@runhalo/engine 0.5.0 → 0.6.0

package/dist/index.js

@@ -45,11 +45,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SCAFFOLD_REGISTRY = exports.detectFramework = exports.ScaffoldEngine = exports.ComplianceScoreEngine = exports.transformSetDefault = exports.transformSanitizeInput = exports.transformRemoveDefault = exports.transformUrlUpgrade = exports.FixEngine = exports.REMEDIATION_MAP = exports.HaloEngine = exports.AU_SBD_RULES = exports.AI_AUDIT_RULES = exports.ETHICAL_RULES = exports.COPPA_RULES = exports.treeSitterParser = exports.TreeSitterParser = void 0;
+exports.classifyFile = classifyFile;
 exports.loadRulesFromYAML = loadRulesFromYAML;
 exports.loadRulesFromJSON = loadRulesFromJSON;
 exports.loadRulesFromJSONByPack = loadRulesFromJSONByPack;
 exports.compileRawRules = compileRawRules;
 exports.parseHaloignore = parseHaloignore;
+exports.isVendorPath = isVendorPath;
+exports.isDocGeneratorPath = isDocGeneratorPath;
 exports.shouldIgnoreFile = shouldIgnoreFile;
 exports.shouldIgnoreViolation = shouldIgnoreViolation;
 exports.getRemediation = getRemediation;
@@ -78,6 +81,12 @@ function extractCategory(ruleId) {
         return 'ai-risk';
     if (ruleId.startsWith('AI-TRANSPARENCY'))
         return 'ai-transparency';
+    if (ruleId.startsWith('AI-GOVERNANCE'))
+        return 'ai-governance';
+    if (ruleId.startsWith('AI-OVERSIGHT'))
+        return 'ai-oversight';
+    if (ruleId.startsWith('AI-ACCURACY'))
+        return 'ai-accuracy';
     if (ruleId.startsWith('CAI-'))
         return 'constitutional-ai';
     const match = ruleId.match(/^coppa-(\w+)-\d+$/);
@@ -96,6 +105,140 @@ function detectLanguage(filePath) {
     };
     return langMap[ext] || 'unknown';
 }
+/**
+ * Sprint 13a: Classify a file using deterministic heuristics.
+ * Returns a FileClassification object that the scan loop uses to skip
+ * files or suppress specific rules.
+ *
+ * @param filePath — normalized file path (forward slashes)
+ * @param contentPrefix — first 3000 chars of file content (for decorator/annotation detection)
+ */
+function classifyFile(filePath, contentPrefix = '') {
+    const normalized = filePath.replace(/\\/g, '/');
+    const language = detectLanguage(filePath);
+    const isVendorResult = isVendorPath(filePath);
+    const isDocGeneratorResult = isDocGeneratorPath(filePath);
+    // Test/spec/fixture detection (Sprint 8 + 11a, consolidated)
+    const isTest = /\.(test|spec)\.(ts|tsx|js|jsx|py|rb|java|go)$/i.test(normalized) ||
+        /(^|\/)__tests__\//.test(normalized) ||
+        /(^|\/)test\//.test(normalized) ||
+        /(^|\/)tests\//.test(normalized) ||
+        /(^|\/)spec\//.test(normalized) ||
+        /(^|\/)fixtures\//.test(normalized) ||
+        /\.(stories|story)\.(ts|tsx|js|jsx)$/i.test(normalized) ||
+        /(^|\/)cypress\//.test(normalized) ||
+        /(^|\/)e2e\//.test(normalized) ||
+        /jest\.config|vitest\.config|playwright\.config/i.test(normalized) ||
+        // Sprint 11a: Test environment configs
+        /(^|\/)envs\/test[^/]*\.(py|json|ya?ml|toml|cfg|ini)$/i.test(normalized) ||
+        /(^|\/)config\/test[^/]*\.(py|json|ya?ml|toml|cfg|ini|js|ts)$/i.test(normalized) ||
+        /(^|\/)settings\/test[^/]*\.(py|json|ya?ml|toml)$/i.test(normalized) ||
+        /(^|\/)conftest\.py$/i.test(normalized);
+    // Consent/privacy implementation files (Sprint 10b)
+    const CONSENT_PATH_PATTERNS = /(?:^|\/)(?:consent|cookie[_-]?(?:consent|banner|preferences|notice|policy)|privacy[_-]?(?:policy|notice|banner|settings)|gdpr|ccpa|compliance|data[_-]?(?:deletion|removal|protection))\b/i;
+    const isConsent = CONSENT_PATH_PATTERNS.test(normalized);
+    // Admin/instructor/staff backend paths (Sprint 11a, updated Sprint 13b)
+    // Matches admin directories AND admin.py/admin.rb files (Django/Rails admin registration modules)
+    const ADMIN_PATH_PATTERNS = /(?:^|\/)(?:admin|instructor|teacher|staff|management|backoffice|dashboard\/admin|cms|moderator|superuser)(?:\/|\.py|\.rb|\.php|$)/i;
+    const isAdmin = ADMIN_PATH_PATTERNS.test(normalized) ||
+        /(?:@staff_member_required|@permission_required|@user_passes_test|@login_required.*staff|@admin_required|is_staff|is_superuser)/i.test(contentPrefix);
+    // === Sprint 13a: New heuristic patterns ===
+    // Django migrations — auto-generated schema changes, no user-facing code
+    const isDjangoMigration = /(^|\/)migrations\/\d{4}_[a-zA-Z0-9_]+\.py$/i.test(normalized) ||
+        /(^|\/)migrations\/__init__\.py$/i.test(normalized);
+    // Rails fixture and seed files — test data, not production behavior
+    const isFixtureOrSeed = /(^|\/)fixtures\/[^/]+\.(ya?ml|json|csv)$/i.test(normalized) ||
+        /(^|\/)seeds?\//i.test(normalized) ||
+        /(^|\/)db\/seeds/i.test(normalized) ||
+        /(^|\/)factories?\//i.test(normalized) ||
+        /(^|\/)factory\.(ts|js|py|rb)$/i.test(normalized);
+    // Mock/factory files — test infrastructure
+    const isMockOrFactory = /(?:^|\/)(?:__mocks__|mocks?|fakes?|stubs?)(?:\/|$)/i.test(normalized) ||
+        /\.mock\.(ts|tsx|js|jsx|py)$/i.test(normalized) ||
+        /\.fake\.(ts|tsx|js|jsx|py)$/i.test(normalized) ||
+        /(?:^|\/)(?:mock|fake|stub)[_-]?\w+\.(ts|tsx|js|jsx|py)$/i.test(normalized) ||
+        /(?:^|\/)(?:\w+)?[_-](?:mock|fake|stub)\.(ts|tsx|js|jsx|py)$/i.test(normalized);
+    // CI/CD configuration files — pipeline definitions, not application code
+    const isCIConfig = /(^|\/)\.github\/workflows\//i.test(normalized) ||
+        /(^|\/)\.github\/actions\//i.test(normalized) ||
+        /(^|\/)\.circleci\//i.test(normalized) ||
+        /(^|\/)\.gitlab-ci/i.test(normalized) ||
+        /(^|\/)Jenkinsfile$/i.test(normalized) ||
+        /(^|\/)\.travis\.yml$/i.test(normalized) ||
+        /(^|\/)azure-pipelines/i.test(normalized) ||
+        /(^|\/)bitbucket-pipelines/i.test(normalized) ||
+        /(^|\/)\.buildkite\//i.test(normalized) ||
+        /(^|\/)Dockerfile$/i.test(normalized) ||
+        /(^|\/)docker-compose/i.test(normalized);
+    // Build output directories — generated code, not source
+    const isBuildOutput = /(^|\/)dist\//i.test(normalized) ||
+        /(^|\/)build\/(?!src)/i.test(normalized) || // build/ but not build/src/
+        /(^|\/)\.next\//i.test(normalized) ||
+        /(^|\/)\.nuxt\//i.test(normalized) ||
+        /(^|\/)\.svelte-kit\//i.test(normalized) ||
+        /(^|\/)out\//i.test(normalized) ||
+        /(^|\/)\.output\//i.test(normalized) ||
+        /(^|\/)coverage\//i.test(normalized) ||
+        /(^|\/)\.cache\//i.test(normalized) ||
+        /(^|\/)\.parcel-cache\//i.test(normalized) ||
+        /(^|\/)\.turbo\//i.test(normalized);
+    // Type definition files — no runtime behavior, only type annotations
+    const isTypeDefinition = /\.d\.ts$/i.test(normalized) ||
+        /\.pyi$/i.test(normalized) ||
+        /(^|\/)@types\//i.test(normalized);
+    // Storybook stories — UI component demos, not production code
+    const isStorybook = /\.(stories|story)\.(ts|tsx|js|jsx|mdx)$/i.test(normalized) ||
+        /(^|\/)\.storybook\//i.test(normalized);
+    // Determine if file should be completely skipped
+    // (vendor and doc generator are already handled at file-discovery level,
