feat(model-grounded-detection): tasks 2.1-2.2, the Joern seam and the taint verdict

The whole engine integration is one subprocess boundary: joern-parse builds a
cpg.bin, joern --script runs a shipped CPGQL query that prints its JSON between
fence markers, because Joern's stdout carries a banner and a REPL prompt around
whatever a script emits. Nothing is imported in-process, so the core install
keeps dependencies = [] -- a test walks the seam's AST to assert it imports
only the standard library and names no JVM binding.

Fail closed everywhere. A build or query that errors, times out, or prints
something unparseable yields no verdict and the caller reports suspicion. The
taint verdict distinguishes this from absence deliberately: a query returning
None means "the engine could not decide", which is not "there is no flow", and
conflating them is how a missing engine silently becomes a clean bill of health.

The verdict is where the ladder earns its keep. An unsanitized source->sink
path is model_entailed -- the graph establishes it and the LLM's claim is no
longer load-bearing. A path a sanitizer may break is model_corroborated: the
flow is real, but whether the sanitizer suffices is the semantic residual the
LLM answers, checked against this verdict rather than averaged over runs. The
chosen flow is picked by a total order (shortest, then lexicographic), so two
runs over one CPG cannot disagree -- Req 6.4 asserted directly.

The query itself is the part our flat IR could not do: reachableByFlows walks
the PDG, so `q = "..." + request.args["x"]; execute(q)` is found, which is
exactly the one-hop limit that held measured entailment at 2.2%.

Capability detection reuses semantic/engines.joern_available rather than
growing a second notion of "installed". The audit manifest is regenerated; the
new modules are named by Req 4/5/6 rather than counted as orphans.

Task 2.3, the go/no-go measurement, needs Joern installed and has not run.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/cpg/queries/taint.sc

@@ -0,0 +1,61 @@
+// Taint reachability for one flow family (model-grounded-detection Req 6.1).
+//
+// The question this answers is the one our flat IR could not: does an untrusted source reach the labeled sink
+// *through resolved dataflow*, and is there a sanitizer on that path. Joern's `reachableByFlows` walks the
+// PDG, so a value bound three statements upstream — `q = "..." + request.args["x"]; execute(q)` — is found,
+// which is exactly the one-hop limit that held our measured entailment at 2.2%.
+//
+// Parameters (all comma-separated where plural):
+//   cpgFile     the built cpg.bin
+//   sources     source matchers, e.g. request.args,request.form
+//   sinks       sink call names, e.g. execute,os.system
+//   sanitizers  sanitizer call names; a flow through one of these is corroborated, not entailed
+//   function    optional: restrict sinks to this enclosing method
+//
+// Output: a fenced JSON array of {sink, sinkLine, sinkMethod, source, sanitized, length}.
+// The fence exists because Joern prints a banner and a prompt around whatever a script emits.
+
+@main def exec(cpgFile: String, sources: String, sinks: String, sanitizers: String = "", function: String = "") = {
+  importCpg(cpgFile)
+
+  def split(raw: String): List[String] =
+    raw.split(",").map(_.trim).filter(_.nonEmpty).toList
+
+  val sourcePatterns    = split(sources)
+  val sinkNames         = split(sinks)
+  val sanitizerNames    = split(sanitizers)
+
+  // A source is any call or identifier whose code matches one of the source patterns. Matching on `code`
+  // rather than on a method name keeps `request.args["x"]` and `req.body.name` both reachable without
+  // per-framework special cases.
+  def sourceNodes = cpg.call.filter(c => sourcePatterns.exists(p => c.code.contains(p))).l ++
+                    cpg.identifier.filter(i => sourcePatterns.exists(p => i.code.contains(p))).l
+
+  // A sink is a call whose name (or full code) names one of the family's sinks, optionally inside `function`.
+  def sinkNodes = {
+    val all = cpg.call.filter(c => sinkNames.exists(n => c.name == n || c.code.startsWith(n) || c.methodFullName.contains(n))).l
+    if (function.isEmpty) all else all.filter(_.method.name == function)
+  }
+
+  def isSanitized(flowCode: List[String]): Boolean =
+    sanitizerNames.nonEmpty && flowCode.exists(code => sanitizerNames.exists(s => code.contains(s)))
+
+  val rows = sinkNodes.flatMap { sink =>
+    val flows = sourceNodes.reachableByFlows(sink).l
+    flows.map { flow =>
+      val elements = flow.elements.map(_.code).l
+      ujson.Obj(
+        "sink"       -> sink.code.take(200),
+        "sinkLine"   -> sink.lineNumber.getOrElse(-1).toString,
+        "sinkMethod" -> sink.method.name,
+        "source"     -> elements.headOption.getOrElse("").take(200),
+        "sanitized"  -> isSanitized(elements),
+        "length"     -> elements.size
+      )
+    }
+  }
+
+  println("---OUSAST-CPG-BEGIN---")
+  println(ujson.write(ujson.Arr(rows: _*)))
+  println("---OUSAST-CPG-END---")
+}