sparda-mcp 0.67.0 → 0.68.0

package/README.md

@@ -35,6 +35,26 @@ npx sparda-mcp badge        # a README badge: proven · coverage% · routes
 
 Under the hood it compiles your backend into one language-agnostic graph — the **Unified Behavior Graph (UBG)**, serialized as `.sparda/ubg.json` under the **SBIR** specification ([SPARDA Behavior IR](docs/SBIR_SPEC_V1.1.md)) — and every command is a pass over that graph.
 
+## The wedge — catch an AI edit that removes a guard, in the loop
+
+The one thing a text-diff review and a pattern scanner structurally can't do: prove that **this specific edit** dropped a protection the previous version had. `sparda gate` diffs the behavior graph before/after an edit and blocks a regression — deterministic, offline, sub-second, exit 2 (the Claude Code `PostToolUse` contract that stops the agent's edit loop). See it end-to-end in one command, zero setup:
+
+```bash
+npm run wedge     # (from a clone)  — or drive it on your own app with `sparda gate --arm` then `sparda gate --hook`
+```
+
+```
+  1. baseline armed on the guarded code   (POST /admin/delete-user · requireAdmin)
+  2. an AI edit "simplifies" requireAdmin → a pass-through (still compiles, still 200s)
+  3. sparda gate on the edit:
+       ✗ [critical] GUARD_REMOVED — POST /admin/delete-user was guarded in the baseline
+                    and is now reachable without any guard (src/app.js:11)
+     ⏱  ~40 ms · deterministic · offline · no API key
+     ⛔ exit 2 on --hook — Claude Code PostToolUse blocks the edit
+```
+
+**Wire it into Claude Code in one line** — the [plugin](integrations/claude-code-plugin) registers a `PostToolUse` hook that runs `npx -y sparda-mcp gate --hook` after every `Edit`/`Write`, so a guard-removing edit is caught before it lands.
+
 > [!IMPORTANT]  
 > **The Route-Compilation Proof — reproduce it yourself.** SPARDA compiles real open-source monsters to their behavior graph with **zero crashes**, each in **≈1–2 seconds**: Next.js _Dub_ (579 routes), NestJS _Immich_ (281), _MedusaJS_ (477). It natively resolves deep Dependency Injection, external controllers, and Next.js handlers. One command clones them and re-measures on your machine:
 >

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sparda-mcp",
-  "version": "0.67.0",
+  "version": "0.68.0",
   "mcpName": "io.github.zyx77550/sparda-mcp",
   "description": "AI writes. SPARDA proves. A deterministic, offline gate that catches when an AI edit removes a guard, exposes a route, or breaks an invariant — no API key, right in the agent edit loop.",
   "type": "module",
@@ -28,7 +28,8 @@
     "format": "prettier --write \"**/*.{js,cjs,mjs}\"",
     "format:check": "prettier --check \"**/*.{js,cjs,mjs}\"",
     "bench:check": "node bench/check-readme.mjs",
-    "mutation": "node tests/mutation/run.mjs"
+    "mutation": "node tests/mutation/run.mjs",
+    "wedge": "node bench/wedge.mjs"
   },
   "files": [
     "src",

