v0.185.0

All new behavior is Preview and is off by default or purely additive. No GA capability changed its contract.

• A graph analysis now says whether it finished. The field analysis, the call-graph driver, source seeding and reverse selection return a completion record (complete, partial or cancelled) with reasons. A stopped analysis, a coarser fallback context, a construction limit or a cancellation shows in graph.scanHealth, coverage.analysisCompletion, the limitations list, the signed export and scan health, even when zero flows were projected. A query that did not finish never says "no path" (negativeClaimAllowed: false). Invalid query budgets (NaN, Infinity, negative, fractional, over the bound) return status: "invalid". AGENTIC_SECURITY_LINEAGE_DEADLINE_MS and the signal and deadline options cancel a build; from the bundle the cooperative deadline applies and the watchdog for a worker that never stops is source-only.
• Recursion. The call graph is condensed into strongly connected components, callees are solved first, and recursive groups iterate to a fixed point or report partial. Reconstruction walks one shared path, so a 20,000-hop chain went from 8.9 s to 22 ms and a 400,000-hop chain completes without a stack overflow.
• Call-site correlation (correlationVersion: 2). Value versions and invocation identity keep two calls to one helper, sibling fields and overwritten values apart, with balanced call and return witnesses. Version 1 output is unchanged.
• Demand-driven reverse queries (AGENTIC_SECURITY_DEMAND=1). A selector narrows analysis to the functions that can feed one sink argument and the forward engine corroborates. Parity with full analysis holds on 21 programs. The 2x target was missed on this repository's own source when the index is built per query (1.8x); with a warm index a query is about 277x faster. 10 of 30 own-tree queries fell back to full analysis.
• Path predicates and control credit (pathEvidence: true). Branch conditions travel with each witness. A control earns credit only for its own sink family and value version, and an all-path claim is refused on any truncated sample.
• Dependency-complete incremental analysis (AGENTIC_SECURITY_INCREMENTAL=1). Cached summaries are invalidated through the reverse-dependency closure, including deleted and renamed functions. Corrupt or interrupted caches fall back to a cold scan and say why. A key bug is fixed: summaries for qualified names (those containing ::) were persisted under the file path, so reuse was effectively inert. The deep stage meets 3x on every project measured; end to end the median is 1.8x to 2.9x, and projects of about 5,000 functions or more run cold at the default summary budget.
• Boundary contracts, graph views, control planning and witness bundles. HTTP, queue and storage contracts seed a consumer's parameter or record field (library entry point). Read-only graph views join findings, call sites, witnesses and flows. dataflow plan-cuts computes minimum cuts over the modeled flow network. Signed witness bundles replay offline, with four evidence statuses that are never merged. Witness replay succeeded on 64 of 64 bundles built from real hop streams, and all four tamper kinds tried were rejected 64 of 64.
• Measured, with the limits stated. bench/dag/ pins six real projects and a labeled multi-service fixture. Precision on the labeled JS and Nix samples is low (5 of 25 and 6 of 17 flagged sites were true), and the fixture finds 3 of 8 labeled positives. Impossible call and return witnesses: 6 of 65 under version 1 and 0 of 64 under version 2 on the fixtures. Labels were written after seeing scanner output and are not independent.
• Not claimed. Reachability, satisfiability and runtime observation are not exploit proof. A signature on a witness bundle proves integrity, not that the transfer models are right. No real SMT solver ships. Boundary contracts, witness building, graph views and demand queries are not wired into a normal scan.
• Self-scan baseline. The scanner's own source gained 18 findings from existing heuristics (14 from the state-machine heuristic, which applies the first declared status set in a project to every .status write). The baseline was re-recorded with that reason. Narrowing that heuristic is a follow-up.