euthyna 0.4.1 → 0.6.0

package/.agents/skills/euthyna/references/fact-producers.md

@@ -146,14 +146,31 @@ node <euthyna 仓库>/bin/euthyna.js coverage `
   --symbol <符号名> --symbol <符号名>
 ```
 
-`--symbol` 可重复，一次查多个。加 `--file` 可限定到某个文件。
+`--symbol` 可重复，一次查多个。加 `--file` 可限定到某个文件。Go profile 另需 `--source`
+（见下）。
 
-**两种覆盖率格式都读**（自动识别，无需参数）：
+**三种覆盖率格式都读**（自动识别，无需参数）：
 
 | 格式 | 来源 | 说明 |
 |---|---|---|
 | c8 / v8-to-istanbul `coverage-final.json` | JS 项目（c8 默认落在 `coverage/coverage-final.json`） | 每文件有 `fnMap` + `f`（调用计数数组） |
 | coverage.py JSON（format 3） | Python 项目（`coverage json` 产出） | 顶层 `{meta, files}`；`functions` 里「函数名 → 已执行行列表」，**无调用计数**。从未调用的函数仍在列表中且 `executed_lines` 为空 |
+| Go `-coverprofile`（文本） | Go 项目（`go test -coverprofile` 产出） | `mode:` 头 + 每区块一行 `路径:起始行.列,结束行.列 语句数 命中数`，**无函数名**。必须加 `--source <模块根目录>`：产出器读源码里的顶层 `func` 把行区间映射回函数 |
+
+Go 的产出命令（Go 目标）：
+```bash
+go test ./包路径/ -coverprofile=<绝对路径>.out -run <测试名>
+node <euthyna 仓库>/bin/euthyna.js coverage `
+  --coverage <绝对路径>.out --symbol <符号名> --source <Go 模块根目录>
+```
+
+> Go 专属注意事项（在 act 案例研究中实测）：
+> 1. **文件不在 profile 里 ≠ 未执行**——该文件所在的包可能根本没被编译进测试二进制。
+>    产出器把这种情况报为「未评估」，绝不当「未被覆盖」。要测到某个包，用
+>    `-coverpkg=<包>` 或直接运行对应包的测试。
+> 2. profile 路径是模块导入路径（`module/pkg/file.go`）；`--source` 指向含 go.mod 的
+>    模块根，产出器据此把导入路径映射回磁盘文件。
+> 3. `mode: set` 就够用——两态语义（调用过/从未调用）不需要 `count`/`atomic` 的精确计数。
 
 coverage.py 的产出命令（Python 目标）：
 ```powershell

package/.agents/skills/euthyna/references/verification-gates.md

@@ -291,3 +291,8 @@ Gate Review（被 P5 阻塞）: 6 门禁评估 → 裁定
 2. TRUE POSITIVE 列表：每条附简要漏洞描述
 3. FALSE POSITIVE 列表：每条附简要拒绝理由
 4. INCONCLUSIVE 列表：**每条附缺什么、为什么缺**
+
+5. **可触发性不能当驳回的承担者。** 靠「这条路径走不到／不会被执行／是死代码」来排除一条断言时：
+   - coverage 的两个出口都承担不了这个论证。**ESTABLISHED（从未被调用，含「文件未出现在覆盖率数据里」这一出口）只记录「本次运行未执行」**——可以写进证据栏作佐证，但它证明不了「不可能触发」；**UNKNOWN「符号未定位」等于没拿到覆盖事实**。
+   - 没有覆盖事实时，支撑该论证的那道门禁记**未评估**，原因写 `coverage=not-measured`。未评估是这道门禁的**完成态**，不是跳过：其余门禁照常全部评完。此后按折叠走——任一其他门禁 FAIL， FALSE POSITIVE 由那道 FAIL 承担（其论证不得依赖可触发性）；没有其他 FAIL，就是 INCONCLUSIVE。
+   - **因此依赖可触发性的 FALSE POSITIVE 只有一种合法形态**：另有一条不依赖可触发性的证伪在支撑它——数据流上根本不可能（参数硬编码、无攻击者可控输入），或 PoC 直接证否。覆盖率对这类论证既不增加也不减少，本条不适用。「这条路径没有触发」永远不等于「这条路径不可能触发」。

package/.agents/skills/euthyna-en/references/fact-producers.md

@@ -135,13 +135,33 @@ node <euthyna repo>/bin/euthyna.js coverage `
 ```
 
 `--symbol` is repeatable — query several at once. Add `--file` to restrict to a single file.
