@chemx/create-chemx 26.9.26-253 → 26.9.28-1234

package/cli/audit/ast-visitors.js

@@ -23,12 +23,18 @@ export const createAstVisitors = ({ relativePath, violations, hookRegistry, conf
       const isCustomHook = isCustomHookFunction(astPath);
 
       // Pillar 3: Hook Saturation
+      const CONTROLLER_WRAPPER_EXCLUSIONS = new Set([
+        'useSharedStatusController',
+        'useSharedController',
+        'useController'
+      ]);
       let hookCount = 0;
       astPath.traverse({
         CallExpression(callPath) {
           const callee = callPath.node.callee;
           if (t.isIdentifier(callee) && /^use[A-Z0-9]/.test(callee.name)) {
-            if (callPath.getFunctionParent() === astPath) {
+            const isExcluded = CONTROLLER_WRAPPER_EXCLUSIONS.has(callee.name);
+            if (!isExcluded && callPath.getFunctionParent() === astPath) {
               hookCount += 1;
             }
           }

package/cli/audit/csharp-analyzer.js

@@ -1,18 +1,334 @@
 /**
  * Chemical X C# / .NET Structural Analyzer
- * Evaluates .NET Clean Architecture, MediatR handlers, EF Core usage, and AI slop.
+ * Evaluates .NET Clean Architecture, MediatR handlers, EF Core usage,
+ * cyclomatic complexity, control flow nesting depth, and AI slop.
  */
 import { RULE_REGISTRY } from './rules-registry.js';
 
-const SHALLOW_CATCH_PATTERN = /catch\s*(?:\([^)]*\))?\s*\{\s*(?:\/\/[^\n]*)?\s*\}/;
 const IN_MEMORY_DB_PATTERN = /\bUseInMemoryDatabase\s*\(/;
+const SQLITE_PROVIDER_PATTERN = /\b(?:UseSqlite|SqliteConnection|DataSource\s*=\s*:memory:)\b/;
 const SIMULATED_DELAY_PATTERN = /\bTask\.Delay\s*\(\s*\d+\s*\)/;
 const HARDCODED_LIST_MOCK_PATTERN = /new\s+List<[A-Za-z0-9_]+>\s*\{\s*new\s+[A-Za-z0-9_]+\s*\{/;
+const SIMULATION_SWITCH_PATTERN = /(?:public|private|protected|internal)?\s*(?:static\s+)?(?:readonly\s+)?(?:const\s+)?bool\s+(?:Simulate|UseSimulation|Mock|Fake|Stub)[A-Za-z0-9_]*\s*(?:\{\s*get;\s*(?:set|init)?;\s*\}\s*)?=\s*true\b/i;
 
