circle-ir-ai 2.67.0 → 2.75.0

package/CHANGELOG.md

@@ -5,6 +5,333 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.75.0] - 2026-07-31
+
+### Fixed — bound verifier fan-out per file (#252 problem B)
+
+Closes #252's last substantive item: *"verification cannot emit unbounded
+15×15×N chunk storms without hitting a documented budget."*
+
+`verifyBatchChunkSplit` has always capped its **sink** partitioning at
+`VERIFY_MAX_CHUNKS` (default 4). The **source**-chunking path had no cap at
+all, so a single file could emit an unbounded number of verifier calls — and it
+bites hardest exactly where it hurts. `chunkSize` is
+`floor(effectiveMaxPairs / sinks)`, so a sink-heavy file drives it to 1 and
+produces **one LLM call per source**. #252 recorded
+`15 sources × 15 sinks = 225 pairs → 15 chunks`: fifteen calls for one file,
+against a provider already returning 429s.
+
+Source chunks are now capped at `VERIFY_MAX_CHUNKS`. Sources arrive ordered by
+the upstream `prioritized` selection strategy, so truncating the tail keeps the
+highest-value candidates. Raise `LLM_VERIFY_MAX_CHUNKS` to widen.
+
+The dropped pairs are **counted, not silently discarded** — new
+`pairsDroppedByBudget` on `ScanMeta.verification`, distinct from `pairsOmitted`:
+
+| field | who declined |
+|---|---|
+| `pairsOmitted` | the model, shown the pair, chose not to mention it |
+| `pairsDroppedByBudget` | **us**, never showed it the pair |
+
+Collapsing the two would make our own fan-out cap read as model behaviour —
+the same conflation that made `Finding.exploitable` useless in #246. A budget
+drop also must not inflate `omissionRate`, which describes only pairs actually
+submitted; a test pins that.
+
+Harness rolls the field up alongside the rest. 1 test added. Suite 1585 pass +
+3 skipped.
+
+## [2.74.0] - 2026-07-31
+
+### Added — progress logs that name the stuck file (#252 problem E)
+
+Closes #252's progress-logging item. Two defects, one of them silently wrong for
+as long as parallel scanning has existed:
+
+**The `[N/M]` index was meaningless under concurrency.** It was logged as
+`filesProcessed + 1` when a worker *picked up* a file, but `filesProcessed` only
+advances when a file *finishes*. With four workers, four different files all
+logged `[1/812]`. Now a dispatch counter, so every line has a distinct index
+that identifies its file.
+
+**Nothing said which file was stuck.** `ScanHeartbeat` (`src/utils/scan-heartbeat.ts`)
+tracks what is actually in flight and names anything running past a threshold:
+
+```
+  ⏱ still analyzing after 180s: site/bisheng.common.config.js (1 file(s) in flight). cognium-ai#252
+```
+
+That is the line whose absence made #252's own evidence require attaching to a
+running process to find the offending 4 KB file.
+
+Silent on a healthy scan — nothing is emitted unless a file exceeds
+`SCAN_STALL_WARN_MS`, and each stalled file reports **once**, so a 3-hour wedge
+produces one line rather than hundreds. Tunable via `SCAN_HEARTBEAT_MS`
+(default 30000; `0` disables) and `SCAN_STALL_WARN_MS` (default 60000).
+
+**Known limit, verified rather than assumed:** the heartbeat is timer-driven, so
+a worker wedged in CPU-bound synchronous work (a Tree-sitter parse) blocks it —
+the same constraint that defeats `withTimeout` and the scan deadline. Confirmed
+on the #252 repro fixture: silent by default, and correct once
+`SCAN_PARSE_ISOLATION=1` moves the parse off the main thread. The two features
+compose; either alone leaves a gap.
+
+8 tests. Suite 1584 pass + 3 skipped.
