Take the ABAP call graph across the whole tree, bounded by ABAP's own visibility

The per-artefact graph answered nothing about class-based code. Measured on
sample_data/abap_src, every method parameter came back `no_caller` — a class's
callers live in other files by construction, and class-based ABAP is most modern
ABAP. So the graph now spans the scanned tree.

SEEING THE TREE IS NOT PERMISSION TO CLEAR A METHOD, and that is the part worth
reading. Who may call a procedure is decided by the language:

    FORM        file-local in every codebase anyone writes
    PRIVATE     only from inside its class — one artefact holds every caller
    PROTECTED   its class and its subclasses, which need the whole tree
    PUBLIC      anything that imports the class, including code never exported
    FUNCTION    another system entirely, if it carries the RFC flag

`by_public_literal` and `priv_literal` in the new fixture are the pair that makes
this a rule rather than a convenience: identical evidence — every call in the
whole tree passes a literal — and only the private one is downgraded.

RESOLUTION HAD TO BECOME CLASS-QUALIFIED FIRST. `run`, `execute` and `get_data`
are each defined dozens of times in a real custom-code base; resolving a call by
bare name across a tree would make almost every method ambiguous, and the tree
graph would have answered LESS than the per-artefact one it replaced. Receivers
are typed from TYPE REF TO, NEW, me-> and zcl_x=>. A receiver that cannot be
typed leaves the call unqualified, and an unqualified call may add taint to every
method of that name and may never clear any of them.

Local variable types are per artefact and never carried between files: `lo_worker`
in two files is two variables, and carrying a type across would resolve one
file's call against another file's declaration.

THE TRACE POINTED AT THE WRONG FILE. A cross-file call step carrying only
"line 20" sends the reader to line 20 of the artefact they are already reading,
which is an unrelated statement. The step now carries the caller's file, the
caller's own statement, and the variable the caller actually passed —
`iv_user_input`, not the callee's `iv_where`, which does not appear on that line.
The console ignored the new key and would have reproduced exactly that
misdirection on screen, so FindingDetail renders it.

Across every ABAP fixture, over the two commits: 11 confirmed / 0 tentative
became 17 / 4, with 7 traces crossing a call boundary and 1 reaching into another
artefact. The tree pass costs about 16% on a 120-file synthetic tree.

Still not interprocedural data-flow analysis, and docs/CVA_MERGE_PLAN.md's "not
claim interprocedural analysis" still holds: no fixpoint, and a non-literal
actual is treated as tainted rather than proven to be. It decides where the walk
starts; it does not trace a value through a procedure.

Eight mutations against the backend tests and two against the frontend one. All
ten fail them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: Krishcalin

CLAUDE.md

@@ -717,7 +717,7 @@ wrong in that way.
 | `grcac` | grc_access_control | **GRC Access Control**: EAM/Firefighter usage+ownership, ARM access-request workflow, GRC-native SoD violations, mitigating controls, SoD ruleset governance |
 | `rolegov` | role_governance | **role design**: SU24 proposal hygiene for custom tcodes, ungenerated profiles (AGR_1016), derived-role authorization-value drift vs parent |
 | `atc` | atc_import | SAP's own ATC/CVA results, ingested rather than re-derived |
-| `cva` | abap_sast | **our** ABAP/CDS/BDEF scanner — **135 rules dispatched by file type** (ABAP/CDS/RAP, JS/UI5 and BTP descriptors — the split is in `modules/abap_sast_rules.py`, which is the only place worth counting), statement lexer, taint refinement with intra-artefact call-graph awareness (`modules/abap_callgraph.py` decides whether a procedure parameter is caller-controlled; it is NOT interprocedural data-flow and must not be described as such). `ABAP-XSS-006` is retired and `ABAP-AUTH-003` is handled in the engine, so 116 of the 118 fire from the rule table |
+| `cva` | abap_sast | **our** ABAP/CDS/BDEF scanner — **135 rules dispatched by file type** (ABAP/CDS/RAP, JS/UI5 and BTP descriptors — the split is in `modules/abap_sast_rules.py`, which is the only place worth counting), statement lexer, taint refinement with call-graph awareness across the scanned tree (`modules/abap_callgraph.py` decides whether a procedure parameter is caller-controlled, and what ABAP's own visibility rules allow us to conclude; it is NOT interprocedural data-flow and must not be described as such). `ABAP-XSS-006` is retired and `ABAP-AUTH-003` is handled in the engine, so 116 of the 118 fire from the rule table |
 | `logreview` | log_review | retrospective SM20 review: what the audit log actually recorded |
 | `capxsuaa` | cap_xsuaa | **CAP project as written** (`--cap-src`): `xs-security.json` exactly + CDS model lexically. Traces scope ← role-template ← role-collection ← IdP group; `CAPX-TOK-001` closes the application-override blind spot `BTP-TOK-*` declares |
 | `codeinv` | code_inventory_report | custom-code estate: size by type, unreachable, dormant, unknown-kept-separate |