-export const analyzeCSharpCode = (content, relativePath, violations) => {
+const isVerbatimStringPrefix = (code, i) => {
+  const ch = code[i];
+  const next = code[i + 1];
+  const isVerbatim = ch === '@' && next === '"';
+  const isInterpVerbatim = (ch === '$' && next === '@') || (ch === '@' && next === '$');
+  const hasQuote = code[i + 2] === '"';
+  return isVerbatim || (isInterpVerbatim && hasQuote);
+};
+
+export const maskCommentsAndStrings = (code) => {
+  let out = '';
+  let i = 0;
+  const len = code.length;
+  while (i < len) {
+    const ch = code[i];
+    const next = code[i + 1];
+
+    if (ch === '/' && next === '/') {
+      out += '  ';
+      i += 2;
+      while (i < len && code[i] !== '\n') {
+        out += ' ';
+        i++;
+      }
+    } else if (ch === '/' && next === '*') {
+      out += '  ';
+      i += 2;
+      while (i < len && !(code[i] === '*' && code[i + 1] === '/')) {
+        out += code[i] === '\n' ? '\n' : ' ';
+        i++;
+      }
+      if (i < len) {
+        out += '  ';
+        i += 2;
+      }
+    } else if (isVerbatimStringPrefix(code, i)) {
+      const isVerbatim = ch === '@' && next === '"';
+      const skip = isVerbatim ? 2 : 3;
+      out += ' '.repeat(skip);
+      i += skip;
+      while (i < len) {
+        if (code[i] === '"' && code[i + 1] === '"') {
+          out += '  ';
+          i += 2;
+        } else if (code[i] === '"') {
+          out += ' ';
+          i++;
+          break;
+        } else {
+          out += code[i] === '\n' ? '\n' : ' ';
+          i++;
+        }
+      }
+    } else if (ch === '"') {
+      out += ' ';
+      i++;
+      while (i < len && code[i] !== '"' && code[i] !== '\n') {
+        if (code[i] === '\\') {
+          out += '  ';
+          i += 2;
+        } else {
+          out += ' ';
+          i++;
+        }
+      }
+      if (i < len && code[i] === '"') {
+        out += ' ';
+        i++;
+      }
+    } else if (ch === "'") {
+      out += ' ';
+      i++;
+      while (i < len && code[i] !== "'" && code[i] !== '\n') {
+        if (code[i] === '\\') {
+          out += '  ';
+          i += 2;
+        } else {
+          out += ' ';
+          i++;
+        }
+      }
+      if (i < len && code[i] === "'") {
+        out += ' ';
+        i++;
+      }
+    } else {
+      out += ch;
+      i++;
+    }
+  }
+  return out;
+};
+
+const extractMethods = (maskedContent) => {
+  const methods = [];
+  const methodRegex = /(?:public|internal|protected|private|static|async|override|virtual|sealed|partial)\s+[\w<>\[\],\s?]+?\s+([A-Za-z0-9_]+)\s*\(([\s\S]*?)\)\s*(?:where[^{]+)?\s*\{/g;
+  let match;
+
+  while ((match = methodRegex.exec(maskedContent)) !== null) {
+    const methodName = match[1];
+    const signature = match[0];
+    const startIdx = match.index + signature.length - 1;
+    let depth = 0;
+    let endIdx = -1;
+
+    for (let i = startIdx; i < maskedContent.length; i++) {
+      if (maskedContent[i] === '{') depth++;
+      else if (maskedContent[i] === '}') {
+        depth--;
+        if (depth === 0) {
+          endIdx = i;
+          break;
+        }
+      }
+    }
+
+    if (endIdx !== -1) {
+      const startLine = maskedContent.slice(0, match.index).split('\n').length;
+      methods.push({
+        name: methodName,
+        startLine,
+        body: maskedContent.slice(startIdx, endIdx + 1),
+        startIdx,
+        endIdx
+      });
+    }
+  }
+
+  return methods;
+};
+
+const evaluateMethodComplexityAndNesting = (method, relativePath, violations, config = {}) => {
+  const maxComplexity = config.maxCyclomaticComplexity || 12;
