Make the two taint engines agree

[b-macker]

Summary

Taint tracking is implemented twice — the tree-walker walks the AST in expressionContainsTaint(), the VM carries taint on taint_stack_. CLAUDE.md says changes "must be made in both paths", and nothing checked that they were.

Running 12 scenarios through both engines found two divergences, in opposite directions, each hiding the other.

Defect 1 — the declaration after a taint source inherited its taint

checkRhsTainted() clears lastReturnWasTainted on entry, then sets it again when it identifies a direct source, so VarDeclStmt can read lastTaintSource() for lineage. Nothing cleared it afterwards:

let t = env.get("HOME")      // legitimately tainted
let c = "a clean literal"    // <- silently tainted by the stale flag
let x = c
file.write("o.txt", x)       // tree-walk: sink violation on clean data

A false positive on clean data, which makes every taint count untrustworthy — including L25-03's baseline. It presented intermittently: with more statements in between, the stale flag lands on a throwaway variable that never reaches a sink and nothing looks wrong.

The identical hazard was already fixed for ExprStmt (V13-S7, interpreter.cpp); the declaration path was missed.

Defect 2 — try as an expression laundered taint

expressionContainsTaint() did not handle TryCatchExpr, so let x = try { tainted } catch (e) { "" } produced an untainted x. The walk returns false for any node type it does not handle, so this is fail-open by construction. YieldExpr was missing for the same reason.

They cancelled each other

Defect 1 was tainting the try-expression anyway, so defect 2 was invisible — an early test of the try case passed because of a bug. Fixing the leak exposed it as a fresh divergence.

The vacuity check shows the interaction directly:

state	failing case
both fixes reverted	clean_after_source (VM 0, tree-walk 2) — and try_expr passes
only the TryCatchExpr fix reverted	try_expr (VM 2, tree-walk 0)

Neither would have been found by fixing them in the other order, or by testing either in isolation.

Why nothing caught them

Both blind spots are structural rather than oversights:

• tests/differential/ exists precisely to catch VM/tree-walker divergence, but diff_runner.py runs --no-governance — taint is switched off in that corpus by construction.
• tests/property/test_taint_monotonicity.naab runs on a single engine, so a divergence is invisible to it.

New tests/governance_v4/test_taint_engine_parity.sh (12 scenarios × 2 engines), registered in run-all-tests.sh. Its pass condition is agreement plus a per-engine expectation — two engines that both miss a taint agree perfectly — with a control requiring ≥5 positive detections so the clean cases cannot pass vacuously.

Changes

• src/interpreter/interpreter.cpp — VarDeclStmt consumes the stale flag after the lineage lookup, mirroring the ExprStmt fix
• src/interpreter/governance_taint.cpp — TryCatchExpr (both arms) and YieldExpr handled; ThrowExpr documented as N/A
• tests/governance_v4/test_taint_engine_parity.sh + registration
• CLAUDE.md — corrects the governance_taint.cpp path (src/interpreter/, not src/runtime/), and records the fail-open walk, the dual implementation, and the two violation message formats

Test Plan

• Ran bash run-all-tests.sh with no new failures — 441 tests, 0 unexpected failures
• Added/updated tests for new functionality — test_taint_engine_parity.sh, 13/13
• bash tests/security/test_error_msg_leaks.sh — 874 checks, 0 failures
• Tested manually in the REPL — n/a

One finding retracted

A third divergence — "the tree-walker misses inline subscripts at sinks" — was wrong, and was a measurement artifact. Violations print in two formats: checkTaintedSink() names the variable (taint_tracking.sink_violation), while checkExpressionTaintedSink()'s expression path emits Taint tracking violation: expression contains untrusted data.... The detector matched only the first, so a working engine looked broken.

Recorded in the findings doc rather than dropped, because it is the fourth time in this campaign that a detector carried the defect it was hunting.

Related Issues

Follow-up to #113, which found the same class in the assertion set. This is the engine-side counterpart.

---

Generated by Claude Code

[github-actions]

NAAb Governance Report

Metric	Count
Files checked	16
Passed	16
Failed	0

All governance checks passed!

_{Generated by NAAb Governance Engine v4.0}