sparda-mcp 0.58.0 → 0.62.0

package/README.md

@@ -47,11 +47,11 @@ Under the hood it compiles your backend into one language-agnostic graph — the
 |---|---|
 | **`prove`** | *The whole trust verdict in one gesture* — proof + coverage + a shareable seal (`--json` / `--markdown`) |
 | **`apocalypse`** | *Prove the deploy* — no guard, invariant, transaction or aggregate boundary can be broken (SARIF + CI gate) |
+| **`heal`** | *Self-heal, **proven*** — the gate Copilot Autofix doesn't have: a fix ships **only if** replay matches, `verify` still passes, and `apocalypse` finds no new risk / no dropped guard. Whoever wrote the fix, the machine judges it. |
 | **`badge`** | *The shareable artifact* — a self-contained SVG badge + README snippet (verdict · coverage · routes) |
 | **`dossier`** | *The public report* — one self-contained HTML page: verdict, risks, and SPARDA's own blind spots |
 | **`ubg`** | Compile the codebase to its behavior graph (Express · FastAPI · Next.js · NestJS · Medusa natively; **any** stack via OpenAPI) |
 | **`timeless`** | *Time-travel* — record a production request, replay it byte-identically, export the bug as a test |
-| **`heal`** | *Self-heal, proven* — bug → fix → the machine proves the fix is correct and breaks nothing |
 | **`mirror`** | *Execute the graph* — serve the compiled behavior over HTTP with no framework and no source |
 | **`init` / `dev`** | *Runtime, optional* — expose the graph to AI clients as a live MCP server (+ Twin, Immune, Evolution) |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sparda-mcp",
-  "version": "0.58.0",
+  "version": "0.62.0",
   "mcpName": "io.github.zyx77550/sparda-mcp",
   "description": "Compile backends to behavior graphs. Statically prove security, simulate APIs, and replay bugs.",
   "type": "module",
@@ -26,7 +26,9 @@
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "format": "prettier --write \"**/*.{js,cjs,mjs}\"",
-    "format:check": "prettier --check \"**/*.{js,cjs,mjs}\""
+    "format:check": "prettier --check \"**/*.{js,cjs,mjs}\"",
+    "bench:check": "node bench/check-readme.mjs",
+    "mutation": "node tests/mutation/run.mjs"
   },
   "files": [
     "src",
@@ -55,8 +57,7 @@
     "@babel/parser": "7.26.5",
     "@babel/traverse": "7.26.5",
     "@clack/prompts": "0.9.1",
-    "@modelcontextprotocol/sdk": "1.29.0",
-    "js-tokens": "^10.0.0"
+    "@modelcontextprotocol/sdk": "1.29.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.4",

package/src/commands/stitch.js

@@ -0,0 +1,58 @@
+// commands/stitch.js — cross-repo / cross-service behavior stitching. Point it at two or more app
+// directories (microservices of the same system); it compiles each, joins the outbound HTTP calls
+// of one to the entrypoints of another, and reports the trust boundaries + any cross-service BOLA
+// the join reveals — a finding no mono-repo tool can produce. Quorum sensing: each service's graph
+// is a signal; the collective behavior emerges from reading them together.
+import path from 'node:path';
+import { compileUBG } from '../ubg/compile.js';
+import { canonicalizeGraph } from '../ubg/schema.js';
+import { checkGraph } from '../ubg/apocalypse.js';
+import { stitchServices } from '../ubg/stitch.js';
+
+export async function runStitch(opts, dirs) {
+  if (!dirs || dirs.length < 2) {
+    console.error(
+      'Usage: sparda stitch <dir1> <dir2> [...]  — two or more service/app directories',
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const services = [];
+  for (const d of dirs) {
+    const abs = path.resolve(opts.cwd, d);
+    try {
+      const { graph } = compileUBG(abs, { write: false });
+      const g = canonicalizeGraph(graph);
+      const { findings } = checkGraph(g);
+      services.push({ name: path.basename(abs), graph: g, findings });
+    } catch (e) {
+      console.error(`  ✗ ${d}: ${e.message.slice(0, 70)}`);
+    }
+  }
+
+  const { edges, findings } = stitchServices(services);
+
+  if (opts.json) {
+    console.log(
+      JSON.stringify({ services: services.map((s) => s.name), edges, findings }, null, 2),
+    );
+    return;
+  }
+
+  console.log(`\nSPARDA · stitch — ${services.map((s) => s.name).join(' · ')}`);
+  console.log('─'.repeat(52));
+  if (!edges.length) {
+    console.log(
+      '  no cross-service calls resolved (targets may be dynamic or unrelated)',
+    );
+  } else {
+    console.log(`  ${edges.length} cross-service call(s):`);
+    for (const e of edges)
+      console.log(`    ${e.fromService} → ${e.toService}  ${e.method} ${e.path}`);
+  }
+  if (findings.length) {
+    console.log(`\n  ◐ ${findings.length} cross-service advisory(ies):`);
+    for (const f of findings) console.log(`    ${f.message}`);
+  }
+  console.log('');
+}

