Convert 68 await-free tokio tests to sync

Author: Mte90

CONTRIBUTING.md

@@ -1,6 +1,6 @@
 # Contributing to BACO
 
-Welcome! BACO (Bug Analysis & Cross-reference Orchestrator) is a research-backed SAST scanner that augments static analysis with LLM-powered discovery across a 23-phase pipeline. Sponsored by [Regolo.AI](https://regolo.ai), this project integrates techniques from 20 academic papers to detect vulnerabilities with higher accuracy than traditional tools.
+Welcome! BACO (Bug Analysis & Cross-reference Orchestrator) is a research-backed SAST scanner that augments static analysis with LLM-powered discovery across a 23-phase pipeline. Sponsored by [Regolo.AI](https://regolo.ai), this project integrates techniques from 31 academic papers to detect vulnerabilities with higher accuracy than traditional tools.
 
 ## Getting Started
 

README.md

@@ -33,16 +33,15 @@ cargo build --release
 # 2. Install semgrep (required for static analysis)
 pip install semgrep
 
-# 3. Set your LLM API key
-export MISTRAL_API_KEY="your-key-here"
+# 3. Set your LLM API key (per-phase or generic fallback)
+export LLM_DISCOVERY_KEY="your-key-here"  # or LLM_API_KEY for generic fallback
 
-# 4. Run pre-flight checks
+# 4. Initialize config and run pre-flight checks
+./target/release/baco init /path/to/project
 ./target/release/baco doctor
 
-# 5. Configure and scan
-cp config.toml my-config.toml
-# Edit my-config.toml: set [project] path to your target code
-./target/release/baco scan --config my-config.toml
+# 5. Scan
+./target/release/baco scan --config config.toml
 ```
 
 ### Additional subcommands
@@ -75,17 +74,15 @@ cp config.toml my-config.toml
 ./target/release/baco scan --config my.toml --force     # Force full rescan
 ```
 
-- **Phases**: 4 parallel (Indexing, Semgrep, CpgSlice, LlmStaticAnalysis) + sequential phases — some disabled by default (see [Configuration](docs/configuration.md))
+- **Phases**: 4 parallel (Indexing, Semgrep, CpgSlice, LlmStaticAnalysis) + 19 sequential phases — some disabled by default (see [Configuration](docs/configuration.md))
 
-### What happens next
 
-- **Phases**: 4 parallel (Indexing, Semgrep, CpgSlice, LlmStaticAnalysis) + sequential phases — some disabled by default (see [Configuration](docs/configuration.md))
 
 ## Features
 
 - **Pipeline profiles**: `core` (default) runs essential phases; `all` enables experimental phases (still individually flag-gated) — set with `scanner.profile = "core" | "all"`
 - **Pipeline phases**: Indexing → Semgrep → CpgSlice (`[cpg]` section, requires Joern) → LlmStaticAnalysis → CweRouting (`router.enabled`) → RuleSynthesis (experimental) → LlmDiscovery → LlmVerification → Validate (opt-in) → SecurityAgentVerification (opt-in) → TicketCrossRef → GitAnalysis → CrossFileAnalysis → ConfidenceScoring → AiAggregation → ThreatModeling (`enable_threat_modeling`) → RootCauseDedup → MultiVerifier (`enable_multi_verifier`, experimental) → AutoPatching (`enable_auto_patching`, opt-in) → CveBootstrap → PocCompiler (`enable_poc_compilation`, opt-in) → ExploitSynth (`[exploit]` section, experimental) → VariantSearch → Reporting
-- **Parallel execution**: Indexing, Semgrep, CpgSlice, and LlmStaticAnalysis run concurrently; 20 sequential phases follow
+- **Parallel execution**: Indexing, Semgrep, CpgSlice, and LlmStaticAnalysis run concurrently; 19 sequential phases follow
 - **CWE-aware MoE (opt-in)**: BM25 RAG retrieval from CWE knowledge base, routes to specialized analysis paths — enable with `router.enabled = true`
 - **Research-backed**: 16 academic papers integrated (VulTriage, VulIn, MoCQ, MoEVD, AgentFlow) — see [Research Integration](docs/research-integration.md)
 - **Checkpoint/resume**: Crash recovery after each phase
@@ -134,12 +131,18 @@ cp config.toml my-config.toml
 