package/src/commands/claude-hook.js

@@ -0,0 +1,105 @@
+// commands/claude-hook.js — one-command install of the SPARDA gate into Claude Code's
+// PostToolUse hook, so every AI edit is proven in the loop with zero manual wiring. This is
+// the DX that makes the gate irreproachable: the agent edits, the gate fires, a regression
+// comes back on stderr with a fix (see gate.js). Writes to the PROJECT's .claude/settings.json
+// so the whole team inherits it via the repo.
+//
+// Two hard constraints, both honored by the pure functions below:
+//   • idempotent — installing twice never duplicates the hook;
+//   • cleanly removable (hard rule #4) — uninstall strips EXACTLY our entry and prunes the
+//     containers it emptied, leaving any other hooks/settings byte-for-byte untouched.
+import fs from 'node:fs';
+import path from 'node:path';
+import { atomicWriteFileSync as atomicWrite } from '../server/persistence.js';
+
+// the exact command the hook runs; also the marker that identifies OUR entry on removal.
+export const GATE_HOOK_CMD = 'npx --no-install sparda-mcp gate --hook';
+const MATCHER = 'Edit|Write';
+
+const isOurHook = (h) => h?.type === 'command' && h?.command === GATE_HOOK_CMD;
+
+// Ensure our PostToolUse hook is present. Pure: takes a settings object, returns
+// { settings, changed }. Idempotent — if any PostToolUse block already runs our command,
+// nothing changes. Never touches unrelated hooks or matchers.
+export function applyClaudeHook(settings) {
+  const next = structuredClone(settings ?? {});
+  next.hooks ??= {};
+  const post = Array.isArray(next.hooks.PostToolUse) ? next.hooks.PostToolUse : [];
+  const already = post.some((block) => (block?.hooks ?? []).some(isOurHook));
+  if (already) return { settings: next, changed: false };
+  post.push({ matcher: MATCHER, hooks: [{ type: 'command', command: GATE_HOOK_CMD }] });
+  next.hooks.PostToolUse = post;
+  return { settings: next, changed: true };
+}
+
+// Strip EXACTLY our hook and prune what that emptied: our command out of each block's hooks,
+// then blocks left with no hooks, then PostToolUse if empty, then hooks if empty. Any other
+// hook a user added is preserved. Pure: returns { settings, changed }.
+export function removeClaudeHook(settings) {
+  const next = structuredClone(settings ?? {});
+  const post = next.hooks?.PostToolUse;
+  if (!Array.isArray(post)) return { settings: next, changed: false };
+
+  let changed = false;
+  const kept = [];
+  for (const block of post) {
+    const hooks = block?.hooks ?? [];
+    const remaining = hooks.filter((h) => !isOurHook(h));
+    if (remaining.length !== hooks.length) changed = true;
+    if (remaining.length) kept.push({ ...block, hooks: remaining });
+    // a block whose only hook was ours is dropped entirely (never leave a matcher orphaned)
+  }
+  if (!changed) return { settings: next, changed: false };
+
+  if (kept.length) next.hooks.PostToolUse = kept;
+  else delete next.hooks.PostToolUse;
+  if (next.hooks && Object.keys(next.hooks).length === 0) delete next.hooks;
+  return { settings: next, changed: true };
+}
+
+function settingsPath(cwd) {
+  return path.join(cwd, '.claude', 'settings.json');
+}
+
+// read .claude/settings.json into an object. `{}` when absent; throws a USER error (never a
+// silent overwrite) when present-but-unparseable — we will not clobber a file we can't read.
+function readSettings(file) {
+  if (!fs.existsSync(file)) return {};
+  const raw = fs.readFileSync(file, 'utf8');
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw Object.assign(
+      new Error(`${file} is not valid JSON — refusing to overwrite it.`),
+      { code: 'USER', hint: 'Fix the JSON by hand, then re-run.' },
+    );
+  }
+}
+
+export function installClaudeHook(cwd) {
+  const file = settingsPath(cwd);
+  const { settings, changed } = applyClaudeHook(readSettings(file));
+  if (!changed) return { changed: false, file };
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  atomicWrite(file, JSON.stringify(settings, null, 2) + '\n');
+  return { changed: true, file };
+}
+
+// Uninstall for the CLI and for `sparda remove` (rule #4). Returns whether anything was
+// removed. Never errors when the file/hook is absent — removal is best-effort cleanup.
+export function uninstallClaudeHook(cwd) {
+  const file = settingsPath(cwd);
+  if (!fs.existsSync(file)) return { changed: false, file };
+  let current;
+  try {
+    current = JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return { changed: false, file }; // unreadable — leave it exactly as-is
+  }
+  const { settings, changed } = removeClaudeHook(current);
+  if (!changed) return { changed: false, file };
+  // if we emptied the file to `{}` AND it holds nothing else, remove it; else write it back
+  if (Object.keys(settings).length === 0) fs.rmSync(file);
+  else atomicWrite(file, JSON.stringify(settings, null, 2) + '\n');
+  return { changed: true, file };
+}

package/src/commands/gate.js

@@ -87,6 +87,30 @@ function locOf(canonical, f) {
   return loc ? ` (${loc.file}:${loc.line || 1})` : '';
 }
 
