@rigour-labs/core 4.2.1 → 4.2.3

package/dist/deep/verifier.js

@@ -94,32 +94,49 @@ function verifyFinding(finding, factsByPath) {
                 };
             }
             return { ...finding, verified: finding.confidence >= 0.4, verificationNotes: 'Accepted on confidence' };
-        // ── Categories verified by file existence + reasonable confidence ──
-        case 'dry_violation':
-        case 'copy_paste_code':
-        case 'data_clump':
+        // ── Entity-name-verified categories (Tier 1) ──
+        // LLM must reference a real class/struct/function name — drops hallucinated entities
+        case 'lazy_class':
+            return verifyLazyClass(finding, fileFacts);
         case 'feature_envy':
-        case 'shotgun_surgery':
-        case 'inappropriate_intimacy':
         case 'primitive_obsession':
-        case 'lazy_class':
         case 'speculative_generality':
         case 'refused_bequest':
-        case 'architecture':
-        case 'circular_dependency':
-        case 'package_cohesion':
-        case 'api_design':
         case 'missing_abstraction':
-        case 'language_idiom':
-        case 'naming_convention':
+        case 'api_design':
+            return verifyEntityNameRequired(finding, fileFacts);
+        // ── Structural precondition categories (Tier 2) ──
         case 'dead_code':
-        case 'code_smell':
-        case 'performance':
+            return verifyDeadCode(finding, fileFacts, factsByPath);
+        case 'naming_convention':
+            return verifyNamingConvention(finding, fileFacts);
         case 'hardcoded_config':
+            return verifyHardcodedConfig(finding, fileFacts);
+        case 'data_clump':
+            return verifyDataClump(finding, fileFacts);
+        case 'performance':
+            return verifyPerformance(finding, fileFacts);
+        // ── Cross-file graph categories (Tier 3) ──
+        case 'circular_dependency':
+            return verifyCircularDependency(finding, fileFacts, factsByPath);
+        case 'dry_violation':
+        case 'copy_paste_code':
+            return verifyDryViolation(finding, fileFacts, factsByPath);
+        case 'shotgun_surgery':
+            return verifyShotgunSurgery(finding, fileFacts, factsByPath);
+        case 'inappropriate_intimacy':
+            return verifyInappropriateIntimacy(finding, fileFacts, factsByPath);
+        // ── Confidence-floor categories (Tier 4) — raised from 0.3 → 0.5 ──
+        case 'architecture':
+        case 'package_cohesion':
+        case 'code_smell':
+        case 'language_idiom':
             return {
                 ...finding,
-                verified: finding.confidence >= 0.3,
-                verificationNotes: finding.confidence < 0.3 ? 'Low confidence' : 'File exists, accepted',
+                verified: finding.confidence >= 0.5,
+                verificationNotes: finding.confidence < 0.5
+                    ? `Low confidence (${finding.confidence}) — requires >= 0.5 for ${finding.category}`
+                    : `Accepted at confidence ${finding.confidence} (threshold: 0.5)`,
             };
         default:
             // Unknown category — accept if file exists and confidence is reasonable
@@ -344,6 +361,498 @@ function verifyTestFinding(finding, facts) {
         verificationNotes: 'Accepted on confidence',
     };
 }
+// ════════════════════════════════════════════════════════════════════════
+// Tier 1: Entity-name-verified categories
+// LLM must reference a real class/struct/function — hallucinated names are dropped
+// ════════════════════════════════════════════════════════════════════════
+/**
+ * Verify lazy_class: class/struct must exist AND have few methods.
+ * A "lazy class" that doesn't exist is a hallucination.
