feat(model-grounded-detection): 4.1 guard dominance, 4.2 the missing sink facts

4.1 is the arbiter for the class no crash oracle reaches. An access-control bug
is the ABSENCE of a guard: no flow to follow, no crash to reproduce. What the
model can establish is a consistency violation -- an obligated operation no
discharging guard governs, in a file where its siblings are governed by one.

"Governed" turned out not to be one relation, and asking pure CFG dominance of
the operation gets two of three shapes wrong. Measured against the real engine:

  identity constraint  the guard is INSIDE the operation's arguments
                       filter_by(owner_id = current_user.id)
  identity branch      abort(403).controlledBy == [note.owner_id != current_user.id]
                       -- the check runs AFTER the fetch, so it never dominates
                       the operation, but it controls whether the value escapes
  dominating guard     a discharger-naming call that dominates the operation

That is why the query uses controlledBy rather than dominatedBy for shape 2.

Two bugs found by running it, both the same class as the sanitizer bug in group
2 -- part of a fact flattened, the part carrying the signal dropped:

  * dominance_specs used only `calls` and `decorators`, omitting
    identity_sources (current_user, request.user) and constraint_params
    (owner_id, user_id) -- which is how an identity constraint is actually
    written. The arbiter reported "no guard" on handlers that plainly had one.
    request_sources and permissive_values stay excluded: they describe the
    vulnerable shape, and including them would let the arbiter read a bug as
    its own fix.
  * matching operations by code containment yielded four or five desugared rows
    per operation (the bare `tmp1.filter_by` receiver among them, carrying none
    of the guards the real call has), so a guarded operation could be flagged.
    Matching is by call name now.

Live, deterministic, zero model calls:
  leaky      -> model_entailed  no discharging guard, while 2 sibling handlers are guarded
  edit_note  -> no finding      (ownership check controls the denial)
  list_notes -> no finding      (identity constraint in the query)

4.2 authors the sink facts the go/no-go measured as its largest miss class (11
of 23): Django ORM raw SQL, and the four families that previously had no fact
routing to them by CWE at all -- path, output_encoding, untrusted_destination,
prototype. Each entry is a documented dangerous API of the named library with
its provenance recorded inline, and rule_ids left empty because a sink fact is
not a detection rule. Flagged for maintainer review as data, given the standing
"no LLM-authored patterns" constraint. The exact-set assertion written in task
1.1 to hold this gap open is updated rather than deleted, so it still fails if a
family ever loses its seed.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

tests/test_model_specs.py

@@ -36,10 +36,9 @@ def test_the_guard_classifier_still_recognises_each_kind() -> None:
 def test_the_seeded_families_and_the_named_gaps_are_both_exact() -> None:
     """What the retained fact data can seed, and what it provably cannot — Req 9.2, a gap is *named*.
 
-    `path`, `output_encoding`, `untrusted_destination` and `prototype` have no sink in `ruleset/semantic`
-    whose CWE routes to them, which is the same hole the entailment ceiling diagnosed ("closed literal sink
-    table: misses per-family sinks"). Task 4.2 authors those sinks and must update this test when it does —
-    the set is asserted exactly so a gap can neither appear nor close silently.
+    Task 4.2 closed the gap this test was written to hold open: `path`, `output_encoding`,
+    `untrusted_destination` and `prototype` now have sink facts routing to them by CWE. The set is still
+    asserted exactly, so a family can neither lose its seed nor gain one without this record moving.
     """
     from openultrasast.model.specs import dominance_specs, taint_specs
     from openultrasast.model.taxonomy import load_families
@@ -50,11 +49,12 @@ def test_the_seeded_families_and_the_named_gaps_are_both_exact() -> None:
         seeded |= {spec.family for spec in taint_specs(language=language).values()}
         seeded |= {spec.family for spec in dominance_specs(language=language).values()}
     deferred = {"unknown", "memory"}  # the declined bucket and the deferred execution tier
-    assert seeded == {"injection", "deserialization", "config_secrets", "access_control", "memory"}
+    assert seeded == {
+        "injection", "deserialization", "config_secrets", "access_control",
+        "path", "output_encoding", "untrusted_destination", "prototype", "memory",
+    }
     gaps = {family.id for family in taxonomy.families} - seeded - deferred
-    assert gaps == {"path", "output_encoding", "untrusted_destination", "prototype"}, (
-        "a family lost or gained a seed without this record being updated"
-    )
+    assert gaps == set(), f"a family lost its seed: {sorted(gaps)}"
 
 
 def test_the_injection_taint_spec_carries_sources_sinks_and_sanitizers() -> None:
@@ -126,3 +126,25 @@ def test_safe_shape_sinks_are_kept_for_the_shape_test() -> None:
     assert "execute" not in spec.sanitizers
     c_memory = taint_specs(language="c").get("memory")
     assert c_memory is not None and "printf" in c_memory.safe_shape_sinks
+
+
+def test_dischargers_carry_identity_and_constraint_tokens_but_not_the_negative_fields() -> None:
+    """A discharger fact spreads across six fields and two of them mean the opposite.
+
+    `identity_sources` (current_user, request.user) and `constraint_params` (owner_id, user_id) are how an
+    identity constraint is actually written, and omitting them left the absence arbiter reporting "no guard"
+    on a handler that plainly had one. `request_sources` and `permissive_values` are excluded because they
+    describe the vulnerable shape, not the fix -- including them would let the arbiter read a bug as its fix.
+    """
+    from openultrasast.model.specs import dominance_specs
+    from openultrasast.semantic.obligations import load_obligation_facts
+
+    spec = dominance_specs(language="python")["access_control"]
+    assert "current_user" in spec.dischargers and "owner_id" in spec.dischargers
+    assert "login_required" in spec.dischargers  # decorators still present
+
+    facts = load_obligation_facts().for_language("python")
+    negative = {p for fact in facts.dischargers for p in fact.request_sources} | {
+        v for fact in facts.dischargers for v in fact.permissive_values
+    }
+    assert not (negative & set(spec.dischargers)), "the negative fields must never read as a discharge"