+Go profiles additionally need `--source` (see below).
 
-**Both coverage formats are read** (auto-detected, no parameters needed):
+**Three coverage formats are read** (auto-detected, no parameters needed):
 
 | Format | Source | Notes |
 |---|---|---|
 | c8 / v8-to-istanbul `coverage-final.json` | JS projects (c8 lands at `coverage/coverage-final.json` by default) | Per-file `fnMap` + `f` (invocation-count array) |
 | coverage.py JSON (format 3) | Python projects (produced by `coverage json`) | Top-level `{meta, files}`; in `functions`, "function name → list of executed lines", **no invocation counts**. Functions never called are still in the list with empty `executed_lines` |
+| Go `-coverprofile` (text) | Go projects (produced by `go test -coverprofile`) | A `mode:` header plus one line per block (`path:startL.startC,endL.endC stmts count`), **no function names**. `--source <module root>` is required: the producer reads top-level `func` declarations in the source to map line ranges back to functions |
+
+The Go production commands (Go targets):
+
+```bash
+go test ./<package>/ -coverprofile=<absolute path>.out -run <test name>
+node <euthyna repo>/bin/euthyna.js coverage `
+  --coverage <absolute path>.out --symbol <symbol> --source <Go module root>
+```
+
+> Go-specific notes (measured in the act case study):
+> 1. **A file absent from the profile is not "never executed"** — its package may not have
+>    been compiled into the test binary at all. The producer reports this as "not evaluated",
+>    never as "not covered". To measure a package, use `-coverpkg=<package>` or run that
+>    package's tests directly.
+> 2. Profile paths are module import paths (`module/pkg/file.go`); point `--source` at the
+>    module root containing go.mod, and the producer maps import paths back to disk files.
+> 3. `mode: set` is enough — the two-state semantics (invoked / never invoked) do not need
+>    the exact counts of `count`/`atomic`.
 
 The coverage.py production commands (Python targets):
 

package/.agents/skills/euthyna-en/references/verification-gates.md

@@ -289,3 +289,8 @@ When there are multiple suspected bugs:
 2. TRUE POSITIVE list: each with a brief vulnerability description
 3. FALSE POSITIVE list: each with a brief rejection reason
 4. INCONCLUSIVE list: **each with what is missing and why**
+
+5. **Triggerability cannot carry a dismissal.** When a claim is excluded because "this path cannot be reached / never runs / is dead code":
+   - Neither outlet of the coverage producer can carry that argument. **ESTABLISHED (never invoked — including the "file does not appear in the coverage data" outlet) records only "not exercised in this run"**: it may sit in the evidence column as corroboration, but it proves nothing about whether the path *can* fire; **the UNKNOWN "symbol not located" is the absence of a coverage fact**.
+   - When no coverage fact was obtained, the gate that would carry the argument is recorded **NOT EVALUATED** with the reason `coverage=not-measured`. Not-evaluated is that gate's **completed state**, not a skipped step: every other gate is still evaluated in full. The verdict then follows the folding — any other gate FAILs and the FALSE POSITIVE is carried by that gate (whose own argument must not rest on triggerability); with no other FAIL, the verdict is INCONCLUSIVE.
+   - **So a triggerability-based FALSE POSITIVE has exactly one legal form**: some refutation that does not rest on triggerability carries it — impossibility by data flow (hardcoded arguments, no attacker-controlled input), or a PoC that disproves it directly. Coverage adds nothing to and takes nothing from such an argument, and this rule does not apply to it. "This path did not fire" is never "this path cannot fire".