+// Per-rule remediation the AGENT reads and acts on. The gate's whole value in the edit
+// loop is self-heal: the agent gets exact, imperative feedback on stderr and fixes it in
+// the same turn. A regression message that only says WHAT broke (not HOW to fix) makes the
+// agent guess; naming the fix closes the loop. Each hint also names the honest escape hatch
+// (`--arm`) for when the change was intentional, so an intended refactor is never a dead end.
+const REMEDIATION = {
+  GUARD_REMOVED:
+    'restore the guard/auth that protected this route in the baseline — or, if the route is now intentionally public, re-arm',
+  ENTRYPOINT_REMOVED:
+    'restore this route if the removal was unintentional; if it was renamed or removed on purpose, re-arm',
+  INVARIANT_REMOVED:
+    'restore the removed constraint on this table — or, if the schema change is intended, re-arm',
+  BLAST_RADIUS_GREW:
+    'scope this write so it only touches its own aggregate, or confirm the wider write is intended and re-arm',
+};
+// A finding always resolves to actionable text: its own rule hint, or a safe generic fallback
+// (never an empty string — the agent must always know its next move).
+export function remediationFor(finding) {
+  return (
+    REMEDIATION[finding.rule] ??
+    'review this change against the baseline; if intended, re-arm with `sparda gate --arm`'
+  );
+}
+
 export async function runGate(opts) {
   const t0 = process.hrtime.bigint();
   const hook = opts.hook;
@@ -144,7 +168,7 @@ export async function runGate(opts) {
         {
           ok: blocking.length === 0,
           ms: Math.round(ms),
-          findings,
+          findings: findings.map((f) => ({ ...f, fix: remediationFor(f) })),
           abstained: abstained.map((f) => f.entrypoint),
         },
         null,
@@ -175,8 +199,10 @@ export async function runGate(opts) {
   say(
     `✗ SPARDA GATE — this edit changed the app's proven behavior (${Math.round(ms)} ms, deterministic):`,
   );
-  for (const f of findings)
+  for (const f of findings) {
     say(`  [${f.severity}] ${f.rule} — ${f.message}${locOf(candidate, f)}`);
+    say(`      ↳ fix: ${remediationFor(f)}`);
+  }
   say(
     blocking.length
       ? `  → fix the edit or, if intended, accept it with \`sparda gate --arm\`.`

package/src/commands/prove.js

@@ -99,8 +99,19 @@ export async function runProve(opts) {
   if (state === 'PROVEN') {
     console.log(`  ${obligations} obligations discharged · 0 violations`);
   } else if (state === 'PARTIAL') {
+    // PARTIAL has three possible reasons (ADR-070): a mutation rests on an asserted-only guard
+    // (deny not proven), high-risk blind spots, or incomplete coverage. Name the real one(s) —
+    // "only X% resolved" is misleading when coverage is high but a guard is merely trusted.
+    const reasons = [];
+    if (verdict.assertedMutations > 0)
+      reasons.push(
+        `${verdict.assertedMutations} guarded mutation(s) rest on a guard SPARDA could not verify (trusted by name — the deny is not proven)`,
+      );
+    if (summary.blindHigh > 0)
+      reasons.push(`${summary.blindHigh} high-risk blind spot(s)`);
+    reasons.push(`${cov} of the surface resolved`);
     console.log(
-      `  ${obligations} obligations discharged · 0 violations — but only ${cov} of the surface resolved; the rest is UNPROVEN, not safe`,
+      `  ${obligations} obligations discharged · 0 violations — PARTIAL: ${reasons.join('; ')}. The unproven part is not asserted safe.`,
     );
   } else if (state === 'NO_PROOF') {
     console.log(

package/src/commands/remove.js

@@ -6,6 +6,7 @@ import { removeInjection as removeExpress } from '../generator/express.js';
 import { removeInjection as removeFastAPI } from '../generator/fastapi.js';
 import { detectStack } from '../detect.js';
 import { removeHook } from './hook.js';
+import { uninstallClaudeHook } from './claude-hook.js';
 
 export async function runRemove(opts) {
   const manifestPath = path.join(opts.cwd, 'sparda.json');
@@ -99,6 +100,8 @@ export async function runRemove(opts) {
   if (revertGitignore(opts.cwd, manifest.gitignore))
     console.log('✓ Reverted .gitignore edit');
   if (removeHook(opts.cwd)) console.log('✓ Uninstalled post-commit sentinel hook');
+  if (uninstallClaudeHook(opts.cwd).changed)
+    console.log('✓ Removed the SPARDA gate from Claude Code PostToolUse');
   fs.rmSync(manifestPath);
   fs.rmSync(path.join(opts.cwd, '.sparda'), { recursive: true, force: true });
   console.log('✓ Deleted sparda.json and .sparda/');

