feat(model): a region that spans the flow, not just a function

contributor-scan 2.4, closing the no-go task 2.2 recorded.

VAmPI's SQL injection is a request parameter reaching `get_by_username`
in api_views/users.py, passed to `User.get_user` in models/user_model.py,
interpolated into a query string and executed there. Source and sink are
in different functions and different modules. Regions were per-function,
so neither region saw both ends and the engine was silent on the most
ordinary shape a real injection bug has.

`reachableByFlows` was never the limitation -- it follows calls already.
The limitation was the QUESTION. Sinks were filtered to the labeled
function's own body, so a crossing flow had no sink to end at.

Three changes, each with a reason it is sound rather than convenient:

**An entry point is the trust boundary.** parameter_sources was off for
repository scans because a repository's parameters are not all attacker
input. An entry point's are, by definition -- that is what makes it an
entry point. The driver turns it on only for regions the mapper found and
named, and leaves it off for walker fallbacks and for named functions that
are not entry points.

**Sinks may sit below the handler.** taint.sc admits sinks in methods
reachable from the labeled method through the call graph, bounded at
ENTRY_POINT_CALL_DEPTH = 3: handler -> service -> data access, which is
where these bugs live. Unbounded would make the question about most of the
repository rather than about this entry point, and make it unaffordable.

**The finding names the sink, not the asker.** A crossing flow ends in
another file and another function, so Verdict carries the evidence's own
`path:line:function` and the site uses it. Reporting
`models/user_model.py:73:get_by_username` would name a place that does not
exist: line 73 is inside get_user.

Also: labeled methods are now resolved by name AND file. `get_user` exists
in more than one module of a real repository, which a corpus of one-file
excerpts could never surface.

Measured on the same checkout and budget as 2.2:

  VAmPI-SQLI    missed -> model_entailed at models/user_model.py:73:get_user
  known found   0 of 2 before 2.2's fixes, 1 of 2 in 2.2, 2 of 2 now
  entailed      7 -> 8
  query time    40.9s -> 37.4s
  peak RSS      869MB -> 827MB
  cost          $0.0067, unchanged

Asking the bigger question cost nothing measurable here: file scoping and
call-graph following pull in opposite directions and roughly cancel at this
size. That is one 520-line repository, and VAmPI is now the repository this
change was developed against -- the exact overfitting shape Req 8 exists to
catch. The depth bound and the entry-point rule mean nothing general until
a checkout nobody tuned against says so.

Gates byte-identical.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/model/scan.py

@@ -40,6 +40,19 @@ from .taxonomy import load_families
 # would let a fourth spec kind reach `_grouped` and silently fall through to the taint branch.
 ArbiterSpec = TaintSpec | DominanceSpec | ConfigSpec
 
+# How far below an entry point a sink may sit and still be attributed to it.
+#
+# An entry point is the trust boundary, so its parameters ARE attacker input and a sink it reaches is its
+# responsibility -- which is what makes VAmPI's SQL injection askable at all: a request parameter reaches
+# `get_by_username`, is passed to `User.get_user` in another module, interpolated there and executed. A
+# function-scoped question sees neither end of that.
+#
+# Bounded, and deliberately shallow. "Every method transitively reachable from a handler" is most of a
+# repository: the question stops being about this entry point and the query stops being affordable. Three
+# levels covers handler -> service -> data access, which is where these bugs live. Raising it is a
+# measurement, not a preference.
+ENTRY_POINT_CALL_DEPTH = 3
+
 logger = logging.getLogger(__name__)
 
 _RUNG_ORDER = {Rung.ENTAILED: 0, Rung.CORROBORATED: 1, Rung.SUSPICION: 2, Rung.EXECUTION_CONFIRMED: -1}
@@ -167,7 +180,11 @@ def scan_repository(
                 client=None if exhausted else counted,
                 model=model,
                 candidates=candidates,
-                parameter_sources=False,  # a repository's parameters are not all attacker input
+                # A repository's parameters are not all attacker input -- but an ENTRY POINT's are, by
+                # definition. That is the trust boundary, and it is the one place both halves of the old
+                # objection stop applying.
+                parameter_sources=_is_entry_point(region),
+                call_depth=ENTRY_POINT_CALL_DEPTH if _is_entry_point(region) else 0,
             )
         except Exception as exc:  # noqa: BLE001 -- one bad region must not end the scan
             logger.warning("model scan failed for %s: %s", region.path, exc)
@@ -218,16 +235,36 @@ def _grouped(work: Sequence[tuple[str, ScanRegion, ArbiterSpec]]) -> dict[str, d
     grouped: dict[str, dict[str, Mapping[str, object]]] = {}
     for rid, region, spec in work:
         function = region.function or ""
+        entry = _is_entry_point(region)
         if isinstance(spec, DominanceSpec):
             kind, params = "dominance", dominance_params(spec, function=function)
         elif isinstance(spec, ConfigSpec):
             kind, params = "config", config_params(spec, function=function, file=region.path)
         else:
-            kind, params = "taint", taint_params(spec, function=function, file=region.path, parameter_sources=False)
+            kind, params = (
+                "taint",
+                taint_params(
+                    spec,
+                    function=function,
+                    file=region.path,
+                    parameter_sources=entry,
+                    call_depth=ENTRY_POINT_CALL_DEPTH if entry else 0,
+                ),
+            )
         grouped.setdefault(kind, {})[rid] = params
     return grouped
 
 
+def _is_entry_point(region: ScanRegion) -> bool:
+    """Is this region a place untrusted input actually enters?
+
+    A named function the entry-point mapper found, not a file the walker fell back to. The distinction is
+    what makes treating parameters as untrusted sound: a handler's parameters carry request data, an
+    arbitrary helper's carry whatever its caller had.
+    """
+    return region.source == "entry_point" and bool(region.function)
+
+
 def _spec_for(family: str, language: str) -> ArbiterSpec | None:
     """The spec whose arbiter can decide this family. Routing stays a lookup; dispatch stays in `_arbitrate`."""
     if family == "access_control":