feat(update): working on next release

♬ Fury Weekend - Stuck In the Sunlight

Author: Mte90

docs/architecture.md

@@ -100,7 +100,7 @@ The pipeline includes several verification gates and calibration layers that aug
 
 Before rendering the final report, deterministic checks verify that all citations (file paths + line ranges) match the scanned source tree. Findings failing this check have their confidence score halved and a note added explaining the discrepancy.
 
-Configured via `[citation_verification] enabled = false` (disabled by default).
+Configured via `[citation_verification] enabled = true` (enabled by default).
 
 ### Prior-Runs Store (Discovery Phase)
 

docs/configuration.md

@@ -814,6 +814,26 @@ cp presets/wordpress-core.toml ~/.config/baco/presets/my-project.toml
 baco scan --config my.toml --preset my-project
 ```
 
+Name the preset in the config instead of on the command line:
+
+```toml
+preset = "my-project"
+
+[project]
+name = "my-project"
+path = "."
+```
+
+`--preset` wins when both are present, since passing it is a deliberate
+override. A name that does not resolve fails the load and names the preset,
+rather than quietly scanning with no preset applied.
+
+Presets matter more than the flag suggests: they carry
+`required_security_primitives` and the hook registry, which is what the
+entry-point primitive check reads. A scan run without the WordPress preset
+finds no missing-nonce findings, because it has no list of nonce functions to
+check against.
+
 ### Fields a Preset Can Override
 
 | Section      | Key fields                                                                 |
@@ -861,15 +881,22 @@ enabled = false
 
 ## Citation verification
 
-The `[citation_verification]` section controls verification that finding citations (file + line) actually resolve in the target source, downgrading unverifiable findings.
+The `[citation_verification]` section controls verification that finding citations (file + line) actually resolve in the target source.
+
+A citation that does not resolve gets `verification_status = failed` and a note
+in `verification_notes`. The finding is kept and its confidence is left alone:
+confidence is the model's own estimate, and multiplying it by a constant
+corrupts that estimate without saying anything about how wrong the citation is.
+Whether failed findings reach the report is decided by
+`[output] evidence_gate`; `include_rejected` keeps them visible when it is on.
 
 | Key       | Type | Default | Description                                          |
 | --------- | ---- | ------- | ---------------------------------------------------- |
-| `enabled` | bool | `false` | Verify finding citations against source files        |
+| `enabled` | bool | `true`  | Verify finding citations against source files        |
 