+ */
+function verifyLazyClass(finding, facts) {
+    const entities = [
+        ...facts.classes.map(c => ({ name: c.name, methodCount: c.methodCount, lineCount: c.lineCount })),
+        ...(facts.structs || []).map(s => ({ name: s.name, methodCount: s.methodCount, lineCount: s.lineCount })),
+    ];
+    if (entities.length === 0) {
+        return { ...finding, verified: false, verificationNotes: 'No classes or structs found — cannot verify lazy class' };
+    }
+    const entityName = extractEntityName(finding.description, entities.map(e => e.name));
+    if (!entityName) {
+        // LLM didn't reference a specific name — only accept if high confidence
+        return {
+            ...finding,
+            verified: finding.confidence >= 0.6,
+            verificationNotes: 'No entity name found in description — requires high confidence',
+        };
+    }
+    const entity = entities.find(e => e.name === entityName);
+    if (!entity) {
+        return { ...finding, verified: false, verificationNotes: `Entity "${entityName}" not found in ${facts.path}` };
+    }
+    // Lazy class = too few methods for its existence
+    if (entity.methodCount >= 4 && entity.lineCount >= 50) {
+        return {
+            ...finding,
+            verified: false,
+            verificationNotes: `"${entityName}" has ${entity.methodCount} methods, ${entity.lineCount} lines — not lazy`,
+        };
+    }
+    return {
+        ...finding,
+        verified: true,
+        verificationNotes: `"${entityName}" has only ${entity.methodCount} methods, ${entity.lineCount} lines — lazy class confirmed`,
+    };
+}
+/**
+ * Generic entity-name verification for design smell categories.
+ * Requires the LLM to reference a real function/class/struct name.
+ */
+function verifyEntityNameRequired(finding, facts) {
+    const allNames = [
+        ...facts.classes.map(c => c.name),
+        ...(facts.structs || []).map(s => s.name),
+        ...facts.functions.map(f => f.name),
+    ];
+    if (allNames.length === 0) {
+        return { ...finding, verified: false, verificationNotes: 'No entities found in file' };
+    }
+    const entityName = extractEntityName(finding.description, allNames);
+    if (entityName) {
+        return {
+            ...finding,
+            verified: finding.confidence >= 0.3,
+            verificationNotes: `Entity "${entityName}" exists — ${finding.category} accepted`,
+        };
+    }
+    // LLM didn't name a specific entity — require higher confidence
+    return {
+        ...finding,
+        verified: finding.confidence >= 0.6,
+        verificationNotes: `No entity name matched in description — requires confidence >= 0.6 for ${finding.category}`,
+    };
+}
+// ════════════════════════════════════════════════════════════════════════
+// Tier 2: Structural precondition categories
+// ════════════════════════════════════════════════════════════════════════
+/**
+ * Verify dead_code: function/export must exist AND not be referenced by other files.
+ */
+function verifyDeadCode(finding, facts, factsByPath) {
+    const allNames = [
+        ...facts.functions.map(f => f.name),
+        ...facts.exports,
+        ...facts.classes.map(c => c.name),
+    ];
+    const entityName = extractEntityName(finding.description, allNames);
+    if (!entityName) {
+        return {
+            ...finding,
+            verified: finding.confidence >= 0.6,
+            verificationNotes: 'No entity name found — requires high confidence for dead code',
+        };
+    }
+    // Check if the entity is referenced in any other file's imports
+    let referencedExternally = false;
+    for (const [otherPath, otherFacts] of factsByPath) {
+        if (otherPath === facts.path)
+            continue;
+        // Check if any import in other files references this entity or this file
+        for (const imp of otherFacts.imports) {
+            if (imp.includes(entityName)) {
+                referencedExternally = true;
+                break;
+            }
+        }
+        if (referencedExternally)
+            break;
+    }
+    if (referencedExternally) {
+        return {
+            ...finding,
+            verified: false,
+            verificationNotes: `"${entityName}" is imported by other files — not dead code`,
+        };
+    }
+    // Check if the entity is exported (could be used externally)
+    const func = facts.functions.find(f => f.name === entityName);
+    if (func?.isExported) {
+        // Exported but no internal references — might be a public API
+        return {
+            ...finding,
+            verified: finding.confidence >= 0.5,
+            verificationNotes: `"${entityName}" is exported but unreferenced — possible dead public API`,
+        };
+    }
+    return {
+        ...finding,
+        verified: true,
+        verificationNotes: `"${entityName}" exists and is not referenced externally — dead code confirmed`,
+    };
+}
+/**
+ * Verify naming_convention: check the referenced name against language-specific patterns.
