CLOSED: only these 5 matchers exist.
+ * The matcher table is CLOSED: only these 9 matchers exist.
  * Adding a new matcher requires a spec amendment.
  */
 import type { Finding } from '../agents/types.js';

package/dist/report/framework-pattern-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"framework-pattern-filter.d.ts","sourceRoot":"","sources":["../../src/report/framework-pattern-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAMlD,MAAM,WAAW,uBAAuB;IACtC,gCAAgC;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IACtE,0DAA0D;IAC1D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAClC;AA4ND;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,EAAE,MAAM,GAClB,sBAAsB,CAuCxB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,EAAE,CAE3E"}
+{"version":3,"file":"framework-pattern-filter.d.ts","sourceRoot":"","sources":["../../src/report/framework-pattern-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAMlD,MAAM,WAAW,uBAAuB;IACtC,gCAAgC;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IACtE,0DAA0D;IAC1D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAqnBD;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,EAAE,MAAM,GAClB,sBAAsB,CAuCxB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,EAAE,CAE3E"}

package/dist/report/framework-pattern-filter.js

@@ -5,7 +5,7 @@
  * using a closed, default-deny matcher table. Runs in Stage 1 validation
  * (after self-contradiction filter, before Stage 2 diff-bound validation).
  *
- * The matcher table is CLOSED: only these 5 matchers exist.
+ * The matcher table is CLOSED: only these 9 matchers exist.
  * Adding a new matcher requires a spec amendment.
  */
 // =============================================================================
@@ -67,14 +67,14 @@ function extractLinesNearFinding(diffSection, findingLine, windowSize = 10) {
 }
 // =============================================================================
 // Closed Matcher Table — DEFAULT DENY
-// Only these 5 matchers. No additions without spec change.
+// Only these 9 matchers. No additions without spec change.
 // =============================================================================
 const FRAMEWORK_MATCHERS = [
     // T019: Express Error Middleware
     {
         id: 'express-error-mw',
         name: 'Express Error Middleware',
-        messagePattern: /unused.*param/i,
+        messagePattern: /unused.*param|declared\s+but\s+never\s+referenced|dead\s+code.*never\s+called|parameter\s+not\s+referenced/i,
         evidenceValidator(finding, diffContent) {
             const fileSection = extractFileDiffSection(finding, diffContent);
             if (!fileSection)
@@ -134,11 +134,11 @@ const FRAMEWORK_MATCHERS = [
         },
         suppressionReason: 'Exhaustive switch with assertNever/throw — all cases handled at compile time',
     },
-    // T022: React Query Deduplication
+    // T022: React Query Advisory (dedup, error handling, data fetching concerns)
     {
         id: 'react-query-dedup',
-        name: 'React Query Dedup',
-        messagePattern: /duplicate|double.?fetch|redundant.*query|multiple.*useQuery/i,
+        name: 'React Query Advisory',
+        messagePattern: /duplicate|double.?fetch|redundant.*query|multiple.*useQuery|(?:verify|ensure|validate).*(?:endpoint|api|fetch).*(?:return|format|response|error|handle)|missing.*error.*handling.*(?:fetch|query|useQuery)|error.?handling.*(?:useQuery|useSWR)/i,
         evidenceValidator(finding, diffContent) {
             const fileSection = extractFileDiffSection(finding, diffContent);
             if (!fileSection)
@@ -159,15 +159,69 @@ const FRAMEWORK_MATCHERS = [
             if (/api\s*call|http\s*request|\bfetch\s*\(/.test(finding.message.toLowerCase())) {
                 return false;
             }
+            // Evidence 4: When the finding is about missing error handling, require BOTH:
+            //   (a) error/isError is destructured from the hook result, AND
+            //   (b) the destructured binding is used in a conditional branch on error state
+            //       (if-check, short-circuit, ternary). Property access alone (error?.message)
+            //       is NOT sufficient — logging or rendering a field without branching does
+            //       not prove the component handles the error for the user.