package/.cursor/commands/euthyna.md

@@ -0,0 +1,14 @@
+# /euthyna — 代码安全审计（判定纪律）
+
+你在 Cursor 中调用本命令。**把审计目标（文件、目录、PR 描述或 diff 范围）用 @ 引用或直接写在命令后面。**
+
+按 euthyna 技能执行一次完整审计：
+
+1. **先加载纪律**：找到 euthyna 技能目录（`~/.cursor/skills/euthyna/`、项目 `.cursor/skills/euthyna/`，或 npm 全局包内的 `.agents/skills/euthyna/`），读 `SKILL.md`，需要时再读 `references/`。找不到就明说「技能缺失」，不要凭印象执行。
+2. **按入口决策树走**：单条漏洞结论 → 阶段 C；一次变更 → 阶段 B；依赖面 → 阶段 A；整体审计 → 阶段 B 为主。
+3. **先测量再读码**：第一条命令跑 `euthyna audit --base <分叉点> --repo <被审计仓库>`（history + deps 一次跑完）；谈测试覆盖再跑 `coverage`（操作手册在 `references/fact-producers.md`）。
+4. **每条结论过六道门禁**：证据到 `文件:行号`、可复现命令、影响说明；拿不出证据的降级为「观察」。
+5. **三态裁定**：`BUG #N TRUE POSITIVE / FALSE POSITIVE / INCONCLUSIVE`。
+6. **报告落盘**：`<项目>_EUTHYNA_AUDIT_<日期>.md`，并跑 `euthyna gate <报告>` 校验（退出码 0 才算过）。
+
+CLI 未安装时先 `npm install -g euthyna`，或每次用 `npx euthyna <子命令> …`。

package/.github/prompts/euthyna.prompt.md

@@ -0,0 +1,16 @@
+---
+description: 代码安全审计：按 euthyna 纪律审一段代码、一次变更或一条漏洞结论，产出带证据的报告
+---
+
+你在 GitHub Copilot（VS Code / CLI）中调用本命令。**把审计目标（文件、目录、PR 描述或 diff 范围）用 #file / #codebase 引用或直接写在命令后面。**
+
+按 euthyna 技能执行一次完整审计：
+
+1. **先加载纪律**：找到 euthyna 技能目录（项目 `.github/skills/euthyna/` 或 `.agents/skills/euthyna/`，个人 `~/.copilot/skills/euthyna/`），读 `SKILL.md`，需要时再读 `references/`。找不到就明说「技能缺失」，不要凭印象执行。
+2. **按入口决策树走**：单条漏洞结论 → 阶段 C；一次变更 → 阶段 B；依赖面 → 阶段 A；整体审计 → 阶段 B 为主。
+3. **先测量再读码**：第一条命令跑 `euthyna audit --base <分叉点> --repo <被审计仓库>`（history + deps 一次跑完）；谈测试覆盖再跑 `coverage`（操作手册在 `references/fact-producers.md`）。
+4. **每条结论过六道门禁**：证据到 `文件:行号`、可复现命令、影响说明；拿不出证据的降级为「观察」。复现命令执行前须向用户报备（见技能「执行纪律」节）。
+5. **三态裁定**：`BUG #N TRUE POSITIVE / FALSE POSITIVE / INCONCLUSIVE`。
+6. **报告落盘**：`<项目>_EUTHYNA_AUDIT_<日期>.md`，并跑 `euthyna gate <报告>` 校验（退出码 0 才算过）。
+
+CLI 未安装时先 `npm install -g euthyna`，或每次用 `npx euthyna <子命令> …`。

package/README.md

@@ -31,12 +31,14 @@ When an AI coding agent touches security, it fails in two specific ways:
 
 1. **It reports things that are not real.** Code that *looks* dangerous gets called a
    vulnerability, without tracing the data. In validation runs on real codebases — a
-   JavaScript one and a Python one — the pattern-matched "vulnerabilities" were mostly
-   false: **5 out of 5** refuted at the gates on the first run; **2 out of 3** refuted,
-   the third unresolved (INCONCLUSIVE, supply-chain-dependent) on the second. See the
+   JavaScript one, a Python one, and a Go one — the pattern-matched "vulnerabilities" were
+   mostly false: **5 out of 5** refuted at the gates on the first run; **2 out of 3**
+   refuted, the third unresolved (INCONCLUSIVE, supply-chain-dependent) on the second;
+   **4 out of 4** refuted on the third. See the
    [case studies](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-crewai.md)
    ([Python/crewAI](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-crewai.md),
-   [JavaScript/axe-core](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-axe-core.md)).
