feat(paper): implementation

Author: Mte90

README.md

@@ -244,3 +244,61 @@ credentials.token = "${GITHUB_TOKEN}"
 - **findings.json**: Complete vulnerability data with all 16 fields
 - **report.html**: Visual report with severity colors, code snippets, AI summary
 - **report.sarif**: SARIF format for CI/CD integration
+
+## Research-Backed Design
+
+BACO's LLM integration is informed by a survey of 30 papers and 7 projects from
+[Awesome-LLMs-for-Vulnerability-Detection](https://github.com/huhusmang/Awesome-LLMs-for-Vulnerability-Detection).
+The full analysis and integration roadmap live in [`docs/papers-integration-analysis.md`](docs/papers-integration-analysis.md)
+and the task list in [`todo.md`](todo.md).
+
+### Integrated Papers
+
+#### Tier 1 — Quick wins (days → 2 weeks)
+
+| Task | Paper | arxiv | baco target |
+|------|-------|-------|------------|
+| Agentic FP filter | Sifting the Noise (ISSTA 2026) | [2601.22952](https://arxiv.org/abs/2601.22952) | `src/llm_verification.rs` + `src/confidence_refinement.rs` |
+| Hierarchical context extraction | Context-Enhanced Vuln Detection | [2504.16877](https://arxiv.org/abs/2504.16877) | new `src/context/` module |
+| CWE KB RAG (BM25, no vectors) | VulInstruct (FSE 2026) | [2511.04014](https://arxiv.org/abs/2511.04014) | new `src/retrieval/` module |
+| Regression suite | SV-TrustEval-C (SP 2025) | [2505.20630](https://arxiv.org/abs/2505.20630) | `tests/integration/` |
+
+#### Tier 2 — Structural improvements (2 → 6 weeks)
+
+| Task | Paper | arxiv/code | baco target |
+|------|-------|-------------|------------|
+| MoE per-CWE/language routing | MoEVD (FSE 2025) | [2501.16454](https://arxiv.org/abs/2501.16454) | new `src/router/` module |
+| Triple-path context (AST/CFG/DFG) | VulTriage | [2605.09461](https://arxiv.org/abs/2605.09461) | `src/context/` extension |
+| LLM→semgrep rule synthesis | MoCQ | [2504.16057](https://arxiv.org/abs/2504.16057) | new `src/rulesynth/` phase |
+| Global FP suppression | AutoCVE | [code](https://github.com/larlarua/AutoCVE) | `src/findings.rs` + `src/root_cause_dedup.rs` |
+| Six-phase parallel orchestration | Cloudflare security-audit-skill | [code](https://github.com/cloudflare/security-audit-skill) | `src/scanner/pipeline/orchestrator.rs` |
+
+#### Tier 3 — Heavy infrastructure (months)
+
+| Task | Paper | arxiv/code | baco target |
+|------|-------|-------------|------------|
+| CPG-guided slicing | LLMxCPG (Usenix 2025) | [2507.16585](https://arxiv.org/abs/2507.16585) | new `src/cpg/` + Joern |
+| Adversarial exploit synthesis | QRS | [2602.09774](https://arxiv.org/abs/2602.09774) | new `src/exploit/` + sandbox |
+| Specialized reasoning LLM | R2Vul + VULPO | [2504.04699](https://arxiv.org/abs/2504.04699) + [2511.11896](https://arxiv.org/abs/2511.11896) | new `LlmProvider::TgiServed` |
+
+#### Cross-cutting insights
+
+| Insight | Paper | baco application |
+|---------|-------|-----------------|
+| Rationale validation via LLM-as-judge | CORRECT — [2504.13474](https://arxiv.org/abs/2504.13474) | `src/llm_verification.rs` |
+| Statement-level localization | SecVulEval — [2505.19828](https://arxiv.org/abs/2505.19828) | `src/findings.rs` |
+| Dataset hygiene (chronological splits) | PrimeVul (ICSE 2025) — [2403.18624](https://arxiv.org/abs/2403.18624) | `tests/fixtures/` |
+| Confidence calibration per user study | Closing the Gap (ICSE 2025) — [2412.14306](https://arxiv.org/abs/2412.14306) | `src/confidence_refinement.rs` |
+| Semantic Trap guard for fine-tuning | Semantic Trap — [2601.22655](https://arxiv.org/abs/2601.22655) | `docs/fine-tuning-guidelines.md` |
+
+### Surveyed but deferred/skipped
+
+- **AgentFlow** (2604.20801) — Python-only, defer until Rust interop stabilizes
+- **AgenticSCR** (2601.19138) — niche pre-commit case
+- **VulnLLM-R** (2512.07533) — GPU cluster required
+- **OpenAnt** — heavy UniFFI build
+- **DeepAudit** — too large/divergent
+- **FocusVul** (2505.17460) — paper withdrawn
+
+For the full list of surveyed papers and their verdicts, see
+[`docs/papers-integration-analysis.md`](docs/papers-integration-analysis.md).

