# Band-2 cross-file DELIVERY — shipped through gate.py, MEASURED 3/3

audience: AI coding agents first. BLUF-ordered. Tag [MEASURED]/[INFERRED].

## BLUF [MEASURED 2026-06-17]
The Shape-B cross-file bug (an imported INSECURE DEFAULT — the C02 founding shape) is now CAUGHT end-to-end by
the **shipped** `orchestrator/gate.py`, not just by a hand-built concatenation. On the `S1-xfile-2fa-on-refresh`
cell, k=3, the gate's top finding was the canonical at **3/3 rolls, [critical]**:

```
[critical] 2FA enforcement and verification state silently zeroed on every token refresh  (found by 3/3 rolls)
```

Canonical = `buildSessionPayload enforce2fa omission` (`canonical.json`). This closes #36's DELIVERY half.

## What made it catch — the delivery mechanism (#36 piece 3)
A Shape-B bug is a band-1 single-file SILENT miss (0/3): `refresh.ts` calls `buildSessionPayload({...})` omitting
`enforce2fa`; the bug lives in the IMPORTED builder's default `enforce_2fa: args.enforce2fa ?? false`. The
caller looks innocent in isolation. The 2026-06-17 band-2 spike proved the catch needs caller+callee in ONE
review (manual concat → 3/3). The shipped gate now reproduces that channel automatically:

1. **Resolver + trigger** (`first_party_value_imports` + `resolve`, committed f046536): pull ALL first-party VALUE
   imports of the target (payments-name regex DEMOTED to a priority-ordering hint, no longer a gate).
2. **Delivery** (`collect_deps` + `build_bundle` + `write_bundle_file`, this commit): inline the resolved
   dependency BODIES into the target's review as a delimited bundle — the target is reviewed TOGETHER WITH its
   dependencies in ONE prompt. Deps are CONTEXT for the target, NOT separate isolated scans (an isolated dep scan
   cannot diff the caller's assumption against the callee's body).
3. **Black-box override** (`DEP_OVERRIDE`): appended to the prompt LAST (recency beats the template's
   "single module / treat imports as a black box" line) ONLY when deps are inlined → single-file reviews keep the
   template byte-for-byte.

## Design choices (advisor-reconciled) [decisions]
- **Temp-concat (option C), not inline-asymmetry (B).** Reproduces the spike's exact channel; `one_roll` adds only
  an optional `cwd` arg. The bundle is written to the SYSTEM tempdir (NOT the source tree — a kill mid-run must not
  leak a compilable `.sgbundle.ts` a tsc --watch could trip on); the LLM reads it by absolute path and its `cwd` is
  set separately to the repo dir (decoupled from bundle location, so repo-relative behavior still matches the spike).
  Deleted in a `finally`; the OS reclaims `/tmp` even on SIGKILL.
- **Oracle runs PER in-scope file (target + each inlined dep), NOT on the bundle.** The deterministic oracle's sink
  enumeration is IN-FILE (`extractSinks` walks one file's AST; `findDefBody` resolves imported PREDICATE bodies for
  guards but NOT imported sink constructions). With deps moved into the LLM bundle (which the oracle never reads),
  scanning only the target would make a C02/C09 whose money-move object-literal is BUILT inside an imported helper a
  silent FALSE CLEAN — and C02/C09 are oracle-ONLY (no LLM backstop). Running the oracle on every in-scope file
  restores the original gate's per-in-scope-file reach. Asymmetry is deliberate: oracle = deterministic/precise/cheap
  → every file; LLM = expensive/noisy → one bundle. (Advisor-caught; see "Oracle-reach restoration" below.)
- **1-hop default (`--depth 1`).** Caller + DIRECT callees = the validated shape. `--depth >1` inlines deps-of-deps
  (budget-bounded by `--max-scope`, NOT rate-validated) — opt-in, never default. The old `--depth` BFS-as-scan
  semantics are gone (it was vestigial under the new model).
- **`--max-scope` now caps INLINED bodies** (not separate scans); budget-dropped imports are RECORDED and reported
  under "Dropped — NOT inlined, NOT clean" (no-false-coverage), never silently skipped.

