circle-ir-ai 4.28.0 → 4.30.0-rc.0

package/CHANGELOG.md

@@ -7,6 +7,53 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.30.0-rc.0] - 2026-10-29
+
+Release candidate, published under the npm `next` tag for the cost gates before a final 4.30.0. It contains everything below, merged since 4.29.0 (4.29.1 and 4.29.2 were bumped in the repo but never published).
+
+### Changed
+- **The LLM-path dependencies are pinned to exact versions (cognium-ai#810):** `@ax-llm/ax` 25.4.5, `@mastra/core` 1.79.0, `zod` 4.6.7, the versions in the lockfile CI tests against. A range let the same release install a different LLM client depending on the install date.
+
+### Fixed
+- **Nested test-tree excludes (cognium-ai#801)** — restore `**/tests/**` and exclude
+  nested `.../test/...` outside `src/main/` while keeping #615 Java `test` packages
+  scannable. Shared `shouldExcludeTestTreePath` for `SecurityScanner` and cognium-ai
+  `init` / `collectFiles`.
+
+### Changed
+- **Combined enrichment discovery (cognium-ai#780 S3)** — `runEnrich` issues one
+  `discoverSourcesAndSinksForLanguage` LLM call per file (was two parallel calls).
+  Prompts use a cache-friendly layout: static instructions and JSON schema before
+  `[CODE START]`, per-file context after. Language-discoverer cache sentinel
+  `lang-disc-v4`.
+
+### Fixed
+- **Truncation retry (cognium-ai#776 S2)** — `chatJSON` retries once with a larger output cap
+  when `finish_reason=length` leaves empty `content` (up to `REASONING_MAX_TOKENS`), reads
+  `reasoning_content` when present, and no longer counts truncation toward the project-dead
+  breaker.
+- **DeepSeek V4 reasoning budget (cognium-ai#776)** — `isThinkingModel()` now recognizes
+  `deepseek-v4*` ids (e.g. Fireworks `deepseek-v4p1-flash`) so they get the 16k completion
+  budget and 360s phase timeout instead of the 8k default.
+- **Concurrent `chatJSON` telemetry (cognium-ai#778)** — batch verification and parallel
+  enrichment discovery each use a dedicated `AxLLMClient` (`fork()` / fresh instance) so
+  per-call `lastUsage` and `lastErrorCategory` are not clobbered across concurrent requests.
+- **Verifier omission on thinking models (cognium-ai#777)** — when the verification-phase model
+  is a thinking/reasoning model (`isThinkingModel`), a successful batch answer with an empty
+  `pairs` array no longer labels static findings `refuted_by: 'omission'`; they stay
+  `UNVERIFIED` (`mode: attempted`) so default `{"pairs":[]}` responses do not mass-refute.
+- **Thinking verifier explicit verdicts (cognium-ai#777 S3)** — batch verification on
+  thinking/reasoning models (`isThinkingModel`) uses a prompt contract that requires an
+  explicit TRUE_POSITIVE / FALSE_POSITIVE / UNCERTAIN entry for every submitted pair so
+  omission is not mistaken for refutation; verify-cache `PROMPT_VER` bumped to `verify-v5`.
+- **High verifier omission telemetry (cognium-ai#777 S2)** — `ScanMeta.verification` now
+  includes `verifierModel` and sets `omissionRateElevated` (with a stderr `VERIFY_OMISSION`
+  warning) when omissionRate ≥ 99% on ≥ 20 submitted pairs.
+- **Prompt template substitution (cognium-ai#779)** — `fillPromptTemplate()` substitutes
+  `{name}` placeholders in one pass without interpreting `$&`, `$'`, `` $` `` or `$$` in scanned
+  code. Batch/single verification, discovery `getPrompt()`, and ax-client enrichment prompts
+  now use it instead of `String.replace` with string replacements.
+
 ### Added
 - **The ten MCP tools declare annotations** (4.18.0), each measured before it was written down.