+  const maxNestingLimit = 4;
+  const body = method.body;
+
+  let cyclomaticComplexity = 1;
+  const ifMatches = body.match(/\bif\s*\(/g);
+  if (ifMatches) cyclomaticComplexity += ifMatches.length;
+  const caseMatches = body.match(/\bcase\b[^:]+:/g);
+  if (caseMatches) cyclomaticComplexity += caseMatches.length;
+  const whileMatches = body.match(/\bwhile\s*\(/g);
+  if (whileMatches) cyclomaticComplexity += whileMatches.length;
+  const forMatches = body.match(/\bfor\s*\(/g);
+  if (forMatches) cyclomaticComplexity += forMatches.length;
+  const foreachMatches = body.match(/\bforeach\s*\(/g);
+  if (foreachMatches) cyclomaticComplexity += foreachMatches.length;
+  const catchMatches = body.match(/\bcatch\b/g);
+  if (catchMatches) cyclomaticComplexity += catchMatches.length;
+  const andMatches = body.match(/&&/g);
+  if (andMatches) cyclomaticComplexity += andMatches.length;
+  const orMatches = body.match(/\|\|/g);
+  if (orMatches) cyclomaticComplexity += orMatches.length;
+  const nullCoalMatches = body.match(/\?\?/g);
+  if (nullCoalMatches) cyclomaticComplexity += nullCoalMatches.length;
+
+  if (cyclomaticComplexity > maxComplexity) {
+    const meta = RULE_REGISTRY.COMPLEXITY_CYCLOMATIC_HIGH;
+    violations.push({
+      filePath: relativePath,
+      line: method.startLine,
+      column: 1,
+      hazard: `High cyclomatic complexity in method ${method.name} (${cyclomaticComplexity} > ${maxComplexity} threshold)`,
+      rule: 'COMPLEXITY_CYCLOMATIC_HIGH',
+      severity: meta.severity,
+      pillar: meta.pillar,
+      directive: meta.directive
+    });
+  }
+
+  let braceLevel = 0;
+  const controlStack = [];
+  let maxControlDepth = 0;
+  let maxDepthLine = method.startLine;
+  const bodyTokens = body.split(/(\bif\s*\(|\belse\s*if\s*\(|\belse\b|\bwhile\s*\(|\bfor\s*\(|\bforeach\s*\(|\bswitch\s*\(|\bcatch\b|\{|\})/g);
+  let curLine = method.startLine;
+  let pendingControl = null;
+
+  for (const token of bodyTokens) {
+    curLine += (token.match(/\n/g) || []).length;
+    if (/\b(?:if|else|while|for|foreach|switch|catch)\b/.test(token)) {
+      pendingControl = { line: curLine };
+    } else if (token === '{') {
+      braceLevel++;
+      if (pendingControl) {
+        controlStack.push({ braceLevel, line: pendingControl.line });
+        pendingControl = null;
+        if (controlStack.length > maxControlDepth) {
+          maxControlDepth = controlStack.length;
+          maxDepthLine = curLine;
+        }
+      }
+    } else if (token === '}') {
+      if (controlStack.length > 0 && controlStack[controlStack.length - 1].braceLevel === braceLevel) {
+        controlStack.pop();
+      }
+      braceLevel--;
+    }
+  }
+
+  if (maxControlDepth >= maxNestingLimit) {
+    const meta = RULE_REGISTRY.STRUCTURAL_WEIGHT_EXCEEDED;
+    violations.push({
+      filePath: relativePath,
+      line: maxDepthLine,
+      column: 1,
+      hazard: `Excessive control flow nesting depth (${maxControlDepth} levels >= ${maxNestingLimit}) in method ${method.name}`,
+      rule: 'STRUCTURAL_WEIGHT_EXCEEDED',
+      severity: meta.severity,
+      pillar: meta.pillar,
+      directive: 'Flatten control flow using early-return guard clauses or decomposed methods'
+    });
+  }
+
+  const condRegex = /\b(?:if|while)\s*\(([\s\S]*?)\)/g;
+  let condMatch;
+  while ((condMatch = condRegex.exec(body)) !== null) {
+    const expr = condMatch[1];
+    const logicOps = (expr.match(/&&|\|\|/g) || []).length;
+    if (logicOps >= 3) {
+      const lineNum = method.startLine + body.slice(0, condMatch.index).split('\n').length - 1;
+      const meta = RULE_REGISTRY.CONTROL_FLOW_INLINE_BOOLEAN;