+
+## [2.73.0] - 2026-07-31
+
+### Added — skip mirrored CDN/vendor trees (#252 problem C)
+
+Closes #252's CDN-mirror acceptance item. #243 catches build artifacts by the
+`.min.` convention, but site-ripper mirrors carry neither `.min.` nor a giant
+line — they flatten a remote URL into a filename:
+
+```
+js/ajax.googleapis.com__ajax__libs__dojo__1.4.3__dojo__dojo.js
+```
+
+poisontap ships 249 such copies. They are third-party code the repo owner does
+not maintain, so findings in them are noise — and in #252 these were the trees
+that walked discovery into a 7200s timeout with no artifact.
+
+`isCdnMirrorPath()` refuses two shapes, either sufficient:
+
+1. a hostname-shaped token ending in a real TLD, immediately followed by the
+   `__` flattening marker;
+2. a known CDN host anywhere in the path, for mirrors that keep real
+   directories (`vendor/cdnjs.cloudflare.com/ajax/libs/...`).
+
+Wired into `preFlightSkip` next to the `#243` check — matched by name, so the
+file is never stat'd or read.
+
+**Deliberately conservative**, because the failure mode of a filename heuristic
+is silently dropping first-party source. Both conditions are required for shape
+1: the `__` marker keeps ordinary dotted names out (`utils.test.js`,
+`app.config.js`), and the TLD allowlist keeps first-party names that merely
+contain `__` out (`foo.bar__baz.js`, `data.v2__snapshot.json` — the first of
+which an earlier draft of the pattern did match). A hostname-shaped name with
+no marker (`foo.example.com.js`) is treated as first-party.
+
+Opt out with `SKIP_CDN_MIRRORS=0`. 17 tests, 11 of them asserting what must NOT
+be skipped. Suite 1576 pass + 3 skipped.
+
+## [2.72.0] - 2026-07-31
+
+### Changed — one minified predicate across every stage (#252 problem D)
+
+Closes the fourth acceptance item on #252: *"content skipped by verification
+`#102` thresholds is also skipped at discovery / `preFlightSkip`."*
+
+Verification has refused minified/bundled content since #102 — but that decision
+was made at the **end** of the pipeline. A bundle had already paid for a parse,
+the SAST passes, and both discovery LLM calls before anything looked at its
+shape. The walker's own caps don't cover this class: `preFlightSkip` refuses a
+line over **50,000** chars, while the minified predicate trips at **5,000**, so
+everything in between sailed through the expensive stages only to be dropped at
+the last one.
+
+`isMinifiedContent` now lives in `src/utils/file-skip.ts` — the module that owns
+the other skip heuristics — and `verification.ts` re-exports it, so the two
+stages share one binding and cannot drift. `runEnrich` applies it before the
+`#145` pattern pre-filter, emitting the same synthetic `discoverSources` /
+`discoverSinks` skip rows so `analyze-llm-log.ts` still reconciles.
+
+Contract is unchanged from #102: this gates **LLM enrichment only**. Static
+findings on minified files are unaffected, and ordinary source is untouched —
+the predicate needs size > 50KB *and* a line > 5,000 chars *and* an average line
+over 500, so a large well-formatted file does not trip it.
+
+5 tests, including one that asserts the two stages reference the same function
+rather than merely agreeing today. Suite 1559 pass + 3 skipped.
+
+## [2.71.0] - 2026-07-31
+
+### Added — `LLM_RATE_INTERVAL_MS`: throttle below 60 RPM
+
+`LLM_RATE_LIMIT` shared a hardcoded 1000ms p-queue window, so it meant
+"requests per second" and the slowest rate expressible was `LLM_RATE_LIMIT=1` →
+**60 RPM**. Providers enforcing a lower requests-per-minute budget could not be
+respected by any combination of settings — #252 recorded Novita returning 429s
+even at `LLM_CONCURRENCY=1`.
+
+Concurrency is the wrong lever for an RPM cap: the AIMD controller (#229) floors
+at one in-flight call and a single call every few seconds can still exceed a
+30 RPM budget. The result was scans burning retries against a limit they had no
+way to obey.