package/src/index.js

@@ -40,6 +40,34 @@ const opts = {
   cwd: path.resolve(process.cwd(), getOpt('dir', null) ?? getOpt('cwd', null) ?? '.'),
 };
 
+// Per-command help — `sparda <cmd> --help` (or -h) prints usage and exits, instead of running
+// the command (the old behavior: `--help` was ignored and the command just ran). Every command
+// reads opts.cwd, so `--dir <path>` works on all of them; only per-command extras are listed.
+const HELP = {
+  prove: `sparda prove [--dir <path>] [--json | --markdown]\n  The whole trust verdict: proof + coverage + a shareable seal.\n  --markdown  emit a sticky-PR-comment body (used by the GitHub Action).`,
+  apocalypse: `sparda apocalypse [--dir <path>] [--sarif] [--save-baseline]\n  Prove the deploy — exit 1 on any critical/high finding.\n  --sarif         also write .sparda/apocalypse.sarif for the Security tab.\n  --save-baseline freeze this graph; later runs diff against it.`,
+  ubg: `sparda ubg [--dir <path>] [--json] [--out <file>] [--openapi <spec>]\n  Compile the codebase to its Unified Behavior Graph (.sparda/ubg.json).`,
+  stitch: `sparda stitch <dir1> <dir2> [...] [--json]\n  Cross-service proof: join one service's outbound HTTP calls to another's routes,\n  surface cross-service trust boundaries + BOLA no mono-repo tool can see.`,
+  badge: `sparda badge [--dir <path>] [--out <file>] [--json]\n  Emit a shareable SVG badge + README snippet (verdict · coverage · routes).`,
+  dossier: `sparda dossier [--dir <path>] [--json]\n  Render the whole proof as one self-contained, shareable HTML page.`,
+  review: `sparda review [--dir <path>] --base <ref> [--json | --markdown]\n  Semantic behavior diff of the working tree vs a base git ref.`,
+  init: `sparda init [--dir <path>] [--yes]\n  Scan the app, generate & inject the reversible /mcp router.`,
+  dev: `sparda dev [--dir <path>] [--port <n>]\n  Run the MCP stdio bridge (connect an AI client).`,
+  remove: `sparda remove [--dir <path>] [--yes]\n  Remove SPARDA from this project — byte-for-byte clean git diff.`,
+  heal: `sparda heal <flightId> [--check] [--expect <json>] [--agent <cli>]\n  Turn a production bug into a fix brief + a proof gate.`,
+  timeless: `sparda timeless [list | replay <id> | export <id>]\n  Record / replay a production request byte-identically.`,
+  mirror: `sparda mirror [--dir <path>] [--port <n>]\n  Serve the compiled graph over HTTP — no framework, no source.`,
+};
+if (flags.has('--help') || rest.includes('-h')) {
+  if (cmd && HELP[cmd]) console.log(HELP[cmd]);
+  else if (cmd)
+    console.log(
+      `No detailed help for \`${cmd}\`. Run \`sparda\` for the full command list.`,
+    );
+  else console.log('Run `sparda` for the command list, or `sparda <command> --help`.');
+  process.exit(0);
+}
+
 try {
   switch (cmd) {
     case 'demo': {
@@ -121,6 +149,14 @@ try {
       await runBadge(opts);
       break;
     }
+    case 'stitch': {
+      const { runStitch } = await import('./commands/stitch.js');
+      await runStitch(
+        opts,
+        rest.filter((a) => !a.startsWith('--')),
+      );
+      break;
+    }
     case 'apocalypse': {
       const { runApocalypse } = await import('./commands/apocalypse.js');
       await runApocalypse(opts);
@@ -201,6 +237,7 @@ PROVE — the point
   review       Semantic diff of a PR vs a base ref (--base main / --json / --markdown)
   blindspots   Map SPARDA's own blindness — every unseen route/effect/guard, ranked (--json)
   badge        Emit a shareable SVG badge + README snippet (verdict · coverage · routes)
+  stitch       Cross-service proof — join N repos' graphs, find boundary-crossing BOLA
   dossier      Render the whole proof as one self-contained HTML page anyone can read
   verify       Prove the compiler's own laws (determinism, soundness, round-trip)
   heal         Turn a production bug into a fix brief + a gate (--check / --expect / --agent)

