feat(prover): delivery B: handler-named operations, Symfony, Livewire, Remix and Tornado entries, enforcement witnesses, memoised path walk

Codex delivery under spec access-control-prover plus one fix of mine. Operation rows may now name a handler by
name pattern and framework (Jenkins form validation and list filling, Tornado request methods, Remix actions);
the mapper recognises Symfony, Livewire and Laravel controllers, Remix exports and Tornado handlers;
`obligations/enforcement.py` turns Laravel route middleware, Symfony attributes and security.yaml rules and
Tornado's authenticated decorator into router and decorator witnesses. The path walk looks each node's callers
up once per change and does not walk a tree with no recognised entry: one seatunnel change fell from 670 s to
35 s. One name Codex could not source (Tornado get_current_user) is left out and said so in the facts header.

Smoke on the 23 fix changes: 15 pushes caught (65 percent, Wilson 45 to 81), 55 of 93 locations, precision
15 of 15 flagged, no instrument failure, no change over 120 s. Delivery A caught 7.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

.kiro/specs/access-control-prover/tasks.md

@@ -18,7 +18,7 @@
   - _Requirements: 4.1a_
   - _Boundary: obligations.check (opt-in only)_
 
-- [ ] 2. Entry recognisers
+- [x] 2. Entry recognisers
 - [x] 2.1 Stapler and Jetty recognisers in `mapping.py` (P)
   - Public `do[A-Z]...` methods on exposed types or with Stapler-typed or `@QueryParameter` parameters; Jetty
     `AbstractHandler`, `HttpServlet`, JAX-RS resources; evidence strings; `public` only for `UnprotectedRootAction`
@@ -26,13 +26,13 @@
     helper named `doX`, and the existing mapping tests still pass
   - _Requirements: 1.1, 1.6, 1.7, 1.8_
   - _Boundary: mapping_
-- [ ] 2.2 Symfony, Livewire and Laravel controller, Remix export and Tornado recognisers in `mapping.py` (P)
+- [x] 2.2 Symfony, Livewire and Laravel controller, Remix export and Tornado recognisers in `mapping.py` (P)
   - Done when fixture files of each shape yield `route` entries with evidence and the negative fixtures yield none
   - _Requirements: 1.2, 1.3, 1.4, 1.5, 1.7, 1.8_
   - _Boundary: mapping_
 
 - [ ] 3. Enforcement witnesses and facts
-- [ ] 3.1 `semantic/obligations/enforcement.py` producing router and decorator `Discharge` witnesses (P)
+- [x] 3.1 `semantic/obligations/enforcement.py` producing router and decorator `Discharge` witnesses (P)
   - Laravel route middleware and controller `middleware`/`authorizeResource`; Symfony `IsGranted`, `Security`,
     security.yaml `access_control`; Tornado `authenticated`; names listed in the facts headers
   - Done when `tests/test_obligation_enforcement.py` shows a guarded Laravel route, a Symfony attribute and a
@@ -50,15 +50,15 @@
   - _Requirements: 2.3, 2.4, 2.7_
   - _Boundary: ruleset/obligations_
 
-- [ ] 3.3 Handler-named operations: `handlers` and `framework` fields in the facts loader, `find_operations(..., handlers_of=)`, Stapler form-validation rows in `java.toml`, Tornado handler rows in `python.toml`, Remix action rows in `typescript.toml`
+- [x] 3.3 Handler-named operations: `handlers` and `framework` fields in the facts loader, `find_operations(..., handlers_of=)`, Stapler form-validation rows in `java.toml`, Tornado handler rows in `python.toml`, Remix action rows in `typescript.toml`
   - Done when `tests/test_obligation_facts.py` loads a handler-named row, `tests/test_obligation_operations.py`
     (or the existing operations test file) yields the operation at the declaration line only for listed
     handlers, and the prover smoke on the 23 fixes reaches and checks the Jenkins form-validation methods
   - _Requirements: 2.8_
   - _Boundary: obligations.facts, obligations.operations_
 