+
+The interval is now configurable, so the two knobs together express any rate:
+
+| target | `LLM_RATE_LIMIT` | `LLM_RATE_INTERVAL_MS` |
+|---|---|---|
+| 30 RPM (Novita) | `1` | `2000` |
+| 60 RPM | `1` | `1000` (default) |
+| 120 RPM | `2` | `1000` |
+| 1200 RPM | `20` | `1000` (default) |
+
+Default stays 1000ms, so existing deployments are byte-identical. Non-positive
+or unparseable values fall back to 1000 rather than disabling the throttle — a
+0ms p-queue interval would busy-loop. A one-line startup banner reports the
+effective RPM whenever the interval is non-default.
+
+Both `LLM_RATE_LIMIT` and `LLM_RATE_INTERVAL_MS` are read once at module load,
+so they must be exported before the process starts. 5 tests; suite 1554 pass +
+3 skipped.
+
+## [2.70.1] - 2026-07-31
+
+### Changed — bump circle-ir 3.194.0 → 3.195.0
+
+Uniform fleet pin. No circle-ir-ai source change; typecheck clean, full suite
+1549 pass + 3 skipped on 3.195.0.
+
+## [2.70.0] - 2026-07-31
+
+### Fixed — `maxScanMs` now bounds in-flight work, not just the next file (#252)
+
+`--max-scan-time` (2.65.0) checked the budget only *before a worker pulled its
+next file*. If every worker was blocked inside an in-flight file when the budget
+expired, none returned to the top of the loop, `Promise.all` never settled, and
+the scan ran until an outer orchestrator SIGKILLed it **with no output** — the
+exact failure the budget exists to prevent.
+
+Found while running the #246 measurement against a local Ollama endpoint, which
+serializes requests: 4 workers each grabbed a file at t=0 and blocked on the
+queue for longer than the whole budget. Two consecutive corpus runs lost ~4 h of
+compute across 8 repos and produced **zero** `scan.json` files between them.
+
+New exported `awaitWorkersWithDeadline()` races the worker pool against the
+deadline: on expiry the queue drains, the result is marked degraded, and the
+scan returns with whatever completed. In-flight workers are abandoned rather than
+awaited, and their late rejections are swallowed so an unhandled rejection can't
+kill the process before the partial result is written.
+
+Same repo, same 5-minute stage timeout, before and after:
+
+| | before | after |
+|---|---|---|
+| outcome | `timeout (300019ms, SIGKILL)` | `ok (241510ms)` |
+| `scan.json` | **absent** | present, `degraded: true` |
+| files analyzed | — | 23 |
+| findings | — | 164 |
+
+Known limit, documented on the function: the race only fires while the event
+loop is free. A worker wedged in CPU-bound synchronous work (a Tree-sitter
+parse) still blocks the timer — that case needs `SCAN_PARSE_ISOLATION=1`
+(2.66.0). The two mechanisms cover different halves of the same failure.
+
+Unchanged when `maxScanMs` is unset: a plain `Promise.all`. 5 tests; suite 1549
+pass + 3 skipped.
+
+## [2.69.1] - 2026-07-31
+
+### Fixed — verifier summary counts, and the chunked-path denominator (#246)
+
+Two defects found by running 2.69.0's own instrumentation against real models.
+Both made the verifier look more permissive than it is.
+
+**1. The summary counted raw model strings.** `pairs[]` stored
+`normalizeVerdict(p.verdict)` while `summary` filtered the *unnormalized*
+`p.verdict`, so the two disagreed for any model that phrased a verdict its own
+way. `gemma3:12b` returns `"Likely Vulnerable"`; others return `"tp"` or
+`"false-positive"`. `normalizeVerdict` handles all of these for `pairs[]`
+(unknown → `UNCERTAIN`), but the summary scored them as neither TP, FP, nor
+uncertain. The summary is now derived from the normalized array.
+
+Related: when the model supplied its own `summary` block it was preferred over
+counting the pairs (`...(response.summary || {…})`). A model's arithmetic about
+its own answer is not a fact about our data; the self-report is now ignored.