package/src/detect.js

@@ -40,6 +40,15 @@ export function detectStack(cwd) {
     // out-of-the-box for a skeptic testing the framework repo directly (E-043).
     const medusaApi = medusaApiDir(cwd);
     if (medusaApi) return { framework: 'medusa', entryFile: medusaApi, port: 9000 };
+    // Strapi: routes are a DECLARATIVE data structure (`module.exports = { routes: [...] }`
+    // or `createCoreRouter(uid)`), invisible to every route-CALL scan. Detected by its dep
+    // (`@strapi/strapi`) OR — for the framework repo / a dep-less checkout — by its structural
+    // signature: a `src/api/*/routes/*` file whose export is a route table or a core router.
+    // Checked before express (Strapi lists koa/express transitively) so its config routes win
+    // over a stray bootstrap. Cheap on a non-Strapi app: the dep check is a map lookup, the
+    // structural probe two statSync + a bounded read only when src/api exists (E-043 style).
+    if (deps['@strapi/strapi'] || deps['@strapi/core'] || strapiApiDir(cwd))
+      return { framework: 'strapi', entryFile: 'src/api', port: 1337 };
     // A decorator-framework app (routes on `@Get`/`@Post` class methods, not
     // `app.get()`) is read by the decorator extractor even when `express` is a direct
     // dep and no `@nestjs/*` is present — n8n's home-made `@RestController` registry,
@@ -311,6 +320,31 @@ function medusaApiDir(cwd) {
   return null;
 }
 
+// Strapi's structural signature: a `src/api/*/routes/*` file whose export is a route table
+// (`routes:` array) or a `createCoreRouter(...)` — the two shapes strapi.js reads. Structural
+// so a dep-less checkout (the framework repo, a monorepo app) is still detected. Bounded +
+// short-circuits at the first match. Returns true, or false when src/api is absent/non-Strapi.
+const STRAPI_ROUTE_SIG = /createCoreRouter\s*\(|routes\s*:\s*\[/;
+function strapiApiDir(cwd) {
+  const abs = path.join(cwd, 'src/api');
+  try {
+    if (!fs.statSync(abs).isDirectory()) return false;
+  } catch {
+    return false;
+  }
+  for (const file of walkSourceFiles(abs, 400)) {
+    if (!/([\\/])routes([\\/])/.test(file)) continue;
+    let src;
+    try {
+      src = fs.readFileSync(file, 'utf8');
+    } catch {
+      continue;
+    }
+    if (STRAPI_ROUTE_SIG.test(src)) return true;
+  }
+  return false;
+}
+
 const DECO_EXCLUDE = new Set([
   'node_modules',
   '.git',

package/src/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// SPARDA — Turn any codebase into an MCP server. Residual Labs.
+// SPARDA — The trust layer for AI-written code. AI writes. SPARDA proves. Residual Labs.
 import { readFileSync } from 'node:fs';
 import path from 'node:path';
 
