[DO NOT MERGE] Prototype runtime IAST taint tracking for Go

[eliottness]

DO NOT MERGE

This is a research PR for discussion and review. It is not production-ready and
must not be merged.

Summary

This PR explores runtime IAST taint tracking for Go with one concrete source,
os.Getenv, and one sink, os.Open.

It contains two complementary prototypes:

1. An Orchestrion source-rewriting implementation that preserves ordinary Go
   values while storing taint ranges in a runtime registry.
2. A patched Go compiler/runtime experiment that carries one-byte shadow labels
   through SSA, calls, memory, maps, channels, closures, stack relocation, and GC
   object reuse.

The objective is to evaluate achievable coverage, runtime invariants, compiler
integration points, and operational costs before selecting a production design.

Motivation

Go values do not carry application-defined metadata, so transparent IAST must
either rewrite source operations or add a parallel metadata representation below
the language surface. This work tests both approaches against explicit data flow
without changing user-visible string, []byte, or []rune types.

All source, propagation, and sink decisions remain runtime decisions. The
compiler and injector select where tracking executes, but they do not decide at
compile time whether a concrete value is tainted.

Orchestrion prototype

Injector primitives

• Adds a typed value-operation join point for language-level operations such as
  string concatenation, slices, conversions, indexing, append, copy, and
  clear.
• Adds statement replacement and insertion advice.
• Matches advice against the original AST before applying mutations, preventing
  newly inserted nodes from being rematched during the same traversal.
• Adds type-aware context queries for constants, builtins, and addressability.
• Rejects scalar-capture patterns that would evaluate effectful expressions twice
  or accumulate deferred cleanup inside for/range loops.
• Rejects insert-statements-after when the statement occupies a field rather
  than a list, avoiding dstutil.Cursor.InsertAfter panics.

Runtime tracking

runtime/taint propagates byte ranges through:

• strings, byte slices, rune slices, named types, and generic types;
• concatenation, explicit slices, conversions, indexing, append, copy, clear,
  and byte assignment;
• strings.Clone, Replace, ReplaceAll, Join, Repeat, ToUpper,
  ToLower, and Map;
• fmt.Sprintf and filepath.Join conservatively;
• strings.Builder and bytes.Buffer operations.

The registry is bounded to 65,536 retained occurrences per storage category.
When a category reaches its limit, additional occurrences remain clean rather
than allowing request-driven unbounded growth. Clean builders are not retained.

The default JSON sink reporter redacts the raw value. Controlled debugging can
opt in with ORCHESTRION_TAINT_INCLUDE_VALUE=1, or install a custom reporter.

Patched Go compiler/runtime prototype

The complete patch is stored in
experiments/go-shadow/go-taint-shadow.patch and is gated by
-d=taint=1.

Compiler behavior

• Associates tracked string SSA values with runtime uint8 labels.
• Propagates labels through assignments, aliases, control-flow phis, memory
  loads/stores, and closure environments.
• Uses authenticated per-goroutine transitions for static calls, function values,
  interface dispatch, recursion, panic/recover, deferred results, and
  address-taken parameters.
• Supports exactly one explicit string parameter and one string result per
  interprocedural transition in this prototype.
• Excludes runtime support packages from recursive instrumentation.

Runtime behavior

• Uses dense atomic arena shadow bytes for heap and managed stack addresses.
• Copies stack shadows during growth/shrink and clears them before stack reuse.
• Clears dead heap labels during sweep before allocator reuse.
• Preserves labels through buffered and unbuffered chan string, blocked
  senders/receivers, close paths, select cases, timers, and sudog reuse.
• Preserves labels through Swiss-map assignment, lookup, overwrite, range,
  delete, clear, clone, and growth.
• Avoids proportional metadata allocation for zero-sized and non-string channels.
• Keeps buffered string-channel buffers and label storage visible to the GC.

Consolidated test suite

The minimal fixture programs remain independently runnable under
experiments/go-shadow/fixture. A table-driven subprocess suite consolidates the
full behavior matrix:

TAINT_GO=/path/to/go-taint-shadow/bin/go \
  go test -count=1 ./experiments/go-shadow/suite

The suite skips when TAINT_GO is not configured, so normal repository test and
vet commands remain usable.

Coverage includes:

• disabled and clean paths;
• local copies and SSA phis;
• static calls, function values, interface dispatch, recursion, panic/recover,
  dynamic defer, receiver isolation, unnamed parameters, and address-taken
  parameters;
• buffered, unbuffered, GC-stressed, closed, selected, and race-enabled channels;
• map literals, assignments, lifecycle operations, reflection-based slot reuse,
  growth, and race mode;
• closure environments, exact-address heap reuse, and race-enabled reuse;
• zero-sized-channel allocation behavior.

Validation performed

The following passed locally:

go test -race -count=1 ./runtime/taint/...
go test -count=1 ./internal/injector/aspect/... ./internal/injector/config/...
go vet ./...
go run ./_tools/headercheck/header_check.go
go build ./...
go test -count=1 -run='^$' ./...
TAINT_GO=/path/to/go-taint-shadow/bin/go \
  go test -count=1 ./experiments/go-shadow/suite

The isolated Go toolchain also passed:

GOMAXPROCS=1 ./make.bash
../bin/go test -count=1 runtime internal/runtime/maps \
  cmd/compile/internal/typecheck

Full repository tests that dynamically resolve external integration modules were
blocked locally by timeouts to the internal module proxy. No failure was observed
in the changed packages.

The final patched-runtime implementation received a dedicated Oracle audit, and
the complete PR received goal, hands-on QA, code-quality, security, and repository
context reviews after blocker remediation.

Known boundaries

Orchestrion prototype

• No implicit/control-flow taint.
• Scalar propagation is intentionally limited when preserving single evaluation
  cannot be proven.
• No arbitrary scalar transport through calls, maps, or channels.
• No unsafe aliases, cgo, assembly, plugins, go:linkname, prebuilt code, or
  uninstrumented dependencies.
• Registry bounds trade false negatives after saturation for bounded memory.

Patched compiler/runtime prototype

• Exactly one explicit string parameter and one string result are supported by
  the current call protocol.
• Globals, foreign memory, and some aggregate/conversion forms remain clean.
• Arena shadow memory and runtime structure overhead are currently unconditional,
  including when taint compilation is disabled.
• Validation was performed on darwin/arm64; 32-bit execution was not tested.
• The patch targets an isolated Go worktree and must not be applied to a primary
  development checkout.

Review guidance

Please focus review on:

1. Whether the injector primitives are general enough without exposing unsafe AST
   mutation behavior.
2. Registry identity/lifetime tradeoffs and the bounded-retention policy.
3. The authenticated call-transition protocol and panic cleanup.
4. Stack-shadow copying and heap-shadow sweep timing.
5. Channel/select atomicity and Swiss-map metadata movement.
6. Which prototype, if either, provides a viable path toward a production design.

Again, this PR is intentionally a draft and must not be merged.