Classify scoped JSON trust boundaries (#5037)

* Classify JSON trust boundaries (#4913)

* Reject string-shaped trust annotations (#4913)

* Harden JSON trust classification (#4913)

* Bind JSON trust annotations to operations (#4913)

* Stabilize JSON trust classification (#4913)

* Bind trust evidence across line columns (#4913)

* Reject prior same-line trust operations (#4913)

* Tighten JSON trust operation binding (#4913)

* Bind JSON trust across child queries (#4913)

* Handle multiline JSON trust binding (#4913)

* Harden JSON trust declaration binding (#4913)

* Harden multiline JSON trust binding (#4913)

* Harden conditional JSON trust binding (#4913)

* Recognize spaced JSON trust directives (#4913)

* Require declared JSON trust receivers (#4913)

* Normalize verbatim JSON trust matches (#4913)

* Recognize negated JSON trust directives (#4913)

* Handle composite JSON trust casts (#4913)

* Scope JSON trust assignment parsing (#4913)

Author: Widthdom

DEVELOPER_GUIDE.md

@@ -230,6 +230,8 @@ Use `docs/test-doc-maintenance-plan.md` before moving oversized suites or adding
   Command-specific output format coverage uses a command/format matrix that checks both parser acceptance and the matching usage line; recognized shared formats without a command implementation need a separate usage-error assertion.
   Ad-hoc search SARIF completion coverage shares one fixture across complete, 1-of-126 limited, facet-filtered occurrence-expanded limited, bounded guarded, empty, and synthetically merged multi-run documents. Assert source/emitted/omitted counts and source-count authority in SARIF result units, applied limits, conservative truncation, null cursor state, raw-FTS and option-like-query replay commands, guard-preserving replay, and unchanged rule/location/severity fields on every run.
   Recipe SARIF coverage must assert bounded result counts, `recipe/query` rule identity, source locations, severity mapping, confidence, conservative truncation metadata, stable `fingerprints.cdidx/v1` values across identical runs, and the same `query_freshness` run properties as aggregate JSON. Query-freshness coverage must keep successful matched and zero-match executions separate from stale index/recipe/query versions and invalid or missing child executions, preserve the compatibility cardinality fields, and reconcile clean/stale/invalid state counts in mixed runs. Byte-budget coverage must count the complete UTF-8 stdout including JSON escaping and the final newline, exercise exact-fit and one-byte-under boundaries, Unicode, empty and multi-query runs, an individually oversized result, captured/redirected stdout, and replay metadata. Every successful output must parse as complete SARIF, omit only whole results, retain matching rules and locations, and stay within the requested cap. Below-minimum failures must emit no SARIF; non-explicit JSON failures leave stdout empty, while explicit `--json` may emit a bounded versioned error object. Also cover counting-writer measurement and replay recovery when the complete size exceeds the maximum accepted byte cap.
+  JSON trust-boundary classifier coverage must keep controlled private-local writers, public writers, a review-required public writer, a same-chunk row with distinct private/public boundaries, annotations followed by two adjacent operations on separate lines and by an earlier statement, evaluated arithmetic/comparison operand, a conditional branch followed by a nested assignment, indexer assignment target, unresolved bare receiver, one-hop/chained property-valued assignment or invocation receiver, conditional-compilation directive, control-flow block, or comma-separated operation on the matched line, nullable-declaration, direct-cast, first-named-argument, nested-generic-first-argument, expression-bodied method with a default parameter, and declaration-resolved direct invocation-receiver positive controls, explicit `Utf8JsonWriter` declaration-plus-constructor