 ## Supported Languages
 
-| Language   | Static analysis          | LLM analysis |
-| ---------- | ------------------------ | ------------ |
-| C / C++    | tree-sitter + semgrep    | ✅           |
-| Rust       | tree-sitter + semgrep    | ✅           |
-| Python     | tree-sitter + semgrep    | ✅           |
-| JavaScript | tree-sitter + semgrep    | ✅           |
+| Language      | Static analysis          | LLM analysis |
+| ------------- | ------------------------ | ------------ |
+| C / C++       | tree-sitter + semgrep    | ✅           |
+| Rust          | tree-sitter + semgrep    | ✅           |
+| Python        | tree-sitter + semgrep    | ✅           |
+| JavaScript    | tree-sitter + semgrep    | ✅           |
+| TypeScript    | tree-sitter + semgrep    | ✅           |
+| PHP           | tree-sitter + semgrep    | ✅           |
+| Go            | tree-sitter + semgrep    | ✅           |
+| Java          | tree-sitter + semgrep    | ✅           |
+| C#            | tree-sitter + semgrep    | ✅           |
+| Ruby          | tree-sitter + semgrep    | ✅           |
 
 ## Outputs
 
@@ -166,7 +169,7 @@ See [Research Integration](docs/research-integration.md) for per-paper details (
 - [Operator Tuning](docs/operator-tuning.md) — Performance flags and scenario-based tuning
 - [Output Interpretation](docs/output-interpretation.md) — Reading findings, confidence, triage verdicts
 - [Troubleshooting](docs/troubleshooting.md) — Common errors and fixes
-- [Roadmap](todo.md) — Completed and pending work
+
 
 ### Reading Order
 
@@ -179,7 +182,7 @@ Recommended for new users:
 6. **docs/operator-tuning.md** — performance tuning
 7. **docs/output-interpretation.md** — reading results
 8. **docs/troubleshooting.md** — error fixes
-9. **todo.md** — roadmap
+
 
 ## Acknowledgements
 

config.example.toml

@@ -114,7 +114,7 @@ enable_hunt_prompts = false
 timeout_secs = 60
 # Maximum number of retries for failed requests (on 429/5xx)
 max_retries = 3
-# Retry backoff in milliseconds (exponential: ms * 2^attempt)
+# Retry backoff in milliseconds (linear: ms * (retries + 1))
 retry_backoff_ms = 2000
 # Maximum concurrent LLM requests (default: 4)
 max_concurrent = 4
@@ -190,58 +190,6 @@ project = "libxml2"
 # enabled = false       # Set to true to enable the agent
 # max_turns = 10        # Maximum agent conversation turns per issue
 
-# --- Paper-Integration Research Flags (P1-P5) ---
-# All flags default to disabled. Enable to opt in to experimental
-# research-backed analysis augmentations. See todo.md for details.
-
-# VulTriage triple-path context augmentation — arXiv:2605.09461
-# Augments LLM input with control path (AST/CFG/DFG), knowledge path
-# (CWE pattern RAG), and semantic path (function summary) before judgement.
-#[vultriage]
-#enabled = false
-#control_path = true
-#knowledge_path = true
-#semantic_path = true
-
-# VulnLLM-R policy-based generation — arXiv:2605.09461
-# Queries the LLM N times to build a CWE candidate set, then a final
-# call picks one label. Increases LLM cost ~5x.
-#[policy_sampling]
-#enabled = false
-#samples = 4
-
-# VulnLLM-R agent scaffold — arXiv:2605.09461
-# Builds 3-path call-graph context + function-lookup tool per target.
-#[agent_scaffold]
-#enabled = false
-#max_rounds = 5
-#paths_per_target = 3
-
-# MoCQ neuro-symbolic rule synthesis (RuleSynthesis 2.0) — arXiv:2605.13918
-# LLM proposes patterns in a DSL → symbolic validator gives feedback → loop.
-# Extends [scanner.rulesynth] with these fields:
-#[scanner.rulesynth]
-#mocq_mode = false
-#max_iterations = 5
-#corpus_path = "tests/fixtures/"
-
-# PacVD primitive-API abstraction — arXiv:2605.07785
-# Appends callee abstraction at one of four granularity levels to the
-# LLM prompt. Level 1 = fuzzy branches only; 4 = concrete branches + key vars.
-#[pacvd]
-#enabled = false
-#level = 2
-#auto_level = false
-
-# AgentFlow multi-agent harness synthesis — arXiv:2605.11835
-# Represents the harness as a typed graph DSL with a search loop.
-# Most invasive integration — static harness only until P5.5.
-#[agent_flow]
-#enabled = false
-#max_iterations = 10
-#requires_instrumented_target = false
-
-
 # CPG-guided slicing
 [cpg]
 # Whether CPG slicing is enabled
@@ -267,41 +215,7 @@ project = "libxml2"
 # Whether the Validate phase is enabled
 # enabled = false
 