frontend/src/routes/FindingDetail.taintflow.test.tsx

@@ -0,0 +1,191 @@
+/**
+ * "How untrusted input reaches it" — the taint trace on a code finding.
+ *
+ * THE STEP THAT CAN LIE. Since the ABAP call graph spans the scanned tree, the
+ * call that feeds a method's parameter is usually in ANOTHER artefact: a class's
+ * callers live in other files by construction. The backend marks such a step
+ * with the file it came from.
+ *
+ * Rendered as line/role/var/statement alone, that step reads "line 20" — and the
+ * reader looks at line 20 of the file they are already looking at, which is an
+ * unrelated statement about something else. The row would be pointing at the
+ * wrong code while looking exactly as authoritative as the rows around it.
+ *
+ * A step with no `file` is in the finding's own artefact, and must stay clean:
+ * most traces in the product are entirely local, and stamping a filename on
+ * every row of those is noise.
+ */
+import { render, screen } from '@testing-library/react'
+import { MemoryRouter } from 'react-router'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const finding = vi.fn()
+const findingHistory = vi.fn()
+const serviceRequest = vi.fn()
+
+vi.mock('../api/client', () => ({
+  finding: (...a: unknown[]) => finding(...a),
+  findingHistory: (...a: unknown[]) => findingHistory(...a),
+  serviceRequest: (...a: unknown[]) => serviceRequest(...a),
+  setFindingState: vi.fn(),
+  assignFinding: vi.fn(),
+  ApiError: class ApiError extends Error {
+    status: number
+    constructor(status: number, message: string) { super(message); this.status = status }
+  },
+}))
+vi.mock('../lib/title', () => ({ useTitle: () => {} }))
+vi.mock('../lib/session', () => ({
+  useSession: () => ({ user: { username: 't', role: 'admin', can_write: true } }),
+}))
+vi.mock('react-router', async () => {
+  const actual = await vi.importActual<typeof import('react-router')>('react-router')
+  return { ...actual, useParams: () => ({ id: '1' }) }
+})
+
+import { FindingDetail } from './FindingDetail'
+import type { FindingDetail as Finding } from '../api/types'
+
+/** modules/abap_sast.py on tests/fixtures/abap_tree, verbatim: the SQL injection
+ *  in zcl_tree_worker~by_public_tainted, whose caller is in the other file. */
+const FLOW = [
+  {
+    line: 20,
+    role: 'call',
+    var: 'iv_user_input',
+    code: 'lo_worker->by_public_tainted( iv_where = iv_user_input )',
+    file: 'zcl_tree_caller.clas.abap',
+  },
+  { line: 35, role: 'source', var: 'iv_where', code: 'METHOD by_public_tainted' },
+  {
+    line: 36,
+    role: 'sink',
+    var: 'iv_where',
+    code: 'SELECT * FROM sflight INTO TABLE @DATA(lt_a) WHERE (iv_where)',
+  },
+]
+
+const FINDING = {
+  id: 1001,
+  landscape_id: 5,
+  system_id: null,
+  fingerprint: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6',
+  check_id: 'ABAP-SQLI-001',
+  client: '100',
+  fingerprint_basis: 'objects',
+  scope: 'object',
+  subject: [],
+  severity: 'CRITICAL',
+  priority_tier: null,
+  priority_score: null,
+  priority_factors: [],
+  priority_rationale: null,
+  state: 'open',
+  remediation_owner: 'customer_fixable',
+  assignee: null,
+  owning_team: null,
+  due_date: null,
+  provider_ticket_ref: null,
+  first_seen_run: null,
+  last_seen_run: null,
+  first_seen_at: '2026-09-01T00:00:00Z',
+  last_detected_at: '2026-09-01T00:00:00Z',
+  resolved_at: null,
+  regression_count: 0,
+  accepted_by: null,
+  acceptance_reason: null,
+  acceptance_from: null,
+  acceptance_due: null,
+  false_positive_reason: null,
+  transitioned_by: null,
+  last_transition_at: null,
+  sla_started_at: null,
+  taint_confidence: 'confirmed',
+  reachability: null,
+  title: 'Dynamic WHERE clause built from caller input',
+  category: null,
+  default_team: null,
+  baseline_req_id: null,
+  sid: 'PRD',
+  system_client: null,
+  system_tier: null,
+  platform: null,
+  external_key: null,
+  system_label: null,
+  expired_acceptance: false,
+  is_overdue: false,
+  days_open: 0,
+  latest_evidence: null,
+  risk_narrative: null,
+  remediation: null,
+  references_json: [],