   All ten are `readOnlyHint: true`, `destructiveHint: false`, `idempotentHint: true`: none writes,
@@ -116,6 +163,60 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   Unchanged on 4.9.29: OWASP 1415/1415, Juliet 243/243, SecuriBench 97.2%/6.7%, Go 89.5%,
   NodeJS 92.9%, CWE-Bench-Rust 100%, bash and HTML 100%.
 
+## [4.29.0] - 2026-10-17
+
+Minor release: `circle-ir` 4.15.0 → 4.16.1, LLM enrichment sinks anchored on the `scan --llm`
+merge path, and corrected SecuriBench and C# oracle scoring. 4.16.0 was not pinned: it carried
+four regressions, fixed upstream in 4.16.1 before this bump.
+
+### Changed
+- **`circle-ir` 4.15.0 → 4.16.1** (exact pin). 4.16.0 adds the navigation API (callers per
+  overload and through dispatch), `navigationTypes` extraction, `AnalyzerOptions.resources`, and
+  many recall and precision fixes across Java, C#, JS/TS, Go, Python and Rust. 4.16.1 fixes four
+  regressions found while benchmarking this bump. Java `analyze()` is back to 4.15.0 speed on
+  large classes (one NiFi file took 638 s on 4.16.0 and 0.83 s on 4.16.1; cognium-dev#806). A
+  `Character.is*` predicate on tainted text is no longer an `external_taint_escape`, which clears
+  SecuriBench Sanitizers2/6 (cognium-dev#807). Two C# false positives are fixed: a field
+  sanitized in another method (cognium-dev#808) and an `Array.IndexOf` allowlist guard
+  (cognium-dev#809). The underlying Java name-collision cause of #807 is cognium-dev#814.
+
+  Static suites, compared with 4.15.0 (packed 4.16.1, 27 runners):
+  - SecuriBench 97.2% / 6.7% → 97.7% / 6.7%;
+  - C# oracle 76.6% / 0.8% (3/367) → 77.1% / 0.3% (1/367);
+  - CWE-Bench-Java static 64 → 65 of 120;
+  - Python synthetic 72.2% → 74.0%;
+  - Vulnerability-goapp FPR 14.3% → 0.0%;
+  - the other 21 identical.
+
+  Figures before the scoring changes below.
+
+### Fixed
+- **LLM enrichment sinks are anchored in `runMerge`** (#330). The `scan --llm` merge path now
+  applies `resolveDiscoveryAnchor`, so an enrichment sink lands on a call node or carries
+  `llm-unanchored`, as in discovery mode. `runPatternMatch` forwards the IR calls for anchoring,
+  and LLM sinks merge on their post-anchor key.
+- **SecurityScanner test-tree excludes (cognium-ai#615)**. The engine walker no longer uses
+  unanchored `**/test/**` / `**/tests/**`, which also matched a Java package segment named
+  `test` under main source. It now mirrors the `init` template: `test/**`, `tests/**`,
+  `**/src/test/**`, `**/__tests__/**`.
+
+### Benchmarks
+- **SecuriBench Micro labels.** The runner read only the `@servlet vuln_count` annotation. Where
+  that annotation contradicts both `getVulnerabilityCount()` and the `/* BAD */` markers, the
+  method and markers now win, and every disagreement is printed (`benchmarks/lib/securibench-labels.ts`).
+  - Overrides: `pred/Pred2.java` 0 → 1 (the suite's one FP was a true positive),
+    `collections/Collections10.java` 0 → 1, `inter/Inter10.java` 2 → 1.
+  - Six other disagreements keep the annotation, because the markers side with it.
+  - On circle-ir 4.16.1: **TPR 97.3%, FPR 0.0%** (107/110, 0/13). With the old labels it was
+    97.7% / 6.7% (105/108, 1/15).
+- **C# oracle clean controls are scored against their category's taint sinks**
+  (`cleanScope()`, `benchmarks/lib/csharp-oracle-scoring.ts`).
+  - A placeholder `category: "clean"` case resolves through its paired `*Tp.cs`.
+  - 33 controls for a non-taint signal (for example `IncorrectDefaultPermsSafe.cs`, the
+    CWE-276 twin) leave the denominator.