-# Triple-path context augmentation (P1: VulTriage)
-[vultriage]
-# Whether triple-path context augmentation is enabled
-# enabled = false
-# Whether to include the control path (AST/CFG/DFG verbalisation)
-# control_path = true
-# Whether to include the knowledge path (CWE pattern RAG)
-# knowledge_path = true
-# Whether to include the semantic path (function summary)
-# semantic_path = true
-
-# Policy-based generation
-[policy_sampling]
-# Whether policy-based generation is enabled
-# enabled = false
-# Number of sampling rounds to build the policy
-# samples = 4
 
-# Agent scaffold
-[agent_scaffold]
-# Whether the agent scaffold is enabled
-# enabled = false
-# Maximum interaction rounds per target function
-# max_rounds = 5
-# Number of call-graph paths to sample per target function
-# paths_per_target = 3
-
-# Primitive-API abstraction
-[pacvd]
-# Whether PacVD abstraction is enabled
-# enabled = false
-# Abstraction level 1-4 (1=fuzzy, 4=concrete)
-# level = 2
-# Whether to auto-select the level based on the configured LLM model
-# auto_level = false
 
 # Citation verification gate: deterministic checks that report citations
 # (file existence, line ranges) match the scanned tree before rendering.

docs/README.md

@@ -10,7 +10,7 @@ Documentation for baco — a 23-phase LLM-assisted code scanner.
 |------|-------------|
 | [architecture.md](architecture.md) | The 23-phase pipeline, PhaseGraph, data flow |
 | [configuration.md](configuration.md) | All config options, LLM setup, phase flags |
-| [research-integration.md](research-integration.md) | The 20 papers integrated into baco |
+| [research-integration.md](research-integration.md) | The 31 papers integrated into baco |
 | [ci-integration.md](ci-integration.md) | CI/CD setup with SARIF output |
 | [llm-vuln-detection-papers-survey.md](llm-vuln-detection-papers-survey.md) | Full survey of 36 papers |
 | [example-report-screenshot.png](example-report-screenshot.png) | Sample HTML report preview |

docs/architecture.md

@@ -11,9 +11,7 @@ BACO uses a **data-driven PhaseGraph** (`src/scanner/pipeline/orchestrator.rs`)
 
 ## Pipeline Phases
 
-**Core Pipeline (23 phases):**
-
-**Core Pipeline**:
+**Core Pipeline (23 phases total: 4 parallel + 19 sequential):**
 
 > **Note:** Phase order is defined in `PhaseGraph::new()` (src/scanner/pipeline/orchestrator.rs:28-53). This table is manually maintained and should be updated when that code changes.
 
@@ -36,12 +34,12 @@ BACO uses a **data-driven PhaseGraph** (`src/scanner/pipeline/orchestrator.rs`)
 | 15 | AI Aggregation | `llm.phases.aggregation` (API key present) |
 | 16 | Threat Modeling | `scanner.performance.enable_threat_modeling=false` |
 | 17 | Root Cause Deduplication | `scanner.performance.enable_root_cause_dedup=true` |
-| 19 | Auto-Patching | `scanner.performance.enable_auto_patching=false` |
-| 20 | CVE Bootstrap | `scanner.performance.enable_cve_bootstrap=true` |
-| 21 | PoC Compilation | `scanner.performance.enable_poc_compilation=false` |
-| 22 | Exploit Synthesis | `exploit.enabled=false` |
-| 23 | Variant Search | `scanner.performance.enable_variant_search=true` |
-| 24 | Reporting | Always-on |
+| 18 | Auto-Patching | `scanner.performance.enable_auto_patching=false` |
+| 19 | CVE Bootstrap | `scanner.performance.enable_cve_bootstrap=true` |
+| 20 | PoC Compilation | `scanner.performance.enable_poc_compilation=false` |
+| 21 | Exploit Synthesis | `exploit.enabled=false` |
+| 22 | Variant Search | `scanner.performance.enable_variant_search=true` |
+| 23 | Reporting | Always-on |
 