+    //  but including here for completeness in the classification)
+    let shouldSkip = false;
+    let skipReason;
+    if (isVendorResult) {
+        shouldSkip = true;
+        skipReason = 'vendor-library';
+    }
+    else if (isDocGeneratorResult) {
+        shouldSkip = true;
+        skipReason = 'doc-generator';
+    }
+    else if (isDjangoMigration) {
+        shouldSkip = true;
+        skipReason = 'django-migration';
+    }
+    else if (isBuildOutput) {
+        shouldSkip = true;
+        skipReason = 'build-output';
+    }
+    else if (isTypeDefinition) {
+        shouldSkip = true;
+        skipReason = 'type-definition';
+    }
+    else if (isCIConfig) {
+        shouldSkip = true;
+        skipReason = 'ci-config';
+    }
+    // Note: test, consent, admin, mock, fixture, storybook files are NOT fully skipped
+    // They get per-rule suppression instead (some rules ARE valid in these files)
+    return {
+        method: 'heuristic',
+        language,
+        isVendor: isVendorResult,
+        isTest,
+        isConsent,
+        isAdmin,
+        isDocGenerator: isDocGeneratorResult,
+        isDjangoMigration,
+        isFixtureOrSeed,
+        isMockOrFactory,
+        isCIConfig,
+        isBuildOutput,
+        isTypeDefinition,
+        isStorybook,
+        shouldSkip,
+        skipReason,
+    };
+}
 // YAML Rule Loader - Load rules from coppa-tier-1.yaml
 function loadRulesFromYAML(yamlPath) {
     try {
@@ -378,7 +521,7 @@ exports.COPPA_RULES = [
             /LoginManager\.getInstance\s*\(\s*\)\s*\.logIn/gi
         ],
         fixSuggestion: 'Wrap the auth call in a conditional check for user.age >= 13 or use signInWithParentEmail() for children',
-        penalty: '$51,744 per violation',
+        penalty: '$53,088 per violation',
         languages: ['typescript', 'javascript', 'python', 'go', 'java', 'kotlin', 'swift']
     },
     {
@@ -390,11 +533,19 @@ exports.COPPA_RULES = [
             /(\?|&)(email|first_?name|last_?name|dob|phone|birthdate)=/gi,
             /axios\.get\s*\(\s*[`'"]https?:\/\/[^\s]*\?[^`'"]*\$\{/gi,
             /fetch\s*\(\s*[`'"]https?:\/\/[^\s]*\?[^`'"]*\$\{/gi,
-            /\?[^'"`\s]*\$\{[^}]*(?:\.email|\.firstName|\.lastName|\.dob|\.phone)[^}]*\}/gi
+            /\?[^'"`\s]*\$\{[^}]*(?:\.email|\.firstName|\.lastName|\.dob|\.phone)[^}]*\}/gi,
+            // Python — requests.get with PII query params
+            /requests\.get\s*\([^)]*params\s*=\s*\{[^}]*(?:email|name|phone|dob|birthdate)/gi,
+            // Python — Django/Flask redirect with PII in URL
+            /(?:redirect|HttpResponseRedirect)\s*\([^)]*\?[^)]*(?:email|name|phone)/gi,
+            // PHP — PII in $_GET superglobal
+            /\$_GET\s*\[\s*['"](?:email|first_?name|last_?name|dob|phone|birthdate)['"]\s*\]/gi,
+            // Ruby — params[] with PII in GET context
+            /request\.query_parameters\s*\[\s*:(?:email|name|phone|dob|birthdate)\s*\]/gi
         ],
         fixSuggestion: 'Switch to POST method and move PII to request body',
-        penalty: '$51,744 per violation',
-        languages: ['typescript', 'javascript', 'python', 'java', 'swift']
+        penalty: '$53,088 per violation',
+        languages: ['typescript', 'javascript', 'python', 'java', 'swift', 'php', 'ruby']
     },
     {
         id: 'coppa-tracking-003',
@@ -406,11 +557,23 @@ exports.COPPA_RULES = [
             /ga\s*\(\s*['"]create['"]/gi,
             /adsbygoogle/gi,
             /gtag\s*\(\s*['"]config['"]/gi,
-            /google-analytics\.com\/analytics\.js/gi
+            /google-analytics\.com\/analytics\.js/gi,
+            // Python — Google Analytics measurement protocol
+            /(?:import|from)\s+(?:google\.analytics|pyga|universal_analytics)/gi,
+            // Python — Facebook pixel server-side
+            /FacebookAdsApi\.init|facebook_business\.adobjects/gi,
+            // PHP — Google Analytics server-side
+            /(?:TheIconic\\Tracking|Rize\\UriTemplate).*(?:Analytics|Measurement)/gi,
+            // PHP — wp_enqueue_script with GA/FB pixel
+            /wp_enqueue_script\s*\([^)]*(?:google-analytics|gtag|fbq|facebook-pixel)/gi,
+            // Ruby — Google Analytics gems
+            /(?:require|gem)\s+['"](?:staccato|google-analytics-rails|gabba)['"]/gi,
+            // Java/Kotlin — Firebase Analytics initialization
+            /FirebaseAnalytics\.getInstance\s*\(/gi
         ],
         fixSuggestion: 'Add "child_directed_treatment": true or "restrictDataProcessing": true to SDK initialization',
-        penalty: '$51,744 per violation',
-        languages: ['typescript', 'javascript', 'html']
+        penalty: '$53,088 per violation',
+        languages: ['typescript', 'javascript', 'html', 'python', 'php', 'ruby', 'java', 'kotlin']
     },
     {
         id: 'coppa-geo-004',
@@ -437,17 +600,24 @@ exports.COPPA_RULES = [
             // Python — geopy geolocators
             /(?:Nominatim|GoogleV3|Bing)\s*\([^)]*\)\s*\.(?:geocode|reverse)/gi,
             // Android manifest — fine location permission
-            /android\.permission\.ACCESS_FINE_LOCATION/gi
+            /android\.permission\.ACCESS_FINE_LOCATION/gi,
+            // PHP — geolocation APIs
+            /(?:geoip_record_by_name|geoip_country_code_by_name|maxmind)\s*\(/gi,
+            // PHP — WordPress geolocation
+            /WC_Geolocation::geolocate_ip|wp_geolocate/gi,
+            // Ruby — Geocoder gem
+            /Geocoder\.search\s*\(|geocode_by\s+:/gi,
+            /reverse_geocoded_by\s+:/gi
         ],
         fixSuggestion: 'Downgrade accuracy to kCLLocationAccuracyThreeKilometers or require parental consent',
-        penalty: '$51,744 per violation',
-        languages: ['typescript', 'javascript', 'swift', 'kotlin', 'java', 'python', 'xml']
+        penalty: '$53,088 per violation',
+        languages: ['typescript', 'javascript', 'swift', 'kotlin', 'java', 'python', 'xml', 'php', 'ruby']
     },
     {
         id: 'coppa-retention-005',
         name: 'Missing Data Retention Policy',
         severity: 'medium',
-        description: 'User schemas must have deleted_at, expiration_date, or TTL index for data retention',
+        description: 'COPPA 2025 explicitly prohibits indefinite retention of children\'s PI. Operators must retain data only as long as reasonably necessary for the purpose collected. Schemas with PII fields must define retention periods, deletion mechanisms, and purpose limitation.',
         patterns: [
             // JS/TS — Mongoose schemas
             /new\s+Schema\s*\(\s*\{[^{}]*\}/gi,
@@ -460,11 +630,17 @@ exports.COPPA_RULES = [
             // Java/Kotlin — JPA @Entity on user-related classes
             /@Entity[\s\S]*?class\s+(?:User|Child|Student|Profile|Account|Member)/gi,
             // Kotlin — data class for user models
-            /data\s+class\s+(?:User|Child|Student|Profile|Account|Member)\w*\s*\(/gi
+            /data\s+class\s+(?:User|Child|Student|Profile|Account|Member)\w*\s*\(/gi,
+            // PHP — Laravel/WordPress user models
+            /class\s+(?:User|Child|Student|Profile|Account|Member)\w*\s+extends\s+(?:Model|Authenticatable|WP_User)/gi,
+            // Ruby — ActiveRecord user models