+      violations.push({
+        filePath: relativePath,
+        line: lineNum,
+        column: 1,
+        hazard: `Complex inline boolean condition detected in method ${method.name} (${logicOps} logical operators)`,
+        rule: 'CONTROL_FLOW_INLINE_BOOLEAN',
+        severity: meta.severity,
+        pillar: meta.pillar,
+        directive: meta.directive
+      });
+      break;
+    }
+  }
+};
+
+const checkCleanArchitectureAndCoupling = (content, relativePath, violations) => {
+  const isController =
+    relativePath.includes('/Controllers/') ||
+    relativePath.endsWith('Controller.cs') ||
+    /:\s*(?:ControllerBase|Controller)\b/.test(content) ||
+    /\[ApiController\]/.test(content);
+
+  if (!isController) return;
+
+  const ctorRegex = /(?:public|internal)\s+(?:class\s+)?([A-Za-z0-9_]+)\s*\(([\s\S]*?)\)\s*(?::\s*(?:base|this)\s*\([^)]*\)\s*)?\{/g;
+  let ctorMatch;
+
+  while ((ctorMatch = ctorRegex.exec(content)) !== null) {
+    const paramsText = ctorMatch[2].trim();
+    if (!paramsText) continue;
+
+    const lineNum = content.slice(0, ctorMatch.index).split('\n').length;
+    const rawParams = paramsText.split(',').map((p) => p.trim()).filter(Boolean);
+
+    if (rawParams.length > 5) {
+      const meta = RULE_REGISTRY.COUPLING_EXCESSIVE_INJECTION;
+      violations.push({
+        filePath: relativePath,
+        line: lineNum,
+        column: 1,
+        hazard: `Excessive constructor dependency injection (${rawParams.length} dependencies > 5 threshold) in controller`,
+        rule: 'COUPLING_EXCESSIVE_INJECTION',
+        severity: meta.severity,
+        pillar: meta.pillar,
+        directive: meta.directive
+      });
+    }
+
+    const hasDbContext = rawParams.some((p) => {
+      const isDb = /\b(?:[A-Za-z0-9_]*DbContext|DbContext|[A-Za-z0-9_]*Context)\b/.test(p);
+      const isHttp = /\b(?:HttpContext|ActionContext|ControllerContext)\b/.test(p);
+      return isDb && !isHttp;
+    });
+
+    const hasService = rawParams.some((p) => /\b(?:[A-Za-z0-9_]*Service|[A-Za-z0-9_]*Repository)\b/.test(p));
+
+    if (hasDbContext) {
+      const meta = RULE_REGISTRY.LAYER_VIOLATION_CONTROLLER;
+      const hazardDesc = hasService
+        ? 'Clean Architecture layer violation: Controller directly injects DbContext and service dependencies, bypassing MediatR CQRS'
+        : 'Clean Architecture layer violation: Controller directly injects DbContext, bypassing application/MediatR layer';
+
+      violations.push({
+        filePath: relativePath,
+        line: lineNum,
+        column: 1,
+        hazard: hazardDesc,
+        rule: 'LAYER_VIOLATION_CONTROLLER',
+        severity: meta.severity,
+        pillar: meta.pillar,
+        directive: meta.directive
+      });
+    }
+  }
+
+  const fromServicesDbMatches = content.matchAll(/\[FromServices\]\s*(?:[A-Za-z0-9_]*DbContext|DbContext|[A-Za-z0-9_]*Context)\b/g);
+  for (const m of fromServicesDbMatches) {
+    const lineNum = content.slice(0, m.index).split('\n').length;
+    const meta = RULE_REGISTRY.LAYER_VIOLATION_CONTROLLER;
+    violations.push({
+      filePath: relativePath,
+      line: lineNum,
+      column: 1,
+      hazard: 'Clean Architecture layer violation: Action method directly injects DbContext via [FromServices]',
+      rule: 'LAYER_VIOLATION_CONTROLLER',
+      severity: meta.severity,
+      pillar: meta.pillar,
+      directive: meta.directive
+    });
+  }
+};
+
+export const analyzeCSharpCode = (content, relativePath, violations, config = {}) => {
   const lines = content.split('\n');
+  const maskedContent = maskCommentsAndStrings(content);
 