+            const isErrorHandlingFinding = /missing.*error|error.*handling/i.test(finding.message);
+            if (isErrorHandlingFinding) {
+                // Step (a): error/isError must appear in a destructuring pattern.
+                // Extract the actual binding name (handles aliases like { error: queryError }).
+                const errorBindings = [];
+                // Match shorthand `{ ..., error, ... }` or `{ ..., isError, ... }`
+                // and aliased `{ ..., error: NAME, ... }` or `{ ..., isError: NAME, ... }`
+                const destructuringBlock = nearbyText.match(/\{\s*([^}]*\b(?:error|isError)\b[^}]*)\}/);
+                if (!destructuringBlock?.[1])
+                    return false;
+                const blockContent = destructuringBlock[1];
+                // Check for alias pattern: `error: someAlias` or `isError: someAlias`
+                const aliasMatches = blockContent.matchAll(/\b(?:error|isError)\s*:\s*(\w+)/g);
+                for (const m of aliasMatches) {
+                    if (m[1])
+                        errorBindings.push(m[1]);
+                }
+                // Check for shorthand: `error` or `isError` without `: alias`
+                if (/\berror\b(?!\s*:)/.test(blockContent)) {
+                    errorBindings.push('error');
+                }
+                if (/\bisError\b(?!\s*:)/.test(blockContent)) {
+                    errorBindings.push('isError');
+                }
+                if (errorBindings.length === 0)
+                    return false;
+                // Step (b): At least one extracted binding must appear in a conditional branch
+                // on error state: if-check, short-circuit (&&), or ternary (?).
+                // SAFETY: bindings are from \w+ match — only [a-zA-Z0-9_], no regex special chars.
+                //
+                // Fail-open patterns (not checked, finding passes through):
+                //   - binding used only as callback argument
+                //   - binding only logged (console.log/console.error)
+                //   - property access without conditional guard (error?.message)
+                //   - nested destructuring from the binding
+                const hasErrorUsage = errorBindings.some((binding) => {
+                    // eslint-disable-next-line security/detect-non-literal-regexp
+                    const ifCheck = new RegExp('\\bif\\s*\\(\\s*' + binding + '\\b');
+                    // eslint-disable-next-line security/detect-non-literal-regexp
+                    const shortCircuit = new RegExp('\\b' + binding + '\\s*&&');
+                    // Ternary: `binding ? ... : ...` — must exclude optional chaining `binding?.`
+                    // eslint-disable-next-line security/detect-non-literal-regexp
+                    const ternary = new RegExp('\\b' + binding + '\\s*\\?(?!\\.)');
+                    return (ifCheck.test(nearbyText) || shortCircuit.test(nearbyText) || ternary.test(nearbyText));
+                });
+                if (!hasErrorUsage)
+                    return false;
+            }
             return true;
         },
-        suppressionReason: 'Query library deduplicates by cache key — not double-fetching',
+        suppressionReason: 'Query library handles caching, dedup, and error state — advisory is redundant',
     },
-    // T023: Promise.allSettled Order Preservation
+    // T023: Promise.allSettled Convention (Order + Error Handling)
     {
         id: 'promise-allsettled-order',
-        name: 'Promise.allSettled Order',
-        messagePattern: /allSettled.*(?:order|sequence)|(?:order|sequence).*allSettled|allSettled.*results.*not.*(?:match|correspond|align)/i,
+        name: 'Promise.allSettled Convention',
+        messagePattern: /allSettled.*(?:order|sequence|reject|unhandled|error.?handling|silent)|(?:order|sequence).*allSettled|(?:unhandled|missing|silent).*(?:reject|error|exception).*(?:promise|settled)|allSettled.*results.*not.*(?:match|correspond|align)|(?:additional|need).*error.*handling.*(?:promise|fetch|request|response|processing)|verify.*(?:fetch|request).*(?:error|handling|additional|response)/i,
         evidenceValidator(finding, diffContent) {
             const fileSection = extractFileDiffSection(finding, diffContent);
             if (!fileSection)
@@ -177,13 +231,302 @@ const FRAMEWORK_MATCHERS = [
             const nearbyText = nearbyLines.join('\n');
             if (!/Promise\.allSettled\s*\(/.test(nearbyText))
                 return false;
-            // Evidence 2: Result iteration (indexed or sequential access)
-            const hasResultAccess = /\.\s*forEach|\.map\s*\(|\[(\w+|\d+)\]|for\s*\(.*\s+of\s/.test(nearbyText);
-            if (!hasResultAccess)
+            // Evidence 2+3: Iteration and .status must be BOUND to the allSettled result variable.