-- [ ] 4. The prover
-- [ ] 4.1 `hunt/prover.py`: `prove_change` over the hunter `Context`, `Coverage`, findings as hunt defects
+- [x] 4. The prover
+- [x] 4.1 `hunt/prover.py`: `prove_change` over the hunter `Context`, `Coverage`, findings as hunt defects
   - Touched functions from head lines, build output left out, targets include direct callees holding operations,
     IRs of hop files passed to the checker, extra witnesses from enforcement, coverage counts by reason, no model
   - Done when `tests/test_hunt_prover.py` shows: an unguarded Stapler handler calling `lookupCredentials` gives
@@ -103,3 +103,40 @@
   requested static gate passed (format, Ruff and mypy); the exact pytest gate passed with 112 passed,
   zero failed, exit 0. UV_NO_SYNC=1 was set; UV_CACHE_DIR was placed under /tmp because the default
   cache is outside the writable sandbox. The unchanged unjustified-path checker test remains intact.
+
+- Delivery B (2026-10-14) implements task 2.2's Symfony, Livewire/Laravel, Remix and Tornado
+  entries, task 3.1's scoped enforcement witnesses, task 3.3's handler facts and operation discovery,
+  and task 4.1's integration. Changes remain uncommitted as the brief requires.
+- Handler facts are explicitly opt-in through file-qualified handler maps in the checker. The prover
+  uses handler obligations where a Stapler or Tornado entry reaches no listed call operation; existing
+  call-site findings and Delivery A tests remain unchanged. Remix retains its handler operation even
+  when listed calls exist, and independently requires a path guard and an ownership check. Public
+  access waives only the path guard for these handler facts. The checker default is unchanged.
+- The prover supplies a local dominance adapter for handler facts: it checks guards within the handler
+  body while reporting the operation at its declaration. A final ordinary return does not turn a bare
+  permission predicate into a guard. OrderDominance and the existing producers and arms are unchanged.
+- Remix arrow exports are named locally in the prover's IR copy, including TSX route modules. Symfony
+  recognises positional and named route paths and class prefixes. Tornado recognises local subclasses
+  and the pool terminal's terminado base when it explicitly invokes Tornado's WebSocketHandler method.
+- PHP CST Point.row access crashed on the larger Kimai controller with the installed native parser.
+  New recognisers derive line numbers from byte offsets instead; a fixture past line 320 and the
+  23-change source smoke complete without a crash. Existing CST code was not modified.
+- Task 3.2 remains partially complete: TypeScript adds clone-verified requireUserId and
+  authenticateApiRequest, retaining requireUser and authorize; PHP rows are retained and their header
+  records enforcement sources. Python retains the existing authenticated decorator and gains the
+  Tornado handler operation. No get_current_user fact was added: Git searches of Mage HEAD, the pool
+  revision and websocket fix 66440e4d3 found neither that API nor an authenticated decorator use, and
+  local framework documentation was unavailable. The brief forbids network access and unsourced names.
+- Review used the main-context fallback because the brief prohibits model calls. Verdict: APPROVED
+  for tasks 2.2, 3.1, 3.3 and 4.1; task 3.2 remains open for its source-verification gap. No new
+  placeholder markers, credentials, dependencies, producer edits or arm edits were introduced.
+- Fresh verification: UV_NO_SYNC=1 and UV_CACHE_DIR=/tmp/ousast-uv. The exact static gate passed:
+  ruff format --check ., ruff check ., mypy src/openultrasast (178 source files). The exact requested
+  pytest gate plus test_obligation_operations.py passed with 145 passed, zero failed, exit 0.
+  Initial missing-feature tests produced 24 failed and 14 passed; integration tests initially produced
+  eight failed and 20 passed. No test_search_* test was run.
+- A separate file-scoped smoke read immutable Git source objects for all 23 access-control changes,
+  validated their commit objects and source digests, and recorded nonzero input bytes for every change.
+  All 23 executions completed, zero errors; 16 changes checked operations and seven remained unchecked.
+  It materialised only changed source files in temporary directories, so it is not a full-repository
+  recall measurement. The maintainer-owned task 6.1 and release readiness remain unclaimed.