+            /class\s+(?:User|Child|Student|Profile|Account|Member)\w*\s*<\s*(?:ApplicationRecord|ActiveRecord::Base)/gi,
+            // Android — SharedPreferences/Editor storing user PII
+            /(?:putString|putInt|putBoolean)\s*\(\s*['"](?:user_?(?:name|email|id|phone)|child_?(?:name|email|id|dob)|student_?(?:name|email|id)|email|phone|dob|birthdate)['"]/gi
         ],
-        fixSuggestion: 'Add deleted_at column, expiration_date field, or TTL index to database schema',
-        penalty: 'Regulatory audit failure',
-        languages: ['typescript', 'javascript', 'python', 'go', 'java', 'kotlin', 'sql']
+        fixSuggestion: 'Add explicit retention period (retentionDays, expiresAt, or TTL index), deleted_at column, and document the purpose limitation for data collection per COPPA 2025 § 312.10',
+        penalty: '$53,088 per violation (COPPA 2025 indefinite retention prohibition)',
+        languages: ['typescript', 'javascript', 'python', 'go', 'java', 'kotlin', 'sql', 'php', 'ruby']
     },
     // ========== Rules 6-20 (Sprint 2) ==========
     // Rule 6: Unencrypted PII Transmission
@@ -478,11 +654,18 @@ exports.COPPA_RULES = [
             /http:\/\/localhost:[^\s]*(\/api\/)/gi,
             /axios\.get\s*\(\s*['"]http:\/\//gi,
             /fetch\s*\(\s*['"]http:\/\//gi,
-            /http:\/\/[^\s]*email[^\s]*/gi
+            /http:\/\/[^\s]*email[^\s]*/gi,
+            // Python — requests/urllib with HTTP
+            /requests\.(?:get|post)\s*\(\s*['"]http:\/\/(?!localhost)/gi,
+            /urllib\.request\.urlopen\s*\(\s*['"]http:\/\/(?!localhost)/gi,
+            // PHP — HTTP API calls
+            /(?:curl_setopt|file_get_contents|wp_remote_get)\s*\([^)]*['"]http:\/\/(?!localhost)/gi,
+            // Ruby — HTTP requests
+            /(?:Net::HTTP|HTTParty|Faraday)\.(?:get|post)\s*\([^)]*['"]http:\/\/(?!localhost)/gi
         ],
         fixSuggestion: 'Replace http:// with https:// for all API endpoints and resources',
         penalty: 'Security breach liability + COPPA penalties',
-        languages: ['typescript', 'javascript', 'python', 'java', 'swift']
+        languages: ['typescript', 'javascript', 'python', 'java', 'swift', 'php', 'ruby']
     },
     // Rule 7: Passive Audio Recording
     // Fixed Sprint 4: Skip audio:false, skip AudioContext (playback only), skip import-only
@@ -498,11 +681,18 @@ exports.COPPA_RULES = [
             /AVAudioSession\s*\.\s*sharedInstance/gi,
             /AVAudioRecorder\s*\(/gi,
             /new\s+AudioRecord\s*\(/gi,
-            /new\s+MediaRecorder\s*\(/gi
+            /new\s+MediaRecorder\s*\(/gi,
+            // Python — audio recording libraries
+            /(?:import|from)\s+(?:pyaudio|sounddevice|speech_recognition)/gi,
+            /sounddevice\.rec\s*\(/gi,
+            /Recognizer\(\)\.listen/gi,
+            // Java/Kotlin — Android AudioRecord
+            /AudioRecord\.Builder\s*\(\s*\)/gi,
+            /MediaRecorder\s*\(\s*\)\s*\.setAudioSource/gi
         ],
         fixSuggestion: 'Wrap audio recording in click handler and add parental consent check',
-        penalty: '$51,744 per violation',
-        languages: ['typescript', 'javascript', 'swift', 'kotlin']
+        penalty: '$53,088 per violation',
+        languages: ['typescript', 'javascript', 'swift', 'kotlin', 'python', 'java']
     },
     // Rule 8: Missing Privacy Policy Link
     // Fixed Sprint 4: Only flag forms with registration-related fields (email, password, name, DOB)
@@ -519,11 +709,17 @@ exports.COPPA_RULES = [
             // kebab-case / snake_case: sign-up-form, register_form, create-account-form
             /\b(?:sign[-_]?up|register|registration|create[-_]?account)[-_]form\b/gi,
             // HTML form elements with registration-related ids/classes
-            /<form[^>]*(?:id|class|name)\s*=\s*["'][^"']*(?:register|signup|sign[-_]up|create[-_]account)[^"']*["']/gi
+            /<form[^>]*(?:id|class|name)\s*=\s*["'][^"']*(?:register|signup|sign[-_]up|create[-_]account)[^"']*["']/gi,
+            // Python — Django/Flask registration form classes
+            /class\s+(?:SignUp|Register|Registration|CreateAccount)Form\s*\(\s*(?:forms\.Form|ModelForm|FlaskForm)/gi,
+            // Ruby — Rails registration routes/controllers
+            /def\s+(?:sign_up|register|create_account)\b/gi,
+            // PHP — WordPress registration hooks
+            /(?:register_new_user|wp_create_user|user_register)\s*\(/gi
         ],
         fixSuggestion: 'Add <a href="/privacy">Privacy Policy</a> link to registration form footer',
         penalty: 'Compliance failure',
-        languages: ['typescript', 'javascript', 'html', 'tsx', 'jsx', 'php']
+        languages: ['typescript', 'javascript', 'html', 'tsx', 'jsx', 'php', 'python', 'ruby']
     },
     // Rule 9: Contact Info Collection Without Parent Email
     {
@@ -533,15 +729,24 @@ exports.COPPA_RULES = [
         description: 'Forms collecting child email/phone must also require parent email for consent verification',
         patterns: [
             /(child_email|student_email)\s*:\s*String/gi,
-            /(child_email|student_email|kid_email)\s*=/gi
+            /(child_email|student_email|kid_email)\s*=/gi,
+            // Python — Django model field for child contact
+            /(?:child_email|student_email|kid_email)\s*=\s*models\.(?:EmailField|CharField)/gi,
+            // PHP — child email in form processing
+            /\$(?:child_email|student_email|kid_email)\s*=\s*\$_(?:POST|GET|REQUEST)/gi,
+            // Ruby — child contact in params or model
+            /(?:child_email|student_email|kid_email)\s*=\s*params\[/gi,
+            // Java/Kotlin — child email field
+            /(?:private|var|val)\s+\w*\s*(?:childEmail|studentEmail|kidEmail)/gi
         ],
         fixSuggestion: 'Make parent_email required when collecting child contact information',
-        penalty: '$51,744 per violation',
-        languages: ['typescript', 'javascript', 'python']
+        penalty: '$53,088 per violation',
+        languages: ['typescript', 'javascript', 'python', 'php', 'ruby', 'java', 'kotlin']
     },
     // Rule 10: Insecure Default Passwords
     {
         id: 'coppa-sec-010',
+        is_active: false, // Sprint 16 W1: 100% FP (0/3 TP) — all hits are test fixture passwords, not production defaults
         name: 'Weak Default Student Passwords',
         severity: 'medium',
         description: 'Default passwords like "password", "123456", or "changeme" create security vulnerabilities',
@@ -570,50 +775,79 @@ exports.COPPA_RULES = [
             /Freshdesk|FreshChat/gi
         ],
         fixSuggestion: 'Disable chat widget for unauthenticated or under-13 users via conditional rendering',
-        penalty: '$51,744 per violation',
+        penalty: '$53,088 per violation',
         languages: ['typescript', 'javascript', 'html']
     },
     // Rule 12: Biometric Data Collection
+    // Sprint 15: DISABLED — 0% TP precision (46 entries, ALL false positives).
+    // Pattern matches generic terms (FaceID, TouchID, FaceDetector) without
+    // distinguishing real biometric capture from SDK type definitions, AWS API
+    // schemas, and vendor library code. Rebuild requires AST-level context.