+            // Unscoped checks (any .forEach + any .status in nearbyText) allow false suppression
+            // when unrelated iteration or HTTP .status references exist nearby.
+            // Step 2a: Extract the result variable name.
+            // Primary: `const/let/var X = await Promise.allSettled(...)`
+            const allSettledVarMatch = nearbyText.match(/\b(?:const|let|var)\s+(\w+)\s*=\s*await\s+Promise\.allSettled\s*\(/);
+            let varName = allSettledVarMatch?.[1];
+            // Fallback: `.then()` chain — `Promise.allSettled(...).then((X) => ...)` or
+            // `.then(X => ...)` or `.then(function(X) { ... })`.
+            // NOTE: This is a bounded heuristic over the ±10-line diff window, not a
+            // structurally correct parser. The lazy [\s\S]*? relies on regex backtracking
+            // to find the closing paren of allSettled(...) when nested parens are present.
+            // This is acceptable given the small window size but is not balanced-paren parsing.
+            // Fail-open patterns (not checked):
+            //   - separated await: `const p = Promise.allSettled(...); const r = await p;`
+            //   - named function reference: `.then(handleResults)`
+            //   - generator patterns
+            if (!varName) {
+                const thenMatch = nearbyText.match(/Promise\.allSettled\s*\([\s\S]*?\)\.then\s*\(\s*(?:function\s*\(\s*(\w+)|(\w+)\s*=>|\(\s*(\w+)\s*\)\s*=>)/);
+                varName = thenMatch?.[1] ?? thenMatch?.[2] ?? thenMatch?.[3];
+            }
+            if (!varName)
+                return false; // Cannot identify result variable — fail open
+            // Step 2b: Require iteration to reference the allSettled result variable.
+            // SAFETY: varName is from \w+ match — only [a-zA-Z0-9_], no regex special chars.
+            // eslint-disable-next-line security/detect-non-literal-regexp
+            const iterationPattern = new RegExp('\\b' +
+                varName +
+                '\\s*\\.\\s*forEach\\s*\\(' +
+                '|for\\s*\\([^)]*\\s+of\\s+' +
+                varName +
+                '\\b' +
+                '|\\b' +
+                varName +
+                '\\s*\\[');
+            if (!iterationPattern.test(nearbyText))
+                return false;
+            // Step 2c: .status check must appear on the iteration callback parameter,
+            // not on an unrelated variable. Extract the callback/loop variable name
+            // and require PARAM.status in nearbyText.