package/src/ubg/apocalypse.js

@@ -68,6 +68,10 @@ export function checkGraph(graph) {
   const g = indexGraph(graph);
   const findings = [];
   let obligations = 0;
+  // Resource tables by name — the input to BolaRay ownership-model inference (O7 below).
+  const statesByTable = new Map();
+  for (const n of g.nodes.values())
+    if (n?.kind === 'state' && n.meta?.table) statesByTable.set(n.meta.table, n);
   // Behavior polarity (ADR-036): per entrypoint, a ternary vector over the same
   // obligations checked below — +1 protection present, 0 not applicable, -1
   // violated. Built HERE so a -1 is literally the same condition as the finding
@@ -208,9 +212,15 @@ export function checkGraph(graph) {
       );
       vec.aggregate = touchesRoot && vec.aggregate !== -1 ? 1 : -1;
       if (!touchesRoot) {
+        // ADVISORY (E-046): a direct member-table write is a design-smell, not a proven
+        // violation — many ORMs/apps legitimately write members directly. On a real
+        // schema-rich app it fires in bulk (dub: 174), so it points a human at the pattern,
+        // it never gates the verdict. (Surfaced once the split-schema state layer became
+        // visible; making it hard would have flooded every folder-schema app.)
         findings.push({
           rule: 'AGGREGATE_MEMBER_BYPASS',
           severity: 'info',
+          advisory: true,
           entrypoint: ep.id,
           message: `${ep.label} mutates member table "${state.meta.table}" of aggregate "${state.meta.consistencyDomain}" without going through its root`,
           evidence: [w.stateId],
@@ -238,12 +248,27 @@ export function checkGraph(graph) {
       const tables = [
         ...new Set(idScoped.map((n) => n.meta.table).filter(Boolean)),
       ].sort();
+      // BolaRay (CCS 2024) step 1: infer the ownership MODEL each accessed table SHOULD carry
+      // (from its declared columns/FKs), so the advisory names the scope the access is MISSING
+      // instead of a vague "verify authorization". Still advisory (soundness unchanged): the
+      // schema tells us the model, never the runtime intent — that gap is why O7 never gates.
+      const ownership = tables.map((t) => ({
+        table: t,
+        ...(inferOwnershipModel(t, statesByTable) ?? { model: null, key: null }),
+      }));
+      const hints = ownership
+        .filter((o) => o.model)
+        .map((o) => `${o.table} should be ${o.model} (${o.key})`);
       findings.push({
         rule: 'OBJECT_SCOPE_UNPROVEN',
         severity: 'info',
         advisory: true,
         entrypoint: ep.id,
-        message: `${ep.label} accesses ${tables.join(', ')} by a request-supplied id with no ownership scope proven on the path — verify object-level authorization (BOLA/IDOR)`,
+        ownership,
+        message:
+          `${ep.label} accesses ${tables.join(', ')} by a request-supplied id with no ownership scope proven on the path` +
+          (hints.length ? ` — ${hints.join('; ')}` : '') +
+          ` — verify object-level authorization (BOLA/IDOR)`,
         evidence: idScoped.map((n) => `${n.id} (${locOf(n)})`),
       });
     }
@@ -251,7 +276,55 @@ export function checkGraph(graph) {
     polarity.push({ entrypoint: ep.id, vector: vec });
   }
 