@@ -30,6 +30,8 @@ const opts = {
   check: flags.has('--check'),
   hook: flags.has('--hook'),
   arm: flags.has('--arm'),
+  installClaude: flags.has('--install-claude'),
+  uninstallClaude: flags.has('--uninstall-claude'),
   markdown: flags.has('--markdown'),
   port: getOpt('port', null),
   out: getOpt('out', null),
@@ -49,7 +51,7 @@ const opts = {
 const HELP = {
   prove: `sparda prove [--dir <path>] [--json | --markdown]\n  The whole trust verdict: proof + coverage + a shareable seal.\n  --markdown  emit a sticky-PR-comment body (used by the GitHub Action).`,
   apocalypse: `sparda apocalypse [--dir <path>] [--sarif] [--proof] [--save-baseline]\n  Prove the deploy — exit 1 on any critical/high finding.\n  --sarif         also write .sparda/apocalypse.sarif for the Security tab.\n  --proof         also write .sparda/apocalypse.proof.json — a re-verifiable\n                  discharge trace (deny_path per guarded mutation) a third party\n                  can audit against the graph hash without re-compiling.\n  --save-baseline freeze this graph; later runs diff against it.`,
-  gate: `sparda gate [--dir <path>] [--arm] [--hook] [--json]\n  The agent edit-loop gate: prove THIS edit lost no guard, dropped no route,\n  grew no blast radius — delta vs the armed baseline only (pre-existing state\n  never blocks an edit). Arms itself on first run.\n  --arm   accept the current graph as the new baseline.\n  --hook  Claude Code PostToolUse contract: silent when clean, report on\n          stderr + exit 2 (blocking feedback to the agent) on regression.`,
+  gate: `sparda gate [--dir <path>] [--arm] [--hook] [--json]\n  The agent edit-loop gate: prove THIS edit lost no guard, dropped no route,\n  grew no blast radius — delta vs the armed baseline only (pre-existing state\n  never blocks an edit). Arms itself on first run.\n  --arm   accept the current graph as the new baseline.\n  --hook  Claude Code PostToolUse contract: silent when clean, report on\n          stderr + exit 2 (blocking feedback to the agent) on regression.\n  --install-claude    wire the gate into .claude/settings.json PostToolUse (one command).\n  --uninstall-claude  remove exactly that hook again (clean).`,
   ubg: `sparda ubg [--dir <path>] [--json] [--out <file>] [--openapi <spec>]\n  Compile the codebase to its Unified Behavior Graph (.sparda/ubg.json).`,
   stitch: `sparda stitch <dir1> <dir2> [...] [--json]\n  Cross-service proof: join one service's outbound HTTP calls to another's routes,\n  surface cross-service trust boundaries + BOLA no mono-repo tool can see.`,
   badge: `sparda badge [--dir <path>] [--out <file>] [--json]\n  Emit a shareable SVG badge + README snippet (verdict · coverage · routes).`,
@@ -167,6 +169,26 @@ try {
       break;
     }
     case 'gate': {
+      if (opts.installClaude || opts.uninstallClaude) {
+        const { installClaudeHook, uninstallClaudeHook } =
+          await import('./commands/claude-hook.js');
+        if (opts.uninstallClaude) {
+          const { changed, file } = uninstallClaudeHook(opts.cwd);
+          console.log(
+            changed
+              ? `✓ Removed the SPARDA gate from Claude Code's PostToolUse hook (${file}).`
+              : `· No SPARDA gate hook found in ${file} — nothing to remove.`,
+          );
+        } else {
+          const { changed, file } = installClaudeHook(opts.cwd);
+          console.log(
+            changed
+              ? `✓ Installed — Claude Code now proves every edit in the loop.\n  ${file} → PostToolUse runs \`sparda gate --hook\`. Remove with \`sparda gate --uninstall-claude\`.`
+              : `· Already installed — ${file} already runs the SPARDA gate on PostToolUse.`,
+          );
+        }
+        break;
+      }
       const { runGate } = await import('./commands/gate.js');
       await runGate(opts);
       break;

package/src/server/stdio.js

@@ -356,7 +356,7 @@ export async function startStdioBridge({ cwd, portOverride }) {
       {
         name: 'sparda_info',
         description:
-          'Info about this MCP server. Generated by SPARDA (npx sparda-mcp init) — turn any codebase into an MCP server in 3 minutes. By Residual Labs (residual-labs.fr) — github.com/zyx77550/sparda',
+          'Info about this SPARDA endpoint. SPARDA is the trust layer for AI-written code — AI writes, SPARDA proves: deterministic, offline behavior proofs (guards, invariants, irreversible effects) plus a live gate for AI edits, no API key. By Residual Labs (residual-labs.fr) — github.com/zyx77550/sparda',
         inputSchema: { type: 'object', properties: {} },
       },
       {

package/src/ubg/apocalypse.js

@@ -123,6 +123,36 @@ export function reachOf(epId, cfOut) {
 
 const locOf = (node) => (node?.loc ? `${node.loc.file}:${node.loc.line}` : 'unknown');
 