+   [JavaScript/axe-core](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-axe-core.md),
+   [Go/nektos-act](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-act.md)).
 2. **Its reassurances cannot be checked.** "I'm done." "The tests cover this." "It's
    safe now." These are assertions. You cannot tell a done-claim from a done-deal.
 
@@ -105,7 +107,9 @@ the project is deliberately zero-dependency.
 | **Codex** | The same Markdown layer works; packaging goes through Codex's plugin/marketplace format | Same |
 | **Hermes** | Copy the same folder into `~/.hermes/skills/` under a category folder, or install from a repo with `hermes skills install` — and for the slash command, install the repo as a plugin (see below) | Same |
 | **OpenCode** | Copy the same folder into `~/.agents/skills/` or `~/.config/opencode/skills/` (OpenCode loads both; unknown frontmatter fields are ignored). For a `/euthyna` slash command, copy `.opencode/commands/euthyna.md` into `~/.config/opencode/commands/` — it is a prompt template that tells the model to run the CLI | Same |
-| **OpenClaw** | Copy the same folder into `~/.agents/skills/` (or `<workspace>/.agents/skills/`) — OpenClaw exposes every `user-invocable` skill as a slash command natively, so `/euthyna` works with no extra file | Same |
+| **OpenClaw** | Copy the same folder into `~/.agents/skills/` (or `<workspace>/.agents/skills/`) — OpenClaw exposes every `user-invocable` skill as a slash command natively, so `/euthyna` works with no extra file. Published on ClawHub as [`@modusensus/euthyna`](https://clawhub.ai/modusensus/skills/euthyna) (zh) and [`@modusensus/euthyna-en`](https://clawhub.ai/modusensus/skills/euthyna-en) (en): `clawhub install modusensus/euthyna` | Same |
+| **GitHub Copilot** | Copy the same folder into `.github/skills/` (project), `~/.copilot/skills/` or `~/.agents/skills/` (personal) — Copilot reads all three. For a `/euthyna` prompt, copy `.github/prompts/euthyna.prompt.md` into the same-named folder of your repo or profile. `gh skill` can also install skills from this repository | Same |
+| **Cursor** | Copy the same folder into `.cursor/skills/` (project), `~/.cursor/skills/` (global) — Cursor also reads `.claude/skills/` for compatibility. For a `/euthyna` command, copy `.cursor/commands/euthyna.md` into the matching `commands/` folder (plain Markdown, no frontmatter) | Same |
 | **Any terminal** | — | `npm install -g euthyna`, then `euthyna …` |
 
 The skill ships in two languages. The directory above is the Chinese original (`euthyna`);
@@ -154,6 +158,9 @@ replying in chat.
 | Codex | — | Codex's custom-prompt slash commands (`~/.codex/prompts/`) are deprecated upstream; the same Markdown can still be placed there manually |
 | DSH | `/euthyna` | installed with the plugin; after a restart the command prints the usage manual (DSH slash commands run without reaching the model) |
 | Hermes | `/euthyna <subcommand> <args…>` | install this repository as a Hermes plugin: `hermes plugins install slow-stack/euthyna` then `hermes plugins enable euthyna` (needs Node >= 20 on PATH; the repo root carries `plugin.yaml` + `__init__.py`). The command forwards to the CLI and prints its output without reaching the model. The skill itself can still be installed separately with `hermes skills install slow-stack/euthyna/.agents/skills/euthyna` |
+| OpenCode | `/euthyna <args…>` | copy `.opencode/commands/euthyna.md` into `~/.config/opencode/commands/` or `.opencode/commands/` |
+| GitHub Copilot | `/euthyna <target>` | copy `.github/prompts/euthyna.prompt.md` into `.github/prompts/` (project) or the prompt folder of your profile; available in VS Code and Copilot CLI |
+| Cursor | `/euthyna <target>` | copy `.cursor/commands/euthyna.md` into `.cursor/commands/` (project) or `~/.cursor/commands/` (global); plain Markdown, no frontmatter |
 
 ### How to tell it was euthyna that audited
 
@@ -298,9 +305,13 @@ This project tries to be explicit about the difference. Current state:
   *declared* requirement, not the resolved build version; and the producer never maps a version
   to a CVE — that mapping is deliberately left to the adjudication layer.