+ */
+function verifyNamingConvention(finding, facts) {
+    const allNames = [
+        ...facts.classes.map(c => c.name),
+        ...(facts.structs || []).map(s => s.name),
+        ...facts.functions.map(f => f.name),
+    ];
+    const entityName = extractEntityName(finding.description, allNames);
+    if (!entityName) {
+        return {
+            ...finding,
+            verified: finding.confidence >= 0.6,
+            verificationNotes: 'No entity name found — requires high confidence for naming convention',
+        };
+    }
+    // Language-specific naming convention checks
+    let violatesConvention = false;
+    let reason = '';
+    switch (facts.language) {
+        case 'go':
+            // Go: exported = PascalCase, unexported = camelCase. Common violation: snake_case
+            if (entityName.includes('_') && !entityName.startsWith('_') && entityName !== entityName.toUpperCase()) {
+                violatesConvention = true;
+                reason = 'Go names should use MixedCaps, not snake_case';
+            }
+            break;
+        case 'python':
+            // Python: functions/variables = snake_case, classes = PascalCase
+            if (facts.functions.some(f => f.name === entityName)) {
+                // Function — should be snake_case
+                if (entityName !== entityName.toLowerCase() && /[A-Z]/.test(entityName) && !entityName.startsWith('_')) {
+                    violatesConvention = true;
+                    reason = 'Python functions should be snake_case';
+                }
+            }
+            else if (facts.classes.some(c => c.name === entityName)) {
+                // Class — should be PascalCase
+                if (entityName.includes('_') && entityName !== entityName.toUpperCase()) {
+                    violatesConvention = true;
+                    reason = 'Python classes should be PascalCase';
+                }
+            }
+            break;
+        case 'typescript':
+        case 'javascript':
+            // JS/TS: functions = camelCase, classes = PascalCase
+            if (facts.functions.some(f => f.name === entityName)) {
+                if (entityName.includes('_') && entityName !== entityName.toUpperCase()) {
+                    violatesConvention = true;
+                    reason = 'JS/TS functions should be camelCase';
+                }
+            }
+            break;
+        default:
+            // No language-specific check — fall back to confidence
+            return {
+                ...finding,
+                verified: finding.confidence >= 0.5,
+                verificationNotes: `No naming rules for ${facts.language} — accepted on confidence`,
+            };
+    }
+    if (!violatesConvention) {
+        return {
+            ...finding,
+            verified: false,
+            verificationNotes: `"${entityName}" follows ${facts.language} naming conventions — false positive`,
+        };
+    }
+    return {
+        ...finding,
+        verified: true,
+        verificationNotes: `"${entityName}" — ${reason}`,
+    };
+}
+/**
+ * Verify hardcoded_config: file must have sufficient magic numbers or string constants.
+ */
+function verifyHardcodedConfig(finding, facts) {
+    const hasMagicNumbers = (facts.magicNumbers || 0) > 2;
+    const isTestFile = facts.hasTests;
+    // Don't flag test files for hardcoded config — test data is expected
+    if (isTestFile) {
+        return {
+            ...finding,
+            verified: false,
+            verificationNotes: 'Test files are expected to have hardcoded values',
+        };
+    }
+    if (hasMagicNumbers) {
+        return {
+            ...finding,
+            verified: true,
+            verificationNotes: `File has ${facts.magicNumbers} magic numbers — hardcoded config likely`,
+        };
+    }
+    // No magic numbers detected by AST — require higher LLM confidence
+    return {
+        ...finding,
+        verified: finding.confidence >= 0.6,
+        verificationNotes: `No magic numbers detected by AST (${facts.magicNumbers || 0}) — requires confidence >= 0.6`,
+    };
+}
+/**
+ * Verify data_clump: multiple functions must share 3+ similar parameter names.
+ */
+function verifyDataClump(finding, facts) {
+    if (facts.functions.length < 2) {
+        return { ...finding, verified: false, verificationNotes: 'Need multiple functions to detect data clump' };
+    }
+    // Check if any pair of functions shares 3+ parameter names
+    let maxSharedParams = 0;
+    let clumpPair = '';
+    for (let i = 0; i < facts.functions.length; i++) {
+        for (let j = i + 1; j < facts.functions.length; j++) {
+            const paramsA = new Set(facts.functions[i].params.map(p => p.replace(/[:\s].*/, '').trim().toLowerCase()));
+            const paramsB = new Set(facts.functions[j].params.map(p => p.replace(/[:\s].*/, '').trim().toLowerCase()));
+            const shared = [...paramsA].filter(p => paramsB.has(p) && p.length > 1).length;
+            if (shared > maxSharedParams) {
+                maxSharedParams = shared;
+                clumpPair = `${facts.functions[i].name} & ${facts.functions[j].name}`;
+            }
+        }
+    }
+    if (maxSharedParams >= 3) {
+        return {
+            ...finding,
+            verified: true,
+            verificationNotes: `${clumpPair} share ${maxSharedParams} parameters — data clump confirmed`,
+        };
+    }
+    return {
+        ...finding,
+        verified: false,
+        verificationNotes: `Max shared params between any function pair: ${maxSharedParams} (need >= 3)`,
+    };
+}
+/**
+ * Verify performance: function must be non-trivial (> 20 lines or has deep nesting).