     {
         id: 'coppa-bio-012',
         name: 'Biometric Data Collection',
         severity: 'critical',
-        description: 'Face recognition, voice prints, or gait analysis requires explicit parental consent. COPPA 2.0 explicitly classifies biometrics as PI.',
+        is_active: false,
+        description: 'COPPA 2025 explicitly adds biometric identifiers to the definition of PI. Face recognition, voice prints, gait analysis, behavioral biometrics (keystroke dynamics, mouse movement patterns), iris/pupil scanning, and health biometric APIs all require verifiable parental consent.',
         patterns: [
             /(?:import\s+.*from\s+['"]face-api\.js['"]|require\s*\(\s*['"]face-api\.js['"]\s*\))/gi,
             /LocalAuthentication.*evaluatePolicy/gi,
-            /FaceID|TouchID/gi,
-            /biometricAuth|BiometricAuth/g,
-            /voicePrint|VoicePrint/g,
-            /livenessCheck|LivenessCheck/g,
-            /FaceMatcher|FaceDetector|FaceRecognizer/g
+            /(?:biometricAuth|BiometricAuth|biometricPrompt|BiometricPrompt)/g,
+            /voicePrint|VoicePrint|voiceRecognition|VoiceRecognition|speakerVerification/g,
+            /livenessCheck|LivenessCheck|livenessDetection/g,
+            /FaceMatcher|FaceDetector|FaceRecognizer|FaceLandmarks/g,
+            // Behavioral biometrics (COPPA 2025 expansion)
+            /keystrokeDynamic|keystrokePattern|typingBiometric|keyPressAnalysis/g,
+            /gaitAnalysis|gaitDetect|gaitRecognition|motionBiometric/g,
+            /mouseMovementPattern|cursorTracking|behavioralBiometric/g,
+            /irisScann?|pupilDetect|eyeTracking|gazeTracking/gi,
+            // Health biometric APIs
+            /(?:HKHealthStore|HKQuantityType|HealthKit).*(?:heartRate|stepCount|workout|sleep)/gi,
+            /(?:GoogleFit|FitnessOptions|HistoryClient).*(?:heartRate|steps|calories|sleep)/gi,
+            // Face detection libraries
+            /(?:import|require).*(?:face-api|@mediapipe\/face|@tensorflow\/tfjs-models\/face|deepface|insightface)/gi
         ],
-        fixSuggestion: 'Ensure biometric data remains local-only (on-device) or obtain verifiable parental consent',
-        penalty: '$51,744 per violation',
-        languages: ['typescript', 'javascript', 'swift', 'kotlin']
+        fixSuggestion: 'Ensure biometric data remains local-only (on-device) or obtain verifiable parental consent per COPPA 2025. Do not transmit biometric identifiers to servers without separate parental consent.',
+        penalty: '$53,088 per violation',
+        languages: ['typescript', 'javascript', 'swift', 'kotlin', 'python', 'java']
     },
     // Rule 13: Push Notifications to Children
+    // Rebuilt Sprint 18: removed generic Notification constructor & requestPermission (94.4% FP).
+    // Now targets push subscription/registration APIs only.
     {
         id: 'coppa-notif-013',
         name: 'Direct Push Notifications Without Consent',
-        severity: 'medium',
-        description: 'Push notifications are "Online Contact Info" under COPPA 2.0. Direct notifications to children require parental consent.',
+        severity: 'low',
+        description: 'FTC declined to codify push notification restrictions in the 2025 final rule but stated it remains concerned about push notifications and engagement techniques. Best practice: gate push subscriptions behind parental consent. Maps to NGL Labs and Sendit enforcement patterns.',
         patterns: [
-            /FirebaseMessaging\.subscribeToTopic/gi,
-            /OneSignal\.promptForPushNotifications/gi,
-            /sendPushNotification\s*\(/gi,
-            /fcm\.send\s*\(/gi,
-            /PushManager\.subscribe\s*\(/gi,
-            /Notification\.requestPermission/gi,
-            /new\s+Notification\s*\(/gi
+            /FirebaseMessaging\.subscribeToTopic/g,
+            /OneSignal\.(?:promptForPushNotifications|init)\s*\(/g,
+            /sendPushNotification\s*\(/g,
+            /fcm\.send\s*\(/g,
+            /PushManager\.subscribe\s*\(/g,
+            /pushManager\.subscribe\s*\(/g,
+            /messaging\(\)\.getToken\s*\(/g,
+            /registerForPushNotifications\s*\(/g,
+            /addEventListener\s*\(\s*['"]push['"]/g,
+            /expo-notifications/g,
+            /react-native-push-notification/g,
+            // Python — Django push notification libraries
+            /(?:import|from)\s+(?:webpush|pywebpush|push_notifications|django_push_notifications)/gi,
+            /webpush\.send\s*\(/gi,
+            // PHP — web-push-php library
+            /(?:new\s+)?WebPush\s*\(\s*\[/gi,
+            /\$webPush->sendOneNotification/gi,
+            // Ruby — web-push gem
+            /WebPush\.payload_send\s*\(/gi
         ],
         fixSuggestion: 'Gate push notification subscription behind parental dashboard setting',
-        penalty: '$51,744 per violation',
-        languages: ['typescript', 'javascript', 'swift', 'kotlin']
+        penalty: '$53,088 per violation',
+        languages: ['typescript', 'javascript', 'swift', 'kotlin', 'python', 'php', 'ruby']
     },
     // Rule 14: Unfiltered User Generated Content
     {
         id: 'coppa-ugc-014',
+        is_active: false, // Sprint 16 W1: 100% FP (0/3 TP) — all hits are API model property assignments, not child UGC
         name: 'UGC Upload Without PII Filter',
         severity: 'high',
         description: 'Text areas for "bio", "about me", or comments must pass through PII scrubbing before database storage',
@@ -626,7 +860,7 @@ exports.COPPA_RULES = [
             /commentForm.*submit|handleCommentSubmit/gi
         ],
         fixSuggestion: 'Add middleware hook for PII scrubbing (regex or AWS Comprehend) before database storage',
-        penalty: '$51,744 per violation',
+        penalty: '$53,088 per violation',
         languages: ['typescript', 'javascript', 'python']
     },
     // Rule 15: XSS Vulnerabilities
@@ -641,11 +875,21 @@ exports.COPPA_RULES = [
             /\.innerHTML\s*=\s*\$\{/gi,
             /\.innerHTML\s*=\s*(?!['"]?\s*['"]?\s*;)(?!.*[Ll]ocal(?:ize|ization))(?!.*styleContent)[^;]*\b(?:user|input|query|param|req\.|request\.|body\.|data\.)\w*/gi,
             /\.html\s*\(\s*(?:user|req\.|request\.|params?\.)/gi,
-            /v-html\s*=\s*["']?(?!.*sanitize)/gi
+            /v-html\s*=\s*["']?(?!.*sanitize)/gi,
+            // PHP — echo/print user input without escaping
+            /echo\s+\$_(?:GET|POST|REQUEST)\s*\[/gi,
+            // PHP — WordPress unescaped output
+            /<?php\s+echo\s+\$(?!esc_)/gi,
+            // Python — Django mark_safe with user input
+            /mark_safe\s*\([^)]*(?:request|user_input|params)/gi,
+            // Ruby — Rails raw() with user input
+            /raw\s*\(\s*(?:params|@\w*user|@\w*input)/gi,
+            // Ruby — html_safe on user input
+            /(?:params|request)\[.*\]\.html_safe/gi
         ],
         fixSuggestion: 'Use standard JSX rendering or DOMPurify before setting HTML content',
         penalty: 'Security failure',
-        languages: ['typescript', 'javascript', 'tsx', 'jsx', 'vue']
+        languages: ['typescript', 'javascript', 'tsx', 'jsx', 'vue', 'php', 'python', 'ruby']
     },
     // Rule 16: Missing Cookie Consent
     // Fixed Sprint 4: Only flag tracking/PII cookies, not functional preferences (theme, view mode)
@@ -668,11 +912,17 @@ exports.COPPA_RULES = [
             // Java/Kotlin — Spring ResponseCookie
             /ResponseCookie\.from\s*\(/gi,
             // Generic — any language setting cookies with PII field names
-            /(?:set_cookie|SetCookie|addCookie|add_cookie)\s*\([^)]*(?:user|email|token|session|track|auth|uid|analytics)/gi
+            /(?:set_cookie|SetCookie|addCookie|add_cookie)\s*\([^)]*(?:user|email|token|session|track|auth|uid|analytics)/gi,
+            // PHP — setcookie() with PII
+            /setcookie\s*\(\s*['"][^'"]*(?:user|email|token|track|auth|uid|analytics)[^'"]*['"]/gi,
+            // PHP — WordPress set_transient with PII
+            /set_transient\s*\(\s*['"][^'"]*(?:user|email|auth)[^'"]*['"]/gi,
+            // Ruby — Rails cookies[] with PII
+            /cookies\s*\[\s*:(?:user|email|token|session|track|auth|uid|analytics)\s*\]/gi
