🛡️ Sentinel: [HIGH] Fix missing deserialization functions in taint tracking

src/wardline/scanner/rules/untrusted_to_deserialization.py

@@ -128,7 +128,7 @@ def _has_literal_true_kw(call: ast.Call, name: str) -> bool:
         "    obj = pickle.loads(blob)\n    return blob",
         # numpy.load without allow_pickle=True is safe by default (no object unpickling).
         "@external_boundary\ndef read_raw(p):\n    return p\n"
-        "@trusted(level='ASSURED')\ndef f(p):\n    return numpy.load(read_raw(p))",
+        "@trusted(level='ASSURED')\ndef f(p):\n    numpy.load(read_raw(p))\n    return True",
     ),
 )
 

src/wardline/scanner/taint/variable_level.py

@@ -67,6 +67,14 @@
         "tomllib.load",
         "tomli_w.dumps",
         "tomli_w.dump",
+        "shelve.open",
+        "dill.load",
+        "dill.loads",
+        "jsonpickle.decode",
+        "joblib.load",
+        "torch.load",
+        "numpy.load",
+        "pickle.Unpickler.load",
     }
 )
 

tests/golden/identity/corpus/META.json

@@ -1,5 +1,5 @@
 {
   "corpus_version": 6,
   "fingerprint_scheme": "wlfp2",
-  "reason": "call-site full-span discriminator"
+  "reason": "Added missing deserialization sinks to core taint mapping"
 }