+ */
+function verifyPerformance(finding, facts) {
+    const entityName = extractEntityName(finding.description, facts.functions.map(f => f.name));
+    if (entityName) {
+        const func = facts.functions.find(f => f.name === entityName);
+        if (!func) {
+            return { ...finding, verified: false, verificationNotes: `Function "${entityName}" not found` };
+        }
+        if (func.lineCount < 10) {
+            return {
+                ...finding,
+                verified: false,
+                verificationNotes: `Function "${entityName}" is only ${func.lineCount} lines — unlikely performance issue`,
+            };
+        }
+        return {
+            ...finding,
+            verified: true,
+            verificationNotes: `Function "${entityName}" is ${func.lineCount} lines — performance review accepted`,
+        };
+    }
+    // No specific function referenced — check file-level
+    if (facts.lineCount < 50) {
+        return {
+            ...finding,
+            verified: false,
+            verificationNotes: `File is only ${facts.lineCount} lines — unlikely performance hotspot`,
+        };
+    }
+    return {
+        ...finding,
+        verified: finding.confidence >= 0.5,
+        verificationNotes: `No specific function referenced — accepted at confidence >= 0.5`,
+    };
+}
+// ════════════════════════════════════════════════════════════════════════
+// Tier 3: Cross-file graph verification
+// ════════════════════════════════════════════════════════════════════════
+/**
+ * Verify circular_dependency: build import graph and check if a cycle actually exists.
+ */
+function verifyCircularDependency(finding, facts, factsByPath) {
+    // Extract the other file(s) mentioned in the finding description
+    const mentionedPaths = [];
+    for (const [p] of factsByPath) {
+        const baseName = p.split('/').pop() || '';
+        const dirName = p.split('/').slice(-2).join('/');
+        if (finding.description.includes(baseName) || finding.description.includes(dirName) || finding.description.includes(p)) {
+            if (p !== facts.path)
+                mentionedPaths.push(p);
+        }
+    }
+    if (mentionedPaths.length === 0) {
+        // LLM didn't reference a specific file — require high confidence
+        return {
+            ...finding,
+            verified: finding.confidence >= 0.6,
+            verificationNotes: 'No specific file path mentioned in description — requires confidence >= 0.6',
+        };
+    }
+    // Check for actual bidirectional imports
+    for (const otherPath of mentionedPaths) {
+        const otherFacts = factsByPath.get(otherPath);
+        if (!otherFacts)
+            continue;
+        const thisImportsOther = facts.imports.some(imp => otherPath.includes(imp.replace(/\./g, '/')) || imp.includes(otherPath.replace(/\//g, '.').replace(/\.\w+$/, '')));
+        const otherImportsThis = otherFacts.imports.some(imp => facts.path.includes(imp.replace(/\./g, '/')) || imp.includes(facts.path.replace(/\//g, '.').replace(/\.\w+$/, '')));
+        if (thisImportsOther && otherImportsThis) {
+            return {
+                ...finding,
+                verified: true,
+                verificationNotes: `Circular import confirmed: ${facts.path} ↔ ${otherPath}`,
+            };
+        }
+    }
+    // Check generic: does the current file import something that imports it back?
+    const thisFileModules = new Set(facts.imports);
+    for (const [otherPath, otherFacts] of factsByPath) {
+        if (otherPath === facts.path)
+            continue;
+        const otherImportsThis = otherFacts.imports.some(imp => {
+            const normalized = facts.path.replace(/\.\w+$/, '').replace(/\//g, '/');
+            return normalized.endsWith(imp.replace(/\./g, '/')) || imp.endsWith(normalized);
+        });
+        if (otherImportsThis) {
+            const thisImportsOther = facts.imports.some(imp => {
+                const normalized = otherPath.replace(/\.\w+$/, '').replace(/\//g, '/');
+                return normalized.endsWith(imp.replace(/\./g, '/')) || imp.endsWith(normalized);
+            });
+            if (thisImportsOther) {
+                return {
+                    ...finding,
+                    verified: true,
+                    verificationNotes: `Circular import found: ${facts.path} ↔ ${otherPath}`,
+                };
+            }
+        }
+    }
+    return {
+        ...finding,
+        verified: false,
+        verificationNotes: 'No circular dependency found in import graph',
+    };
+}
+/**
+ * Verify dry_violation / copy_paste_code: check for functions with similar signatures across files.
