fix(model-grounded-detection): the absence arbiter was silencing its own family

Two bugs, together making 4.1 report "no bug" on a textbook IDOR. Both found by
running it against a real corpus pair rather than a fixture.

1. constraint_params were treated as dischargers. A field named `user_id` is
   what an IDOR is MADE OF -- `filter_by(id=user_id)` with user_id off the
   request is the bug, not the fix. The deleted checker only counted an identity
   constraint whose value's PROVENANCE was the authenticated context, so the
   parameter name alone evidences nothing. This is the mirror of group 2's
   sanitizer bug: a thing that must never count as a discharge, counted.

2. Guard tokens matched as substrings. With `user` in the token list, the string
   "SELECT * FROM users WHERE id = ?" contains `user`, so the query reported
   every operation in the handler as guarded. Matching is word-boundary now.

On threatbyte-api-v1-delete the arbiter previously found three operations, all
"guarded" by evidence like '"SELECT * FROM users WHERE id = ?"' and '(user_id,)',
and returned no verdict at all. After the fix, on the real pairs:

  threatbyte-api-v1-delete     vuln=model_corroborated  fixed=none
  vampi-users-update-password  vuln=model_corroborated  fixed=none

Both distinguished, deterministically, with no model call. Corroborated rather
than entailed is right for these: they are single-handler excerpts with no
guarded sibling to be inconsistent with, which is the asymmetry the rung
distinction exists to express.

identity_sources still discharge; request_sources and permissive_values remain
excluded because they describe the vulnerable shape rather than the fix.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/cpg/queries/dominance.sc

@@ -30,7 +30,11 @@
   val opNames     = split(operations)
   val guardTokens = split(dischargers)
 
-  def mentionsGuard(code: String): Boolean = guardTokens.exists(g => code.contains(g))
+  // Word-boundary matching, never substring. A discharger token like `user` matched as a substring hits
+  // `users` inside "SELECT * FROM users WHERE id = ?", marking a textbook IDOR as guarded -- a silent false
+  // negative on the one family this arbiter exists for.
+  def mentionsGuard(code: String): Boolean =
+    guardTokens.exists(g => java.util.regex.Pattern.compile("(?<![A-Za-z0-9_])" + java.util.regex.Pattern.quote(g) + "(?![A-Za-z0-9_])").matcher(code).find())
 
   // Match by CALL NAME, never by code containment: the frontend desugars `Note.query.filter_by(x).first()`
   // into a chain of temporaries, and matching on code yields four or five rows for one operation -- some of

src/openultrasast/model/specs.py

@@ -109,11 +109,16 @@ class DominanceSpec:
 
         calls, decorators          an explicit guard: ``login_required``, ``check_owner``
         identity_sources           the authenticated context: ``current_user``, ``request.user``
-        constraint_params          a field that constrains by identity: ``owner_id``, ``user_id``
 
-    ``request_sources`` and ``permissive_values`` are excluded because they describe the NEGATIVE case -- a
-    value that comes from the request discharges nothing, and a permissive literal is the bug rather than the
-    guard. Including them would let the absence arbiter read a vulnerability as its own fix.
+    Three fields are deliberately excluded, and each for a different reason:
+
+        constraint_params          NOT a discharge on its own. A field named ``user_id`` is what an IDOR is
+                                   *made of* -- ``filter_by(id=user_id)`` with ``user_id`` off the request is
+                                   the bug, not the fix. The original checker only counted a constraint whose
+                                   value's provenance was the authenticated context, so the param name alone
+                                   evidences nothing and treating it as a guard silences the whole family.
+        request_sources            a value from the request discharges nothing, by definition.
+        permissive_values          a permissive literal is the bug, not the guard.
     """
 
     family: str
@@ -205,7 +210,6 @@ def dominance_specs(*, language: str, facts: ObligationFacts | None = None) -> M
             {call for fact in scoped.dischargers for call in fact.calls}
             | {decorator for fact in scoped.dischargers for decorator in fact.decorators}
             | {source for fact in scoped.dischargers for source in fact.identity_sources}
-            | {param for fact in scoped.dischargers for param in fact.constraint_params}
         )
     )
     return {"access_control": DominanceSpec(family="access_control", language=language, operations=operations, dischargers=dischargers)}