+// The type-lock (ADR-070). Counts CLEAN mutation routes whose protection is ASSERTED-only — a
+// route that mutates state, is guarded (so no UNGUARDED_MUTATION fires), but where NO guard is
+// VERIFIED (SPARDA never saw a deny; the guards are trusted by name / opaque middleware). Such a
+// route is clean only because an UNPROVEN signal suppressed the finding, so the app's safety rests
+// on TRUST, not PROOF — it must read PARTIAL, never PROVEN. Computed here in ONE place (the verdict
+// chokepoint) so the honesty rule is structural: no signal author can accidentally let an asserted
+// guard buy PROVEN (E-060 was exactly that class of mistake). Only ever SOFTENS PROVEN→PARTIAL —
+// same safe direction as the coverage/blind-spot rungs — never masks a finding, never touches the
+// CI gate. Verified guards (incl. the ADR-069 auth-library catalog) keep a route PROVEN.
+const MUTATING_EFFECT = new Set(['db_write', 'http_call', 'fs_write']);
+function assertedOnlyMutations(graph) {
+  if (!graph) return 0;
+  const g = indexGraph(graph);
+  let count = 0;
+  for (const ep of g.entrypoints) {
+    const reached = [...reachOf(ep.id, g.cfOut)].map((id) => g.nodes.get(id));
+    const mutates = reached.some(
+      (n) =>
+        n?.kind === 'effect' &&
+        MUTATING_EFFECT.has(n.meta.effectType) &&
+        !n.meta.bypassesGuard,
+    );
+    if (!mutates) continue;
+    const guards = reached.filter((n) => n?.kind === 'guard');
+    if (guards.length === 0) continue; // unguarded → a hard finding already, not "clean"
+    if (!guards.some((n) => n.meta.verified === true)) count++; // guarded, but by trust only
+  }
+  return count;
+}
+
 // ---------------------------------------------------------------------------
 // static obligations
 // ---------------------------------------------------------------------------
@@ -149,7 +179,16 @@ export function checkGraph(graph) {
     const writes = []; // { effect, stateId }
     for (const n of reached) {
       if (n?.kind !== 'effect') continue;
-      for (const e of g.mutOut.get(n.id) ?? []) writes.push({ effect: n, stateId: e.to });
+      const outs = g.mutOut.get(n.id) ?? [];
+      for (const e of outs) writes.push({ effect: n, stateId: e.to });
+      // Opaque persistence write (ADR-068): a proven-handle call with an UNKNOWN target table has
+      // no mutation edge (the linker needs a table), but it IS a mutation. Count it with a null
+      // state so the guard obligation (O1) fires — while O2/O3/O5 skip it for lack of a state
+      // node, so it can NEVER fabricate value/atomicity/aggregate precision, only the unguarded
+      // check. This is the effect-bias inversion: a missed write is a hidden hole; an over-counted
+      // one is a surfaceable false positive.
+      if (n.meta.opaque && n.meta.effectType === 'db_write' && outs.length === 0)
+        writes.push({ effect: n, stateId: null });
     }
     const observables = reached.filter((n) => n?.kind === 'effect' && n.meta.observable);
     const vec = { auth: 0, validation: 0, atomicity: 0, reversibility: 0, aggregate: 0 };
@@ -319,12 +358,24 @@ export function checkGraph(graph) {
     );
     if (constrained.length) vec.validation = ep.meta.inputValidated ? 1 : -1;
     if (!ep.meta.inputValidated && constrained.length) {
+      // Proof-grade tier: a constrained write the taint pass PROVED carries request data
+      // (`const { email } = req.body; insert({ email })`) is a demonstrated source→sink —
+      // unvalidated input reaches a column whose CHECK/NOT NULL/UNIQUE it can violate. The
+      // conservative flag still fires when taint is not proven (taint under-approximates —
+      // never drop the finding, only sharpen it when the flow is visible).
+      const taintedConstrained = constrained.filter((w) => w.effect.meta.tainted);
+      const proven = taintedConstrained.length > 0;
       findings.push({
         rule: 'UNVALIDATED_CONSTRAINED_WRITE',
         severity: 'medium',
         entrypoint: ep.id,
-        message: `${ep.label} writes ${fmtStates(constrained)} whose declared invariants (CHECK/NOT NULL/UNIQUE) can be violated by unvalidated input`,
-        evidence: constrained.map((w) => w.stateId),
+        message: proven
+          ? `${ep.label} lets unvalidated request data flow straight into ${fmtStates(taintedConstrained)}, whose declared invariants (CHECK/NOT NULL/UNIQUE) it can violate`
+          : `${ep.label} writes ${fmtStates(constrained)} whose declared invariants (CHECK/NOT NULL/UNIQUE) can be violated by unvalidated input`,
+        evidence: proven
+          ? taintedConstrained.map((w) => `${w.effect.id} (${locOf(w.effect)})`)
+          : constrained.map((w) => w.stateId),
+        ...(proven ? { tainted: true } : {}),
       });
     }
 