+  - 95 general-FP or unmapped cases keep the any-flow rule.
+  - On circle-ir 4.16.1: **TPR 77.1% (340/441), FPR 0.0% (0/334)**.
+
 ## [4.28.0] - 2026-10-15
 
 Minor release: `circle-ir` 4.14.2 → 4.15.0, discovery prompts carry line numbers, verifier

package/dist/agents/mastra/workflow.d.ts

@@ -9,9 +9,10 @@
  */
 import type { DFG, ProjectProfile, TaintSanitizer } from 'circle-ir';
 import type { TypeShape } from '../../security-scan/source-classifier.js';
-import type { LLMConfig } from '../../llm/config.js';
+import { type LLMConfig } from '../../llm/config.js';
 import type { PackageCoordinate } from '../../cache/coordinate.js';
 import { type ClusterVector } from '../../cluster/cluster.js';
+import { type AnchorCallNode } from '../../llm/anchoring.js';
 export { patternMatchStep, enrichStep, mergeStep, verifyStep, reportStep, } from './steps.js';
 export type VerificationStrategy = 'complete' | 'sampled' | 'prioritized';
 export interface WorkflowInput {
@@ -97,7 +98,7 @@ export interface WorkflowOutput {
 }
 /** cognium-ai#591 — why `runEnrich` made no discovery call for a file. */
 export type EnrichmentSkipReason = 'prefilter' | 'minified';
-export declare function runMerge(patternSources: any[], patternSinks: any[], enrichmentResult: any | null, confidenceThreshold: number, sourceCode?: string, filePath?: string, types?: ReadonlyArray<TypeShape>, language?: string): {
+export declare function runMerge(patternSources: any[], patternSinks: any[], enrichmentResult: any | null, confidenceThreshold: number, sourceCode?: string, filePath?: string, types?: ReadonlyArray<TypeShape>, language?: string, irCalls?: ReadonlyArray<AnchorCallNode>): {
     mergedSources: any[];
     mergedSinks: any[];
 };
@@ -135,6 +136,13 @@ verifyAccounting?: {
      * callers omit it and keep the pre-#471 `UNVERIFIED` label.
      */
     submittedPairs?: UnverifiedPair[];
+    /**
+     * cognium-ai#777 — when false, a successful verifier answer that omits every
+     * pair stays `UNVERIFIED` instead of `refuted_by: 'omission'`. Set false for
+     * thinking/reasoning verifier models that often return `pairs: []` without
+     * assessing the batch.
+     */
+    treatOmissionAsRefutation?: boolean;
 }, 
 /**
  * cognium-ai#460 — the rest of `generateFindings`' argument list. With

package/dist/agents/mastra/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../../src/agents/mastra/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAoC,GAAG,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAOvG,OAAO,KAAK,EACV,SAAS,EAEV,MAAM,0CAA0C,CAAC;AAKlD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAcrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGpF,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,UAAU,EACV,UAAU,GACX,MAAM,YAAY,CAAC;AAMpB,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAE1E,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE;QACR,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;KAC7C,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,GAAG,EAAE,CAAC;IACvB;;;;;;OAMG;IACH,YAAY,EAAE,GAAG,EAAE,CAAC;IACpB,KAAK,EAAE;QACL,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,uBAAuB,EAAE,MAAM,CAAC;QAChC,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB;;;;;WAKG;QACH,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;QACtB,+EAA+E;QAC/E,oBAAoB,EAAE,MAAM,CAAC;QAC7B;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gHAAgH;QAChH,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;WAIG;QACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,gFAAgF;QAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,oBAAoB,CAAA;KAAE,CAAC;CACnD;AAED,0EAA0E;AAC1E,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,UAAU,CAAC;AA2Y5D,wBAAgB,QAAQ,CACtB,cAAc,EAAE,GAAG,EAAE,EACrB,YAAY,EAAE,GAAG,EAAE,EACnB,gBAAgB,EAAE,GAAG,GAAG,IAAI,EAC5B,mBAAmB,EAAE,MAAM,EAC3B,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,EAChC,QAAQ,CAAC,EAAE,MAAM;IAqHf,aAAa;IACb,WAAW;EAEd;AAmSD,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AAIH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