Open_Ultra_SAST/benchmarks/measurements/2026-09-16-operation-inventory-smoke.json

{
  "schema_version": 1,
  "experiment": "operation-inventory-engine-smoke-v1",
  "milestone": "M1b task 10.4",
  "purpose": "Verify on the real engine that the taint query emits the enumerated operation inventory separately from traced flows, and that adding it does not disturb answers or the arbiter.",
  "provenance": {
    "engine": "joern-4.0.625",
    "engine_runtime": "7213365694f836758cb5fe2b05504cbbb735b8c2f0dea5d5dd19546a1f5fd43d",
    "facts": "32edb6e1a78f1afb08ac4248cd436be16663e0d90dc1b3aaf948f2ce49a5a8f0",
    "queries": "9e1f00272daec14cf9a4632a763fba9e5e629bf6a851f3fff81e60d665734932",
    "policy": "a641f6d1241702b4290574dd70e825176fbf0f8b03517d92f4051bac1b59dc92",
    "core": "5de41aaa2e7b8706fae265b7ba1a0aad724395ee05cb2bf99edcd8391b5aa48f",
    "semantics": "b08156ca261c602c6626fa10546d3ae926bdfa11324a1a2d5dcbce5ca0bd70f4"
  },
  "source": {
    "path": "app/api.js",
    "base_change": "const safe = \"fixed\" -> req.body.value",
    "note": "authored two-revision control, not a security claim"
  },
  "observations": [
    {
      "side": "head",
      "question": {
        "path": "app/api.js",
        "function": "handler",
        "family": "injection"
      },
      "status": "unresolved",
      "reason": "change_context_incomplete",
      "flow_rows": 1,
      "inventory_operations": [
        "eval(safe) at app/api.js:5"
      ],
      "inventory_complete_marker": {
        "kind": "operation_inventory_complete",
        "operations": 1
      }
    },
    {
      "side": "head",
      "question": {
        "path": "app/api.js",
        "function": "<module>",
        "family": "injection"
      },
      "status": "unresolved",
      "reason": "change_context_incomplete",
      "flow_rows": 0,
      "inventory_operations": [],
      "inventory_complete_marker": {
        "kind": "operation_inventory_complete",
        "operations": 0
      }
    },
    {
      "side": "base",
      "question": {
        "path": "app/api.js",
        "function": "handler",
        "family": "injection"
      },
      "status": "completed",
      "reason": "query_answered_and_arbitrated",
      "flow_rows": 0,
      "inventory_operations": [
        "eval(safe) at app/api.js:5"
      ],
      "inventory_complete_marker": {
        "kind": "operation_inventory_complete",
        "operations": 1
      }
    }
  ],
  "limits": [
    "One authored two-revision JavaScript control; no detection, precision, recall or latency claim.",
    "Exercises inventory emission and answer integrity, not the changed-line novelty branch."
  ],
  "findings_by_side": {
    "head": 1,
    "base": 0
  },
  "degradations_by_side": {
    "head": [],
    "base": []
  },
  "after_task_10_5": {
    "purpose": "Same control after binding the reachability boundary to what it limits.",
    "provenance": {
      "engine": "joern-4.0.625",
      "queries": "c170a0d445b9bf2af2dc5ffedfbf276e89887cff963fc99cd737506a840341e2",
      "policy": "422ed83b1ea418a692c722554f728b843bb34e611686a8c60de393d76c8bce46",
      "core": "002f0901a9f6b27d56afa6b9e6e9db83ee5d1fed5a49a7280525f53aaa9f585f",
      "semantics": "21e6641c98406181446cce13b23cd52f7b3f5196d361368e0e19dbeaae0dd581"
    },
    "handler_injection_status": {
      "head": [
        "completed",
        "query_answered_and_arbitrated"
      ],
      "base": [
        "completed",
        "query_answered_and_arbitrated"
      ]
    },
    "candidates": [
      {
        "site": "app/api.js:5:handler",
        "novelty": "new",
        "reason": "source_connection_absent_from_comparable_base",
        "witness": "req.body.value -> eval(safe) in app/api.js (line 5, 3 steps)",
        "admitted": false,
        "admission_reasons": [
          "capability_unavailable"
        ]
      }
    ],
    "result": {
      "finding_status": "none",
      "coverage_status": "incomplete"
    },
    "note": "Both target questions now complete and the production comparison reaches a new verdict with an exact witness. The single remaining admission reason is capability_unavailable, which is the deliberate eligibility gate: no capability is qualified, so no alert is emitted. This is an authored one-file control, not a real vulnerability, and it qualifies nothing."
  }
}