prompts/phases/llm_static_analysis.md

@@ -8,6 +8,7 @@ You are an OFFENSIVE SECURITY RESEARCHER and EXPERT SECURITY REVERSE ENGINEER. Y
 - **File**: %%FILE_PATH%%
 - **Lines**: %%LINE_RANGE%%
 - **Context**: %%CONTEXT_LINES%% lines before/after
+- **CWE Specs**: %%CWE_SPECS%%
 - **Code**:
 ```%%LANGUAGE%%
 %%CODE_CONTENT%%

prompts/phases/llm_verification.md

@@ -21,3 +21,19 @@ Return JSON with format:
   "mitigating_factors": ["optional mitigation 1", ...],
   "related_patterns": ["optional pattern 1", ...]
 }
+
+## Triage Step
+
+When a finding is marked as `NeedsReview`, invoke the triage filter for additional analysis:
+
+1. **Triage Prompt**: Send a zero-shot prompt asking "Is this finding a true positive or false positive?"
+2. **Expected Output**: JSON with `{"verdict": "true_positive"|"false_positive", "confidence": 0.0-1.0, "reasoning": "..."}`
+3. **Integration**:
+   - If triage returns `false_positive`: Set status to `FalsePositive`, add reasoning to `verification_notes`
+   - If triage returns `true_positive`: Keep `Confirmed` status, boost confidence by +0.10
+   - On parse failure: Fall back gracefully to `NeedsReview` status
+
+## Confidence Refinement Factors
+
+- `TriageTruePositive`: +0.10 boost when triage confirms true positive
+- `TriageFalsePositive`: -0.25 penalty when triage identifies false positive

src/context.rs src/analysis_context.rssrc/context.rs renamed to src/analysis_context.rs

@@ -8,7 +8,7 @@
 //! - Generates confidence explanations
 //! - Integrates with AnalysisContext (T5)
 
-use crate::context::AnalysisContext;
+use crate::analysis_context::AnalysisContext;
 use crate::findings::{VerificationStatus, VulnerabilityFinding};
 use std::collections::HashMap;
 
@@ -55,6 +55,10 @@ pub enum ConfidenceFactor {
     TestCodeRelated,
     /// Code is in dependency/vendor
     ThirdPartyCode,
+    /// Triage confirmed true positive
+    TriageTruePositive,
+    /// Triage identified false positive
+    TriageFalsePositive,
 }
 
 /// Historical data for confidence refinement.
@@ -357,6 +361,21 @@ impl ConfidenceRefinementPhase {
             }
         }
 
+        // Factor 9: Tiage-based adjustments
+        if let Some(ref notes) = finding.verification_notes {
+            if notes.contains("triage") || notes.contains("Triage") {
+                if notes.contains("false_positive") || notes.contains("False positive") {
+                    refined_score = (refined_score - 0.25).max(0.0);
+                    factors.push(ConfidenceFactor::TriageFalsePositive);
+                    explanations.push("Triage identified as false positive".to_string());
+                } else if notes.contains("true_positive") || notes.contains("True positive") {
+                    refined_score = (refined_score + 0.10).min(1.0);
+                    factors.push(ConfidenceFactor::TriageTruePositive);
+                    explanations.push("Triage confirmed as true positive".to_string());
+                }
+            }
+        }
+
         // Clamp final score
         refined_score = refined_score.clamp(0.0, 1.0);
 

src/confidence_refinement.rs

@@ -19,6 +19,10 @@ pub struct ScannerConfig {
     pub tickets: TicketConfig,
     #[serde(default)]
     pub agent: AgentConfig,
+    #[serde(default)]
+    pub router: RouterConfig,
+    #[serde(default)]
+    pub aggregation: AggregationConfig,
 }
 
 /// Config error with field path and TOML location information
@@ -417,6 +421,45 @@ fn default_trusted_paths() -> Vec<String> {
     vec![".".to_string()]
 }
 
+/// Router configuration for MoE per-CWE / per-language routing
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct RouterConfig {
+    /// Whether the router is enabled
+    #[serde(default)]
+    pub enabled: bool,
+    /// Default prompt template name
+    #[serde(default = "default_llm_static_analysis")]
+    pub default_prompt: String,
+    /// CWE ID -> PromptSpec overrides
+    #[serde(default)]
+    pub cwe_overrides: HashMap<String, PromptSpec>,
+    /// Language -> PromptSpec overrides
+    #[serde(default)]
+    pub language_overrides: HashMap<String, PromptSpec>,
+}
+
+/// Prompt specification for router overrides
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct PromptSpec {
+    /// The prompt template name to use
+    #[serde(default = "default_llm_static_analysis")]
+    pub prompt_template: String,
+    /// Optional model override for this prompt
+    pub model_override: Option<String>,
+}
+
+fn default_llm_static_analysis() -> String {
+    "llm_static_analysis".to_string()
+}
+
+/// Aggregation configuration including false positive store settings
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct AggregationConfig {
+    /// Path to the false positive store JSON file
+    #[serde(default)]
+    pub fp_store_path: Option<PathBuf>,
+}
+
 fn default_max_parallel_tasks() -> usize {
     4
 }

src/config.rs

@@ -0,0 +1,8 @@
+//! Hierarchical context extraction for LLM analysis.
+//!
+//! Extracts function/module/project-level summaries to provide
+//! structured context to LLM prompts.
+
+mod summary;
+
+pub use summary::{ContextExtractor, ContextSummary, FunctionSummary};