,GAAG,EAAE,EACpB,WAAW,EAAE,GAAG,EAAE,EAClB,mBAAmB,EAAE,GAAG,EAAE,EAC1B,kBAAkB,EAAE,MAAM,EAC1B,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,mBAAmB,GAAE,OAAc,EACnC,YAAY,GAAE,GAAG,EAAO,EAQxB,GAAG,CAAC,EAAE,GAAG,EAKT,KAAK,CAAC,EAAE,GAAG,EAAE,EAMb,UAAU,CAAC,EAAE,MAAM;AACnB;;;;;;GAMG;AACH,gBAAgB,CAAC,EAAE;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;IACnC,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,cAAc,EAAE,CAAC;CACnC;AACD;;;;;;;;;;GAUG;AACH,YAAY,CAAC,EAAE;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;CAC/B,GACA,cAAc,CA6gBhB;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;CACnE,GACA,OAAO,CAAC,cAAc,CAAC,CA4KzB;AAED;;GAEG;AACH,wBAAuB,iBAAiB,CACtC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/B,yDAAyD;IACzD,cAAc,CAAC,EAAE,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;CACnE,GACA,cAAc,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,GAAG,CAAA;CAAE,CAAC,CAuF9D;AAGD,eAAO,MAAM,wBAAwB;IACnC,EAAE;IACF,GAAG;IACH,MAAM;CACP,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,aAAa,EAAE,OAAO,GACrB,MAAM,CAWR"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../../src/agents/mastra/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAoC,GAAG,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAOvG,OAAO,KAAK,EACV,SAAS,EAEV,MAAM,0CAA0C,CAAC;AAKlD,OAAO,EAAwC,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAc3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,UAAU,EACV,UAAU,GACX,MAAM,YAAY,CAAC;AAMpB,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAE1E,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE;QACR,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;KAC7C,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,GAAG,EAAE,CAAC;IACvB;;;;;;OAMG;IACH,YAAY,EAAE,GAAG,EAAE,CAAC;IACpB,KAAK,EAAE;QACL,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,uBAAuB,EAAE,MAAM,CAAC;QAChC,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB;;;;;WAKG;QACH,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;QACtB,+EAA+E;QAC/E,oBAAoB,EAAE,MAAM,CAAC;QAC7B;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gHAAgH;QAChH,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;WAIG;QACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,gFAAgF;QAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,oBAAoB,CAAA;KAAE,CAAC;CACnD;AAED,0EAA0E;AAC1E,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,UAAU,CAAC;AAmZ5D,wBAAgB,QAAQ,CACtB,cAAc,EAAE,GAAG,EAAE,EACrB,YAAY,EAAE,GAAG,EAAE,EACnB,gBAAgB,EAAE,GAAG,GAAG,IAAI,EAC5B,mBAAmB,EAAE,MAAM,EAC3B,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,EAChC,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC;IAsKrC,aAAa;IACb,WAAW;EAEd;AA8SD,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AAIH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,GAAG,EAAE,EACpB,WAAW,EAAE,GAAG,EAAE,EAClB,mBAAmB,EAAE,GAAG,EAAE,EAC1B,kBAAkB,EAAE,MAAM,EAC1B,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,mBAAmB,GAAE,OAAc,EACnC,YAAY,GAAE,GAAG,EAAO,EAQxB,GAAG,CAAC,EAAE,GAAG,EAKT,KAAK,CAAC,EAAE,GAAG,EAAE,EAMb,UAAU,CAAC,EAAE,MAAM;AACnB;;;;;;GAMG;AACH,gBAAgB,CAAC,EAAE;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;IACnC,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,cAAc,EAAE,CAAC;IAClC;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AACD;;;;;;;;;;GAUG;AACH,YAAY,CAAC,EAAE;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;CAC/B,GACA,cAAc,CA8gBhB;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;CACnE,GACA,OAAO,CAAC,cAAc,CAAC,CA8KzB;AAED;;GAEG;AACH,wBAAuB,iBAAiB,CACtC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/B,yDAAyD;IACzD,cAAc,CAAC,EAAE,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;CACnE,GACA,cAAc,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,GAAG,CAAA;CAAE,CAAC,CAyF9D;AAGD,eAAO,MAAM,wBAAwB;IACnC,EAAE;IACF,GAAG;IACH,MAAM;CACP,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,aAAa,EAAE,OAAO,GACrB,MAAM,CAmBR"}

package/dist/agents/mastra/workflow.js

@@ -8,9 +8,10 @@
  * analysis pipeline using the core analysis logic.
