feat(model-grounded-detection): group 1, subtract the noise architecture

99 source modules -> 81. 832 tests -> 646. The whole learning/ package (16
modules, ~4,100 lines) and six semantic/ modules removed, with the three gates
byte-identical to 2026-09-06-gate-baseline.txt at every step.

The sequence is what made it safe: vocabularies ported first (1.1), importers
detached second (1.2-1.3), deletion third (1.4). Every import break during the
deletion was therefore a detachment miss in the importer and was fixed there --
no module was restored to satisfy one. Both misses were the same shape and were
fixed as a class: operations.py and shapes.py each imported trailing_name from
the deleted variants.py, so it moved to semantic/ir.py, its natural home, and
both importers changed in one edit.

Ported before deleting: the closed guard vocabulary (verbatim, nothing else
holds it) into model/specs.py, which derives TaintSpec and DominanceSpec from
the retained ruleset facts rather than copying them. Re-homed: families ->
model/taxonomy, candidates -> model/candidates, endpoint -> model/endpoint,
plus Region, labeled_family and labeled_spans. labeled_family no longer falls
back to the LLM classifier -- an unlabeled pair is honestly unknown.

Four deviations, each recorded in the spec notes with its reason. improve/
evolve.py and validator.py were stripped, not deleted: each mixes the mechanism
lever (gone) with the deterministic rule-status loop `ousast improve` still
runs, which has no LLM in it; a test now asserts the lever's absence by symbol
so it cannot creep back. The learning CLI group became `model candidates`,
because deleting it outright would have orphaned the retained enumerator by
removing its only entry point. thinking moved from [learning] to [models].

A gap named rather than papered over: no retained sink fact routes by CWE to
path, output_encoding, untrusted_destination or prototype -- the same hole the
entailment ceiling diagnosed. The test asserts the seeded set and the gap set
exactly, so task 4.2 must update it when it authors those sinks.

The audit found exactly one genuine orphan: vectorstore.py, a bakeoff harness
with no production caller and no CLI, alive only through its own test. The five
named subsystems each carry an explicit decision. Manifest committed, with a
test asserting the tree still matches it.

Group 2 (the Joern go/no-go) has not started.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/model/specs.py