+ */
+function verifyDryViolation(finding, facts, factsByPath) {
+    // Extract referenced function name
+    const entityName = extractEntityName(finding.description, facts.functions.map(f => f.name));
+    if (entityName) {
+        const func = facts.functions.find(f => f.name === entityName);
+        if (!func) {
+            return { ...finding, verified: false, verificationNotes: `Function "${entityName}" not found` };
+        }
+        // Check if a similar function exists in another file
+        for (const [otherPath, otherFacts] of factsByPath) {
+            if (otherPath === facts.path)
+                continue;
+            for (const otherFunc of otherFacts.functions) {
+                // Similar if: same name, or similar param count and line count
+                const nameSimilar = otherFunc.name === func.name
+                    || otherFunc.name.toLowerCase() === func.name.toLowerCase();
+                const structSimilar = Math.abs(otherFunc.paramCount - func.paramCount) <= 1
+                    && Math.abs(otherFunc.lineCount - func.lineCount) <= 5
+                    && func.lineCount > 5;
+                if (nameSimilar || structSimilar) {
+                    return {
+                        ...finding,
+                        verified: true,
+                        verificationNotes: `"${entityName}" (${func.lineCount} lines) similar to "${otherFunc.name}" in ${otherPath} (${otherFunc.lineCount} lines)`,
+                    };
+                }
+            }
+        }
+        return {
+            ...finding,
+            verified: false,
+            verificationNotes: `No similar function found across files for "${entityName}"`,
+        };
+    }
+    // No function name — require high confidence
+    return {
+        ...finding,
+        verified: finding.confidence >= 0.6,
+        verificationNotes: 'No entity name found in DRY violation — requires confidence >= 0.6',
+    };
+}
+/**
+ * Verify shotgun_surgery: an entity should be referenced/imported by many files (>= 4).
+ */
+function verifyShotgunSurgery(finding, facts, factsByPath) {
+    const allNames = [
+        ...facts.classes.map(c => c.name),
+        ...(facts.structs || []).map(s => s.name),
+        ...facts.functions.filter(f => f.isExported).map(f => f.name),
+    ];
+    const entityName = extractEntityName(finding.description, allNames);
+    if (!entityName) {
+        return {
+            ...finding,
+            verified: finding.confidence >= 0.6,
+            verificationNotes: 'No entity name found — requires high confidence for shotgun surgery',
+        };
+    }
+    // Count how many other files reference this entity
+    let importerCount = 0;
+    for (const [otherPath, otherFacts] of factsByPath) {
+        if (otherPath === facts.path)
+            continue;
+        if (otherFacts.imports.some(imp => imp.includes(entityName))) {
+            importerCount++;
+        }
+    }
+    if (importerCount >= 4) {
+        return {
+            ...finding,
+            verified: true,
+            verificationNotes: `"${entityName}" is imported by ${importerCount} files — shotgun surgery confirmed`,
+        };
+    }
+    return {
+        ...finding,
+        verified: false,
+        verificationNotes: `"${entityName}" only imported by ${importerCount} files (need >= 4 for shotgun surgery)`,
+    };
+}
+/**
+ * Verify inappropriate_intimacy: two modules must have bidirectional imports.
+ */
+function verifyInappropriateIntimacy(finding, facts, factsByPath) {
+    // Look for bidirectional import relationships from this file
+    let biDirectionalCount = 0;
+    let biDirectionalPartner = '';
+    for (const [otherPath, otherFacts] of factsByPath) {
+        if (otherPath === facts.path)
+            continue;
+        const thisImportsOther = facts.imports.some(imp => {
+            const otherModule = otherPath.replace(/\.\w+$/, '');
+            return otherModule.endsWith(imp.replace(/\./g, '/')) || imp.endsWith(otherModule.split('/').pop() || '');
+        });
+        const otherImportsThis = otherFacts.imports.some(imp => {
+            const thisModule = facts.path.replace(/\.\w+$/, '');
+            return thisModule.endsWith(imp.replace(/\./g, '/')) || imp.endsWith(thisModule.split('/').pop() || '');
+        });
+        if (thisImportsOther && otherImportsThis) {
+            biDirectionalCount++;
+            biDirectionalPartner = otherPath;
+        }
+    }
+    if (biDirectionalCount > 0) {
+        return {
+            ...finding,
+            verified: true,
+            verificationNotes: `Bidirectional import with ${biDirectionalPartner} — inappropriate intimacy confirmed`,
+        };
+    }
+    return {
+        ...finding,
+        verified: false,
+        verificationNotes: 'No bidirectional import relationships found',
+    };
+}
 /**
  * Try to find a known entity name referenced in a description string.