  */
 import { generateFindings, getRuleInfo } from 'circle-ir';
-import { isSuppressedSinkShape } from '../../security-scan/sink-filters.js';
+import { isPhantomLineSink, isSuppressedSinkShape } from '../../security-scan/sink-filters.js';
 import { classifySource, applyClassificationGate, } from '../../security-scan/source-classifier.js';
 import { shouldGateInterproceduralParam, classifyEntryPointTier, } from '../../analysis/entry-point-detection.js';
+import { getDefaultLLMConfig, isThinkingModel } from '../../llm/config.js';
 import { withLLMContext } from '../../llm/debug-context.js';
 import { fileNeedsEnrichment } from '../../llm/pre-filter.js';
 import { toSupportedLLMLanguage } from '../../llm/prompts/index.js';
@@ -20,6 +21,7 @@ import { resetLLMCallLimiter, isSwarmActive } from '../../llm/call-limiter.js';
 import { resetLLMPerFileBreaker, resetLLMBreakerForScan } from '../../llm/ax-client.js';
 import { getTreeCache, computeTreeCacheKey, computeRuleSetFingerprint, } from '../../cache/tree-cache.js';
 import { extractClusterVector } from '../../cluster/cluster.js';
+import { resolveDiscoveryAnchor, } from '../../llm/anchoring.js';
 // Re-export the Mastra step definitions
 export { patternMatchStep, enrichStep, mergeStep, verifyStep, reportStep, } from './steps.js';
 // ============================================================================
@@ -145,6 +147,9 @@ coordinate) {
         // pre-2.33.0 cached entries will deserialize with `clusterVector`
         // undefined and be excluded from clustering on that scan.
         clusterVector: extractClusterVector(result),
+        // cognium-ai#330 — forward calls so enrichment sinks can be anchored in
+        // `runMerge` the same way discovery mode does in `DiscoveryEngine`.
+        calls: (result.calls ?? []),
     };
     // cognium-ai#153 — populate persistent tree cache. Disk-write errors
     // never fail the workflow. #158 Round 2 — coordinate is honored by
@@ -222,7 +227,7 @@ async function runEnrich(filePath, sourceCode, types, imports, patternSources, p
             skippedBy: 'minified',
         };
     }
-    if (!fileNeedsEnrichment(sourceCode)) {
+    if (!fileNeedsEnrichment(sourceCode, language)) {
         // Synthetic JSONL entries so `analyze-llm-log.ts` can surface the
         // skip rate. Two entries (one per call we *would* have fired) keep
         // the per-signature aggregate numerator/denominator coherent.
@@ -246,7 +251,7 @@ async function runEnrich(filePath, sourceCode, types, imports, patternSources, p
         };
     }
     const { getAxLLMClient } = await import('../../llm/ax-client.js');
-    const client = getAxLLMClient(llmConfig);
+    const discoveryClient = getAxLLMClient(llmConfig);
     const functionNames = types[0]?.methods?.map((m) => m.name).join(', ') || '';
     const functionName = functionNames.split(',')[0]?.trim() || 'main';
     // cognium-ai#591 — pass the real language through. Before this, every
@@ -265,23 +270,15 @@ async function runEnrich(filePath, sourceCode, types, imports, patternSources, p
         .map((s) => `${s.type}:${s.line}`)
         .sort()
         .join(', ');
-    // 2 LLM calls in parallel (source + sink discovery). cognium-ai#139.