         ],
         fixSuggestion: 'Add a cookie consent banner component before setting tracking or PII cookies',
         penalty: 'Compliance warning',
-        languages: ['typescript', 'javascript', 'python', 'go', 'java', 'kotlin']
+        languages: ['typescript', 'javascript', 'python', 'go', 'java', 'kotlin', 'php', 'ruby']
     },
     // Rule 17: External Links to Non-Child-Safe Sites
     // Fixed Sprint 4: Exclude privacy/TOS links, mailto, and common safe targets
@@ -718,13 +968,14 @@ exports.COPPA_RULES = [
             /(?:setUserId|set_user_id)\s*\([^)]*(?:email|\.name|phone)/gi
         ],
         fixSuggestion: 'Hash user ID and omit email/name from analytics payload',
-        penalty: '$51,744 per violation',
+        penalty: '$53,088 per violation',
         languages: ['typescript', 'javascript', 'python', 'go', 'java', 'kotlin']
     },
     // Rule 19: School Official Consent Bypass
     // Fixed Sprint 4: Tightened patterns to match actual auth/registration flows only
     {
         id: 'coppa-edu-019',
+        is_active: false,
         name: 'Missing Teacher/School Verification',
         severity: 'medium',
         description: 'Teacher accounts using generic email (@gmail.com) bypass "School Official" consent exception',
@@ -741,6 +992,7 @@ exports.COPPA_RULES = [
     // Rule 20: Default Privacy Settings Public
     {
         id: 'coppa-default-020',
+        is_active: false,
         name: 'Default Public Profile Visibility',
         severity: 'critical',
         description: 'Default profile visibility must be private. COPPA 2.0 requires privacy by design.',
@@ -752,8 +1004,41 @@ exports.COPPA_RULES = [
             /profileVisibility\s*=\s*['"]?(?:public|Public)['"]?/gi
         ],
         fixSuggestion: 'Change default visibility to "private" or false',
-        penalty: '$51,744 per violation',
+        penalty: '$53,088 per violation',
         languages: ['typescript', 'javascript', 'python', 'swift']
+    },
+    // Rule 21: Targeted Advertising Without Separate Consent (Sprint 17 — COPPA 2025)
+    {
+        id: 'coppa-ads-021',
+        name: 'Targeted Advertising Without Separate Consent',
+        severity: 'critical',
+        description: 'COPPA 2025 requires separate, specific opt-in consent before collecting children\'s PI for targeted advertising. Marketing consent cannot be bundled with general terms acceptance. Ad SDK initialization without a distinct consent flow is a violation.',
+        patterns: [
+            // Google AdMob
+            /(?:import|require).*(?:google-mobile-ads|@react-native-firebase\/admob|react-native-admob)/gi,
+            /(?:GADMobileAds|GADRequest|GADBannerView|GADInterstitial)\.\w+/gi,
+            /MobileAds\.initialize|AdRequest\.Builder|AdView|InterstitialAd\.load/gi,
+            // Meta Audience Network
+            /(?:FBAudienceNetwork|FBAdView|FBInterstitialAd|FBNativeAd)/gi,
+            /(?:import|require).*(?:react-native-fbads|@react-native-community\/fbads)/gi,
+            // Unity Ads
+            /UnityAds\.(?:initialize|show|load)|import\s+UnityAds/gi,
+            // IronSource
+            /IronSource\.(?:init|showRewardedVideo|loadInterstitial)|import\s+IronSource/gi,
+            // AppLovin
+            /AppLovin\.(?:initialize|showAd)|import.*AppLovinSDK/gi,
+            // Chartboost
+            /Chartboost\.(?:start|showInterstitial|cacheInterstitial)/gi,
+            // AdColony
+            /AdColony\.(?:configure|requestInterstitial)/gi,
+            // Vungle
+            /Vungle\.(?:init|playAd|loadAd)/gi,
+            // MoPub
+            /mopub\.(?:loadBanner|loadInterstitial)|MoPubInterstitial/gi
+        ],
+        fixSuggestion: 'Implement a separate, specific opt-in consent flow for advertising before initializing ad SDKs. Marketing consent must NOT be bundled with general terms acceptance. Use age-gated ad experiences or contextual-only advertising for children under 13.',
+        penalty: '$53,088 per violation (COPPA 2025 separate advertising consent requirement)',
+        languages: ['typescript', 'javascript', 'swift', 'kotlin', 'java', 'python']
     }
 ];
 // Ethical Design Rules (Sprint 5 Preview)
@@ -816,6 +1101,7 @@ exports.ETHICAL_RULES = [
     // ETHICAL-004: Manipulative Notifications
     {
         id: 'ETHICAL-004',
+        is_active: false,
         name: 'Manipulative Notification Language',
         severity: 'medium',
         description: 'Notifications using urgency ("Hurry!", "Missing out") manipulate children\'s fear of social exclusion',
@@ -832,6 +1118,7 @@ exports.ETHICAL_RULES = [
     // ETHICAL-005: Artificial Scarcity
     {
         id: 'ETHICAL-005',
+        is_active: false,
         name: 'Artificial Scarcity / Countdowns',
         severity: 'medium',
         description: 'Fake scarcity ("Only 2 left!") and countdown timers pressure children into impulsive decisions',
@@ -856,6 +1143,7 @@ exports.AI_AUDIT_RULES = [
     // AI-AUDIT-001: Placeholder Analytics
     {
         id: 'AI-AUDIT-001',
+        is_active: false, // Sprint 15: Cut to proposed tier — zero GT
         name: 'Placeholder Analytics Script',
         severity: 'high',
         description: 'AI-generated code frequently includes placeholder analytics (UA-XXXXX, G-XXXXXX, fbq) copied from training data. These may activate real tracking without child_directed_treatment flags.',
@@ -890,6 +1178,7 @@ exports.AI_AUDIT_RULES = [
     // AI-AUDIT-003: Hallucinated URLs
     {
         id: 'AI-AUDIT-003',
+        is_active: false, // Sprint 15: Cut to proposed tier — zero GT
         name: 'Hallucinated/Placeholder API URLs',
         severity: 'medium',
         description: 'AI models often generate fake API endpoints (api.example.com, jsonplaceholder, reqres.in) that may be replaced with real endpoints without proper review.',
@@ -905,6 +1194,7 @@ exports.AI_AUDIT_RULES = [
     // AI-AUDIT-004: Copy-Paste Tracking Boilerplate
     {
         id: 'AI-AUDIT-004',
+        is_active: false, // Sprint 15: Cut to proposed tier — zero GT
         name: 'Copy-Paste Tracking Boilerplate',
         severity: 'high',
         description: 'AI assistants reproduce common analytics setup patterns from training data. These often include user identification, event tracking, and session recording without consent flows.',
@@ -944,6 +1234,7 @@ exports.AI_AUDIT_RULES = [
     // AI-AUDIT-006: TODO/FIXME Compliance Gaps
     {
         id: 'AI-AUDIT-006',
+        is_active: false, // Sprint 15: Cut to proposed tier — zero GT
         name: 'Unresolved Compliance TODOs',
         severity: 'low',
         description: 'AI-generated code often includes TODO/FIXME comments for compliance-related features (consent, age verification, privacy policy) that may ship unimplemented.',
@@ -999,6 +1290,7 @@ exports.AU_SBD_RULES = [
     // AU-SBD-003: Unrestricted Direct Messaging
     {
         id: 'AU-SBD-003',
+        is_active: false,
         name: 'Unrestricted Direct Messaging for Minors',
         severity: 'critical',
         description: 'Direct messaging or chat functionality without safety controls (contact restrictions, message filtering, or parental oversight). The AU Online Safety Act requires platforms to take reasonable steps to prevent child exploitation in private communications.',
@@ -1015,6 +1307,7 @@ exports.AU_SBD_RULES = [
     // AU-SBD-004: Algorithmic Feeds Without Safety Guardrails
     {
         id: 'AU-SBD-004',
+        is_active: false, // Sprint 15: Cut to proposed tier — zero GT
         name: 'Recommendation Algorithm Without Safety Guardrails',
         severity: 'high',
         description: 'Content recommendation or feed algorithms detected without safety filtering, content classification, or age-appropriate guardrails. AU SbD requires platforms to assess and mitigate algorithmic harms, particularly for young users.',
@@ -1032,6 +1325,7 @@ exports.AU_SBD_RULES = [
     // AU-SBD-005: Missing Digital Wellbeing / Screen Time Controls
     {
         id: 'AU-SBD-005',
+        is_active: false, // Sprint 16 W1: 18.2% precision (2/11 TP). All 9 FPs are media player autoplay (jellyfin). Pattern too broad — rebuild needed.