-  return { findings: sortFindings(findings), obligations, polarity };
+  // Lateral inhibition (ADR-060): a rule that fires on a large FRACTION of the routes is a
+  // codebase-wide PATTERN, not N independent findings — 97 identical lines bury the rare, sharp
+  // signals (loss of contrast). Collapse a flooding rule into ONE summary at its MAX severity.
+  // SOUND + verdict-neutral: a hard rule stays hard and still gates (we never HIDE a finding — a
+  // suppressed danger would be a false PROVEN); we only stop it flooding the report. The retina
+  // suppresses uniform light, never an edge.
+  const collapsed = collapseFloods(findings, g.entrypoints.length);
+
+  return { findings: sortFindings(collapsed), obligations, polarity };
+}
+
+// A rule is "pervasive" when it fires on more than this fraction of the routes AND on at least
+// FLOOD_MIN of them — measured on the corpus: real floods sit at 18% (dub member-bypass) / 41%
+// (directus irreversible) on 100+ routes, while the sharp per-route signals (BOLA 10%, unvalidated
+// 11%, unguarded 1%) stay below. The absolute floor keeps a small app (a 2-route fixture where one
+// finding is trivially "50%") from ever collapsing — a pattern needs real breadth to be a pattern.
+const FLOOD_DENSITY = 0.15;
+const FLOOD_MIN = 10;
+export function collapseFloods(findings, totalRoutes) {
+  if (!totalRoutes) return findings;
+  const byRule = new Map();
+  for (const f of findings) {
+    if (!byRule.has(f.rule)) byRule.set(f.rule, []);
+    byRule.get(f.rule).push(f);
+  }
+  const out = [];
+  for (const [rule, list] of [...byRule].sort((a, b) => cmp(a[0], b[0]))) {
+    const routes = new Set(list.map((f) => f.entrypoint));
+    if (routes.size >= FLOOD_MIN && routes.size / totalRoutes > FLOOD_DENSITY) {
+      // strongest severity wins; advisory only if EVERY collapsed finding was advisory (a hard
+      // finding in the flood keeps the summary hard — it must still gate the verdict).
+      const severity = list
+        .map((f) => f.severity)
+        .sort((a, b) => SEVERITY_RANK[a] - SEVERITY_RANK[b])[0];
+      const anyHard = list.some((f) => !f.advisory);
+      out.push({
+        rule,
+        severity,
+        ...(anyHard ? {} : { advisory: true }),
+        entrypoint: '(codebase-wide)',
+        pervasive: routes.size,
+        message: `${rule} is pervasive — fires on ${routes.size}/${totalRoutes} routes; review the pattern, not each route (all routes listed in evidence)`,
+        evidence: [...routes].sort(),
+      });
+    } else {
+      out.push(...list);
+    }
+  }
+  return out;
 }
 
 // ---------------------------------------------------------------------------
@@ -365,6 +438,38 @@ export function countProvable(graph) {
   return n;
 }
 