 ## Data Flow
 

docs/llm-vuln-detection-papers-survey.md

@@ -26,11 +26,9 @@ This document is the **full survey** of 36 papers from the Awesome-LLMs-for-Vuln
 ## 2. Top 5 Recommended Papers for Integration
 
 All five papers were approved by the project owner on 2026-08-11 for
-integration into baco. The full implementation roadmap with sub-tasks,
-file paths, and acceptance criteria lives in [`../todo.md`](../todo.md)
-(P1-P5). Each integration is gated behind a config flag that defaults to
-`enabled = false`, so existing scanner behaviour is unchanged until an
-operator opts in.
+integration into baco (P1-P5). Each integration is gated behind a config
+flag that defaults to `enabled = false`, so existing scanner behaviour is
+unchanged until an operator opts in.
 
 ### P1 — VulTriage: Triple-Path Context Augmentation (arXiv:2605.09461)
 
@@ -60,7 +58,7 @@ operator opts in.
   P1.5 Wire triple-path into prompt.
 - **Risk:** Low–medium. Reuses existing tree-sitter parsers and CPG slice
   from `CpgSlice` phase. Knowledge Path needs an embedding endpoint
-  (open question Q1 in `todo.md`).
+  (open question Q1).
 - **Why integrate:** Strong empirical false-positive reduction; minimal
   structural change to baco.
 
@@ -102,7 +100,7 @@ operator opts in.
   retrieval tool, P2.5 Wire agent scaffold into SecurityAgentVerification.
 - **Risk:** Medium. Agent scaffold depends on call-graph quality and a
   tool-calling interface in `LlmClient` (shared prerequisite PS1 in
-  `todo.md`). Policy sampling is 5× LLM calls — must be opt-in.
+  Policy sampling is 5× LLM calls — must be opt-in.
 - **Why integrate:** Inference-time techniques are portable to any
   reasoning-capable model already configured in baco; agent scaffold
   gives the existing `SecurityAgentVerification` phase a concrete
@@ -134,7 +132,7 @@ operator opts in.
   corpus, P3.3 LLM proposer with feedback loop, P3.4 Emit accepted rules
   to disk, P3.5 Config + tests.
 - **Risk:** Medium. Needs a labelled trace corpus (open question Q2 in
-  `todo.md`); start small (CWE-78, CWE-89).
+  start small (CWE-78, CWE-89).
 - **Why integrate:** Bridges symbolic + LLM without replacing existing
   flows; reduces rule-author fatigue. Emitted Semgrep rules are consumed
   by the existing `Semgrep` phase with no further wiring.
@@ -183,7 +181,7 @@ operator opts in.
   walker, P4.3 Four-dimension extractor, P4.4 Level selector + prompt
   integration, P4.5 Model-aware level auto-selection.
 - **Risk:** Low–medium. Call-graph quality is the main dependency (shared
-  prerequisite PS3 in `todo.md`).
+  prerequisite PS3).
 - **Why integrate:** Largest reported precision boost among the five
   papers; abstraction is a strict superset of P1's Control Path, so the
   two compose.
@@ -237,9 +235,9 @@ operator opts in.
   P5.3 Runtime executor, P5.4 Diagnoser, P5.5 Proposer (search loop).
 - **Risk:** High. Coverage/sanitizer feedback requires build
   instrumentation that baco does not have today (shared prerequisite PS2
-  in `todo.md`). Recommend shipping P5.1-P5.4 (static harness execution)
+  Recommend shipping P5.1-P5.4 (static harness execution)
   first and deferring P5.5 (search loop) until instrumentation is
-  available (open question Q3 in `todo.md`).
+  available (open question Q3).
 - **Why integrate:** Most invasive but highest ceiling. Makes the
   existing `SecurityAgentVerification` phase a concrete, searchable
   harness space instead of a fixed pipeline; the typed DSL gives

