I just wanted to ask if there was ever a decision made that said tainted
mode will go into PHP mainstream.
no, there was no decision yet.
It is no secret that I don't like the idea of a taint mode in PHP
because it cannot be made secure and fast at the same time.
/me too. Although I can't argue about those two implementations because I haven't looked at them yet, I think we shouldn't include neither of them in the core. At most we could introduce some hooks in the engine to allow these kind of extensions to be self-contained and distributed by 3rd parties without much trouble.
Also I don't know how GRASP works, but it's very difficult (if not impossible) to provide good analysis..
Nuno