+// Ownership-model inference (BolaRay, CCS 2024): from a resource table's declared columns and
+// foreign keys, which object-level authorization model SHOULD it carry? DIRECT_OWNER (a
+// user/owner column), GROUP_SCOPED (a workspace/team/tenant column — caller must belong to the
+// group), TRANSITIVE (ownership reached via a FK to an owned table), or null (a shared/global
+// resource, or intent SPARDA cannot see). Columns are lowercased (prisma.js / sql.js). Pure and
+// bounded. Used ONLY to enrich the O7 advisory — it never changes the verdict (soundness: the
+// schema reveals the model, never the runtime authorization intent, which is the semantic gap
+// OWASP/BolaRay both name as the reason no static tool can PROVE access control).
+const OWNER_DIRECT = /^(user|owner|author|creator)_?id$/;
+const OWNER_GROUP =
+  /^(workspace|project|team|tenant|org|organization|store|customer|partner|program|account|company|group)_?id$/;
+function inferOwnershipModel(tableName, statesByTable, seen = new Set(), depth = 0) {
+  const st = statesByTable.get(tableName);
+  if (!st || seen.has(tableName) || depth > 3) return null;
+  seen.add(tableName);
+  const cols = (st.meta?.columns ?? []).map((c) => c.name);
+  const direct = cols.find((n) => OWNER_DIRECT.test(n));
+  if (direct) return { model: 'direct-owner', key: direct };
+  const group = cols.find((n) => OWNER_GROUP.test(n));
+  if (group) return { model: 'group-scoped', key: group };
+  for (const ref of st.meta?.references ?? []) {
+    if (!ref.table || ref.table === tableName) continue;
+    const sub = inferOwnershipModel(ref.table, statesByTable, seen, depth + 1);
+    if (sub)
+      return {
+        model: 'transitive',
+        key: `${(ref.fields ?? []).join(',')}->${ref.table}.${sub.key}`,
+      };
+  }
+  return null;
+}
+
 // Below this resolved/surface coverage ratio, a CLEAN app cannot claim PROVEN — it
 // resolved too little of its own behavior for "no violation" to mean anything (the
 // PROVEN-COMPLETE vs PROVEN-PARTIAL line). Measured floor: real PROVEN apps sit at 60%+

package/src/ubg/llm-resolve.js

@@ -0,0 +1,46 @@
+// ubg/llm-resolve.js — LLM-assisted resolution of unverified guards, with the
+// verify-before-admit guardrail the literature identifies as the critical step (Thakur et al.,
+// "Interleaving static analysis and LLM prompting", STTT 2025; "Boosting Pointer Analysis with
+// LLM-Enhanced Allocation Detection", arXiv 2509.22530). See docs/RESEARCH-AND-10X-IDEAS §Part 1.
+//
+// THE CONTRACT (soundness — non-negotiable): an LLM may only produce a *resolution hint* (where a
+// guard's deny logic likely lives) or a *candidate classification*. It never asserts behavior.
+// SPARDA re-verifies the hint STRUCTURALLY against the real graph before anything enters the
+// proof. A guard becomes `verified` ONLY when a deny path is structurally proven — never on the
+// model's word. Skipping this exact step is what produced E-022/E-025/E-026 (false PROVEN), the
+// cardinal sin. This module makes the guardrail executable and testable; the hint *producer*
+// (MCP sampling — the host never pays, CLAUDE.md rule 1) plugs in on top and is out of scope
+// here on purpose, so no LLM dependency and no un-verified path can ever leak into the graph.
+
+// The unverified guards worth an LLM resolution attempt: protection asserted by name, whose body
+// SPARDA never saw deny (the `unverified-guard` blind-spot category, blindspots.js). These are
+// the ambiguous DI/factory/opaque-import patterns the AST walker can't resolve structurally.
+export function resolutionTargets(graph) {
+  if (!graph?.nodes) return [];
+  return graph.nodes.filter((n) => n.kind === 'guard' && !n.meta?.verified);
+}
+
+// Admit an LLM resolution hint for ONE guard — and ONLY if SPARDA's own structural prover
+// confirms a deny path at the hinted location. `proveDeny(hint)` is SPARDA's deny-detection,
+// injected so this module stays testable and carries no LLM dependency itself. The hint is NEVER
+// trusted on its own; it only tells the structural prover where to look.
+//
+// On success the guard is marked `verified: true` with `verifiedVia: 'llm-guided'` — a distinct
+// provenance so an LLM-guided verification is always auditable and never silently indistinguish-
+// able from a natively-proven guard (guardsVerified counting, dossier, audits can separate them).
+// Returns { admitted, reason }; mutates guardNode.meta only on a confirmed admit.
+export function admitResolutionHint(guardNode, hint, { proveDeny } = {}) {
+  if (!guardNode || guardNode.kind !== 'guard')
+    return { admitted: false, reason: 'not-a-guard' };
+  if (guardNode.meta?.verified) return { admitted: false, reason: 'already-verified' };
+  if (typeof proveDeny !== 'function')
+    return { admitted: false, reason: 'no-structural-prover' };
+  if (!hint) return { admitted: false, reason: 'no-hint' };
+
+  // THE GUARDRAIL. The model's hint buys nothing until SPARDA itself proves the deny.
+  const denies = proveDeny(hint) === true;
+  if (!denies) return { admitted: false, reason: 'hint-not-structurally-confirmed' };
+
+  guardNode.meta = { ...guardNode.meta, verified: true, verifiedVia: 'llm-guided' };
+  return { admitted: true, reason: 'structurally-confirmed' };
+}