-  // Multi-line and single-line shallow catch detection
   const catchMatches = content.matchAll(/catch\s*(?:\([^)]*\))?\s*\{(?:\s*|\s*\/\/[^\n]*\s*)\}/g);
   for (const m of catchMatches) {
     const lineNum = content.slice(0, m.index).split('\n').length;
@@ -25,14 +341,29 @@ export const analyzeCSharpCode = (content, relativePath, violations) => {
       rule: 'AI_SLOP_SHALLOW_CATCH',
       severity: meta.severity,
       pillar: meta.pillar,
-      directive: meta.directive
+      directive: meta.directive,
+      isAiSlop: true
     });
   }
 
   lines.forEach((lineText, idx) => {
     const lineNum = idx + 1;
 
-    // Simulated Mock Data / Stubs
+    if (SIMULATION_SWITCH_PATTERN.test(lineText)) {
+      const meta = RULE_REGISTRY.AI_SLOP_LAZY_PLACEHOLDER;
+      violations.push({
+        filePath: relativePath,
+        line: lineNum,
+        column: 1,
+        hazard: `Global simulation switch detected: "${lineText.trim()}" (unverified synthetic component mode)`,
+        rule: 'AI_SLOP_LAZY_PLACEHOLDER',
+        severity: 'CRITICAL',
+        pillar: meta.pillar,
+        directive: meta.directive,
+        isAiSlop: true
+      });
+    }
+
     if (IN_MEMORY_DB_PATTERN.test(lineText)) {
       const meta = RULE_REGISTRY.SYNTHETIC_MOCK_DATA;
       violations.push({
@@ -47,6 +378,20 @@ export const analyzeCSharpCode = (content, relativePath, violations) => {
       });
     }
 
+    if (SQLITE_PROVIDER_PATTERN.test(lineText)) {
+      const meta = RULE_REGISTRY.SYNTHETIC_MOCK_DATA;
+      violations.push({
+        filePath: relativePath,
+        line: lineNum,
+        column: 1,
+        hazard: 'SQLite provider detected in configuration or test setup (potential production database parity mismatch)',
+        rule: 'SYNTHETIC_MOCK_DATA',
+        severity: 'HIGH',
+        pillar: meta.pillar,
+        directive: 'Use Testcontainers or production-identical database engine for integration tests'
+      });
+    }
+
     if (SIMULATED_DELAY_PATTERN.test(lineText)) {
       const meta = RULE_REGISTRY.AI_SLOP_LAZY_PLACEHOLDER;
       violations.push({
@@ -57,7 +402,8 @@ export const analyzeCSharpCode = (content, relativePath, violations) => {
         rule: 'AI_SLOP_LAZY_PLACEHOLDER',
         severity: meta.severity,
         pillar: meta.pillar,
-        directive: meta.directive
+        directive: meta.directive,
+        isAiSlop: true
       });
     }
 
@@ -76,5 +422,12 @@ export const analyzeCSharpCode = (content, relativePath, violations) => {
     }
   });
 
+  const methods = extractMethods(maskedContent);
+  for (const method of methods) {
+    evaluateMethodComplexityAndNesting(method, relativePath, violations, config);
+  }
+
+  checkCleanArchitectureAndCoupling(content, relativePath, violations);
+
   return violations;
 };