         name: 'Engagement Features Without Time Awareness',
         severity: 'medium',
         description: 'High-engagement features (autoplay, continuous scrolling, notifications) detected without corresponding digital wellbeing controls (screen time limits, break reminders, usage dashboards). AU SbD encourages platforms to build in digital wellbeing tools.',
@@ -1049,6 +1343,7 @@ exports.AU_SBD_RULES = [
     // AU-SBD-006: Location Sharing Without Explicit Opt-In
     {
         id: 'AU-SBD-006',
+        is_active: false,
         name: 'Location Data Without Explicit Consent',
         severity: 'critical',
         description: 'Location data collection or sharing enabled without explicit, informed opt-in. AU SbD and the Privacy Act 1988 require data minimization, especially for children\'s geolocation data — location should never be collected by default.',
@@ -1110,6 +1405,48 @@ function parseHaloignore(content) {
     }
     return config;
 }
+/**
+ * Sprint 10: Check if a file path is in a vendored/third-party library directory.
+ * Vendor files are auto-suppressed to eliminate false positives from code the project doesn't control.
+ */
+function isVendorPath(filePath) {
+    const normalized = filePath.replace(/\\/g, '/');
+    return /(^|\/)node_modules\//.test(normalized) ||
+        /(^|\/)vendor\//.test(normalized) ||
+        /(^|\/)bower_components\//.test(normalized) ||
+        /(^|\/)third[_-]?party\//.test(normalized) ||
+        /(^|\/)\.bundle\//.test(normalized) ||
+        /(^|\/)Pods\//.test(normalized) ||
+        /(^|\/)external\//.test(normalized) ||
+        /(^|\/)deps\//.test(normalized) ||
+        /(^|\/)\.yarn\//.test(normalized) ||
+        /(^|\/)\.pnpm\//.test(normalized) ||
+        // Minified files are almost always vendored/built
+        /[.\-]min\.(js|css)$/.test(normalized) ||
+        /\.bundle\.js$/.test(normalized) ||
+        // Well-known vendored library directories (catches lib/google2-service/, lib/aws-sdk/, etc.)
+        /(^|\/)lib\/(google[^/]*|aws[^/]*|yui[^/]*|php[^/]*|jquery[^/]*|bootstrap[^/]*|tinymce[^/]*|h5p[^/]*|firebase[^/]*|simplepie[^/]*|tcpdf[^/]*|guzzle[^/]*|psr[^/]*|font-?awesome[^/]*)\//i.test(normalized) ||
+        // H5P vendored libraries (stored under h5p/h5plib/, not lib/)
+        /(^|\/)h5plib\//.test(normalized);
+}
+/**
+ * Sprint 11a: Check if a file path is in a documentation generator output directory.
+ * Doc generator templates and output contain external links, code examples, etc. that are
+ * developer-facing, not child-facing content. Flagging these is a false positive.
+ */
+function isDocGeneratorPath(filePath) {
+    const normalized = filePath.replace(/\\/g, '/');
+    return /(^|\/)(?:jsdoc|typedoc|apidoc|javadoc|doxygen|sphinx|_build|_static)(?:\/|\.)/i.test(normalized) ||
+        // Documentation template files
+        /(?:^|\/)(?:jsdoc|typedoc|apidoc)\.(?:html|hbs|tmpl|ejs)$/i.test(normalized) ||
+        // Generated API docs
+        /(^|\/)(?:docs?\/(?:api|generated|reference|build))\//i.test(normalized) ||
+        // Sphinx build output
+        /(^|\/)_build\/html\//i.test(normalized) ||
+        // Common doc generator config files with template content
+        /(?:^|\/)\.jsdoc\.(?:json|js)$/i.test(normalized) ||
+        /(?:^|\/)typedoc\.json$/i.test(normalized);
+}
 /**
  * Check if a file should be ignored based on .haloignore config
  */
@@ -1194,6 +1531,35 @@ class HaloEngine {
                 this.rules = [...this.rules, ...exports.AU_SBD_RULES];
             }
         }
+        // Sprint 15: Filter out disabled rules.
+        // Static list ensures rules are disabled regardless of source (API, cache, bundled JSON, hardcoded).
+        // is_active flag handles hardcoded rules; DISABLED_RULE_IDS handles all sources.
+        // Sprint 15: Zero-GT rule actions
+        // DISABLE: zero GT entries, cannot validate precision
+        // CUT (to proposed tier): zero GT entries, pattern too broad for production
+        const DISABLED_RULE_IDS = new Set([
+            'coppa-bio-012', // 0% precision, all FP — rebuild needed
+            // coppa-notif-013 removed — rebuilt Sprint 18 with push-only patterns
+            'coppa-sec-010', // Sprint 16 W1: 100% FP (0/3 TP) — all hits wrong
+            'coppa-ugc-014', // Sprint 16 W1: 100% FP (0/3 TP) — all hits wrong
+            'coppa-edu-019', // Zero GT — teacher registration patterns too narrow to validate
+            'coppa-default-020', // Zero GT — overlaps with AU-SBD-001 default public profiles
+            'ETHICAL-004', // Zero GT — manipulative notification language too broad
+            'ETHICAL-005', // Zero GT — artificial scarcity patterns too broad
+            'AU-SBD-003', // Zero GT — DM detection patterns too broad
+            'AU-SBD-005', // Sprint 16 W1: 18.2% precision — autoplay pattern fires on media player APIs
+            'AU-SBD-006', // Zero GT — location sharing patterns too broad
+            // CUT to proposed tier (zero GT, pattern too broad for production)
+            'AI-AUDIT-001', // Placeholder analytics — low real-world signal
+            'AI-AUDIT-003', // Hallucinated URLs — low real-world signal
+            'AI-AUDIT-004', // Copy-paste tracking boilerplate — too broad
+            'AI-AUDIT-006', // TODO/FIXME compliance — noise in real codebases
+            'AU-SBD-004', // Algorithmic feeds — pattern too broad for production
+            // Sprint 17 Day 0: Zero-GT rules validated against 5 repos — patterns don't match real-world code
+            'ut-sb142-003', // Default DM access — patterns use naming conventions no real app uses (0 hits across Moodle, Discourse, Rocket.Chat, Element, Mastodon)
+            'ut-sb142-004', // Missing parental tools — 2 hits across 5 repos, both FP. API/bundled pattern mismatch. Needs rebuild
+        ]);
+        this.rules = this.rules.filter(r => r.is_active !== false && !DISABLED_RULE_IDS.has(r.id));
         if (config.severityFilter) {
             this.rules = this.rules.filter(r => config.severityFilter.includes(r.severity));
         }
@@ -1307,11 +1673,9 @@ class HaloEngine {
                 v.astConfidence = 0;
             }
         }
-        // Sprint 8: Apply framework overrides
-        if (this.config.framework) {
-            const result = (0, frameworks_1.applyFrameworkOverrides)(violations, this.config.framework);
-            violations = result.violations;
-        }
+        // Sprint 10: Framework overrides now applied in scanFile() for ALL file types.
+        // No longer needed here — scanFile() already filtered/downgraded regex violations.
+        // AST-added violations (e.g. signInWithPopup → auth-001) are not in any framework profile.