  */

package/dist/deep/verifier.test.js

@@ -441,26 +441,147 @@ describe('Verifier', () => {
             expect(result).toHaveLength(0);
         });
     });
-    // ── Confidence-based categories ──
-    describe('confidence-based verification', () => {
-        const confidenceCategories = [
-            'dry_violation', 'feature_envy', 'architecture',
-            'naming_convention', 'dead_code', 'performance',
-        ];
-        for (const category of confidenceCategories) {
-            it(`should accept ${category} with confidence >= 0.3`, () => {
-                const findings = [makeFinding({ category, confidence: 0.5 })];
-                const facts = [makeFileFacts()];
-                const result = verifyFindings(findings, facts);
-                expect(result).toHaveLength(1);
-            });
-            it(`should reject ${category} with low confidence`, () => {
-                const findings = [makeFinding({ category, confidence: 0.1 })];
-                const facts = [makeFileFacts()];
-                const result = verifyFindings(findings, facts);
-                expect(result).toHaveLength(0);
-            });
-        }
+    // ── Structurally-verified categories ──
+    // After verifier hardening, these categories use entity names, cross-file
+    // checks, or raised confidence floors — not just confidence >= 0.3.
+    describe('structurally-verified categories', () => {
+        // Tier 1: Entity-name required — accepts when entity name matches
+        it('should accept feature_envy when entity name exists in file', () => {
+            const findings = [makeFinding({
+                    category: 'feature_envy',
+                    description: 'The processData function accesses too many external modules',
+                    confidence: 0.5,
+                })];
+            const facts = [makeFileFacts()];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(1);
+        });
+        it('should reject feature_envy with no entity name and low confidence', () => {
+            const findings = [makeFinding({
+                    category: 'feature_envy',
+                    description: 'Some function accesses external modules',
+                    confidence: 0.3,
+                })];
+            const facts = [makeFileFacts()];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(0); // No entity name → needs confidence >= 0.6
+        });
+        // Tier 2: dead_code — needs entity unreferenced externally
+        it('should accept dead_code when entity is unreferenced', () => {
+            const findings = [makeFinding({
+                    category: 'dead_code',
+                    description: 'processData is never called',
+                    confidence: 0.5,
+                })];
+            // Only one file — processData can't be imported by other files
+            const facts = [makeFileFacts()];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(1);
+        });
+        it('should reject dead_code when entity is imported by another file', () => {
+            const findings = [makeFinding({
+                    category: 'dead_code',
+                    description: 'processData is never called',
+                    confidence: 0.9,
+                })];
+            const facts = [
+                makeFileFacts(),
+                makeFileFacts({
+                    path: 'src/consumer.ts',
+                    imports: ['./service', 'processData'], // References the entity
+                }),
+            ];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(0); // Entity is referenced — not dead code
+        });
+        // Tier 2: naming_convention — checks actual language rules
+        it('should accept naming_convention when name violates rules', () => {
+            const findings = [makeFinding({
+                    category: 'naming_convention',
+                    file: 'pkg/utils.go',
+                    description: 'get_user_name uses snake_case instead of MixedCaps',
+                    confidence: 0.5,
+                })];
+            const facts = [makeFileFacts({
+                    path: 'pkg/utils.go',
+                    language: 'go',
+                    functions: [{
+                            name: 'get_user_name',
+                            lineStart: 10, lineEnd: 30, lineCount: 20,
+                            paramCount: 1, params: ['id'],
+                            maxNesting: 1, hasReturn: true, isAsync: false, isExported: false,
+                        }],
+                })];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(1);
+            expect(result[0].verified).toBe(true);
+        });
+        it('should reject naming_convention when name follows rules', () => {
+            const findings = [makeFinding({
+                    category: 'naming_convention',
+                    description: 'processData naming issue',
+                    confidence: 0.8,
+                })];