package/cli/audit/csharp-analyzer.spec.js

@@ -0,0 +1,216 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { analyzeCSharpCode, maskCommentsAndStrings } from "./csharp-analyzer.js";
+import { calculateAiSlopScore, calculateMolecularHealthScore } from "./metrics.js";
+
+test("csharp-analyzer: maskCommentsAndStrings preserves layout and line count", () => {
+  const code = "// comment\n/* block */\nstring s = \"hello\";\n";
+  const masked = maskCommentsAndStrings(code);
+  assert.equal(masked.split("\n").length, code.split("\n").length);
+  assert.equal(masked.includes("hello"), false);
+});
+
+test("csharp-analyzer: flags global simulation switches with isAiSlop: true", () => {
+  const code = `
+namespace Nadena.Domain;
+
+public class MarketSimulator
+{
+    public static bool SimulateBuyers = true;
+    public static bool SimulateOrders { get; set; } = true;
+    private static bool UseSimulation = true;
+}
+`;
+
+  const violations = [];
+  analyzeCSharpCode(code, "Domain/MarketSimulator.cs", violations);
+
+  const slopMatches = violations.filter((v) => v.rule === "AI_SLOP_LAZY_PLACEHOLDER" && v.isAiSlop);
+  assert.ok(slopMatches.length >= 3, "Must flag all 3 simulation switches");
+  assert.equal(slopMatches[0].severity, "CRITICAL");
+  assert.ok(slopMatches[0].hazard.includes("SimulateBuyers"));
+
+  // Verify AI Slop scoring calculation is degraded
+  const slopScore = calculateAiSlopScore(violations, 1);
+  assert.ok(slopScore.score < 90, "AI Slop score must drop from 100");
+  assert.notEqual(slopScore.grade, "A+");
+});
+
+test("csharp-analyzer: detects deep control flow nesting (>= 4 levels) in methods", () => {
+  const code = `
+namespace Nadena.Services;
+
+public class OrderProcessor
+{
+    public async Task ProcessAsync(Order order)
+    {
+        if (order != null)
+        {
+            if (order.IsValid)
+            {
+                if (order.HasItems)
+                {
+                    if (order.Total > 0)
+                    {
+                        if (order.IsPaid)
+                        {
+                            await SaveAsync(order);
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+`;
+
+  const violations = [];
+  analyzeCSharpCode(code, "Services/OrderProcessor.cs", violations);
+
+  const nestingViolation = violations.find((v) => v.rule === "STRUCTURAL_WEIGHT_EXCEEDED");
+  assert.ok(nestingViolation, "Must flag excessive control flow nesting depth");
+  assert.ok(nestingViolation.hazard.includes("nesting depth"));
+  assert.equal(nestingViolation.severity, "HIGH");
+});
+
+test("csharp-analyzer: detects high cyclomatic complexity (> 12) in methods", () => {
+  const code = `
+namespace Nadena.Services;
+
+public class ComplexEvaluator
+{
+    public int EvaluateScore(int a, int b, int c, int d, int e, int f)
+    {
+        int score = 0;
+        if (a > 1) score++;
+        if (b > 2) score++;
+        if (c > 3) score++;
+        if (d > 4) score++;
+        if (e > 5) score++;
+        if (f > 6) score++;
+        if (a == b) score++;
+        if (b == c) score++;
+        if (c == d) score++;
+        if (d == e) score++;
+        if (e == f) score++;
+        if (a + b > 10) score++;
+        if (c + d > 10) score++;
+        return score;
+    }
+}
+`;
+
+  const violations = [];
+  analyzeCSharpCode(code, "Services/ComplexEvaluator.cs", violations);
+
+  const complexityViolation = violations.find((v) => v.rule === "COMPLEXITY_CYCLOMATIC_HIGH");
+  assert.ok(complexityViolation, "Must flag cyclomatic complexity > 12");
+  assert.ok(complexityViolation.hazard.includes("EvaluateScore"));
+});
+
+test("csharp-analyzer: detects complex inline boolean conditions in control flow", () => {
+  const code = `
+namespace Nadena.Services;
+
+public class Validator
+{
+    public bool Check(Item item)
+    {
+        if (item.A && item.B && item.C || item.D)
+        {
+            return true;
+        }
+        return false;
+    }
+}
+`;
+
+  const violations = [];
+  analyzeCSharpCode(code, "Services/Validator.cs", violations);
+
+  const inlineBool = violations.find((v) => v.rule === "CONTROL_FLOW_INLINE_BOOLEAN");
+  assert.ok(inlineBool, "Must flag complex inline boolean condition with >= 3 operators");
+});
+
+test("csharp-analyzer: flags Clean Architecture layer violations in controllers", () => {
+  const controllerCode = `
+namespace Nadena.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class OrdersController : ControllerBase
+{
+    private readonly AppDbContext _context;
+    private readonly IOrderService _orderService;
+
+    public OrdersController(AppDbContext context, IOrderService orderService)
+    {
+        _context = context;
+        _orderService = orderService;
+    }
+
+    [HttpGet]
+    public IActionResult GetDirect([FromServices] ApplicationDbContext inlineDb)
+    {
+        return Ok();
+    }
+}
+`;
+
+  const violations = [];
+  analyzeCSharpCode(controllerCode, "Controllers/OrdersController.cs", violations);
+
+  const layerViolations = violations.filter((v) => v.rule === "LAYER_VIOLATION_CONTROLLER");
+  assert.ok(layerViolations.length >= 2, "Must flag constructor DbContext and [FromServices] DbContext");
+  assert.equal(layerViolations[0].severity, "CRITICAL");
+});
+
+test("csharp-analyzer: flags excessive controller constructor injection (> 5 dependencies)", () => {
+  const controllerCode = `
+namespace Nadena.Controllers;
+
+public class HeavyController : ControllerBase
+{
+    public HeavyController(
+        IAuthService auth,
+        IUserService user,
+        IOrderService order,
+        IEmailService email,
+        IPaymentService payment,
+        ILogger<HeavyController> logger)
+    {
+    }
+}
+`;
+
+  const violations = [];
+  analyzeCSharpCode(controllerCode, "Controllers/HeavyController.cs", violations);
+
+  const coupling = violations.find((v) => v.rule === "COUPLING_EXCESSIVE_INJECTION");
+  assert.ok(coupling, "Must flag constructor with 6 dependencies");
+  assert.equal(coupling.severity, "HIGH");
+});
+
+test("csharp-analyzer: flags SQLite test provider in tests/configuration", () => {
+  const testCode = `
+using Microsoft.EntityFrameworkCore;
+using Xunit;
+
+public class OrderTests
+{
+    [Fact]
+    public void TestDatabase()
+    {
+        var options = new DbContextOptionsBuilder<AppDbContext>()
+            .UseSqlite("DataSource=:memory:")
+            .Options;
+    }
+}
+`;
+
+  const violations = [];
+  analyzeCSharpCode(testCode, "Tests/OrderTests.cs", violations);
+
+  const sqliteViolation = violations.find((v) => v.rule === "SYNTHETIC_MOCK_DATA" && v.hazard.includes("SQLite"));
+  assert.ok(sqliteViolation, "Must flag UseSqlite/DataSource=:memory: provider");
+});