## Oracle-reach restoration (advisor-caught silent-false-clean) [MEASURED wiring; reach restored]
The first delivery cut ran the oracle on the target ONLY, moving deps into the LLM bundle. That silently dropped the
ORACLE's cross-file reach (the bundle is LLM-only). Fix: `run_oracle_set` runs the oracle on the target + each inlined
dep file; the report lists per-file oracle status. Re-measured through the shipped gate on the xfile cell:
- Canonical STILL caught **3/3** `[critical]` (top finding) — the LLM-leg path change (bundle→tempdir, explicit cwd)
  did not regress the validated catch.
- Oracle now reports per file: `vuln.ts (target): SILENT` + `imported-builder.ts (dep): SILENT` — auth cell, oracle
  correctly silent on both; the per-file wiring is exercised and reported.
- `pytest` 7/7; no `*.sgbundle.ts` left in the tree (system tempdir + `finally`).

**Precision cost (not a pure win) [INFERRED — direction, not measured].** Running the oracle on a dep file IN
ISOLATION can surface a complete-mediation sink whose identity/authorization guard lives UPSTREAM in the calling
route, as a CANDIDATE finding. That is the FALSE-POSITIVE direction (a flagged sink that is actually mediated by the
caller — triaged/dismissed at review), categorically NOT a false-CLEAN. The trade is deliberate and correct: the
restoration buys back the silent-false-clean reach (a missed C02/C09 is unrecoverable; an over-flag is cheap to
dismiss). Carry this when a dedicated cross-file imported-sink C02 cell is built (#40) — measure the over-flag rate
there, do not assume zero.

## Regression [MEASURED]
- All 11 single-file corpus cells: dry-run inlines ZERO deps → original template + original file path, byte-for-byte
  single-file behavior. No recall regression possible on single-file logic.
- `pytest` 7/7. Temp bundle cleaned up (no `*.sgbundle.ts` left in the tree).

## Honest scope — do NOT overclaim
- **n=1.** This is ONE cell. "Zero regression" is corpus-scoped (the isolated cells resolve no deps). In a REAL
  repo the appendix fires on most files → cross-file-path PRECISION is unmeasured beyond this cell. Carry this into
  the next phase; do not read it as "validated for any codebase."
- **LLM leg treats deps as CONTEXT, not as separate primary targets** (a bug living PURELY inside a dependency is
  still visible — the combined prompt sees the dep body — but is attributed under the target review). The ORACLE,
  by contrast, now runs per dep file, so an intra-dep complete-mediation (C02/C09) sink IS scanned. **Honest gap:**
  the restored oracle reach is reasoned + wiring-verified, NOT freshly measured-as-a-catch — the xfile cell is
  oracle-silent (auth), and NO corpus cell yet has an imported-helper C02 sink. A dedicated cross-file imported-sink
  C02 cell is the proper measurement (fast-follow, tie to #40); until then claim "reach restored", not "catch measured".
- **Barrel/2-hop resolve is NOT covered** (#36b fast-follow). The cell imports via a direct alias
  (`@zync/auth` → `imported-builder`). Real monorepo barrels (`@zync/db/queries` re-exporting an `index.ts`) need a
  re-export-following resolver + tsconfig `paths` / workspaces auto-alias discovery. See
  `2026-06-17-band2-crossfile-spike.md` lines 153-155.

## Reproduce
```
CELL=domains/security/corpus/S1-xfile-2fa-on-refresh
# clean config + fresh creds (blind catch-test discipline)
rm -rf /tmp/sg_cfg && mkdir -p /tmp/sg_cfg && cp ~/.claude/.credentials.json /tmp/sg_cfg/.credentials.json && chmod 600 /tmp/sg_cfg/.credentials.json
python3 orchestrator/gate.py "$CELL/vuln.ts" --alias "@zync/auth=$CELL/imported-builder" --k 3 --config-dir /tmp/sg_cfg
# expect: top finding [critical] 2FA enforcement bypassed on the refresh path, found by 3/3 rolls
#         + oracle reported per file (target + dep), both SILENT on this auth cell
```