docs/research-integration.md

@@ -1,10 +1,10 @@
 # Research-Backed Design
 
-Baco's LLM integration is informed by a survey of 36 papers from [Awesome-LLMs-for-Vulnerability-Detection](https://github.com/huhusmang/Awesome-LLMs-for-Vulnerability-Detection). This document details the 20 papers integrated into baco's architecture and what each contributes.
+Baco's LLM integration is informed by a survey of 36 papers from [Awesome-LLMs-for-Vulnerability-Detection](https://github.com/huhusmang/Awesome-LLMs-for-Vulnerability-Detection). This document details the 31 papers integrated into baco's architecture and what each contributes.
 
 ## Scope
 
-This document covers the **20 papers already integrated** into baco's architecture — what each contributes, where it's wired in, and the config flag that enables it.
+This document covers the **31 papers already integrated** into baco's architecture — what each contributes, where it's wired in, and the config flag that enables it.
 
 ## Integration Status Summary
 

src/config/phases.rs

@@ -3,11 +3,7 @@ use std::path::PathBuf;
 
 /// Aggregation configuration including false positive store settings
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct AggregationConfig {
-    /// Path to the false positive store JSON file
-    #[serde(default)]
-    pub fp_store_path: Option<PathBuf>,
-}
+pub struct AggregationConfig {}
 
 /// Rule synthesis configuration (MoCQ: LLM→semgrep rule generation)
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -64,10 +60,6 @@ pub const DEFAULT_ENABLE_ROOT_CAUSE_DEDUP: bool = true;
 pub fn default_enable_root_cause_dedup() -> bool {
     DEFAULT_ENABLE_ROOT_CAUSE_DEDUP
 }
-pub const DEFAULT_ENABLE_MULTI_VERIFIER: bool = false;
-pub fn default_enable_multi_verifier() -> bool {
-    DEFAULT_ENABLE_MULTI_VERIFIER
-}
 pub const DEFAULT_ENABLE_AUTO_PATCHING: bool = false;
 pub fn default_enable_auto_patching() -> bool {
     DEFAULT_ENABLE_AUTO_PATCHING

src/config/scanner.rs

@@ -87,8 +87,6 @@ pub struct PerformanceSettings {
     pub enable_threat_modeling: bool,
     #[serde(default = "crate::config::default_enable_root_cause_dedup")]
     pub enable_root_cause_dedup: bool,
-    #[serde(default = "crate::config::default_enable_multi_verifier")]
-    pub enable_multi_verifier: bool,
     #[serde(default = "crate::config::default_enable_auto_patching")]
     pub enable_auto_patching: bool,
     #[serde(default = "crate::config::default_enable_poc_compilation")]
@@ -136,7 +134,6 @@ impl Default for PerformanceSettings {
             max_parallel_tasks: default_four(),
             enable_threat_modeling: crate::config::default_enable_threat_modeling(),
             enable_root_cause_dedup: crate::config::default_enable_root_cause_dedup(),
-            enable_multi_verifier: crate::config::default_enable_multi_verifier(),
             enable_auto_patching: crate::config::default_enable_auto_patching(),
             enable_poc_compilation: crate::config::default_enable_poc_compilation(),
             enable_confidence_refinement: crate::config::default_enable_confidence_refinement(),

src/lib.rs

@@ -1,24 +1,3 @@
-#![allow(
-    clippy::items_after_test_module,
-    clippy::assertions_on_constants,
-    clippy::useless_vec,
-    clippy::needless_return,
-    clippy::match_single_binding,
-    clippy::field_reassign_with_default,
-    clippy::single_match,
-    clippy::too_many_arguments,
-    clippy::len_without_is_empty,
-    clippy::redundant_clone,
-    clippy::doc_markdown,
-    clippy::borrow_deref_ref,
-    clippy::len_zero,
-    clippy::module_inception,
-    clippy::vec_init_then_push,
-    clippy::cloned_ref_to_slice_refs,
-    clippy::needless_borrows_for_generic_args,
-    clippy::test_attr_in_doctest
-)]
-
 pub mod agent;
 pub mod agent_flow;
 pub mod agent_scaffold;