+            let hasStatusCheck = false;
+            // Pattern A: VARNAME.forEach((PARAM, ...) => { ... PARAM.status ... })
+            const forEachParamMatch = nearbyText.match(
+            // eslint-disable-next-line security/detect-non-literal-regexp
+            new RegExp('\\b' + varName + '\\s*\\.\\s*forEach\\s*\\(\\s*(?:\\(\\s*)?(\\w+)'));
+            if (forEachParamMatch?.[1]) {
+                const cbParam = forEachParamMatch[1];
+                // eslint-disable-next-line security/detect-non-literal-regexp
+                hasStatusCheck = new RegExp('\\b' + cbParam + '\\.status\\b').test(nearbyText);
+            }
+            // Pattern B: for (const LOOPVAR of VARNAME) { ... LOOPVAR.status ... }
+            if (!hasStatusCheck) {
+                const forOfMatch = nearbyText.match(
+                // eslint-disable-next-line security/detect-non-literal-regexp
+                new RegExp('for\\s*\\(\\s*(?:const|let|var)\\s+(\\w+)\\s+of\\s+' + varName + '\\b'));
+                if (forOfMatch?.[1]) {
+                    const loopVar = forOfMatch[1];
+                    // eslint-disable-next-line security/detect-non-literal-regexp
+                    hasStatusCheck = new RegExp('\\b' + loopVar + '\\.status\\b').test(nearbyText);
+                }
+            }
+            // Pattern C: indexed access VARNAME[i].status
+            if (!hasStatusCheck) {
+                // eslint-disable-next-line security/detect-non-literal-regexp
+                hasStatusCheck = new RegExp('\\b' + varName + '\\s*\\[\\w+\\]\\s*\\.\\s*status\\b').test(nearbyText);
+            }
+            if (!hasStatusCheck)
+                return false;
+            return true;
+        },
+        suppressionReason: 'Promise.allSettled convention — results handled per ECMAScript spec',
+    },
+    // T025: Safe Local File Read
+    {
+        id: 'safe-local-file-read',
+        name: 'Safe Local File Read',
+        messagePattern: /path.*traversal|directory.*traversal|local.*file.*read|file.*inclusion|readFileSync.*block|synchronous.*file.*read|block.*event.*loop.*(?:read|file)/i,
+        evidenceValidator(finding, diffContent) {
+            const fileSection = extractFileDiffSection(finding, diffContent);
+            if (!fileSection)
+                return false;
+            const nearbyLines = extractLinesNearFinding(fileSection, finding.line, 10);
+            // Single-line only: check each line individually (per FR-011 scope limitation)
+            const canonicalPattern = /path\.(join|resolve)\s*\(\s*(?:__dirname|__filename|import\.meta\.(?:dirname|filename|url))\s*(?:,\s*(['"])[^'"]*\2\s*)*\)/;
+            let match = null;
+            for (const line of nearbyLines) {
+                match = canonicalPattern.exec(line);
+                if (match)
+                    break;
+            }
+            if (!match)
+                return false;
+            // Extract the full matched path expression for safety checks
+            const matchedExpr = match[0];
+            // B1: Reject if any string literal segment contains '..' (path traversal)
+            const stringSegments = matchedExpr.match(/(['"])[^'"]*\1/g);
+            if (stringSegments) {
+                for (const seg of stringSegments) {
+                    const content = seg.slice(1, -1);
+                    if (content.includes('..'))
+                        return false;
+                }
+            }
+            // B2: Reject if any string literal segment starts with '/' or drive letter (absolute path)
+            if (stringSegments) {
+                for (const seg of stringSegments) {
+                    const content = seg.slice(1, -1);
+                    if (content.startsWith('/'))
+                        return false;
+                    if (/^[a-zA-Z]:/.test(content))
+                        return false;
+                }
+            }
+            // B3: Performance findings (sync I/O blocking) require module-top-level scope.
+            // Path safety only proves the read is traversal-safe, NOT that blocking I/O
+            // is acceptable. Sync reads inside functions, callbacks, or request handlers
+            // are legitimate performance concerns that must not be suppressed.
