feat(model): first repository measurement, and the four things it found

contributor-scan 2.2. VAmPI at a pinned commit, scanned whole rather than
as excerpts, with benchmarks/repos/measure.py recording build time, query
time, arbitration time, peak memory, cost, unjudged regions, and whether
each known vulnerability was found and at which rung.

The corpus could not have found any of this. Every defect below needs a
repository to become visible, and three of them were invisible behind a
passing test suite.

**The batch path was unreachable.** query_batch was implemented, tested and
committed while CpgResult exposed only `run`, so the driver's capability
check found nothing and fell back to one JVM per region-family: the first
attempt at this measurement ran eighteen minutes on 520 lines, issuing
`--param function=` one at a time. Every test called query_batch directly,
so none of them noticed. CpgResult now carries run_batch and a test asserts
the capability is reachable through the object the driver is handed.
The earlier 275s->106s improvement attributed to batching came from region
deduplication alone.

**The budget stopped free work.** It bounds model calls, but was enforced
by breaking the region loop -- spending a paid limit to stop unpaid CPG
arbitration. 6 of 22 regions were examined and VAmPI's BOLA, which the
graph entails for nothing, was never reached. It now withholds the judge
only. 22 of 22 regions arbitrated, 17 counted as regions_unasked (silent
because unaffordable is not silent because decided), and the BOLA is
entailed by the model layer.

**A region with no function asked about the whole repository.** Sending
function="" matched every hit in the tree and the driver attributed that
answer to whoever asked: one `host='0.0.0.0'` in app.py became eight
identical entailed findings in eight files that do not contain it. Queries
now carry the region's file. Entailed findings 14 -> 7, query time
70.9s -> 40.9s. The single-request form stays unscoped so the committed
pair measurements remain reproducible.

**The JVM had no heap bound.** Joern claimed a quarter of physical RAM and
runs were killed under memory pressure at different points, so the numbers
described the host rather than the engine. -J-Xmx2048m by default,
OPENULTRASAST_CPG_HEAP_MB to raise it.

Also: arbitrated findings carried `function:line` where the report layer
read `path:line`, so every entailed finding reached a contributor with a
function name where its file belonged; and the witness line was parsed by
splitting on a comma, which produced sites like
`config.py:17): permissive literal '0.0.0.0':?`.

Reading: GO on one CPG per repository -- 6.2s to build, 177s end to end,
869MB, $0.0067, nothing infeasible. NO-GO on region-scoped taint as the
only shape: VAmPI's SQL injection runs from a handler parameter into a
function in another module, and a per-function region sees neither end.
That is the ordinary shape of a real injection bug, so it is recorded as
task 2.4 along with three smaller defects this run exposed.

Gates byte-identical.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/cpg/queries/config.sc

@@ -4,17 +4,22 @@
 // This query reports each setting call with its arguments split into literals (which the model can evaluate)
 // and non-literals (which it cannot -- those become `corroborated`, never silently safe).
 //
-// Parameters: cpgFile, settings, function (optional).
+// Parameters: cpgFile, settings, function (optional), file (optional: restrict to this source file).
+//
+// `file` matters more than it looks. A region with no enclosing function -- a module of settings, an
+// __init__.py -- used to send function="" and match EVERY setting in the repository, and the driver then
+// attributed the whole answer to whichever region asked. One `host='0.0.0.0'` in app.py became eight
+// identical entailed findings in eight files that do not contain it.
 // Output: fenced JSON array of {setting, line, method, args, literalArgs}.
 
 // BATCHED, like taint.sc. Single-request form kept for the committed measurements.
 
-@main def exec(cpgFile: String, settings: String = "", function: String = "", requests: String = "") = {
+@main def exec(cpgFile: String, settings: String = "", function: String = "", file: String = "", requests: String = "") = {
   importCpg(cpgFile)
 
   def split(raw: String): List[String] = raw.split(",").map(_.trim).filter(_.nonEmpty).toList
 
-  def rowsFor(settingsS: String, functionS: String): List[ujson.Obj] = {
+  def rowsFor(settingsS: String, functionS: String, fileS: String): List[ujson.Obj] = {
   val names = split(settingsS)
   val function = functionS
 