 - **Anything about the case-study targets' security** — the runs found nothing to endorse or
-  condemn; that is not a statement about either project. See
-  [`docs/case-study-crewai.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-crewai.md) and
-  [`docs/case-study-axe-core.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-axe-core.md).
+  condemn; that is not a statement about any of the projects. See
+  [`docs/case-study-crewai.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-crewai.md),
+  [`docs/case-study-axe-core.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-axe-core.md),
+  and [`docs/case-study-act.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-act.md).
+- **A CI recipe, by running it on GitHub.** The exit-code gate and the workflow wiring are
+  documented in [`docs/ci-integration.md`](https://github.com/slow-stack/euthyna/blob/main/docs/ci-integration.md);
+  the workflow snippet has not been exercised as a live Actions run.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "euthyna",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Deterministic fact producers for security auditing: which deleted code came from a security fix, and which changed symbols no test ever executed.",
   "type": "module",
   "main": "./plugin/index.js",
@@ -18,6 +18,8 @@
     ".agents/skills/euthyna-en/",
     ".claude/commands/",
     ".opencode/commands/",
+    ".cursor/commands/",
+    ".github/prompts/",
     "assets/euthyna.png",
     "NOTICE.md"
   ],

package/plugin.yaml

@@ -1,5 +1,5 @@
 name: euthyna
-version: 0.4.1
+version: 0.6.0
 description: euthyna audit discipline — slash commands that drive the euthyna fact-producing CLI (history / coverage / deps / gate)
 license: Apache-2.0
 homepage: https://github.com/slow-stack/euthyna

package/src/cli.js

@@ -73,7 +73,7 @@ euthyna —— 给 AI 编码 agent 用的确定性事实产出器
 用法:
   euthyna audit    --base <rev> [--head <rev>] [--repo <dir>] [--pickaxe] [--no-origins] [--json]
   euthyna history  --base <rev> [--head <rev>] [--repo <dir>] [--pickaxe] [--no-origins] [--json]
-  euthyna coverage --coverage <file> --symbol <name> [--file <path>] [--json]
+  euthyna coverage --coverage <file> --symbol <name> [--file <path>] [--source <dir>] [--json]
   euthyna deps     [--repo <dir>] [--lockfile <file>] (--dep <name> | --all) [--json]
   euthyna gate     <报告文件> [--verify] [--cwd <dir>] [--json]
 
@@ -92,6 +92,8 @@ euthyna —— 给 AI 编码 agent 用的确定性事实产出器
              --coverage  覆盖率数据文件，c8 的 coverage-final.json
              --symbol    要查询的符号名，可重复
              --file      可选，限定到某个文件
+             --source    可选，Go profile（go test -coverprofile）必需：模块根目录，
+                         用于把行区间映射回函数（profile 不含函数名）
   deps       某个依赖在 lockfile 里被锁定/声明成什么版本（供应链声明的裁决依据）
              --repo      可选，依赖清单所在目录（默认当前目录，自动检测）
              --lockfile  可选，显式指定清单文件（支持 package-lock.json / Cargo.lock / go.mod）
@@ -123,7 +125,7 @@ reliably, and writes the answers as facts with evidence.
 Usage:
   euthyna audit    --base <rev> [--head <rev>] [--repo <dir>] [--pickaxe] [--no-origins] [--json]
   euthyna history  --base <rev> [--head <rev>] [--repo <dir>] [--pickaxe] [--no-origins] [--json]
-  euthyna coverage --coverage <file> --symbol <name> [--file <path>] [--json]
+  euthyna coverage --coverage <file> --symbol <name> [--file <path>] [--source <dir>] [--json]
   euthyna deps     [--repo <dir>] [--lockfile <file>] (--dep <name> | --all) [--json]
   euthyna gate     <report file> [--verify] [--cwd <dir>] [--json]
 
@@ -147,6 +149,9 @@ Commands:
              --coverage  the coverage data file, c8's coverage-final.json
              --symbol    symbol name(s) to query, repeatable
              --file      optional, restrict to one file
+             --source    optional, required for Go profiles (go test -coverprofile):
+                         the module root, used to map line ranges back to
+                         functions (the profile carries no function names)
   deps       what version does the lockfile pin or declare for a dependency? (the basis for supply-chain claims)
              --repo      optional, directory containing the manifest (default cwd, auto-detected)
              --lockfile  optional, explicit manifest path (package-lock.json / Cargo.lock / go.mod)
@@ -305,6 +310,7 @@ async function runCoverage(flags, lang) {
   );
   const symbols = asArray(flags.symbol).map(String);
   const file = flags.file ? String(flags.file) : undefined;
+  const source = flags.source ? path.resolve(String(flags.source)) : undefined;
 
   // Asking for nothing is a caller mistake, not a measurement failure.