and expression-bodied return-type-plus-constructor controls, missing/invalid/direction-mismatched annotations, annotation-shaped inline/verbatim/raw string contents, and untrusted external/network/file parsers in one indexed fixture. Run with a one-line projected snippet and guard-projected controls to prove classification always uses bounded indexed source, assert per-row origin/direction/trust evidence and per-category counts, verify an annotation cannot bleed past intervening executable code, a nested second occurrence, or a later audited API family selected through another child query on either earlier or matched lines, verify review-required and mixed rows remain conservatively ambiguous, verify lexical string and conditional-compilation contents stay ambiguous, and verify that untrusted parser findings are still returned rather than suppressed. Add overlapping-chunk dedup coverage where stale facets carry a removed public site but only the retained private line may affect classification. Keep the lexical source cache bounded independently of matching file count; group same-file rows and prefetch their maximum required line once, then add an order-regression where multiple over-budget high-line rows are ranked before a classifiable lower-line row so exhausted-prefix caching and lower-line reuse remain covered. Keep source-backed classification out of text/scalar-count/compact-summary/SARIF/issue-draft/`--search-fields` paths that do not serialize it.
+  Keep long multiline declaration/assignment continuations, declaration types split from their constructors, fully qualified local declaration types, generic-wrapper expression-bodied return types whose audited type occupies a non-terminal argument, and generic return types split before the audited type as positive JSON trust-boundary controls so formatting, qualification, and wrapper shape cannot change annotation binding. Keep overlapping child-query substrings on one call as a negative reuse control so only the first lexical match consumes the annotation.
   MCP schema-origin coverage keeps identical audit phrases in `McpToolCatalog.cs` top-level tool descriptions, concatenated description segments, nested schema-property prose, and executable C# in one indexed fixture; assert explicit `schema_description` search metadata and the recipe's JSON, SARIF, and issue-draft outputs so origin filtering cannot drift across projections.
   Recipe row-selection coverage reuses one multi-file, multi-chunk fixture across aggregate JSON, compact JSON, NDJSON, and issue-draft source metadata. Assert emitted/matched/omitted counts, `selection_reason` / `selection_omitted_count`, first-per-file path uniqueness, selector-preserving replay commands, suppressed raw cursors when a later limit truncates selected rows, and rejection of incoming cursors with either selector. A separate candidate-window fixture must exceed the default low-limit fetch envelope and prove that `--sample <n>` observes at least its requested candidate target; validate rejected selectors for non-row recipe shapes without opening a database.
   Unused default-suppression row, JSON count, summary-only, and text count envelopes, including the `--all` count control, share one unused-symbol fixture.
@@ -1192,6 +1194,8 @@ dotnet test --filter "FullyQualifiedName~GitHelperTests"
   コマンド別の出力形式 coverage は command / format matrix で parser の受理と対応する usage line の両方を検証してください。共通 parser が認識してもコマンド側に実装がない形式には、別途 usage error の assertion が必要です。
   ad-hoc search SARIF の completion coverage は complete、1-of-126 の limited、facet filter 付き occurrence 展開後の limited、bounded guard、empty、合成した multi-run document で1つの fixture を共有します。SARIF result 単位の source / emitted / omitted count と source count の確定性、適用済み limit、保守的な truncation、null cursor state、raw FTS と option のような query の replay command、guard を保持する replay、および各 run で rule / location / severity field が不変であることを検証してください。