package/cli/audit/extended-text-patterns.js

@@ -32,7 +32,10 @@ const JAVASCRIPT_URL_TEMPLATE_PATTERN = /\b(?:href|src|action|formaction)\s*=\s*
 /**
  * Pillar 10: Check for co-located test files for molecule capsules.
  */
-export const checkMoleculeCoLocatedTest = (filePath, relativePath, violations) => {
+export const checkMoleculeCoLocatedTest = (filePath, relativePath, violations, config = {}) => {
+  const enforceColocated = config.enforceColocatedTests ?? (config.profile === 'atomic-strict');
+  if (!enforceColocated) return;
+
   const baseName = path.basename(filePath);
   const ext = path.extname(filePath);
 
@@ -194,8 +197,8 @@ export const checkControllerViewContract = (filePath, relativePath, content, vio
   }
 };
 
-export const checkExtendedTextPatterns = (content, lines, relativePath, filePath, violations) => {
-  checkMoleculeCoLocatedTest(filePath, relativePath, violations);
+export const checkExtendedTextPatterns = (content, lines, relativePath, filePath, violations, config = {}) => {
+  checkMoleculeCoLocatedTest(filePath, relativePath, violations, config);
   checkControllerViewContract(filePath, relativePath, content, violations);
 
   const isTestFile = /\.(test|spec)\.[jt]sx?$/.test(filePath)