package/src/ubg/prisma.js

@@ -12,6 +12,48 @@ import path from 'node:path';
 import { cmp } from './schema.js';
 
 const SCHEMA_CANDIDATES = ['prisma/schema.prisma', 'schema.prisma', 'db/schema.prisma'];
+// Prisma's `prismaSchemaFolder` layout (stable since 6.x): the schema is SPLIT across many
+// `*.prisma` files under a directory, no single schema.prisma. Modern apps use it (dub: 36
+// files). Without this, their entire state layer — invariants, aggregates, ownership — is
+// invisible (E-046). These directory candidates are scanned when no single file is found.
+const SCHEMA_DIR_CANDIDATES = ['prisma/schema', 'schema', 'db/schema'];
+
+// Gather every `.prisma` file to parse: the single file if present, else all files in a schema
+// folder (bounded, deterministic order). Returns [{ file, rel }] or [] if nothing found.
+function collectSchemaFiles(cwd, fileCandidates, dirCandidates) {
+  for (const c of fileCandidates) {
+    const abs = path.resolve(cwd, c);
+    if (fs.existsSync(abs) && fs.statSync(abs).isFile()) return [abs];
+  }
+  for (const c of dirCandidates) {
+    const abs = path.resolve(cwd, c);
+    let stat;
+    try {
+      stat = fs.statSync(abs);
+    } catch {
+      continue;
+    }
+    if (!stat.isDirectory()) continue;
+    const files = [];
+    const walk = (dir, depth) => {
+      if (depth > 3) return;
+      let entries;
+      try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+      } catch {
+        return;
+      }
+      for (const e of entries.sort((a, b) => (a.name < b.name ? -1 : 1))) {
+        const p = path.join(dir, e.name);
+        if (e.isDirectory()) walk(p, depth + 1);
+        else if (e.name.endsWith('.prisma')) files.push(p);
+      }
+    };
+    walk(abs, 0);
+    if (files.length) return files;
+  }
+  return [];
+}
 
 const TYPE_MAP = {
   string: 'string',
@@ -36,42 +78,47 @@ export function parsePrismaSchemas(cwd) {
   } catch {
     // no package.json / unparsable — the default candidates stand
   }
-  const file = candidates
-    .map((c) => path.resolve(cwd, c))
-    .find((abs) => fs.existsSync(abs));
-  if (!file) return { tables: [], skipped, sourceFile: null };
-
-  let src;
-  try {
-    src = fs.readFileSync(file, 'utf8');
-  } catch (err) {
-    skipped.push({ reason: `unreadable schema.prisma: ${err.message}` });
-    return { tables: [], skipped, sourceFile: null };
+  const files = collectSchemaFiles(cwd, candidates, SCHEMA_DIR_CANDIDATES);
+  if (!files.length) return { tables: [], skipped, sourceFile: null };
+
+  // Read + strip comments once per file; keep the relative path for correct per-table locs.
+  const parts = [];
+  for (const abs of files) {
+    try {
+      parts.push({
+        rel: path.relative(cwd, abs).split(path.sep).join('/'),
+        clean: fs.readFileSync(abs, 'utf8').replace(/\/\/[^\n]*/g, ''),
+      });
+    } catch (err) {
+      skipped.push({ reason: `unreadable prisma schema: ${err.message}` });
+    }
   }
-  const sourceFile = path.relative(cwd, file).split(path.sep).join('/');
-  const clean = src.replace(/\/\/[^\n]*/g, '');
+  if (!parts.length) return { tables: [], skipped, sourceFile: null };
+  const sourceFile = parts.length === 1 ? parts[0].rel : path.dirname(parts[0].rel);
 