-    const [rawSources, rawSinks] = await withLLMContext({ file: filePath, method: moduleName, phase: 'enrichment' }, () => Promise.all([
-        // Source discovery
-        client.discoverSourcesForLanguage(llmLanguage, {
-            code: sourceCode,
-            functionName,
-            moduleRole: 'unknown', // Role intentionally not classified here — see runEnrich docstring
-            existingSources: canonPatternPairs(patternSources),
-        }),
-        // Sink discovery
-        client.discoverSinksForLanguage(llmLanguage, {
-            code: sourceCode,
-            functionName,
-            methodCalls: '',
-            existingSinks: canonPatternPairs(patternSinks),
-        }),
-    ]));
+    // Single combined discovery call (cognium-ai#780 S3); was 2 parallel calls (#139).
+    const { additionalSources: rawSources, additionalSinks: rawSinks } = await withLLMContext({ file: filePath, method: moduleName, phase: 'enrichment' }, () => discoveryClient.discoverSourcesAndSinksForLanguage(llmLanguage, {
+        code: sourceCode,
+        functionName,
+        moduleRole: 'unknown', // Role intentionally not classified here — see runEnrich docstring
+        methodCalls: '',
+        existingSources: canonPatternPairs(patternSources),
+        existingSinks: canonPatternPairs(patternSinks),
+    }));
     // #35: validate LLM-discovered line numbers against file bounds. Small/
     // weak models often echo the few-shot example line literally (e.g.
     // line=15 from the sink prompt template), producing CWE-89 sinks at
@@ -358,7 +355,17 @@ function findEnclosing(types, line) {
     }
     return {};
 }
-export function runMerge(patternSources, patternSinks, enrichmentResult, confidenceThreshold, sourceCode, filePath, types, language) {
+function methodLineBounds(types, line) {
+    const { type, method } = findEnclosing(types, line);
+    if (method) {
+        return { start: method.start_line, end: method.end_line };
+    }
+    if (type) {
+        return { start: type.start_line, end: type.end_line };
+    }
+    return undefined;
+}
+export function runMerge(patternSources, patternSinks, enrichmentResult, confidenceThreshold, sourceCode, filePath, types, language, irCalls) {
     // #48: previously these maps were keyed by `line` alone, which
     // collapsed any two sources / sinks that landed on the same source
     // line — even when they had different types or different variables.
@@ -435,34 +442,61 @@ export function runMerge(patternSources, patternSinks, enrichmentResult, confide
     }
     if (enrichmentResult) {
         for (const llmSink of enrichmentResult.additionalSinks) {
-            const key = sinkKey(llmSink);
-            const existing = sinksByKey.get(key);
+            const llmSinkCode = sliceLine(sourceCode, llmSink.line);
+            // cognium-ai#808 — run phantom/sink-shape guards on the LLM's
+            // original line before re-anchoring. Relocating onto a real call
+            // must not bypass suppression of comment/Javadoc/blank LLM lines.
+            const originalLineTrimmed = (llmSinkCode ?? '').trim();
+            if (originalLineTrimmed) {
+                if (isPhantomLineSink(llmSinkCode)
+                    || isSuppressedSinkShape(llmSinkCode, llmSink.type, filePath, null, llmSink.line, sourceCode)) {
+                    continue;
+                }
+            }
+            let sinkLine = llmSink.line;
+            let anchor;
+            const bounds = methodLineBounds(types, llmSink.line);
+            if (irCalls && bounds) {
+                const snippet = llmSinkCode && llmSinkCode.trim().length > 0
+                    ? llmSinkCode
+                    : llmSink.method
+                        ? `${llmSink.method}(`
+                        : '';
+                const resolved = resolveDiscoveryAnchor(llmSink.line, patternSinks, irCalls, bounds.start, bounds.end, llmSink.type, snippet);
+                sinkLine = resolved.line;
+                if (resolved.anchor !== 'ir-sink') {
+                    anchor = resolved.anchor;
+                }
+            }
+            // Product enrichment path: unanchored LLM sinks are not emitted (#808).