         // Sprint 8: ContextAnalyzer — compute confidence scores
         const violationInputs = violations.map(v => ({
             ruleId: v.ruleId,
@@ -1350,26 +1714,65 @@ class HaloEngine {
         if (ignoreConfig && shouldIgnoreFile(filePath, ignoreConfig)) {
             return [];
         }
-        const violations = [];
+        // Sprint 10: Skip vendored/third-party library files entirely
+        // These produce massive false positives (84% FP rate on Moodle — all from lib/, vendor/ paths)
+        if (isVendorPath(filePath)) {
+            return [];
+        }
+        // Sprint 11a: Skip documentation generator output files
+        // JSDoc templates, Sphinx output, TypeDoc pages — developer tools, not child-facing content
+        if (isDocGeneratorPath(filePath)) {
+            return [];
+        }
+        let violations = [];
         const lines = content.split('\n');
-        // Sprint 8: Test file detection for regex scanner (coppa-sec-010 FP fix)
+        // Sprint 13a: Consolidated file classification (Pre-filter A+)
+        // All heuristics are now in classifyFile() for consistency and future Option C upgrade
         const normalizedPath = filePath.replace(/\\/g, '/');
-        const isTestFile = /\.(test|spec)\.(ts|tsx|js|jsx|py|rb|java|go)$/i.test(normalizedPath) ||
-            /(^|\/)__tests__\//.test(normalizedPath) ||
-            /(^|\/)test\//.test(normalizedPath) ||
-            /(^|\/)tests\//.test(normalizedPath) ||
-            /(^|\/)spec\//.test(normalizedPath) ||
-            /(^|\/)fixtures\//.test(normalizedPath) ||
-            /\.(stories|story)\.(ts|tsx|js|jsx)$/i.test(normalizedPath) ||
-            /(^|\/)cypress\//.test(normalizedPath) ||
-            /(^|\/)e2e\//.test(normalizedPath) ||
-            /jest\.config|vitest\.config|playwright\.config/i.test(normalizedPath);
-        // Rules that commonly false-positive in test/fixture files
+        const classification = classifyFile(filePath, content.substring(0, 3000));
+        // Sprint 13a: Skip files that should never be scanned
+        // (Django migrations, build output, type definitions, CI configs)
+        if (classification.shouldSkip) {
+            return [];
+        }
+        // Rules that commonly false-positive in test/fixture/mock files
         const TEST_FP_RULES = new Set([
             'coppa-sec-010', // Weak passwords in test fixtures
             'coppa-tracking-003', // Analytics snippets in test mocks
             'coppa-auth-001', // Auth patterns in test helpers
             'coppa-sec-015', // XSS patterns in security test cases
+            'coppa-sec-006', // Sprint 11a: HTTP URLs in test config (e.g., http://example-storage.com in envs/test.py)
+        ]);
+        // Rules that should be suppressed in consent/compliance implementation files
+        // These rules flag patterns that are REQUIRED in consent implementations
+        const CONSENT_SUPPRESSED_RULES = new Set([
+            'coppa-cookies-016', // Cookie consent banners MUST set cookies to track consent state
+            'coppa-tracking-003', // Consent management may reference tracking to gate it
+            'coppa-data-002', // Consent flows may reference PII fields to declare collection scope
+        ]);
+        // Rules that FP in admin/instructor code — these patterns exist for managing users, not collecting child data
+        const ADMIN_FP_RULES = new Set([
+            'coppa-flow-009', // Contact collection: admin reading existing user emails is not child contact flow
+            'coppa-data-002', // PII in URLs: admin user lookup endpoints are internal tools
+            'coppa-ui-008', // Registration forms: admin user management is not child registration
+            'coppa-sec-006', // Sprint 16: HTTP URLs in admin/instructor views are internal tooling, not child-facing
+        ]);
+        // ── Graduated Heuristics (Sprint 13b) ──────────────────────────────────
+        // Auto-promoted from AI Review Board via the graduation pipeline.
+        // Each pattern was dismissed consistently by the AI reviewer and passed
+        // MVP validation criteria (min dismissals, min confidence, zero false confirmations).
+        // These replace AI review calls with deterministic checks: zero cost, instant execution.
+        // Graduated pattern: admin-path
+        // 193 consistent dismissals | avg confidence 9.0/10 | 0 false confirmations
+        // AI reviewer cost per check: ~$0.014 → now $0.00
+        const GRADUATED_ADMIN_RULES = new Set([
+            'ut-sb142-001', // UT SB-142 age verification: admin panels are not child-facing
+            'ut-sb142-002', // UT SB-142 parental consent: admin interfaces require staff auth
+        ]);
+        // Graduated pattern: test-file
+        // 27 consistent dismissals | avg confidence 9.0/10 | 0 false confirmations
+        const GRADUATED_TEST_RULES = new Set([
+            'ut-sb142-001', // UT SB-142 age verification: test utilities are not production child-facing code
         ]);
         // Parse suppression comments
         const suppressions = parseSuppressions(content);
@@ -1381,12 +1784,52 @@ class HaloEngine {
             }
         }
         for (const rule of this.rules) {
-            // Sprint 8: Skip rules that commonly FP in test files
-            if (isTestFile && TEST_FP_RULES.has(rule.id)) {
+            // Sprint 10: Skip rules that don't target this file's language
+            if (rule.languages && rule.languages.length > 0 && classification.language !== 'unknown') {
+                if (!rule.languages.includes(classification.language)) {
+                    continue;
+                }
+            }
+            // Sprint 8+13a: Skip rules that commonly FP in test/fixture/mock/factory files
+            if ((classification.isTest || classification.isMockOrFactory || classification.isFixtureOrSeed) && TEST_FP_RULES.has(rule.id)) {
+                continue;
+            }
+            // Sprint 13a: Skip ALL rules in Storybook stories (UI demos, not production code)
+            if (classification.isStorybook) {
+                continue;
+            }
+            // Sprint 10b: Skip rules that FP in consent/compliance implementation files
+            // Consent forms MUST set cookies, reference tracking, and handle PII — that's the solution, not the problem
+            if (classification.isConsent && CONSENT_SUPPRESSED_RULES.has(rule.id)) {
+                continue;
+            }
+            // Sprint 11a: Skip rules that FP in admin/instructor backend code
+            // Admin functions managing existing user data are not child-facing contact collection flows
+            if (classification.isAdmin && ADMIN_FP_RULES.has(rule.id)) {
+                continue;
+            }
+            // Sprint 13b Graduated: admin-path — admin files are not child-facing
+            // (Promoted from AI Review Board: 193 dismissals, confidence 9.0)
+            if (classification.isAdmin && GRADUATED_ADMIN_RULES.has(rule.id)) {
+                continue;
+            }
+            // Sprint 15: AU-SBD-002 fix — skip in admin/vendor code (85% FP rate from these contexts)
+            if ((classification.isAdmin || classification.isVendor) && rule.id === 'AU-SBD-002') {
+                continue;
+            }
+            // Sprint 13b Graduated: test-file — test/fixture files are not production code
+            // (Promoted from AI Review Board: 27 dismissals, confidence 9.0)
+            if ((classification.isTest || classification.isMockOrFactory || classification.isFixtureOrSeed) && GRADUATED_TEST_RULES.has(rule.id)) {
                 continue;
             }
             // Special handling for coppa-retention-005: skip if schema has retention fields
             if (rule.id === 'coppa-retention-005') {
+                // Sprint 11a: Skip Python models annotated with no_pii docstrings
+                // OpenEdX convention: `.. no_pii:` in class docstring means model contains no PII
+                // These models have User FKs but only store non-PII data (e.g., calendar sync preferences)
+                if (classification.language === 'python' && /(?:\.\.\s*no_pii\s*:|#\s*no[_-]?pii\b|no_pii\s*=\s*True)/i.test(content)) {
+                    continue;
+                }
                 // Check if the content has retention-related fields
                 const hasRetention = /deletedAt|deleted_at|expires|TTL|retention|paranoid|expiration/i.test(content);
                 if (!hasRetention) {
@@ -1440,6 +1883,82 @@ class HaloEngine {
                         if (isOwnDomain)
                             continue;
                     }
+                    // Sprint 11a: For coppa-ext-017: skip IE conditional comments
+                    // <!--[if lte IE 9]> ... <![endif]--> are deprecated browser banners, not child-facing links
+                    // Seen in: OpenEdX templates with Chrome/Firefox download links for IE users
+                    if (rule.id === 'coppa-ext-017') {
+                        // Check if we're inside an IE conditional comment block
+                        const beforeMatch = content.substring(Math.max(0, match.index - 500), match.index);
+                        const afterMatch = content.substring(match.index, Math.min(content.length, match.index + 500));
+                        if (/<!--\s*\[if\s+(?:lt|lte|gt|gte|!)?\s*IE/i.test(beforeMatch) && /\[endif\]\s*-->/i.test(afterMatch)) {
+                            continue;
+                        }
+                        // Also skip if the line itself contains the IE conditional pattern
+                        if (/<!--\s*\[if\s+(?:lt|lte|gt|gte|!)?\s*IE/i.test(lineContent)) {
+                            continue;
+                        }
+                    }
+                    // Sprint 10+16: For coppa-sec-006: skip reserved/example/documentation/standards domains
+                    // These are IANA-reserved, standards bodies, or universally used in documentation and are never real endpoints
+                    // Require http:// before the domain to avoid matching domains in email addresses etc.