   if (symbols.length === 0) {
@@ -318,12 +324,13 @@ async function runCoverage(flags, lang) {
   const { facts, evaluated, notEvaluated, measured } = await collectCoverageFacts({
     coverageFile,
     targets,
+    source,
     lang
   });
 
   const report = makeReport({
     producer: producerFor(COVERAGE_PRODUCER, lang),
-    subject: { coverageFile, symbols, file },
+    subject: { coverageFile, symbols, file, ...(source ? { source } : {}) },
     facts,
     evaluated,
     notEvaluated

package/src/facts/coverage.js

@@ -17,11 +17,10 @@
  * There is no code path here that emits "executed". That is the design, not an
  * omission. See docs/fact-contract-zh.md section 6.2.
  */
-import { readFile } from 'node:fs/promises';
+import { readFile, readdir } from 'node:fs/promises';
 import path from 'node:path';
 import { makeFact, notEvaluated as notEvaluatedEntry, KIND, STATUS, shellQuote } from '../contract.js';
 import { T, DEFAULT_LANG } from '../lang.js';
-
 /** c8's default exclusions. A production file matching one of these vanishes from the report. */
 const C8_DEFAULT_EXCLUDES = [
   /(^|\/)node_modules\//,
@@ -52,11 +51,12 @@ function matchesTarget(entryPath, target) {
  * break on any path containing a quote, and the point of the field is that a
  * reader can re-derive the claim without trusting this report.
  */
-function reproduceCommand({ coverageFile, symbol, file }) {
+function reproduceCommand({ coverageFile, symbol, file, source }) {
   return (
     `euthyna coverage --coverage ${shellQuote(coverageFile)} ` +
     `--symbol ${shellQuote(symbol)}` +
-    (file ? ` --file ${shellQuote(file)}` : '')
+    (file ? ` --file ${shellQuote(file)}` : '') +
+    (source ? ` --source ${shellQuote(source)}` : '')
   );
 }
 
@@ -82,6 +82,12 @@ function reproduceCommand({ coverageFile, symbol, file }) {
  *    evidence that the function was never entered. coverage.py reports
  *    functions that were never called as long as their module was loaded,
  *    which is exactly what makes "never invoked" an established fact.
+ * 4. Go coverage profiles (`go test -coverprofile`) — text, `mode:` header
+ *    plus one line per block (`path:startL.startC,endL.endC stmts count`).
+ *    No function names: the two-state mapping runs through function ranges
+ *    parsed from the gofmt'd source under --source (module root). A file
+ *    absent from the profile is *not* evidence of "never executed" (the
+ *    package may not be in the test binary), so absence is notEvaluated.
  *
  * Anything that matches none of these shapes is **not a coverage report this
  * producer can read**, and is reported as notEvaluated — never fed through the
@@ -89,9 +95,160 @@ function reproduceCommand({ coverageFile, symbol, file }) {
  */
 export async function loadCoverage(coverageFile) {
   const raw = await readFile(coverageFile, 'utf8');
+  if (isGoProfileText(raw)) {
+    const parsed = parseGoProfile(raw);
+    if (!parsed) {
+      throw new Error(
+        'the file starts like a Go coverage profile ("mode:" header) but the body has lines that do not match ' +
+          '"file:startLine.startCol,endLine.endCol numStatements count" — refusing to interpret it as coverage'
+      );
+    }
+    return parsed;
+  }
   return JSON.parse(raw);
 }
 
+/**
+ * Go coverage profiles (`go test -coverprofile`) are text, not JSON:
+ *
+ *   mode: set
+ *   github.com/nektos/act/pkg/artifacts/artifact.pb.go:42.2,43.29 2 0
+ *
+ * One line per *block* — a line range with a statement count and a hit count.