+
+**2. `pairs_submitted` was dropped on the chunked path.** The parallel
+chunk loop (`verification.ts` ~765) accumulated pairs and verdicts across chunks
+but not the submitted denominator, so any file large enough to chunk contributed
+its pairs to the numerator and **zero** to the denominator. Caught on
+`lionsoul2014/ip2region`, which reported `pairsSubmitted: 20` against 74 verdicts
+plus 163 unmapped pairs — an impossible ratio that only showed up because
+2.69.0 records all three.
+
+Effect on 2.69.0 readings: `pairsOmitted` clamped low and `omissionRate` read far
+below the truth on any chunked file. `dropRate` is computed from verdict counts
+alone and was **not** affected by (2), but was affected by (1) on models with
+non-canonical verdict strings. Sweeps run on 2.69.0 should be re-run.
+
+3 regression tests pin verdict-phrasing normalization, self-report rejection, and
+the submitted denominator on an all-declined batch. Suite 1544 pass + 3 skipped.
+
+## [2.69.0] - 2026-07-30
+
+### Added — `pairsSubmitted` / `pairsOmitted`: the verifier's silent declines (#246)
+
+The 2.67.0 and 2.68.0 counters exposed what the verifier *said*. They still could
+not express what it was *asked* — and the gap turns out to be where almost all of
+its behaviour lives.
+
+`verification.ts` (~line 376) instructs the model:
+
+> Only include pairs where data CAN flow from source to sink.
+
+So a pair the verifier declines is **omitted from the response**, not returned as
+`FALSE_POSITIVE`. Nothing downstream could distinguish "declined silently" from
+"never submitted". Worse, `verification.ts` set `total_analyzed:
+response.pairs.length` — *analyzed* was defined as *returned*, so a model
+answering about 1 of 200 pairs reported "1 analyzed".
+
+Observed on `jwtk/jjwt` (gemma-3-27b, 2.68.0): **46 `verifyBatch` calls, every one
+`success: true` with a clean parse and ~344 output tokens — 15 verdicts total.**
+
+`BatchVerificationResult.summary` now carries `pairs_submitted` (the already-computed
+`sources.length * sinks.length`, summed across chunks), threaded through `runVerify`
+→ `runReport` → `ScanMeta.verification`, which gains:
+
+| field | meaning |
+|---|---|
+| `pairsSubmitted` | pairs actually sent to the verifier |
+| `pairsUnmapped` | pairs it returned that matched no known source/sink (drifted/hallucinated lines) |
+| `pairsOmitted` | `submitted - verdicts - unmapped` — asked about, never mentioned |
+| `omissionRate` | `pairsOmitted / pairsSubmitted` |
+
+Minimal live demonstration (single Java file, 2 sources × 3 sinks):
+
+```json
+{ "truePositives": 3, "falsePositives": 0, "uncertain": 0,
+  "pairsSubmitted": 6, "pairsOmitted": 3, "omissionRate": 0.5, "dropRate": 0 }
+```
+
+`dropRate: 0` reads as "affirmed everything, declined nothing" — the verifier
+actually declined **half** the pairs, silently. That is #246's illusion in one file.
+
+**Read `dropRate` only alongside `omissionRate`.** dropRate is over returned
+verdicts alone; on its own it is the same trap as `Finding.exploitable`.
+
+Harness updated to match: `baseline-stats.json.verification` gains the four fields,
+`summary.csv` gains `verifyPairsSubmitted` / `verifyPairsOmitted` /
+`verifyOmissionRate`. 7 tests; suite 1541 pass + 3 skipped.
+
+## [2.68.0] - 2026-07-30
+
+### Changed — `meta.verification`: split "verification enabled" from "verifier spoke" (#246)
+
+**Replaces `filesVerified` (2.67.0) with `filesVerificationEnabled` + `filesWithVerdicts`.**
+Breaking for anyone who read the 2.67.0 field — published the same day, no known
+consumer, and the old name asserted something untrue, so it is corrected rather
+than aliased.