+            //
+            // Criteria: a finding is "performance-typed" if its message matches the sync-read
+            // patterns but NOT the security patterns (traversal/inclusion). For such findings:
+            //   1. The readFileSync call must be a direct module-scope declaration (const/let/var
+            //      at ≤2 leading spaces — not nested inside any function, arrow, or callback body)
+            //   2. No request-handler or event-listener context within ±10 lines
+            const isPerformanceFinding = /readFileSync.*block|synchronous.*file.*read|block.*event.*loop/i.test(finding.message) &&
+                !/path.*traversal|directory.*traversal|file.*inclusion/i.test(finding.message);
+            if (isPerformanceFinding) {
+                // Require that at least one nearby line is a module-top-level declaration
+                // (starts with at most 2 spaces of indentation followed by const/let/var/export).
+                // Lines indented ≥4 spaces are inside a function body (not top-level).
+                const hasTopLevelDecl = nearbyLines.some((l) => /^\s{0,2}(?:export\s+)?(?:const|let|var)\s+\w+\s*=/.test(l));
+                if (!hasTopLevelDecl)
+                    return false;
+                // Reject if a request-handler, middleware, or event-listener pattern appears
+                // anywhere within the ±10-line window (nearbyText).
+                const nearbyText = nearbyLines.join('\n');
+                if (/\b(?:app|router)\s*\.\s*(?:get|post|put|patch|delete|use|all)\s*\(/.test(nearbyText) ||
+                    /\.on\s*\(\s*['"]/.test(nearbyText) ||
+                    /addEventListener\s*\(/.test(nearbyText) ||
+                    /(?:req|request)\s*,\s*(?:res|response)\s*[,)]/.test(nearbyText))
+                    return false;
+            }
+            return true;
+        },
+        suppressionReason: 'Safe local file read — path.join/resolve with __dirname and string literals only',
+    },
+    // T026: Exhaustive Type-Narrowed Switch
+    {
+        id: 'exhaustive-type-narrowed-switch',
+        name: 'Exhaustive Type-Narrowed Switch',
+        messagePattern: /missing.*(?:case|default)|no.*default|add.*default|non-?exhaustive/i,
+        evidenceValidator(finding, diffContent) {
+            const fileSection = extractFileDiffSection(finding, diffContent);
+            if (!fileSection)
+                return false;
+            const nearbyLines = extractLinesNearFinding(fileSection, finding.line, 10);
+            const nearbyText = nearbyLines.join('\n');
+            // Evidence 1: switch target must be a simple identifier (not a property access).
+            // Property-access targets like switch(node.type) or switch(event.kind) cannot
+            // have their type proven from a local annotation — fail open (do not suppress).
+            const switchTargetMatch = nearbyText.match(/\bswitch\s*\((\w+)\)/);
+            if (!switchTargetMatch)
+                return false;
+            const varName = switchTargetMatch[1];
+            // Safety constraint: reject if the switch target variable is typed as string or number.
+            // A string/number-typed switch is inherently open-domain — not exhaustive.
+            // SAFETY: varName is from \w+ match — only [a-zA-Z0-9_], no regex special chars.
+            // eslint-disable-next-line security/detect-non-literal-regexp
+            const varPrimitivePattern = new RegExp('\\b' + varName + '\\s*:\\s*(?:string|number)\\b');
+            if (varPrimitivePattern.test(nearbyText))
+                return false;
+            // Evidence 2: the switch variable must have a named type annotation (PascalCase),
+            // and that exact named type must be declared as a string-literal union in the
+            // visible diff/file section. Inferred types (no annotation) and imported types
+            // (not defined in the diff) MUST NOT trigger suppression — fail open.
+            //
+            // Step 2a: extract the type name from the variable's annotation in ±10 lines.
+            // e.g., `function f(theme: Theme)` → typeName = 'Theme'
+            // SAFETY: varName is from \w+ match — only [a-zA-Z0-9_], no regex special chars.
+            // eslint-disable-next-line security/detect-non-literal-regexp
+            const varTypePattern = new RegExp('\\b' + varName + '\\s*:\\s*([A-Z][\\w]*)');
+            const typeNameMatch = nearbyText.match(varTypePattern);
+            if (!typeNameMatch?.[1])
+                return false; // no visible annotation → cannot prove union
+            const typeName = typeNameMatch[1];
+            // Step 2b: verify that typeName is defined as a string-literal union in the file
+            // diff section. Only string-literal unions declared in the visible diff count.