@@ -0,0 +1,156 @@
+"""The security vocabularies the model layer arbitrates with (model-grounded-detection, Req 7.2-7.4).
+
+Two kinds of knowledge live here, and they are held differently on purpose.
+
+The **guard vocabulary** is ported verbatim from ``semantic/variants.py``, whose optimisation loop this
+feature deleted. Nothing else holds it: it is the closed set of ways a fix discharges a flow, and it tells
+the model what a *fixed* twin looks like. Order matters — first match wins.
+
+The **taint and dominance specs** are *derived* from data that survives: the source/sink/sanitizer facts in
+``ruleset/semantic`` and the obligated operations and dischargers in ``ruleset/obligations``. Copying them
+here would create a second place to update, so this module reads them through the retained loaders and
+groups them by family via the taxonomy's CWE map.
+
+Read-only by construction (Req 7.4, the verifier boundary): this module exposes no writer, opens no file for
+writing, and holds no mutable module state. An LLM or a future optimiser has nothing here to rewrite.
+"""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Mapping
+from dataclasses import dataclass
+
+from ..semantic.facts import SemanticFacts, load_facts
+from ..semantic.obligations.facts import ObligationFacts, load_obligation_facts
+from .taxonomy import FamilyTaxonomy, load_families
+
+# --- The guard vocabulary (ported verbatim; nothing else holds it) ----------------------------------------
+
+GUARD_KINDS = ("null_test", "bounds_test", "allowlist_test", "auth_check", "parameterized_call", "type_change", "none")
+
+# Closed guard classification over the statements a fix added inside the labeled function.
+# Order matters: the first matching kind wins. These classify the *fix*, they never detect.
+GUARD_PATTERNS: tuple[tuple[str, re.Pattern[str]], ...] = (
+    ("parameterized_call", re.compile(r"execute\w*\([^,]+,\s*[\(\[]|prepareStatement\(|\?\s*['\"]?\s*[,)]|\$\d\b|%s['\"]\s*,\s*[\(\[]")),
+    (
+        "auth_check",
+        re.compile(
+            r"\b(request\.user|req\.user|current_user|request\.state|session\[|is_authenticated|authoriz|require_auth"
+            r"|login_required|verify_token|check_permission|owner_id\s*[!=]=)"
+        ),
+    ),
+    (
+        "allowlist_test",
+        re.compile(
+            r"\bnot in\b|\bin\s*[\(\{\[]|\.includes\(|\.has\(|\bstartswith\(|\bstartsWith\(|\bendswith\(|\bendsWith\("
+            r"|re\.(?:match|fullmatch)\(|\.test\(|allow_?list|whitelist|\bALLOWED\b|\bsafe_join\(|secure_filename\("
+            r"|\brealpath\(|\bnormpath\(|\bresolve\("
+        ),
+    ),
+    ("bounds_test", re.compile(r"\blen\(|\.length\b|\bsizeof\(|\bstrn?len\(|\bsnprintf\(|\bstrlcpy\(|\bmin\(|\bmax\(|\s(?:<|>|<=|>=)\s")),
+    (
+        "null_test",
+        re.compile(
+            r"\bis None\b|\bis not None\b|[!=]= *NULL\b|[!=]==? *null\b|\bnullptr\b|\bif\s*\(\s*!\s*\w|\bif not \w+\s*:"
+            r"|\bif\s+\w+\s+is\s+None|\?\?|\?\."
+        ),
+    ),
+    (
+        "type_change",
+        re.compile(r"\bint\(|\bparseInt\(|\bNumber\(|\(int\)|\(size_t\)|\(unsigned\b|\bstr\(|\.toString\(|\bstatic_cast<|\bBigInt\("),
+    ),
+)
+
+
+def classify_guard_text(text: str) -> str:
+    """The guard kind the given statements express, or ``none`` when no known guard is recognised."""
+    for kind, pattern in GUARD_PATTERNS:
+        if pattern.search(text):
+            return kind
+    return "none"
+
+
+# --- The specs the CPG queries are parameterised by ------------------------------------------------------
+
+
+@dataclass(frozen=True)
+class TaintSpec:
+    """What a flow family's source→sink−sanitizer query matches on, for one language."""
+
+    family: str
+    language: str
+    sources: tuple[str, ...]
+    sinks: tuple[str, ...]
+    sanitizers: tuple[str, ...]
+
+
+@dataclass(frozen=True)
+class DominanceSpec:
+    """What an absence family's guard-dominates-operation query matches on, for one language.
+
+    ``dischargers`` are the guards that discharge an obligation; the query asks whether one of them dominates
+    the operation on every path, which is the arbiter for the classes that never crash.
+    """
+
+    family: str
+    language: str
+    operations: tuple[str, ...]
+    dischargers: tuple[str, ...]
+
+
+def taint_specs(
+    *,
+    language: str,
+    facts: SemanticFacts | None = None,
+    taxonomy: FamilyTaxonomy | None = None,
+) -> Mapping[str, TaintSpec]:
+    """One ``TaintSpec`` per flow family that has a sink in this language, grouped through the taxonomy's CWE map.
+
+    Sources and sanitizers are language-wide: a family does not get its own notion of what untrusted input is,
+    and a sanitizer that breaks one flow breaks it whatever the sink's family.
+    """
+    scoped = (facts if facts is not None else load_facts()).for_language(language)
+    families = taxonomy if taxonomy is not None else load_families()
+    sources = tuple(sorted({pattern for fact in scoped.sources for pattern in fact.patterns}))
+    sanitizers = tuple(sorted({call for fact in scoped.sanitizers for call in fact.calls}))
+    by_family: dict[str, set[str]] = {}
+    for sink in scoped.sinks:
+        family = families.family_of_cwe(sink.cwe)
+        if family is None:
+            continue
+        by_family.setdefault(family.id, set()).update(sink.calls)
+    return {
+        family_id: TaintSpec(family=family_id, language=language, sources=sources, sinks=tuple(sorted(calls)), sanitizers=sanitizers)
+        for family_id, calls in sorted(by_family.items())
+    }
+
+
+def dominance_specs(*, language: str, facts: ObligationFacts | None = None) -> Mapping[str, DominanceSpec]:
+    """One ``DominanceSpec`` per absence family for this language.
+
+    The obligation facts are authored for authorization, so every obligated operation routes to
+    ``access_control``; the shape generalises when a second absence family is added to the taxonomy.
+    """
+    scoped = (facts if facts is not None else load_obligation_facts()).for_language(language)
+    if not scoped.operations:
+        return {}
+    operations = tuple(sorted({call for fact in scoped.operations for call in fact.calls}))
+    dischargers = tuple(
+        sorted(
+            {call for fact in scoped.dischargers for call in fact.calls}
+            | {decorator for fact in scoped.dischargers for decorator in fact.decorators}
+        )
+    )
+    return {"access_control": DominanceSpec(family="access_control", language=language, operations=operations, dischargers=dischargers)}
+
+
+__all__ = [
+    "GUARD_KINDS",
+    "GUARD_PATTERNS",
+    "DominanceSpec",
+    "TaintSpec",
+    "classify_guard_text",
+    "dominance_specs",
+    "taint_specs",
+]