   Recipe SARIF coverage では、上限付き result count、`recipe/query` rule identity、source location、severity mapping、confidence、保守的な truncation metadata、同一 run 間で安定する `fingerprints.cdidx/v1`、aggregate JSON と同じ `query_freshness` run properties を検証してください。query freshness coverage では、成功した matched / zero-match execution を stale な index / recipe / query version および invalid / missing child execution と分離し、互換用の件数フィールドを維持し、mixed run の clean / stale / invalid state count が整合することを検証してください。byte-budget coverage では JSON escape と末尾改行を含む完全な UTF-8 stdout を数え、exact-fit と1 byte不足の境界、Unicode、空 run と複数 query の run、単体で oversized な result、capture / redirect した stdout、replay metadata を扱ってください。成功した出力はすべて完全な SARIF として parse でき、result を1件単位でのみ省略し、対応する rule / location を維持し、要求 cap 以下でなければなりません。最小値未満の失敗では SARIF を出力せず、明示 JSON でない失敗は stdout を空にし、明示的な `--json` では上限内の version 付き error object を出力できることも検証してください。counting writer による計測と、完全な size が受理可能な最大 byte cap を超える場合の replay recovery も扱ってください。
+  JSON trust-boundary classifier の coverage は、controlled な private-local writer、public writer、review-required な public writer、同一 chunk 内に異なる private / public boundary を持つ row、別々の行で隣接した2操作に続く注釈、および match と同じ行の先行 statement、評価済みの算術 / 比較 operand、条件分岐に続く nested 代入、indexer 代入先、解決不能な単純名 receiver、1段 / 連鎖した property-valued な代入 / 呼び出し receiver、条件コンパイル directive、control-flow block、カンマ区切りの操作に続く注釈、nullable 宣言、直接 cast、first named argument、nested-generic の first argument、default parameter を持つ expression-bodied method、宣言から解決できる直接 invocation receiver の positive control、明示的な `Utf8JsonWriter` の宣言と constructor、および expression-bodied な戻り型と constructor の control、注釈の欠落 / 不正 / direction 不一致、注釈形式の inline / verbatim / raw string 内容、untrusted な external / network / file parser を1つの indexed fixture に含めます。投影 snippet を1行にした case と guard により、分類が常に上限付きの indexed source を使うことを証明します。row ごとの origin / direction / trust evidence と category ごとの count、以前の行または match と同じ行にある実行コード、nested した2番目の occurrence、または別の child query で選択された後続の audit 対象 API family を越えて注釈が流用されないこと、review-required / mixed row が保守的に ambiguous のままであること、lexical な string と条件コンパイル領域の内容が ambiguous のままであることを検証し、untrusted parser finding が抑制されず返却されることを確認してください。overlap chunk の dedup coverage では、削除済み public site を stale facet が保持していても、残った private line だけが分類へ影響することを検証します。lexical source cache は match する file 数に依存しない上限を維持し、同じ file の row をまとめて最大必要行を1回 prefetch します。そのうえで、複数の上限超過 high-line row を分類可能な lower-line row より先に rank する順序回帰により、枯渇済み prefix の cache と lower-line reuse の両方を検証します。source-backed 分類を serialize しない text / scalar count / compact summary / SARIF / issue-draft / `--search-fields` path では実行しないでください。
+  長い複数行へ継続する宣言 / 代入、constructor と別行に分割された宣言型、完全修飾された local 宣言型、audit 対象型が末尾以外の型引数にある generic wrapper を持つ expression-bodied な戻り型、および audit 対象型より前で改行された generic 戻り型を JSON trust-boundary の positive control とし、formatting、修飾、wrapper の形によって注釈の束縛が変わらないことを維持してください。同じ呼び出しで重なる child-query substring は negative reuse control とし、最初の lexical match だけが注釈を消費することを維持してください。
   MCP schema-origin coverage では、同一の audit phrase を `McpToolCatalog.cs` の top-level tool description、連結された description segment、nested schema property の prose、実行可能な C# に置いた1つの indexed fixture を共有し、明示的な `schema_description` 検索 metadata と recipe の JSON、SARIF、issue-draft 出力を検証して、projection 間で origin filter が drift しないようにしてください。
   recipe row-selection coverage は aggregate JSON、compact JSON、NDJSON、issue-draft の source metadata で1つの multi-file / multi-chunk fixture を共有します。emitted / matched / omitted count、`selection_reason` / `selection_omitted_count`、first-per-file の path uniqueness、selector を保持する replay command、後続 limit が選択済み row を truncate する場合の raw cursor 抑止、両 selector と受け取った cursor の併用拒否を検証してください。別の candidate-window fixture では既定の low-limit fetch envelope を超え、`--sample <n>` が少なくとも要求 candidate 数を観測することを証明し、row を持たない recipe shape での selector 拒否は database を開かずに確認してください。
   unused default-suppressionのrow、JSON count、summary-only、text count envelopeは、`--all` count controlも含めて1つのunused-symbol fixtureを共有してください。