+            if (anchor === 'llm-unanchored') {
+                continue;
+            }
+            const anchoredKey = sinkKey({ line: sinkLine, type: llmSink.type });
+            const originalKey = sinkKey({ line: llmSink.line, type: llmSink.type });
+            const existingAtAnchored = sinksByKey.get(anchoredKey);
+            const existingAtOriginal = sinksByKey.get(originalKey);
+            const existing = existingAtAnchored ?? existingAtOriginal;
+            const mergeKey = existingAtAnchored ? anchoredKey : (existingAtOriginal ? originalKey : anchoredKey);
             if (existing) {
-                sinksByKey.set(key, {
+                sinksByKey.set(mergeKey, {
                     ...existing,
                     confidence: Math.min(1.0, (existing.confidence || 0.8) + 0.2),
                 });
             }
             else if (llmSink.confidence >= confidenceThreshold) {
-                // #90/#91/#92/#93/#94: previously LLM-discovered sinks omitted
-                // the `code` field entirely. Downstream `isSuppressedSinkShape`
-                // safely returns false on undefined → phantom-line findings
-                // leak through to the report. Look up the source line so the
-                // existing sink-shape filters (and the new phantom-line guard)
-                // can do their job.
-                const llmSinkCode = sliceLine(sourceCode, llmSink.line);
-                sinksByKey.set(key, {
-                    line: llmSink.line,
+                sinksByKey.set(anchoredKey, {
+                    line: sinkLine,
                     type: llmSink.type,
                     cwe: llmSink.cwe,
-                    location: `LLM-discovered at line ${llmSink.line}`,
+                    location: `LLM-discovered at line ${sinkLine}`,
                     confidence: llmSink.confidence,
                     method: llmSink.method,
                     argPositions: llmSink.argPositions,
-                    code: llmSinkCode,
+                    code: sliceLine(sourceCode, sinkLine) ?? llmSinkCode,
                     file: filePath,
-                    // #26: pure-LLM-discovered sink — see source-side comment above.
                     discoveryMethod: 'llm',
+                    ...(anchor ? { anchor } : {}),
                 });
             }
         }
@@ -552,6 +586,13 @@ language,
 // rubric on library/tool repos and cut the CWE-22 hallucination
 // bucket documented in cognium-dev#245 RC3.
 contextProfile) {
+    const verifierModel = {
+        ...getDefaultLLMConfig(),
+        ...llmConfig,
+    }.phases.verification.model;
+    // cognium-ai#777 — reasoning models often return `{"pairs":[]}` without assessing
+    // pairs; treating omission as refutation over-labels real findings FALSE_POSITIVE.
+    const treatOmissionAsRefutation = !isThinkingModel(verifierModel);
     if (!enableVerification || mergedSources.length === 0 || mergedSinks.length === 0) {
         return {
             verificationResults: [],
@@ -568,6 +609,7 @@ contextProfile) {
             // cognium-ai#471 — nothing was sent to the verifier.
             submittedPairs: [],
             verificationError: undefined,
+            treatOmissionAsRefutation,
             processingTimeMs: 0,
         };
     }
@@ -703,6 +745,7 @@ contextProfile) {
             // "refuted by omission" from "never asked" (sampling) when it labels the
             // static findings it keeps.
             submittedPairs: limitedSources.flatMap((s) => limitedSinks.map((k) => ({ sourceLine: s.line, sinkLine: k.line }))),
+            treatOmissionAsRefutation,
             processingTimeMs: batchResult.processingTimeMs,
         };
     }
@@ -728,6 +771,7 @@ contextProfile) {
             unverifiedPairs,
             submittedPairs: [], // #471 — nothing was answered
             verificationError: (error instanceof Error ? error.message : String(error)) || 'verification_failed',
+            treatOmissionAsRefutation,
             processingTimeMs: Date.now() - startTime,
         };
     }
@@ -1075,7 +1119,8 @@ taintContext) {
     //     sampler never sent was never asked about);
     //   - no contributing pair sits in a failed chunk (#564 keeps those open).