+            const facts = [makeFileFacts()]; // processData is camelCase — correct for TS
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(0); // Name follows conventions → FP
+        });
+        // Tier 2: performance — needs non-trivial function
+        it('should accept performance when function is substantial', () => {
+            const findings = [makeFinding({
+                    category: 'performance',
+                    description: 'processData has O(n²) complexity',
+                    confidence: 0.5,
+                })];
+            const facts = [makeFileFacts()]; // processData is 70 lines
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(1);
+        });
+        // Tier 3: dry_violation — needs cross-file similarity
+        it('should accept dry_violation when similar function exists in another file', () => {
+            const findings = [makeFinding({
+                    category: 'dry_violation',
+                    description: 'processData is duplicated across files',
+                    confidence: 0.5,
+                })];
+            const facts = [
+                makeFileFacts(),
+                makeFileFacts({
+                    path: 'src/other.ts',
+                    functions: [{
+                            name: 'processData', // Same name = similar
+                            lineStart: 10, lineEnd: 80, lineCount: 70,
+                            paramCount: 5, params: ['a', 'b', 'c', 'd', 'e'],
+                            maxNesting: 3, hasReturn: true, isAsync: true, isExported: true,
+                        }],
+                }),
+            ];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(1);
+        });
+        it('should reject dry_violation when no similar function exists', () => {
+            const findings = [makeFinding({
+                    category: 'dry_violation',
+                    description: 'processData is duplicated',
+                    confidence: 0.5,
+                })];
+            const facts = [makeFileFacts()]; // Only one file — no cross-file match
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(0);
+        });
+        // Tier 4: Confidence floor raised to 0.5
+        it('should accept architecture with confidence >= 0.5', () => {
+            const findings = [makeFinding({ category: 'architecture', confidence: 0.6 })];
+            const facts = [makeFileFacts()];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(1);
+        });
+        it('should reject architecture with confidence < 0.5', () => {
+            const findings = [makeFinding({ category: 'architecture', confidence: 0.4 })];
+            const facts = [makeFileFacts()];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(0);
+        });
     });
     // ── Resource leak (Go-specific) ──
     describe('resource leak verification', () => {
@@ -502,13 +623,13 @@ describe('Verifier', () => {
                 makeFinding({ category: 'god_function', file: 'nonexistent.ts' }), // Should fail (no file)
                 makeFinding({ category: 'long_file' }), // Should fail (300 lines, need >300)
                 makeFinding({ category: 'magic_number' }), // Should fail (no magicNumbers set)
-                makeFinding({ category: 'dry_violation', confidence: 0.1 }), // Should fail (low confidence)
-                makeFinding({ category: 'dry_violation', confidence: 0.5 }), // Should pass
+                makeFinding({ category: 'architecture', confidence: 0.1 }), // Should fail (below 0.5 floor)
+                makeFinding({ category: 'architecture', confidence: 0.6 }), // Should pass (above 0.5 floor)
             ];
             const facts = [makeFileFacts()];
             const result = verifyFindings(findings, facts);
             const verified = result.filter(r => r.verified);
-            expect(verified.length).toBeGreaterThanOrEqual(2); // god_class, dry_violation(0.5)
+            expect(verified.length).toBeGreaterThanOrEqual(2); // god_class, architecture(0.6)
         });
     });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "4.2.1",
+  "version": "4.2.3",
   "description": "Deterministic quality gate engine for AI-generated code. AST analysis, drift detection, and Fix Packet generation across TypeScript, JavaScript, Python, Go, Ruby, and C#.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -59,11 +59,11 @@
     "@xenova/transformers": "^2.17.2",
     "better-sqlite3": "^11.0.0",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-x64": "4.2.1",
-    "@rigour-labs/brain-linux-arm64": "4.2.1",
-    "@rigour-labs/brain-linux-x64": "4.2.1",
-    "@rigour-labs/brain-darwin-arm64": "4.2.1",
-    "@rigour-labs/brain-win-x64": "4.2.1"
+    "@rigour-labs/brain-darwin-arm64": "4.2.3",
+    "@rigour-labs/brain-darwin-x64": "4.2.3",
+    "@rigour-labs/brain-linux-arm64": "4.2.3",
+    "@rigour-labs/brain-linux-x64": "4.2.3",
+    "@rigour-labs/brain-win-x64": "4.2.3"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.12",