@@ -22,7 +27,8 @@
 
   val calls = {
     val all = cpg.call.filter(c => matches(c.name)).l
-    if (function.isEmpty) all else all.filter(_.method.name == function)
+    val inFile = if (fileS.isEmpty) all else all.filter(_.method.filename.endsWith(fileS))
+    if (function.isEmpty) inFile else inFile.filter(_.method.name == function)
   }
 
   val rows = calls.map { call =>
@@ -51,11 +57,11 @@
     val parsed = ujson.read(requests).obj
     val answers = parsed.map { case (id, req) =>
       def field(name: String): String = req.obj.get(name).map(_.str).getOrElse("")
-      id -> ujson.Arr(rowsFor(field("settings"), field("function")): _*)
+      id -> ujson.Arr(rowsFor(field("settings"), field("function"), field("file")): _*)
     }
     println(ujson.write(ujson.Obj.from(answers)))
   } else {
-    println(ujson.write(ujson.Arr(rowsFor(settings, function): _*)))
+    println(ujson.write(ujson.Arr(rowsFor(settings, function, file): _*)))
   }
   println("---OUSAST-CPG-END---")
 }

src/openultrasast/cpg/queries/taint.sc

@@ -17,7 +17,13 @@
 // Parameters (comma-separated where plural):
 //   cpgFile, sources, sinks, sanitizers (optional), function (optional: restrict to this method AND any
 //     closure lexically nested inside it -- see `nestedInLabeled`),
-//   parameterSources ("true" to treat the labeled function's parameters as untrusted -- see below)
+//   parameterSources ("true" to treat the labeled function's parameters as untrusted -- see below),
+//   file (optional: restrict sinks to this source file)
+//
+// `file` is what makes a region with no enclosing function askable at all. Without it such a region sends
+//   function="" and matches every sink in the repository, and the driver attributes that whole answer to
+//   whichever region asked. Scoping by file also stops a named function matching a same-named function in
+//   another module, which a corpus of one-file excerpts could never surface.
 //
 // Output: a fenced JSON array of {sink, sinkLine, sinkMethod, source, sanitized, length}. The fence exists
 // because Joern prints a banner, pass logs and a prompt around whatever a script emits.
@@ -36,6 +42,7 @@
     sinks: String = "",
     sanitizers: String = "",
     function: String = "",
+    file: String = "",
     parameterSources: String = "false",
     requests: String = ""
 ) = {
@@ -43,7 +50,7 @@
 
   def split(raw: String): List[String] = raw.split(",").map(_.trim).filter(_.nonEmpty).toList
 
-  def rowsFor(sourcesS: String, sinksS: String, sanitizersS: String, functionS: String, paramSrc: String): List[ujson.Obj] = {
+  def rowsFor(sourcesS: String, sinksS: String, sanitizersS: String, functionS: String, paramSrc: String, fileS: String): List[ujson.Obj] = {
 
   // Word-boundary matching, never substring. `resolveUrl` contains `resolve`, so a bare-substring sanitizer
   // test marked the VULNERABLE flow sanitized and the verdict fell back to a captured `res` that names no
@@ -104,7 +111,8 @@
     val all = cpg.call.filter(c =>
       sinkNames.exists(n => c.name == n || c.code.startsWith(n + "(") || c.code.startsWith(n) || c.methodFullName.contains(n))
     )
-    if (function.isEmpty) all else all.filter(c => nestedInLabeled(c.method))
+    val inFile = if (fileS.isEmpty) all else all.filter(_.method.filename.endsWith(fileS))
+    if (function.isEmpty) inFile else inFile.filter(c => nestedInLabeled(c.method))
   }
 
   val rows = sinkCalls.l.flatMap { sink =>
@@ -148,11 +156,11 @@
     val answers = parsed.map { case (id, req) =>
       def field(name: String): String = req.obj.get(name).map(_.str).getOrElse("")
       val paramSrc = req.obj.get("parameterSources").map(_.str).getOrElse("false")
-      id -> ujson.Arr(rowsFor(field("sources"), field("sinks"), field("sanitizers"), field("function"), paramSrc): _*)
+      id -> ujson.Arr(rowsFor(field("sources"), field("sinks"), field("sanitizers"), field("function"), paramSrc, field("file")): _*)
     }
     println(ujson.write(ujson.Obj.from(answers)))
   } else {
-    println(ujson.write(ujson.Arr(rowsFor(sources, sinks, sanitizers, function, parameterSources): _*)))
+    println(ujson.write(ujson.Arr(rowsFor(sources, sinks, sanitizers, function, parameterSources, file): _*)))
   }
   println("---OUSAST-CPG-END---")
 }