@@ -363,14 +414,28 @@ export function checkGraph(graph) {
       for (const obs of observables) {
         if (obs.meta.compensable) continue;
         if (g.compensators.has(obs.id)) continue; // the undo itself is not a risk
-        bad = true;
+        // Innate immunity (ADR-072): only a KNOWN-dangerous observable — a recognized
+        // payment / mail / SMS / push effect from the SDK PAMP catalog (`target: sdk:…`) — is a
+        // HARD irreversible risk: you genuinely cannot un-send an email or un-charge a card, so an
+        // email+write with no compensation is a real saga hole. A GENERIC external call
+        // (`target: dynamic` — an unknown fetch, and in the wild almost always a READ: a search
+        // hitting an embedding API, an OAuth token handshake) is TOLERATED as an ADVISORY, not
+        // cried-wolf as a hard finding. This is the immune principle — attack the KNOWN pathogen,
+        // tolerate the unfamiliar (autoimmunity = the false positive). It kills the wolf-cry
+        // WITHOUT hiding a hole: the unknown call stays surfaced (advisory), at the honest
+        // confidence level (we cannot prove a generic fetch is irreversible), never silenced.
+        const knownDangerous = String(obs.meta.target ?? '').startsWith('sdk:');
         findings.push({
           rule: 'IRREVERSIBLE_OBSERVABLE',
-          severity: 'high',
+          severity: knownDangerous ? 'high' : 'info',
+          ...(knownDangerous ? {} : { advisory: true }),
           entrypoint: ep.id,
-          message: `${ep.label} makes an irreversible external call (${obs.meta.target ?? obs.label}) while also mutating state — no compensation path exists if the write fails`,
+          message: knownDangerous
+            ? `${ep.label} makes an irreversible external call (${obs.meta.target ?? obs.label}) while also mutating state — no compensation path exists if the write fails`
+            : `${ep.label} makes an external call (${obs.meta.target ?? obs.label}) while also mutating state — if that call is irreversible (payment/mail/…), add a compensation path; a generic fetch/read is fine`,
           evidence: [`${obs.id} (${locOf(obs)})`],
         });
+        if (knownDangerous) bad = true;
       }
       vec.reversibility = bad ? -1 : 1;
     }
@@ -707,8 +772,9 @@ export function verdictOf(findings, graph, { coverage, blindHigh = 0 } = {}) {
     provable && entrypoints > 0 && (provableBehavior === 0 || lowCoverage);
   // guard provenance: how many guards did SPARDA actually VERIFY (see a deny path in
   // the body) vs only assert by name (opaque middleware/decorators it couldn't read).
-  // Honest signal — it does not change the verdict, but it tells you how much of the
-  // auth posture rests on trust vs proof.
+  // As of the type-lock (ADR-070) this is LOAD-BEARING: a clean mutation route protected
+  // ONLY by asserted guards forces PARTIAL (see `assertedMutations` below), so PROVEN can
+  // never rest on trust. The count here is the headline for the dossier/CLI.
   const guards = graph ? graph.nodes.filter((n) => n.kind === 'guard') : [];
   const guardsVerified = guards.filter((g) => g.meta?.verified).length;
   // A clean whole-app proof below the completeness bar is PARTIAL — proved, but not over
@@ -724,10 +790,16 @@ export function verdictOf(findings, graph, { coverage, blindHigh = 0 } = {}) {
   // finding, never touches the CI gate (`safe`). blindHigh defaults to 0, so a caller that
   // did not survey blind spots (heal delta) is unaffected.
   const clean = provable && !surfaceOnly && hardCount === 0;
+  // The type-lock (ADR-070): PROVEN requires that no CLEAN mutation route rests on an
+  // ASSERTED-only guard. If any does, the app is proved-but-on-trust → PARTIAL, not PROVEN.
+  // Only computed when the app is otherwise clean (so it can only SOFTEN PROVEN→PARTIAL).
+  const assertedMutations = clean ? assertedOnlyMutations(graph) : 0;
   const partial =
     clean &&
     entrypoints > 0 &&
-    ((coverage != null && coverage < COVERAGE_COMPLETE) || blindHigh > 0);
+    ((coverage != null && coverage < COVERAGE_COMPLETE) ||
+      blindHigh > 0 ||
+      assertedMutations > 0);
   // `safe` is the CI gate (block a risky deploy): a surface-only app has no
   // critical/high findings and is NOT risky, so it does not fail the gate — it just
   // isn't a positive proof. `clean` is the strong claim (PROVEN) and DOES require
@@ -740,6 +812,7 @@ export function verdictOf(findings, graph, { coverage, blindHigh = 0 } = {}) {
     surfaceOnly,
     guards: guards.length,
     guardsVerified,
+    assertedMutations,
     safe: provable && counts.critical === 0 && counts.high === 0,
     clean,
     partial,
@@ -806,7 +879,13 @@ function sortFindings(findings) {
 }
 
