Re-ground Joern's tool-native decline on a field evaluation of the shipped scan bundle (A26)

[DavidBakerEffendi]

What this is

A maintainer challenge to the Joern tool-native row — Joern ships a query database (https://queries.joern.io, the joern-scan bundle) — sent the preregistered decline's grounds into the field. The result is Amendment A25: no partition cell moves, and the decline comes back stronger than it went in.

What the field evaluation measured

Half of the old grounds failed. The preregistration declined the scan surface as "downloaded from a floating latest release asset, unpinnable at run time". Measured: the pinned v4.0.614 release publishes a versioned querydb.zip asset, and the shipped joern-scan --updatedb --dbversion 4.0.614 installs exactly it (URL + SHA-256 retained). The bundle is pinnable, and joern-scan runs end to end with zero benchmark input. The retired claim stays recorded as retired, per the A10 precedent.

The decline survives on the bundle's own content and behavior, retained under reports/raw/amendment-a26-joern-scan-native/ (produced by scripts/probe-joern-scan-native.sh, which works on a copy of the pinned distribution — the pin is never mutated):

• The version-pinned bundle dumps 58 queries (27 c, 10 android, 9 php, 7 java, 3 kotlin, 2 ghidra) — none for JavaScript, none for Python.
• Java's seven: six bind servlet/Spring/SQL/certificate/crypto identities no probe uses. The seventh — call-to-exec, the one query naming this profile's command sink — is cpg.method("java.lang.Runtime.exec").callIn, and cpg.method(...) full-match-filters the method name property (exec), so it matches zero methods on the very javasrc2cpg graph whose cpg.method("exec").callIn is non-empty (binding check retained).
• Executed over all 36 probe fixtures: zero findings of any query, source-sink positives included (per-fixture argv, exit status, and finding counts retained).
• A shipped-product defect retained along the way: on this pin joern-scan's Python auto-detection emits importCode.pythonsrc(...), which does not compile against the product's own console; the documented --language python runs — and still decides nothing.

Why the cells stay declined rather than becoming scored

The A7 shape: no shipped query binds any probe endpoint — by absence in two languages, by a structurally impossible binding in the third — so the eighteen cells remain capability coverage decided from the bundle's text and confirmed by execution, not an activated model set producing 36 false negatives. Even the sink-existence hazard cannot reach these fixtures: the one sink-existence query aimed at Runtime.exec is the one that cannot bind.

Changes

• docs/native-profile.md — the Joern activation section's scan-bundle paragraph re-grounded (retired claim kept visible), the S-cell rationale extended, and Amendment A25 appended (drafted as A25, renumbered to A26 before opening: concurrent PR Amendment A25: re-ground OpenTaint's native declines on the shipped scan entry point's measured silence #121 claims A25 for OpenTaint).
• src/main.rs — the Joern NATIVE_PARTITION S-cell rationale re-grounded to cite A25.
• adapters/joern/README.md — the three tool-native sections' unpinnability sentences replaced with the measured grounds.
• docs/adapters.md, docs/java-native.md, docs/javascript-native.md — the same claim corrected where echoed.
• scripts/probe-joern-scan-native.sh + reports/raw/amendment-a26-joern-scan-native/ — the reproducible probe and its retained evidence.

No cell moves, so no runner arm changes, no report re-runs, and no site-card change; the retained 0/6 reports predate the amendment and keep their wording (A10 precedent). No freeze is invalidated — v0.6.1 contains no tool-native report and validate-freeze stays green.

Battery

• cargo fmt --check ✓
• cargo test ✓ (207 passed)
• cargo run -- validate ✓ (852 cases)
• cargo run -- validate-reports ✓ (82 reports)
• cargo run -- validate-freeze reports/freeze.json ✓ (v0.6.1)
• cargo run -- generate-results --manifest reports/freeze.json --output-directory <dir> --check ✓
• astro build ✓ (45 pages)

🤖 Generated with Claude Code