+ * There are **no function names**, so a symbol query needs the source tree
+ * (via --source, the module root) to map line ranges back to functions:
+ * goFunctionRanges() reads the gofmt'd source, whose top-level `func`
+ * declarations start at column 0 and end at a `}` at column 0.
+ */
+function isGoProfileText(raw) {
+  const first = String(raw).split(/\r?\n/, 1)[0];
+  return /^mode:\s*(set|count|atomic)\s*$/.test(first);
+}
+
+const GO_BLOCK_RE = /^(.+):(\d+)\.(\d+),(\d+)\.(\d+)\s+(\d+)\s+(\d+)$/;
+
+/** Parse a Go profile into `{ __go, mode, files: Map<path, blocks[]> }`, or null if malformed. */
+export function parseGoProfile(raw) {
+  const lines = String(raw).split(/\r?\n/);
+  const mode = /^mode:\s*(set|count|atomic)\s*$/.exec((lines[0] ?? '').trim())?.[1];
+  if (!mode) return null;
+
+  const files = new Map();
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line.trim()) continue;
+    const m = GO_BLOCK_RE.exec(line);
+    if (!m) return null;
+    const [, file, startLine, , endLine, , statements, count] = m;
+    let blocks = files.get(file);
+    if (!blocks) {
+      blocks = [];
+      files.set(file, blocks);
+    }
+    blocks.push({
+      startLine: Number(startLine),
+      endLine: Number(endLine),
+      statements: Number(statements),
+      count: Number(count)
+    });
+  }
+  return { __go: true, mode, files };
+}
+
+/**
+ * The code visible on each line: comments and raw-string contents blanked out,
+ * with multi-line `/*...*​/` and `...` regions tracked across lines.
+ *
+ * Without this, a commented-out function, a `}` at column 0 inside a block
+ * comment, or a raw string with a column-0 brace would create phantom function
+ * ranges or split real ones — and coverage blocks would be assigned to the
+ * wrong function, which is a false coverage result.
+ */
+function goSignificantLines(text) {
+  const out = [];
+  let inBlock = false;
+  let inRaw = false;
+  for (const line of String(text).split(/\r?\n/)) {
+    let sig = '';
+    let i = 0;
+    while (i < line.length) {
+      const ch = line[i];
+      if (inBlock) {
+        if (ch === '*' && line[i + 1] === '/') {
+          inBlock = false;
+          i += 2;
+          continue;
+        }
+        i++;
+        continue;
+      }
+      if (inRaw) {
+        if (ch === '`') inRaw = false;
+        i++;
+        continue;
+      }
+      if (ch === '`') {
+        inRaw = true;
+        i++;
+        continue;
+      }
+      if (ch === '/' && line[i + 1] === '/') break; // rest of the line is a comment
+      if (ch === '/' && line[i + 1] === '*') {
+        inBlock = true;
+        i += 2;
+        continue;
+      }
+      sig += ch;
+      i++;
+    }
+    out.push(sig);
+  }
+  return out;
+}
+
+/**
+ * Top-level function ranges of a gofmt'd Go source file.
+ *
+ * Only `func` at column 0 of *significant* code matches: nested (indented)
+ * declarations are left alone, which is the point — a closure inside a
+ * function is part of that function's range. A function ends at the next `}`
+ * at column 0, or on its own declaration line when the whole function sits on
+ * that line (`func f() {}`), so a later package-level block is not absorbed.
+ * Methods are reported under their bare method name (two types may share it;
+ * every match is reported, mirroring how c8 reports every fnMap entry with a
+ * given name).
+ */
+export function goFunctionRanges(text) {
+  const lines = goSignificantLines(text);
+  const funcs = [];
+  let current = null;
+  const declRe = /^func\s*(?:\([^)]*\))?\s*([A-Za-z_]\w*)/;
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (current && /^}/.test(line)) {
+      funcs.push({ ...current, endLine: i + 1 });
+      current = null;
+      continue;
+    }
+    if (/^func\s/.test(line)) {
+      // a new decl with no closing brace in between: close the previous range
+      // at the previous line rather than swallowing the new declaration
+      if (current) funcs.push({ ...current, endLine: i });
+      const name = declRe.exec(line)?.[1];
+      current = name ? { name, startLine: i + 1 } : null;
+      // the whole function on one line (gofmt keeps empty ones there): close
+      // it on its own line
+      if (current && /\}\s*$/.test(line)) {
+        funcs.push({ ...current, endLine: i + 1 });
+        current = null;
+      }
+    }
+  }
+  if (current) funcs.push({ ...current, endLine: lines.length });
+  return funcs;
+}
+
 /**
  * True for coverage.py's `{"meta": {...}, "files": {...}}` shape.