 ```toml
 [citation_verification]
-enabled = false
+enabled = true
 ```
 
 ## Prior runs

src/citation_verification.rs

@@ -26,9 +26,18 @@ pub struct CitationReport {
 /// - If `line_number` is Some(n), reads the file and requires n <= total line count
 ///
 /// On failure:
-/// - `confidence_score *= 0.5`
+/// - `verification_status = Failed`
 /// - Appends to `verification_notes`: "citation verification failed: reason" (where reason is the failure cause)
 ///
+/// The finding is kept, not dropped. Two reasons: `include_rejected` exists so a
+/// user can ask to see everything, and deleting here would be a second filter
+/// that does not respect it. The status is the signal, and whether it is
+/// filtered is `apply_evidence_gate`'s decision.
+///
+/// Confidence is deliberately left alone. `classify_finding` tiers on it, so
+/// scaling it by a constant corrupts the model's own estimate with a number
+/// that says nothing about how wrong the finding is.
+///
 /// Returns a summary report with counts.
 pub fn verify_citations(
     findings: &mut [VulnerabilityFinding],
@@ -49,7 +58,7 @@ pub fn verify_citations(
 
         // Reject absolute paths and path traversal attempts
         if finding.file_path.starts_with('/') || finding.file_path.contains("..") {
-            finding.confidence_score *= 0.5;
+            finding.verification_status = Some(crate::findings::VerificationStatus::Failed);
             let note = format!(
                 "citation verification failed: path traversal rejected: {}",
                 finding.file_path
@@ -63,7 +72,7 @@ pub fn verify_citations(
         let file_content = match fs::read_to_string(&file_path) {
             Ok(content) => content,
             Err(_) => {
-                finding.confidence_score *= 0.5;
+                finding.verification_status = Some(crate::findings::VerificationStatus::Failed);
                 let note = format!(
                     "citation verification failed: file not found or unreadable: {}",
                     finding.file_path
@@ -78,7 +87,7 @@ pub fn verify_citations(
         if let Some(line_num) = finding.line_number {
             // Line 0 is invalid (lines are 1-indexed)
             if line_num == 0 {
-                finding.confidence_score *= 0.5;
+                finding.verification_status = Some(crate::findings::VerificationStatus::Failed);
                 let note = format!(
                     "citation verification failed: line 0 is invalid (1-indexed): {}",
                     finding.file_path
@@ -91,7 +100,7 @@ pub fn verify_citations(
             let line_count = file_content.lines().count();
 
             if line_num as usize > line_count {
-                finding.confidence_score *= 0.5;
+                finding.verification_status = Some(crate::findings::VerificationStatus::Failed);
                 let note = format!(
                     "citation verification failed: line {} out of range (file has {} lines): {}",
                     line_num, line_count, finding.file_path

src/config/knowledge.rs

@@ -3,6 +3,7 @@ use std::collections::HashMap;
 
 /// Per-language hook registry configuration
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(deny_unknown_fields)]
 pub struct HookRegistryLanguageConfig {
     /// Label used to synthesize hook names when the registration pattern lacks a `hook` named capture
     #[serde(default = "default_hook_label")]
@@ -21,6 +22,7 @@ fn default_hook_label() -> String {
 
 /// Knowledge configuration: per-CWE false-positive indicator patterns
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(deny_unknown_fields)]
 pub struct KnowledgeConfig {
     /// CWE id ("CWE-79") -> literal code substrings indicating a likely false positive
     #[serde(default)]

src/config/llm.rs

@@ -2,6 +2,7 @@ use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(deny_unknown_fields)]
 pub struct LlmConfig {
     /// Global endpoint used by any phase without its own `base_url`.
     #[serde(default)]
@@ -36,6 +37,7 @@ fn default_enable_llm_cache() -> bool {
 
 /// Pricing for a specific LLM model (per 1K tokens)
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(deny_unknown_fields)]
 pub struct ModelPricing {
     /// Cost per 1K prompt tokens (in USD or currency unit of choice)
     #[serde(default)]
@@ -54,6 +56,7 @@ impl ModelPricing {
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(deny_unknown_fields)]
 pub struct LlmPhasesConfig {
     #[serde(default)]
     pub discovery: LlmPhaseConfig,
@@ -74,6 +77,7 @@ pub struct LlmPhasesConfig {
 impl LlmPhasesConfig {}
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(deny_unknown_fields)]
 pub struct LlmPhaseConfig {
     #[serde(default)]
     pub base_url: String,
@@ -107,6 +111,7 @@ impl LlmPhaseConfig {
 
 /// AgentFlow phase configuration
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(deny_unknown_fields)]
 pub struct AgentFlowPhaseConfig {
     /// Gate: run AgentFlow harness synthesis
     #[serde(default)]
@@ -121,12 +126,14 @@ fn default_agent_flow_max_iterations() -> u32 {
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(deny_unknown_fields)]
 pub struct PromptOverrides {
     #[serde(default, rename = "phases")]
     pub phase_overrides: HashMap<String, String>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct AgentConfig {
     #[serde(default)]
     pub enabled: bool,

src/config/mod.rs

@@ -23,6 +23,7 @@ use std::path::PathBuf;
 
 /// Eval-suite settings (`[eval]` section).
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct EvalConfig {
     /// Minimum aggregate pass-rate for `baco eval` (0.0..=1.0).
     #[serde(default = "default_eval_floor")]
@@ -42,6 +43,7 @@ impl Default for EvalConfig {
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(deny_unknown_fields)]
 pub struct ScannerConfig {
     #[serde(default)]
     pub project: ProjectConfig,
@@ -215,17 +217,45 @@ impl ScannerConfig {
     /// Load with a preset applied UNDER the user file: defaults → preset →
     /// user-explicit-keys (TOML deep merge, arrays replaced wholesale).
     /// User config wins over preset; explicit `temperature = 0.0` applies.
+    ///
+    /// The preset can be named two ways: with the `preset` argument, which is
+    /// what the `--preset` flag supplies, or with a `preset = "name"` key in the
+    /// config file. The flag wins when both are present, because passing it is a
+    /// deliberate override.
     pub fn from_file_with_preset(