+
+Found by running the new counters through the Java harness on `apache/commons-csv`:
+**170 findings emitted, 12 files with verification enabled, 0 verdicts returned.**
+
+`runVerify` short-circuits to an empty result when a file has no merged sources
+or no merged sinks (`workflow.ts:669`), and `runReport` then falls through to the
+unverified `generateFindings` branch. Those findings ship having never been seen
+by the verifier. 2.67.0's `filesVerified` counted the *request*, not the
+*judgement*, so it reported 12 for a file set the verifier never judged.
+
+This is a fourth structural reason #246 never observed a downgraded critical,
+alongside the three in 2.67.0's entry: a large share of findings are not
+verifier output at all. The gap between the two new fields measures it directly.
+
+`dropRate: 0` is now readable only in company with `filesWithVerdicts` — 0 drops
+out of 0 verdicts means "nothing was judged", not "nothing was dropped". 5 tests;
+suite 1539 pass + 3 skipped.
+
 ## [2.67.0] - 2026-07-30
 
 ### Added — `ScanMeta.verification`: the verifier's own verdict tallies (#246)

package/dist/agents/mastra/workflow.d.ts

@@ -43,6 +43,16 @@ export interface WorkflowOutput {
         truePositives: number;
         falsePositives: number;
         uncertain: number;
+        /**
+         * cognium-ai#246 — pairs submitted to the verifier, and pairs it returned
+         * that failed to map back to a known source/sink. Together with the
+         * verdict counts these make the verifier's silent losses measurable:
+         *   omitted = pairsSubmitted - (TP + FP + uncertain) - pairsUnmapped
+         */
+        pairsSubmitted: number;
+        pairsUnmapped: number;
+        /** #252 B — pairs never sent because per-file verifier fan-out hit its cap. */
+        pairsDroppedByBudget: number;
         totalTimeMs: number;
     };
     /**
@@ -64,7 +74,19 @@ export declare function runMerge(patternSources: any[], patternSinks: any[], enr
 /**
  * Run report generation step
  */
-export declare function runReport(filePath: string, mergedSources: any[], mergedSinks: any[], verificationResults: any[], patternMatchTimeMs: number, enrichTimeMs: number, verifyTimeMs: number, verificationEnabled?: boolean, sastFindings?: any[], dfg?: DFG, types?: any[], sourceCode?: string): WorkflowOutput;
+export declare function runReport(filePath: string, mergedSources: any[], mergedSinks: any[], verificationResults: any[], patternMatchTimeMs: number, enrichTimeMs: number, verifyTimeMs: number, verificationEnabled?: boolean, sastFindings?: any[], dfg?: DFG, types?: any[], sourceCode?: string, 
+/**
+ * cognium-ai#246 — verifier submission accounting from `runVerify`.
+ * `verificationResults` only carries pairs the model returned AND that
+ * mapped back to a known source/sink, so on its own it cannot express how
+ * much the verifier was asked about. Optional: legacy callers (tests) omit
+ * it and the stats fall back to the returned counts.
