Prerelease cleanup (#46)

* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/server/models.rs

@@ -582,6 +582,187 @@ pub struct OverviewResponse {
     pub noisy_rules: Vec<NoisyRule>,
     pub recent_scans: Vec<ScanSummary>,
     pub insights: Vec<Insight>,
+
+    // ── Tier 1 ──
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub health: Option<HealthScore>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub posture: Option<PostureSummary>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub backlog: Option<BacklogStats>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub weighted_top_files: Vec<WeightedFile>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub confidence_distribution: Option<ConfidenceDistribution>,
+
+    // ── Tier 2 ──
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub scanner_quality: Option<ScannerQuality>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub issue_categories: Vec<IssueCategoryBucket>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub hot_sinks: Vec<HotSink>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub owasp_buckets: Vec<OwaspBucket>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cross_file_ratio: Option<f64>,
+
+    // ── Tier 3 ──
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub baseline: Option<BaselineInfo>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub language_health: Vec<LanguageHealth>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub suppression_hygiene: Option<SuppressionHygiene>,
+}
+
+/// Composite repo-health rollup.
+#[derive(Debug, Clone, Serialize)]
+pub struct HealthScore {
+    /// 0–100 score; higher is better.
+    pub score: u8,
+    /// Letter grade A–F derived from score.
+    pub grade: String,
+    /// Sub-component contributions (0–100 each) for transparency.
+    pub components: Vec<HealthComponent>,
+}
+
+/// Single line item in the health-score breakdown.
+#[derive(Debug, Clone, Serialize)]
+pub struct HealthComponent {
+    /// Human label (e.g. "Severity pressure", "Trend", "Triage").
+    pub label: String,
+    /// 0–100 — already inverted so higher = healthier.
+    pub score: u8,
+    /// Weight applied when blending into the final score (0.0–1.0).
+    pub weight: f64,
+    /// Short rationale shown in tooltip.
+    pub detail: String,
+}
+
+/// One-line trend posture for the page header.
+#[derive(Debug, Clone, Serialize)]
+pub struct PostureSummary {
+    /// "improving" | "regressing" | "stable" | "unknown"
+    pub trend: String,
+    /// "success" | "warning" | "danger" | "info"
+    pub severity: String,
+    /// Short message shown verbatim in the banner.
+    pub message: String,
+    /// Findings that were previously fixed and have re-appeared.
+    pub reintroduced_count: usize,
+}
+
+/// Backlog age statistics computed from finding_first_seen.
+#[derive(Debug, Clone, Serialize)]
+pub struct BacklogStats {
+    /// Days since the oldest still-open finding was first seen.
+    pub oldest_open_days: Option<u32>,
+    /// Median age of currently-open findings, in days.
+    pub median_age_days: Option<u32>,
+    /// Findings older than 30 days that remain open.
+    pub stale_count: usize,
+    /// Histogram buckets (label, count) — fixed 5 buckets.
+    pub age_buckets: Vec<OverviewCount>,
+}
+
+/// Top-file row including severity stack for the weighted ranking.
+#[derive(Debug, Clone, Serialize)]
+pub struct WeightedFile {
+    pub name: String,
+    pub score: u32,
+    pub high: usize,
+    pub medium: usize,
+    pub low: usize,
+    pub total: usize,
+}
+
+/// Confidence-level distribution.
+#[derive(Debug, Clone, Serialize, Default)]
+pub struct ConfidenceDistribution {
+    pub high: usize,
+    pub medium: usize,
+    pub low: usize,
+    pub none: usize,
+}
+
+/// Engine-quality metrics that describe analysis depth/coverage.
+#[derive(Debug, Clone, Serialize)]
+pub struct ScannerQuality {
+    pub files_scanned: u64,
+    pub files_skipped: u64,
+    /// 0.0–1.0 — files_scanned / (files_scanned + files_skipped).
+    pub parse_success_rate: f64,
+    pub functions_analyzed: u64,
+    pub call_edges: u64,
+    pub unresolved_calls: u64,
+    /// 0.0–1.0 — call_edges / (call_edges + unresolved_calls).
+    pub call_resolution_rate: f64,
+    /// % of taint findings that received a symbolic verdict (Confirmed|Infeasible|Inconclusive).
+    pub symex_verified_rate: f64,
+    /// Count broken down by symbolic verdict label.
+    pub symex_breakdown: HashMap<String, usize>,
+}
+
+/// One issue-category bucket (rule-family derived). Broader than OWASP, with
+/// engine-friendly labels like "Tainted Flow" or "Code Quality".
+#[derive(Debug, Clone, Serialize)]
+pub struct IssueCategoryBucket {
+    pub label: String,
+    pub count: usize,
+}
+
+/// "Hot sink" — a single callee that absorbs many findings.
+#[derive(Debug, Clone, Serialize)]
+pub struct HotSink {
+    /// Callee name (best-effort; from flow_steps last Sink).
+    pub callee: String,
+    pub count: usize,
+}
+
+/// One OWASP Top-10 (2021) bucket.
+#[derive(Debug, Clone, Serialize)]
+pub struct OwaspBucket {
+    /// "A01:2021 — Broken Access Control" etc.
+    pub code: String,
+    pub label: String,
+    pub count: usize,
+}
+
+/// Per-language posture.
+#[derive(Debug, Clone, Serialize)]
+pub struct LanguageHealth {
+    pub language: String,
+    pub findings: usize,
+    pub high: usize,
+    pub medium: usize,
+    pub low: usize,
+}
+
+/// Suppression-quality breakdown.
+#[derive(Debug, Clone, Serialize)]
+pub struct SuppressionHygiene {
+    /// Findings explicitly triaged by fingerprint.
+    pub fingerprint_level: usize,
+    /// Findings suppressed by rule-level suppression.
+    pub rule_level: usize,
+    /// Findings suppressed by file-level suppression.
+    pub file_level: usize,
+    /// Findings suppressed by rule-in-file suppression.
+    pub rule_in_file_level: usize,
+    /// % of suppressed findings using low-specificity (rule/file/rule_in_file) rules.
+    pub blanket_rate: f64,
+}
+
+/// Pinned baseline scan and current drift relative to it.
+#[derive(Debug, Clone, Serialize)]
+pub struct BaselineInfo {
+    pub scan_id: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub started_at: Option<String>,
+    pub baseline_total: usize,
+    pub drift_new: usize,
+    pub drift_fixed: usize,
 }
 
 /// A name + count pair for overview top-N lists.