+  responsibility: null,
+  cwe: 'CWE-89',
+  tier: 'prod',
+  deployment_mode: 'rise_pce',
+  latest_details: {},
+} as unknown as Finding
+
+async function draw(flow: unknown) {
+  finding.mockResolvedValue({
+    ...(FINDING as unknown as Record<string, unknown>),
+    latest_details: { source: 'abap_scan', taint_flow: flow, confidence: 'confirmed' },
+  })
+  findingHistory.mockResolvedValue({ history: [], observations: [] })
+  serviceRequest.mockResolvedValue({})
+  render(<MemoryRouter><FindingDetail /></MemoryRouter>)
+  await screen.findByText('Dynamic WHERE clause built from caller input')
+}
+
+/** The row a step renders into, found by its statement text. */
+function rowFor(code: string): HTMLElement {
+  const cell = screen.getByText(code)
+  const row = cell.closest('tr')
+  if (!row) throw new Error('no row for ' + code)
+  return row as HTMLElement
+}
+
+beforeEach(() => { vi.clearAllMocks() })
+
+describe('the taint trace', () => {
+  it('renders every step', async () => {
+    await draw(FLOW)
+    expect(screen.getByText(/How untrusted input reaches it/)).toBeTruthy()
+    expect(screen.getByText('METHOD by_public_tainted')).toBeTruthy()
+    expect(screen.getByText(/lo_worker->by_public_tainted/)).toBeTruthy()
+  })
+
+  it('names the artefact a cross-file step came from', async () => {
+    await draw(FLOW)
+    const row = rowFor('lo_worker->by_public_tainted( iv_where = iv_user_input )')
+    expect(row.textContent).toContain('zcl_tree_caller.clas.abap')
+    expect(row.textContent).toContain('20')
+  })
+
+  it('leaves a step in the finding’s own file unmarked', async () => {
+    await draw(FLOW)
+    const row = rowFor('METHOD by_public_tainted')
+    expect(row.textContent).not.toContain('.clas.abap')
+    expect(row.textContent).not.toContain('.prog.abap')
+  })
+
+  it('shows the variable the caller actually passed', async () => {
+    await draw(FLOW)
+    const row = rowFor('lo_worker->by_public_tainted( iv_where = iv_user_input )')
+    // `iv_user_input`, not `iv_where`: the callee's parameter name is not on
+    // the caller's line, and naming it there sends the reader looking for a
+    // variable that is not in the statement they are shown.
+    expect(row.textContent).toContain('iv_user_input')
+  })
+
+  it('renders a wholly local trace without any filename', async () => {
+    await draw(FLOW.slice(1))
+    const table = screen.getByText('METHOD by_public_tainted').closest('table')
+    expect(table?.textContent ?? '').not.toContain('.abap')
+  })
+
+  it('renders nothing when there is no trace', async () => {
+    await draw([])
+    expect(screen.queryByText(/How untrusted input reaches it/)).toBeNull()
+  })
+})

frontend/src/routes/FindingDetail.tsx

@@ -392,9 +392,18 @@ export function FindingDetail() {
                       {arr(details['taint_flow']).map((raw, i) => {
                         const hop = obj(raw) ?? {}
                         const role = str(hop['role'])
+                        // A `file` appears only on a step that is in a DIFFERENT
+                        // artefact from the finding — a call reaching in from
+                        // another class. Without it the row reads "line 20", and
+                        // the reader looks at line 20 of the file they are
+                        // already in, which is an unrelated statement.
+                        const file = str(hop['file'])
                         return (
                           <tr key={i} className="hover:bg-panel2">
-                            <td className={`${TD} font-mono text-[12px]`}>{str(hop['line'])}</td>
+                            <td className={`${TD} font-mono text-[12px]`}>
+                              {file && <div className="text-ink3 break-all">{file}</div>}
+                              {str(hop['line'])}
+                            </td>
                             <td className={TD}>
                               {role === 'source' ? <span className="pill sev-HIGH">source</span>
                                 : role === 'sink' ? <span className="pill sev-CRITICAL">sink</span>