+ */
+verifyAccounting?: {
+    pairsSubmitted: number;
+    pairsUnmapped: number;
+    pairsDroppedByBudget: number;
+}): WorkflowOutput;
 /**
  * Run security analysis on a single file
  *

package/dist/agents/mastra/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../../src/agents/mastra/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAoC,GAAG,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAOvF,OAAO,KAAK,EACV,SAAS,EAEV,MAAM,0CAA0C,CAAC;AAKlD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAYrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGpF,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,UAAU,EACV,UAAU,GACX,MAAM,YAAY,CAAC;AAMpB,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAE1E,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE;QACR,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;KAC7C,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,GAAG,EAAE,CAAC;IACvB;;;;;;OAMG;IACH,YAAY,EAAE,GAAG,EAAE,CAAC;IACpB,KAAK,EAAE;QACL,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,uBAAuB,EAAE,MAAM,CAAC;QAChC,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AA8VD,wBAAgB,QAAQ,CACtB,cAAc,EAAE,GAAG,EAAE,EACrB,YAAY,EAAE,GAAG,EAAE,EACnB,gBAAgB,EAAE,GAAG,GAAG,IAAI,EAC5B,mBAAmB,EAAE,MAAM,EAC3B,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,EAChC,QAAQ,CAAC,EAAE,MAAM;;;EAwHlB;AA6OD;;GAEG;AAIH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,GAAG,EAAE,EACpB,WAAW,EAAE,GAAG,EAAE,EAClB,mBAAmB,EAAE,GAAG,EAAE,EAC1B,kBAAkB,EAAE,MAAM,EAC1B,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,mBAAmB,GAAE,OAAc,EACnC,YAAY,GAAE,GAAG,EAAO,EAQxB,GAAG,CAAC,EAAE,GAAG,EAKT,KAAK,CAAC,EAAE,GAAG,EAAE,EAMb,UAAU,CAAC,EAAE,MAAM,GAClB,cAAc,CA+ShB;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;CACnE,GACA,OAAO,CAAC,cAAc,CAAC,CA0JzB;AAED;;GAEG;AACH,wBAAuB,iBAAiB,CACtC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/B,yDAAyD;IACzD,cAAc,CAAC,EAAE,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;CACnE,GACA,cAAc,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,GAAG,CAAA;CAAE,CAAC,CA0E9D;AAGD,eAAO,MAAM,wBAAwB;;;;CAIpC,CAAC"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../../src/agents/mastra/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAoC,GAAG,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAOvF,OAAO,KAAK,EACV,SAAS,EAEV,MAAM,0CAA0C,CAAC;AAKlD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAarD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGpF,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,UAAU,EACV,UAAU,GACX,MAAM,YAAY,CAAC;AAMpB,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAE1E,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE;QACR,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;KAC7C,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,GAAG,EAAE,CAAC;IACvB;;;;;;OAMG;IACH,YAAY,EAAE,GAAG,EAAE,CAAC;IACpB,KAAK,EAAE;QACL,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,uBAAuB,EAAE,MAAM,CAAC;QAChC,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB;;;;;WAKG;QACH,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;QACtB,+EAA+E;QAC/E,oBAAoB,EAAE,MAAM,CAAC;QAC7B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AA+XD,wBAAgB,QAAQ,CACtB,cAAc,EAAE,GAAG,EAAE,EACrB,YAAY,EAAE,GAAG,EAAE,EACnB,gBAAgB,EAAE,GAAG,GAAG,IAAI,EAC5B,mBAAmB,EAAE,MAAM,EAC3B,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,EAChC,QAAQ,CAAC,EAAE,MAAM;;;EAwHlB;AAgQD;;GAEG;AAIH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,GAAG,EAAE,EACpB,WAAW,EAAE,GAAG,EAAE,EAClB,mBAAmB,EAAE,GAAG,EAAE,EAC1B,kBAAkB,EAAE,MAAM,EAC1B,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,mBAAmB,GAAE,OAAc,EACnC,YAAY,GAAE,GAAG,EAAO,EAQxB,GAAG,CAAC,EAAE,GAAG,EAKT,KAAK,CAAC,EAAE,GAAG,EAAE,EAMb,UAAU,CAAC,EAAE,MAAM;AACnB;;;;;;GAMG;AACH,gBAAgB,CAAC,EAAE;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;CAC9B,GACA,cAAc,CAkThB;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;CACnE,GACA,OAAO,CAAC,cAAc,CAAC,CAgKzB;AAED;;GAEG;AACH,wBAAuB,iBAAiB,CACtC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/B,yDAAyD;IACzD,cAAc,CAAC,EAAE,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;CACnE,GACA,cAAc,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,GAAG,CAAA;CAAE,CAAC,CAgF9D;AAGD,eAAO,MAAM,wBAAwB;;;;CAIpC,CAAC"}

package/dist/agents/mastra/workflow.js

@@ -13,6 +13,7 @@ import { classifySource, applyClassificationGate, } from '../../security-scan/so
 import { shouldGateInterproceduralParam, classifyEntryPointTier, } from '../../analysis/entry-point-detection.js';
 import { withLLMContext } from '../../llm/debug-context.js';
 import { fileNeedsEnrichment } from '../../llm/pre-filter.js';
+import { isMinifiedContent } from '../../utils/file-skip.js';
 import { llmCallLogger } from '../../llm/call-logger.js';
 import { resetLLMCallLimiter, isSwarmActive } from '../../llm/call-limiter.js';
 import { resetLLMPerFileBreaker, resetLLMBreakerForScan } from '../../llm/ax-client.js';
@@ -186,6 +187,36 @@ async function runEnrich(filePath, sourceCode, types, imports, patternSources, p
     // the workflow proceeds with `additionalSources: [], additionalSinks: []`
     // and static-analysis sources/sinks flow through merge/verify unchanged.