+                    if (rule.id === 'coppa-sec-006') {
+                        const checkText = (match[0] + ' ' + lineContent).toLowerCase();
+                        if (/http:\/\/(www\.)?(example\.(com|org|net)|localhost(:\d|\/|['"\s]|$)|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|httpbin\.org|jsonplaceholder\.typicode\.com|testserver(\.com)?[\/\s'"]|imsglobal\.org|flickr\.com|w3\.org)/.test(checkText)) {
+                            continue;
+                        }
+                        // Sprint 16: Skip devstack/Docker service URLs (development-only, never production)
+                        if (/devstack/.test(checkText)) {
+                            continue;
+                        }
+                        // Sprint 16: Skip XML schema/namespace URLs (*.xsd, /xmlns/, /schema/)
+                        // These are namespace declarations, not API endpoints
+                        if (/\.xsd['"\s,)]|\/xmlns\/|\/schema\//.test(checkText)) {
+                            continue;
+                        }
+                    }
+                    // Sprint 10: For coppa-sec-015 (XSS): skip innerHTML assignments that are already sanitized
+                    // Y.Escape.html(), DOMPurify.sanitize(), etc. show the developer IS handling XSS
+                    if (rule.id === 'coppa-sec-015') {
+                        if (/(?:escape\.html|dompurify|sanitize|purify)\s*\(/i.test(lineContent)) {
+                            continue;
+                        }
+                    }
+                    // Sprint 10: For coppa-ui-008: skip admin tool registration (LTI cartridge, Brickfield, etc.)
+                    // These are admin/developer-facing forms, not child-facing registration
+                    if (rule.id === 'coppa-ui-008') {
+                        if (/cartridge[_-]?registration|brickfield|registersetting|tool_configure/i.test(lineContent) ||
+                            /cartridge[_-]?registration|brickfield|registersetting/i.test(normalizedPath)) {
+                            continue;
+                        }
+                    }
+                    // Sprint 10b: For coppa-cookies-016: skip consent implementations
+                    // Files/code implementing cookie consent are the solution, not the problem
+                    if (rule.id === 'coppa-cookies-016') {
+                        // File path patterns: cookie-consent.js, gdpr-banner.js, etc.
+                        if (/cookie[_-]?(consent|law|notice|banner|policy|popup|gdpr|preferences)/i.test(normalizedPath) ||
+                            /(?:consent|gdpr|ccpa|privacy)[_-]?(?:banner|popup|modal|notice|manager)/i.test(normalizedPath)) {
+                            continue;
+                        }
+                        // Line-level: function/variable names showing consent management intent
+                        if (/(?:handleConsent|acceptCookies|declineCookies|cookieBanner|consentManager|cookiePreferences|saveCookiePreferences|showCookieNotice|getCookieConsent|setCookieConsent)\s*[=(]/i.test(lineContent) ||
+                            /(?:accept|decline|preferences|banner|consent)\s*[=:]/i.test(lineContent) && /cookie/i.test(lineContent)) {
+                            continue;
+                        }
+                        // Import-level: known consent management libraries
+                        if (/(?:require|import).*(?:cookieconsent|react-cookie-consent|onetrust|cookiebot|osano|cookie-notice|gdpr-cookie)/i.test(content.substring(0, 2000))) {
+                            continue;
+                        }
+                        // Sprint 11a: Skip cookie DELETION patterns — setting expires to past or max-age=0/-1 is cleanup, not tracking
+                        // Seen in: Moodle submit.js — code that removes cookies flagged as if setting them
+                        if (/max[_-]?age\s*[=:]\s*['"]?\s*(-\d+|0)\b/i.test(lineContent) ||
+                            /expires\s*[=:]\s*['"]?\s*(?:Thu,\s*01\s+Jan\s+1970|new\s+Date\s*\(\s*0\s*\))/i.test(lineContent) ||
+                            /new\s+Date\s*\(\s*0\s*\)/.test(lineContent) && /expires/i.test(lineContent) ||
+                            /=\s*['"]?\s*deleted\b/i.test(lineContent) ||
+                            /(?:delete|remove|clear|expire|destroy)[_-]?cookie/i.test(lineContent) ||
+                            /\.cookie\s*=\s*['"][^'"]*;\s*expires\s*=\s*['"]?\s*Thu,\s*01/i.test(lineContent)) {
+                            continue;
+                        }
+                    }
                     // Check if this violation already exists (avoid duplicates)
                     const exists = violations.some(v => v.ruleId === rule.id &&
                         v.line === lineNumber &&
@@ -1453,6 +1972,14 @@ class HaloEngine {
                         if (suppressed) {
                             suppressionComment = suppressions.get(lineNumber);
                         }
+                        // Sprint 11b: Extract surrounding code context (5 lines before + 5 after)
+                        const contextStart = Math.max(0, lineNumber - 6); // lineNumber is 1-indexed
+                        const contextEnd = Math.min(lines.length, lineNumber + 5);
+                        const surroundingLines = lines.slice(contextStart, contextEnd).map((l, i) => {
+                            const ln = contextStart + i + 1;
+                            const marker = ln === lineNumber ? '>>>' : '   ';
+                            return `${marker} ${ln}: ${l}`;
+                        });
                         violations.push({
                             ruleId: rule.id,
                             ruleName: rule.name,
@@ -1471,11 +1998,43 @@ class HaloEngine {
                             matchType: 'regex',
                             fixability: getRemediation(rule.id).fixability,
                             remediation: getRemediation(rule.id),
+                            // Sprint 11b: Enriched context for AI Review Board
+                            surroundingCode: surroundingLines.join('\n'),
+                            fileMetadata: {
+                                language: classification.language,
+                                isVendor: classification.isVendor,
+                                isTest: classification.isTest,
+                                isAdmin: classification.isAdmin,
+                                isConsent: classification.isConsent,
+                                isDocGenerator: classification.isDocGenerator,
+                                detectedFramework: this.config.framework,
+                                // Sprint 13a: Extended classification data
+                                isMock: classification.isMockOrFactory,
+                                isFixture: classification.isFixtureOrSeed,
+                                isCIConfig: classification.isCIConfig,
+                                isBuildOutput: classification.isBuildOutput,
+                                isTypeDefinition: classification.isTypeDefinition,
+                                isStorybook: classification.isStorybook,
+                            },
                         });
                     }
                 }
             }
         }
+        // Sprint 10: Apply framework overrides to ALL file types (Python, PHP, HTML, etc.)
+        // Previously this only ran inside scanFileWithAST() for JS/TS files.
+        if (this.config.framework) {
+            const result = (0, frameworks_1.applyFrameworkOverrides)(violations, this.config.framework);
+            violations = result.violations;
+        }
+        // Sprint 12b: Dedup AI-GOVERNANCE-002 / AI-RISK-003 overlap
+        // If both fire on same file+line, suppress AI-RISK-003 (AI-GOVERNANCE-002 subsumes it)
+        const govViolations = new Set(violations
+            .filter(v => v.ruleId === 'AI-GOVERNANCE-002')
+            .map(v => `${v.filePath}:${v.line}`));
+        if (govViolations.size > 0) {
+            violations = violations.filter(v => !(v.ruleId === 'AI-RISK-003' && govViolations.has(`${v.filePath}:${v.line}`)));
+        }
         // Filter suppressed if configured
         if (this.config.suppressions?.enabled !== false && !this.config.includeSuppressed) {
             const unsuppressed = violations.filter(v => !v.suppressed);