     const submittedPairKeys = new Set((verifyAccounting?.submittedPairs ?? []).map((p) => `${p.sourceLine}:${p.sinkLine}`));
-    const omissionIsRefutation = submittedPairKeys.size > 0 &&
+    const omissionIsRefutation = (verifyAccounting?.treatOmissionAsRefutation ?? true) &&
+        submittedPairKeys.size > 0 &&
         (verifyAccounting?.pairsDroppedByBudget ?? 0) === 0 &&
         (verifyAccounting?.pairsUnmapped ?? 0) === 0;
     const refutedByOmission = (finding) => {
@@ -1327,7 +1372,7 @@ export async function analyzeFile(filePath, sourceCode, options) {
         enrichResult = await runEnrich(filePath, sourceCode, patternResult.types, patternResult.imports, patternResult.patternSources, patternResult.patternSinks, enableEnrichment, language, llmConfig);
     }
     const mergeResult = runMerge(patternResult.patternSources, patternResult.patternSinks, enrichResult.enrichmentResult, confidenceThreshold, sourceCode, filePath, patternResult.types, // cognium-ai#128 gate
-    language);
+    language, patternResult.calls);
     // L2 — same pattern as enrich: wrap when the operator has opted in
     // via CP_VERIFY_TIMEOUT_MS.
     let verifyResult;
@@ -1351,6 +1396,7 @@ export async function analyzeFile(filePath, sourceCode, options) {
         unverifiedPairs: verifyResult.unverifiedPairs,
         verificationError: verifyResult.verificationError,
         submittedPairs: verifyResult.submittedPairs, // cognium-ai#471
+        treatOmissionAsRefutation: verifyResult.treatOmissionAsRefutation,
     }, 
     // cognium-ai#460 — full generateFindings argument list.
     { language, sanitizers: patternResult.sanitizers });
@@ -1388,7 +1434,7 @@ export async function* analyzeFileStream(filePath, sourceCode, options) {
     yield { step: 'enrich', status: 'completed', data: enrichResult };
     yield { step: 'merge', status: 'running' };
     const mergeResult = runMerge(patternResult.patternSources, patternResult.patternSinks, enrichResult.enrichmentResult, 0.7, sourceCode, filePath, patternResult.types, // cognium-ai#128 gate
-    language);
+    language, patternResult.calls);
     yield { step: 'merge', status: 'completed', data: mergeResult };
     yield { step: 'verify', status: 'running' };
     const verifyResult = await runVerify(filePath, sourceCode, mergeResult.mergedSources, mergeResult.mergedSinks, patternResult.types, enableVerification, maxVerificationTargets, verificationStrategy, llmConfig, language, contextProfile);
@@ -1407,6 +1453,7 @@ export async function* analyzeFileStream(filePath, sourceCode, options) {
         unverifiedPairs: verifyResult.unverifiedPairs,
         verificationError: verifyResult.verificationError,
         submittedPairs: verifyResult.submittedPairs, // cognium-ai#471
+        treatOmissionAsRefutation: verifyResult.treatOmissionAsRefutation,
     }, 
     // cognium-ai#460 — full generateFindings argument list.
     { language, sanitizers: patternResult.sanitizers });
@@ -1437,6 +1484,12 @@ export function resolveVerifiedSeverity(verifierSeverity, baseSeverity, detector
     if (detectorSeverity && (rank[detectorSeverity] ?? 0) < (rank[severity] ?? 0)) {
         severity = detectorSeverity;
     }
+    // cognium-ai#811 / #672 — gated detector rejected the sink (no index entry).
+    // Without a per-sink cap, verified findings take the rule ceiling (#264).
+    if (detectorSeverity === undefined &&
+        (rank[severity] ?? 0) > (rank['medium'] ?? 0)) {
+        severity = 'medium';
+    }
     return severity;
 }
 //# sourceMappingURL=workflow.js.map