     // Disable via `LLM_PREFILTER=0` to restore legacy 2-calls-per-file shape.
+    // cognium-ai#252 (problem D) — unify the skip thresholds across stages.
+    // Verification has refused minified/bundled content since #102, but that
+    // decision was made at the END of the pipeline: the file had already paid
+    // for a parse, the SAST passes, and both discovery calls before anything
+    // looked at its shape. The walker's own caps don't catch this class either
+    // — `preFlightSkip` refuses a line over 50k chars, while the minified
+    // predicate trips at 5k, so everything in between sailed through the
+    // expensive stages only to be dropped at the last one.
+    //
+    // Same predicate, applied earlier. Static findings are unaffected (this
+    // gates LLM enrichment only), matching #102's contract exactly.
+    if (isMinifiedContent(sourceCode)) {
+        llmCallLogger.logSkip({
+            signature: 'discoverSources',
+            phase: 'enrichment',
+            context: { file: filePath, method: moduleName },
+        });
+        llmCallLogger.logSkip({
+            signature: 'discoverSinks',
+            phase: 'enrichment',
+            context: { file: filePath, method: moduleName },
+        });
+        const sizeKb = Math.round(sourceCode.length / 1024);
+        console.error(`  ⚠ enrichment: skipping minified content (${sizeKb}kb). ` +
+            `Static findings unchanged. cognium-ai#252`);
+        return {
+            enrichmentResult: null,
+            processingTimeMs: Date.now() - startTime,
+        };
+    }
     if (!fileNeedsEnrichment(sourceCode)) {
         // Synthetic JSONL entries so `analyze-llm-log.ts` can surface the
         // skip rate. Two entries (one per call we *would* have fired) keep
@@ -518,6 +549,11 @@ contextProfile) {
             truePositives: 0,
             falsePositives: 0,
             uncertain: 0,
+            // #246 — nothing submitted: verification disabled, or the file had no
+            // merged sources or sinks. Distinct from "submitted and all omitted".
+            pairsSubmitted: 0,
+            pairsUnmapped: 0,
+            pairsDroppedByBudget: 0,
             processingTimeMs: 0,
         };
     }
@@ -627,6 +663,17 @@ contextProfile) {
             truePositives: batchResult.summary.true_positives,
             falsePositives: batchResult.summary.false_positives,
             uncertain: batchResult.summary.uncertain,
+            // cognium-ai#246 — the denominator. Without it, "the verifier declined
+            // nothing" is unfalsifiable: the prompt tells the model to omit
+            // non-flowing pairs, so a decline leaves no trace in the response.
+            pairsSubmitted: batchResult.summary.pairs_submitted ?? 0,
+            // #246 — pairs the model DID return that we then discarded because
+            // `pair.source_line` / `pair.sink_line` matched no known source/sink
+            // (hallucinated or shifted line numbers). A second silent loss, distinct
+            // from the model's own omissions.
+            pairsUnmapped: Math.max(0, batchResult.pairs.length - results.length),
+            // #252 B — pairs our own fan-out budget refused to send.