         path: &str,
         preset: Option<crate::preset::PresetOverlay>,
     ) -> Result<Self, ConfigError> {
+        let content = fs::read_to_string(path)?;
+        let expanded = expand_env_vars(&content);
+        let mut user_val: toml::Value = toml::from_str(&expanded)?;
+
+        // `preset` is a directive, not a configuration field. It is taken out
+        // here because deserialisation denies unknown keys, and it has to be
+        // read before the user file is merged so the layering below still sees
+        // only real settings.
+        let preset_from_config: Option<String> = user_val
+            .as_table_mut()
+            .and_then(|t| t.remove("preset"))
+            .and_then(|v| v.as_str().map(str::to_string));
+
+        let preset = match preset {
+            Some(explicit) => Some(explicit),
+            None => match preset_from_config {
+                Some(name) => Some(crate::preset::load_preset(&name).map_err(|e| {
+                    ConfigError::Validation {
+                        field: "preset".to_string(),
+                        message: format!("preset `{name}` could not be loaded: {e}"),
+                    }
+                })?),
+                None => None,
+            },
+        };
+
         let mut base = ScannerConfig::default();
         if let Some(overlay) = preset {
             overlay.merge_into(&mut base);
         }
-        let content = fs::read_to_string(path)?;
-        let expanded = expand_env_vars(&content);
-        let user_val: toml::Value = toml::from_str(&expanded)?;
         let mut base_val = toml::Value::try_from(&base).map_err(|e| ConfigError::Parse {
             message: e.to_string(),
             line: None,
@@ -349,6 +379,7 @@ impl ScannerConfig {
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(deny_unknown_fields)]
 pub struct ProjectConfig {
     #[serde(default)]
     pub name: String,
@@ -359,6 +390,7 @@ pub struct ProjectConfig {
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(deny_unknown_fields)]
 pub struct OutputConfig {
     #[serde(default)]
     pub dir: String,
@@ -370,12 +402,22 @@ pub struct OutputConfig {
 
 /// Citation verification gate: deterministic checks that report citations
 /// (file existence, line ranges) match the scanned tree before rendering.
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-#[serde(default)]
+///
+/// On by default. It is local file I/O and no LLM call, and its absence is not
+/// visible: a finding citing line 3894 of a 326-line file is simply wrong, and
+/// nothing downstream catches it unless this runs.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields, default)]
 pub struct CitationVerificationConfig {
     pub enabled: bool,
 }
 
+impl Default for CitationVerificationConfig {
+    fn default() -> Self {
+        Self { enabled: true }
+    }
+}
+
 /// Prior-runs store: cross-run findings history used for skip directives
 /// and coverage gap targeting on subsequent scans.
 #[derive(Debug, Clone, Serialize, Deserialize)]

src/config/phases.rs

@@ -3,10 +3,12 @@ use std::path::PathBuf;
 
 /// Aggregation configuration including false positive store settings
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(deny_unknown_fields)]
 pub struct AggregationConfig {}
 
 /// Rule synthesis configuration (MoCQ: LLM→semgrep rule generation)
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct RuleSynthConfig {
     /// Whether rules synthesis is enabled
     #[serde(default)]
@@ -94,6 +96,7 @@ pub enum NormalizationTier {
 
 /// Configuration for confidence normalization.
 #[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
+#[serde(deny_unknown_fields)]
 pub struct NormalizationConfig {
     /// Whether normalization is enabled.
     pub enabled: bool,
@@ -172,6 +175,7 @@ pub struct ValidateConfig {
 /// Augments LLM input with control path (AST/CFG/DFG), knowledge path
 /// (CWE pattern RAG), and semantic path (function summary) before judgement.
 #[derive(Debug, Clone, Default, serde::Deserialize, serde::Serialize)]
+#[serde(deny_unknown_fields)]
 pub struct VultriageConfig {
     /// Whether triple-path context augmentation is enabled
     #[serde(default)]
@@ -185,6 +189,7 @@ pub struct VultriageConfig {
 /// First pass: cheap model triage per file to filter out non-suspicious files.
 /// Second pass: deep analysis only on files that pass the suspicion threshold.
 #[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
+#[serde(deny_unknown_fields)]
 pub struct TriageConfig {
     /// Whether triage cascade is enabled (default: false)
     #[serde(default)]
@@ -214,6 +219,7 @@ impl Default for TriageConfig {
 /// Configuration for file prioritization (T18).
 /// Scores files based on recency, entry-point status, and size to prioritize LLM budget.
 #[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
+#[serde(deny_unknown_fields)]
 pub struct PriorityConfig {
     /// Whether prioritization is enabled (default: false)
     #[serde(default)]
@@ -251,6 +257,7 @@ impl Default for PriorityConfig {
 /// Configuration for LLM budget enforcement (T18).
 /// Limits total LLM calls and reserves budget for high-risk files.
 #[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
+#[serde(deny_unknown_fields)]
 pub struct BudgetConfig {
     /// Whether budget enforcement is enabled (default: false)
     #[serde(default)]
@@ -277,6 +284,7 @@ impl Default for BudgetConfig {
 /// Queries the LLM N times to get a CWE candidate set ("policy"),
 /// then a final call with the policy as context to pick one label.
 #[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
+#[serde(deny_unknown_fields)]
 pub struct PolicySamplingConfig {
     /// Whether policy-based generation is enabled
     #[serde(default)]
@@ -298,6 +306,7 @@ impl Default for PolicySamplingConfig {
 /// Configuration for the VulnLLM-R agent scaffold (P2.5).
 /// Builds 3-path call-graph context + function-lookup tool per target.
 #[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
+#[serde(deny_unknown_fields)]
 pub struct AgentScaffoldConfig {
     /// Whether the agent scaffold is enabled
     #[serde(default)]
@@ -325,6 +334,7 @@ impl Default for AgentScaffoldConfig {
 /// LLM prompt. With `auto_level = true`, the level is chosen based on
 /// the configured model name.
 #[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
+#[serde(deny_unknown_fields)]
 pub struct PacvdConfig {
     /// Whether PacVD abstraction is enabled
     #[serde(default)]