-  // enums first — model fields reference them
+  // Enums and model names are collected ACROSS ALL files first — a model in one file may
+  // reference an enum (or a relation target) declared in another (the whole point of the
+  // folder layout). Then models are parsed per-file so each table keeps its true file:line.
   const enums = new Map(); // lowercase name -> [values lowercase]
-  for (const m of clean.matchAll(/enum\s+(\w+)\s*\{([^}]*)\}/g)) {
-    const values = m[2]
-      .split(/\s+/)
-      .map((v) => v.trim())
-      .filter((v) => v && !v.startsWith('@'))
-      .map((v) => v.toLowerCase());
-    enums.set(m[1].toLowerCase(), values);
+  const modelNames = new Set();
+  for (const { clean } of parts) {
+    for (const m of clean.matchAll(/enum\s+(\w+)\s*\{([^}]*)\}/g)) {
+      const values = m[2]
+        .split(/\s+/)
+        .map((v) => v.trim())
+        .filter((v) => v && !v.startsWith('@'))
+        .map((v) => v.toLowerCase());
+      enums.set(m[1].toLowerCase(), values);
+    }
+    for (const m of clean.matchAll(/model\s+(\w+)\s*\{/g)) modelNames.add(m[1]);
   }
 
-  const modelNames = new Set([...clean.matchAll(/model\s+(\w+)\s*\{/g)].map((m) => m[1]));
-
   const tables = [];
-  for (const m of clean.matchAll(/model\s+(\w+)\s*\{([^}]*)\}/g)) {
-    const modelName = m[1];
-    const body = m[2];
-    const line = clean.slice(0, m.index).split('\n').length;
-    tables.push(
-      parseModel(modelName, body, line, sourceFile, enums, modelNames, skipped),
-    );
+  for (const { rel, clean } of parts) {
+    for (const m of clean.matchAll(/model\s+(\w+)\s*\{([^}]*)\}/g)) {
+      const line = clean.slice(0, m.index).split('\n').length;
+      tables.push(parseModel(m[1], m[2], line, rel, enums, modelNames, skipped));
+    }
   }
   tables.sort((a, b) => a.name.localeCompare(b.name));
   return { tables, skipped, sourceFile };