+            pairsDroppedByBudget: batchResult.summary.pairs_dropped_by_budget ?? 0,
             processingTimeMs: batchResult.processingTimeMs,
         };
     }
@@ -637,6 +684,9 @@ contextProfile) {
             truePositives: 0,
             falsePositives: 0,
             uncertain: mergedSources.length * mergedSinks.length,
+            pairsSubmitted: mergedSources.length * mergedSinks.length,
+            pairsUnmapped: 0,
+            pairsDroppedByBudget: 0,
             processingTimeMs: Date.now() - startTime,
         };
     }
@@ -666,7 +716,15 @@ types,
 // "application/json…")` before an XSS-typed sink. Optional — when
 // omitted the JSON-content-type check is a no-op and the existing
 // suppression set is unchanged.
-sourceCode) {
+sourceCode, 
+/**
+ * cognium-ai#246 — verifier submission accounting from `runVerify`.
+ * `verificationResults` only carries pairs the model returned AND that
+ * mapped back to a known source/sink, so on its own it cannot express how
+ * much the verifier was asked about. Optional: legacy callers (tests) omit
+ * it and the stats fall back to the returned counts.
+ */
+verifyAccounting) {
     const vulnerabilities = [];
     if (verificationEnabled && verificationResults.length > 0) {
         // cognium-ai#213 — collapse verified findings by (sink.line,
@@ -953,6 +1011,9 @@ sourceCode) {
             truePositives: verificationResults.filter((v) => v.result?.verdict === 'TRUE_POSITIVE').length,
             falsePositives: verificationResults.filter((v) => v.result?.verdict === 'FALSE_POSITIVE').length,
             uncertain: verificationResults.filter((v) => v.result?.verdict === 'UNCERTAIN').length,
+            pairsSubmitted: verifyAccounting?.pairsSubmitted ?? verificationResults.length,
+            pairsUnmapped: verifyAccounting?.pairsUnmapped ?? 0,
+            pairsDroppedByBudget: verifyAccounting?.pairsDroppedByBudget ?? 0,
             totalTimeMs: patternMatchTimeMs + enrichTimeMs + verifyTimeMs,
         },
     };
@@ -1043,7 +1104,13 @@ export async function analyzeFile(filePath, sourceCode, options) {
     }
     const report = runReport(filePath, mergeResult.mergedSources, mergeResult.mergedSinks, verifyResult.verificationResults, patternMatchTimeMs, enrichResult.processingTimeMs, verifyResult.processingTimeMs, enableVerification, patternResult.sastFindings, patternResult.dfg, // #26
     patternResult.types, // #111
-    sourceCode);
+    sourceCode, // #172
+    // cognium-ai#246 — submission denominator + unmapped-pair loss.
+    {
+        pairsSubmitted: verifyResult.pairsSubmitted,
+        pairsUnmapped: verifyResult.pairsUnmapped,
+        pairsDroppedByBudget: verifyResult.pairsDroppedByBudget,
+    });
     // cognium-ai#154 (L5c) — surface the cluster vector extracted while the
     // IR was live in `runPatternMatch`. Keeps `runReport`'s signature
     // untouched (its job is source×sink → vuln synthesis; the vector is
@@ -1081,7 +1148,13 @@ export async function* analyzeFileStream(filePath, sourceCode, options) {
     yield { step: 'report', status: 'running' };
     const reportResult = runReport(filePath, mergeResult.mergedSources, mergeResult.mergedSinks, verifyResult.verificationResults, patternMatchTimeMs, enrichResult.processingTimeMs, verifyResult.processingTimeMs, enableVerification, patternResult.sastFindings, patternResult.dfg, // #26
     patternResult.types, // #111
-    sourceCode);
+    sourceCode, // #172
+    // cognium-ai#246 — submission denominator + unmapped-pair loss.
+    {
+        pairsSubmitted: verifyResult.pairsSubmitted,
+        pairsUnmapped: verifyResult.pairsUnmapped,
+        pairsDroppedByBudget: verifyResult.pairsDroppedByBudget,
+    });
     yield { step: 'report', status: 'completed', data: reportResult };
 }
 // Legacy export for compatibility