 const fmtStates = (writes) =>
-  [...new Set(writes.map((w) => w.stateId.split(':').pop()))].sort().join(', ');
+  [
+    ...new Set(
+      writes.map((w) => (w.stateId ? w.stateId.split(':').pop() : 'an unknown table')),
+    ),
+  ]
+    .sort()
+    .join(', ');
 
 const fmtInvariant = (inv) =>
   inv.type === 'check'

package/src/ubg/compile.js

@@ -8,6 +8,7 @@ import { clearModuleCache } from './extract.js';
 import { extractExpress } from './express.js';
 import { extractNest } from './nestjs.js';
 import { extractMedusa } from './medusa.js';
+import { extractStrapi } from './strapi.js';
 import { extractNext } from './nextjs.js';
 import { extractFastAPI } from './fastapi.js';
 import { extractOpenAPI } from './openapi.js';
@@ -32,6 +33,7 @@ export function compileUBG(
     express: () => extractExpress(cwd, stack.entryFile),
     nestjs: () => extractNest(cwd, stack.entryFile),
     medusa: () => extractMedusa(cwd, stack.entryFile),
+    strapi: () => extractStrapi(cwd, stack.entryFile),
     nextjs: () => extractNext(cwd, stack.entryFile),
     fastapi: () => extractFastAPI(cwd, stack.entryFile, stack.pythonCmd),
     // Flask reuses the FastAPI (Python) extractor — same stdlib-ast walk, Flask route

package/src/ubg/express.js

@@ -6,11 +6,24 @@
 // Depth stays bounded like the v0 parser: entry file + mounted routers.
 import fs from 'node:fs';
 import path from 'node:path';
-import { parseModule, resolveRelImport } from './extract.js';
+import { parseModule, resolveRelImport, authDenyCall } from './extract.js';
 import { createResolver, relOf } from './resolve.js';
 
 const HTTP = new Set(['get', 'post', 'put', 'patch', 'delete']);
 
+// A minimal scan carrying ONLY the deny signal — attached to a middleware recognized as a known
+// auth-library guard (ADR-069: `passport.authenticate()`, `expressjwt({…})`) whose body lives in
+// node_modules and so can't be read in-repo. The catalog is a VERIFIED published fact, so the guard
+// earns `verified` (→ can reach PROVEN), not merely `asserted`. No effects/reads enter the graph.
+const AUTH_DENY_SCAN = {
+  effects: [],
+  returnShapes: [],
+  calls: [],
+  async: false,
+  validatesInput: false,
+  guardSignals: { deniesWithStatus: true },
+};
+
 // → { routes, globalMiddlewares, helpers, skipped, scannedFiles }
 export function extractExpress(cwd, entryFile) {
   const routes = [];
@@ -251,6 +264,20 @@ export function extractExpress(cwd, entryFile) {
           scan: resolver.deepScan(fnArg, mod),
         };
       }
+      // known auth-library deny-form middleware (ADR-069): `passport.authenticate('jwt')`,
+      // `expressjwt({…})`. Its body is in node_modules (opaque), but the catalog is a verified
+      // published fact that it denies — so the guard reads VERIFIED, not asserted, and its app
+      // can legitimately reach PROVEN. Deny-FORM precision (a custom callback / credentialsRequired
+      // false) is handled in authDenyCall, which abstains rather than over-verify.
+      if (authDenyCall(arg, mod.authGuards?.pkgOf)) {
+        return {
+          name,
+          sourceFile: relFile,
+          sourceLine: arg.loc?.start.line ?? 0,
+          fn: null,
+          scan: AUTH_DENY_SCAN,
+        };
+      }
       // factory middleware: validate(schema), rateLimit({…}) — the factory
       // name is known, the produced closure is out of static reach (blind node)
       return {
@@ -333,6 +360,17 @@ export function extractExpress(cwd, entryFile) {
         };
       }
     }
+    // aliased auth-library guard (ADR-069): `const requireAuth = passport.authenticate('jwt')`
+    // used by name here — verified by the catalog, exactly like the inline form above.
+    if (mod.authGuards?.denyBindings?.has(arg.name)) {
+      return {
+        name: arg.name,
+        sourceFile: relFile,
+        sourceLine: arg.loc?.start.line ?? 0,
+        fn: null,
+        scan: AUTH_DENY_SCAN,
+      };
+    }
     // known but bodyless — node exists, microscope stays blind
     return {
       name: arg.name,