package/src/ubg/stitch.js

@@ -0,0 +1,105 @@
+// ubg/stitch.js — cross-repo / cross-service stitching (the moat). SAST incumbents
+// (CodeQL/Semgrep/Snyk) are mono-repo by construction — a violation that crosses a service
+// boundary (service A forwards a caller-supplied id to service B, which trusts it blindly) is
+// invisible to all of them. SPARDA already produces the artifact that makes it possible: a
+// committed `ubg.json` per repo. This pass reads N of them and joins the outbound HTTP calls of
+// one to the entrypoints of another — the reproduction of BACTERIAL QUORUM SENSING: each service
+// emits a signal (its graph); the collective behavior emerges from reading them together, with no
+// central coordinator and no network access between services (each graph is committed in git).
+//
+// Soundness: cross-service findings are ADVISORY (same stance as BOLA/O7) — the join is a
+// structural match, never a proof of runtime intent across the boundary. It points a human at a
+// trust boundary to review; it never gates a verdict.
+
+// A route path or an outbound URL target → comparable segment list. Strips scheme+host and query,
+// lowercases, collapses every parameter form (:id, {id}, *) to a single '*' token.
+function segmentsOf(target) {
+  let s = String(target ?? '');
+  const url = s.match(/^[a-z][a-z0-9+.-]*:\/\/[^/]+(\/.*)?$/i);
+  if (url) s = url[1] ?? '/';
+  s = s.split(/[?#]/)[0].toLowerCase();
+  return s
+    .split('/')
+    .filter(Boolean)
+    .map((seg) => (/^[:{*]/.test(seg) || seg.includes('*') ? '*' : seg));
+}
+
+// method from an entrypoint label ("GET /users/:id") or an http_call ("httpMethod"); default GET.
+const methodOf = (label) =>
+  (String(label).match(/^([A-Z]+)\s/)?.[1] ?? 'GET').toUpperCase();
+const pathPart = (label) => String(label).replace(/^[A-Z]+\s+/, '');
+
+// B's entrypoint (callee) matches A's outbound call when the methods agree and the callee's path
+// segments are a SUFFIX of the caller's target segments — so a base-URL prefix
+// (`http://host/api/v1/users/*` calling B's `/users/:id`) still matches. '*' matches anything.
+function suffixMatch(callerSegs, calleeSegs) {
+  if (calleeSegs.length === 0 || calleeSegs.length > callerSegs.length) return false;
+  const off = callerSegs.length - calleeSegs.length;
+  for (let i = 0; i < calleeSegs.length; i++) {
+    const a = callerSegs[off + i];
+    const b = calleeSegs[i];
+    if (a !== b && a !== '*' && b !== '*') return false;
+  }
+  return true;
+}
+
+// services: [{ name, graph (canonical), findings? }]. Returns cross-service call edges and the
+// advisory findings that ride them.
+export function stitchServices(services) {
+  const edges = [];
+  const findings = [];
+
+  // index every service's entrypoints (the callees) by method + segments
+  const callees = [];
+  for (const svc of services) {
+    for (const n of svc.graph?.nodes ?? []) {
+      if (n.kind !== 'entrypoint') continue;
+      callees.push({
+        service: svc.name,
+        entrypoint: n.id,
+        label: n.label,
+        method: methodOf(n.label),
+        segs: segmentsOf(pathPart(n.label)),
+        bola: (svc.findings ?? []).some(
+          (f) => f.rule === 'OBJECT_SCOPE_UNPROVEN' && f.entrypoint === n.id,
+        ),
+      });
+    }
+  }
+
+  for (const svc of services) {
+    for (const n of svc.graph?.nodes ?? []) {
+      if (n.kind !== 'effect' || n.meta?.effectType !== 'http_call') continue;
+      const callerMethod = (n.meta.httpMethod ?? 'GET').toUpperCase();
+      const callerSegs = segmentsOf(n.meta.target);
+      if (!callerSegs.length) continue;
+      for (const c of callees) {
+        if (c.service === svc.name) continue; // never stitch a service to itself
+        if (c.method !== callerMethod) continue;
+        if (!suffixMatch(callerSegs, c.segs)) continue;
+        edges.push({
+          fromService: svc.name,
+          fromEffect: n.id,
+          toService: c.service,
+          toEntrypoint: c.entrypoint,
+          method: callerMethod,
+          path: '/' + c.segs.join('/'),
+        });
+        // the trust-boundary finding: A forwards to a B endpoint B itself flagged as accessing an
+        // object by a request id with no ownership scope — so the object-level authorization
+        // across the A→B boundary is unproven. Advisory (a structural match, not runtime intent).
+        if (c.bola) {
+          findings.push({
+            rule: 'CROSS_SERVICE_OBJECT_SCOPE',
+            severity: 'info',
+            advisory: true,
+            entrypoint: c.entrypoint,
+            message: `${svc.name} calls ${c.service} ${c.method} ${'/' + c.segs.join('/')}, which accesses an object by a request id with no ownership scope proven — the object-level authorization across this service boundary is unproven (cross-service BOLA/IDOR)`,
+            evidence: [`${svc.name}:${n.id}`, `${c.service}:${c.entrypoint}`],
+          });
+        }
+      }
+    }
+  }
+  return { edges, findings };
+}