+            // e.g., `type Theme = 'light' | 'dark'`
+            // SAFETY: typeName is from [A-Z][\w]* match — only [a-zA-Z0-9_], no regex special chars.
+            // eslint-disable-next-line security/detect-non-literal-regexp
+            const unionDeclarationPattern = new RegExp('\\btype\\s+' + typeName + '\\s*=\\s*((?:[\'"][^\'"]+[\'"]\\s*\\|?\\s*)+)');
+            const unionMatch = fileSection.match(unionDeclarationPattern);
+            if (!unionMatch?.[1])
+                return false;
+            // Step 2c: verify every union member VALUE has a corresponding case branch.
+            // Uses set-membership (not count comparison) to prevent duplicate case values
+            // from inflating the count. e.g., case 'light', case 'light' = 1 unique value,
+            // not 2 — so a 3-member union with a duplicate case is correctly rejected.
+            const unionMemberQuoted = unionMatch[1].match(/['"][^'"]+['"]/g) ?? [];
+            if (unionMemberQuoted.length === 0)
+                return false;
+            // Extract raw string values (without quotes) from union members
+            const unionMemberValues = unionMemberQuoted.map((m) => m.slice(1, -1));
+            // Extract raw string values from case branches (deduplicated via Set)
+            const caseBranchMatches = nearbyText.match(/\bcase\s+['"]([^'"]+)['"]\s*:/g) ?? [];
+            const caseValues = new Set(caseBranchMatches.map((m) => {
+                const val = m.match(/['"]([^'"]+)['"]/);
+                return val?.[1] ?? '';
+            }));
+            // Every union member must have a matching case branch (set membership)
+            const allMembersCovered = unionMemberValues.every((member) => caseValues.has(member));
+            if (!allMembersCovered)
+                return false;
+            return true;
+        },
+        suppressionReason: 'Exhaustive type-narrowed switch — union type with all members covered',
+    },
+    // Convention 18: Error Object XSS
+    {
+        id: 'error-object-xss',
+        name: 'Error Object XSS',
+        messagePattern: /(?:xss|inject).*(?:error|err)\b.*(?:message|\.message)|(?:error|err)\b.*(?:message|\.message).*(?:xss|inject|innerHTML|template)|(?:xss|inject).*error.*(?:directly|message)|error\s+message.*(?:xss|inject|innerHTML)/i,
+        evidenceValidator(finding, diffContent) {
+            const fileSection = extractFileDiffSection(finding, diffContent);
+            if (!fileSection)
+                return false;
+            const nearbyLines = extractLinesNearFinding(fileSection, finding.line, 10);
+            const nearbyText = nearbyLines.join('\n');
+            // MANDATORY: catch clause visible (structural proof of error origin)
+            // No naming heuristics, no function-name matching (security-engineer mandate)
+            if (!/\bcatch\s*\(\s*\w+/.test(nearbyText))
+                return false;
+            // MANDATORY: error.message usage visible (the flagged construct)
+            if (!/\.\s*message\b/.test(nearbyText))
+                return false;
+            // REJECT: error constructed from user input or external API data.
+            // Errors built from req.body, query params, or external input can contain
+            // attacker-controlled data — suppression would hide real XSS.
+            if (/new\s+(?:\w+)?Error\s*\(\s*(?:req\.|request\.|body\.|params\.|query\.|input\.|data\.|payload\.)/.test(nearbyText))
+                return false;
+            // REJECT: direct DOM manipulation (browser-side sinks)
+            if (/\.innerHTML\s*=|\.outerHTML\s*=|document\.write\s*\(|insertAdjacentHTML\s*\(/.test(nearbyText))
+                return false;
+            // REJECT: React dangerouslySetInnerHTML (always renders raw HTML)
+            if (/dangerouslySetInnerHTML/.test(nearbyText))
+                return false;
+            // REJECT: server-side HTTP response sinks that render error.message as HTML.
