feat(model-grounded-detection): the safe-shape test, without which the model arbitrates nothing

The first live run produced the finding that shapes this design: taint
reachability alone does not distinguish a fix from a bug. On the canonical SQL
pair the flow request.args["name"] -> name -> execute exists on BOTH sides --

  vuln   db.execute("select ... '" + name + "'")   one argument, interpolated
  fixed  db.execute("select ... = %s", (name,))    two arguments, bound

-- so the model entailed the fixed twin exactly as readily as the vulnerable
one, and arbitrated nothing. What separates them is the SHAPE of the sink call,
which is precisely what safe_shape_sinks preserved from the earlier sanitizer
fix. The query now reports sinkArity and sinkArg0Literal, and a flow ending at
a sink written in its declared-safe form is not a vulnerability.

Two bugs in that shape test, both found only against the real engine:
Joern's `call.argument` includes the RECEIVER at argumentIndex 0, so `db` was
counted as an argument -- making a one-argument interpolated call look like a
two-argument bound one, the exact inversion of the test -- and the "first
argument" whose literalness decides a format-string sink was the receiver
rather than the format. Both fixed with argumentIndexGt(0).

The rule is narrow on purpose: only sinks named in safe_shape_sinks are subject
to it (os.system(x) is not safe merely because it takes one argument), and a
row carrying no shape fields is judged on the flow alone -- an unknown shape
must never be read as a safe one.

End to end on the pair, deterministic and with no model call:
  vuln  -> model_entailed  request.args["name"] -> db.execute(...) (line 4)
  fixed -> None

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/cpg/queries/taint.sc

@@ -45,17 +45,31 @@
 
   val rows = sinkCalls.l.flatMap { sink =>
     // Data flows into the arguments; asking the call node itself finds nothing.
-    val flows = sink.argument.reachableByFlows(sourceNodes).l
+    // `call.argument` includes the RECEIVER at argumentIndex 0 (`db` in `db.execute(...)`), so counting it
+    // makes a one-argument interpolated call look like a two-argument bound one -- the exact inversion of the
+    // test. Real arguments start at index 1.
+    val realArgs = sink.argument.argumentIndexGt(0).l
+    val flows    = sink.argument.reachableByFlows(sourceNodes).l
+
+    // The SHAPE of the sink call, which is what distinguishes a fix from a bug when the fix is a safe form
+    // rather than a sanitizing call: `execute(sql, params)` binds where `execute(sql + x)` interpolates, and
+    // `printf("literal", x)` is safe where `printf(userFmt)` is not. The taint path is identical in both, so
+    // without these two fields the model entails a pair's fixed side exactly as readily as its vulnerable one.
+    val arity       = realArgs.size
+    val arg0Literal = realArgs.headOption.map(a => a.isLiteral).getOrElse(false)
+
     flows.map { flow =>
       val elements = flow.elements.map(_.code).l
       val sanitized = sanitizerNames.nonEmpty && elements.exists(code => sanitizerNames.exists(s => code.contains(s)))
       ujson.Obj(
-        "sink"       -> sink.code.take(200),
-        "sinkLine"   -> sink.lineNumber.getOrElse(-1).toString,
-        "sinkMethod" -> sink.method.name,
-        "source"     -> elements.headOption.getOrElse("").take(200),
-        "sanitized"  -> sanitized,
-        "length"     -> elements.size
+        "sink"            -> sink.code.take(200),
+        "sinkLine"        -> sink.lineNumber.getOrElse(-1).toString,
+        "sinkMethod"      -> sink.method.name,
+        "source"          -> elements.headOption.getOrElse("").take(200),
+        "sanitized"       -> sanitized,
+        "length"          -> elements.size,
+        "sinkArity"       -> arity,
+        "sinkArg0Literal" -> arg0Literal
       )
     }
   }