+            // Only triggers when BOTH a response output call AND .message appear within
+            // the same ±10-line window (nearbyText), proving the error data flows into
+            // the response. Plain-text responses (res.send(err.message) without HTML
+            // markup) are excluded by requiring an HTML indicator (< or template literal).
+            if (/\bres\s*\.\s*(?:send|write|end)\s*\(/.test(nearbyText)) {
+                // Check for HTML evidence: template literal with tags, or string with '<'
+                const hasHtmlInResponse = /\bres\s*\.\s*(?:send|write|end)\s*\(\s*`[^`]*</.test(nearbyText) ||
+                    /\bres\s*\.\s*(?:send|write|end)\s*\([^)]*['"][^'"]*</.test(nearbyText) ||
+                    /\bres\s*\.\s*(?:send|write|end)\s*\([^)]*\+[^)]*['"]?\s*</.test(nearbyText);
+                if (hasHtmlInResponse)
+                    return false;
+            }
+            // REJECT: template engine render calls (always produce HTML output)
+            if (/\bres\s*\.\s*render\s*\(/.test(nearbyText) ||
+                /\b(?:ejs|pug|handlebars|hbs|nunjucks|mustache)\s*[.(]/.test(nearbyText))
+                return false;
+            return true;
+        },
+        suppressionReason: 'Error from catch clause — error.message is runtime exception, not user input',
+    },
+    // Convention 19: Thin Wrapper Stdlib
+    {
+        id: 'thin-wrapper-stdlib',
+        name: 'Thin Wrapper Stdlib',
+        messagePattern: /(?:missing|add|no).*try.?catch|(?:could|may|might).*throw|unhandled.*(?:error|exception).*(?:JSON\.parse|parseInt|parseFloat|new\s+URL|Buffer\.from|decodeURI)|directly.*(?:return|call).*(?:JSON\.parse|parseInt|parseFloat)/i,
+        evidenceValidator(finding, diffContent) {
+            const fileSection = extractFileDiffSection(finding, diffContent);
+            if (!fileSection)
+                return false;
+            const nearbyLines = extractLinesNearFinding(fileSection, finding.line, 5);
+            const nearbyText = nearbyLines.join('\n');
+            // Evidence 1: WHITELISTED stdlib call present (no open patterns)
+            const SAFE_STDLIB = /\b(?:JSON\.parse|JSON\.stringify|parseInt|parseFloat|Number\(|new\s+URL|Buffer\.from|decodeURIComponent|decodeURI|atob|btoa)\s*\(/;
+            if (!SAFE_STDLIB.test(nearbyText))
+                return false;
+            // Evidence 2: thin wrapper structure (return + stdlib)
+            if (!/\breturn\s+/.test(nearbyText))
+                return false;
+            // REJECT: I/O operations (not pure stdlib delegation)
+            if (/\b(?:fs\.|fetch\s*\(|await\s|\.readFile|\.writeFile|database|\.query\s*\()/.test(nearbyText))
+                return false;
+            // REJECT: conditional logic (not a thin wrapper)
+            if (/\b(?:if\s*\(|else\b|switch\s*\()/.test(nearbyText))
+                return false;
+            // REJECT: request handler context (caller responsibility matters here)
+            if (/\b(?:req\.|request\.|res\.|response\.|app\.\w+\(|router\.\w+\()/.test(nearbyText))
                 return false;
             return true;
         },
-        suppressionReason: 'Promise.allSettled preserves input order per ECMAScript spec',
+        suppressionReason: 'Thin wrapper around stdlib function — try-catch is caller responsibility',
     },
 ];
 // =============================================================================