  * A c8 report never has a top-level `meta` key.
@@ -115,6 +272,7 @@ function isCoveragePyReport(coverage) {
  * honestly is still part of the fact, so the distinction is kept.
  */
 export function detectCoverageFormat(coverage) {
+  if (coverage && typeof coverage === 'object' && coverage.__go) return 'go';
   if (isCoveragePyReport(coverage)) return 'coverage.py';
 
   const entries = Object.entries(coverage).filter(([, v]) => v && typeof v === 'object');
@@ -210,8 +368,10 @@ function locateSymbolInEntry(entry, symbol) {
  * @param {object} options
  * @param {string} options.coverageFile
  * @param {Array<{file?: string, symbol: string}>} options.targets
+ * @param {string} [options.source] module root for Go profiles (--source), whose
+ *   source files are needed to map profile line ranges back to functions
  */
-export async function collectCoverageFacts({ coverageFile, targets = [], lang = DEFAULT_LANG } = {}) {
+export async function collectCoverageFacts({ coverageFile, targets = [], source, lang = DEFAULT_LANG } = {}) {
   const t = T(lang);
   const facts = [];
   const evaluated = [];
@@ -238,6 +398,13 @@ export async function collectCoverageFacts({ coverageFile, targets = [], lang =
 
   const isPy = isCoveragePyReport(coverage);
 
+  // Go profiles take a dedicated path: the report is a block list with no
+  // function names, so symbol location needs the source tree and the
+  // two-state mapping runs through function ranges, not per-file function maps.
+  if (coverage.__go) {
+    return collectGoCoverageFacts({ coverage, coverageFile, targets, source, lang });
+  }
+
   // c8: entries are the report's file keys directly.
   // coverage.py: the file entries live under `files`.
   const entries = Object.entries(isPy ? (coverage.files ?? {}) : coverage).filter(
@@ -435,3 +602,316 @@ export async function collectCoverageFacts({ coverageFile, targets = [], lang =
 
   return { facts, evaluated, notEvaluated, measured: true };
 }
+
+/**
+ * The Go-profile path.
+ *
+ * Profile lines carry no function names, so the two-state mapping goes:
+ * block list -> function ranges from the gofmt'd source -> per-function hit.
+ * The module root (--source) is required; profile paths are import paths
+ * (`module/dir/file.go`) or absolute paths, so resolution tries go.mod's
+ * module prefix and the plain path under the root before giving up — and a
+ * file it cannot resolve is reported as notEvaluated, never as uncovered.
+ */
+async function collectGoCoverageFacts({ coverage, coverageFile, targets, source, lang }) {
+  const t = T(lang);
+  const facts = [];
+  const evaluated = [];
+  const notEvaluated = [];
+  let counter = 0;
+
+  if (coverage.files.size === 0) {
+    notEvaluated.push(
+      notEvaluatedEntry(
+        KIND.TEST_COVERAGE,
+        t(
+          'Go coverage profile 为空（只有 mode 头）。测试没有加载到任何被编译的包，' +
+            '或 -coverpkg 没有指向被测代码',
+          'The Go coverage profile is empty (mode header only). The test run loaded no compiled package, ' +
+            'or -coverpkg did not point at the code under test'
+        )
+      )
+    );
+    return { facts, evaluated, notEvaluated, measured: false };
+  }
+
+  if (targets.length === 0) {
+    notEvaluated.push(
+      notEvaluatedEntry(
+        KIND.TEST_COVERAGE,
+        t('没有指定要查询的符号（--symbol）', 'no symbol requested for query (--symbol)')
+      )
+    );
+    return { facts, evaluated, notEvaluated, measured: false };
+  }
+
+  let module = null;
+  if (source) {
+    try {
+      module = modulePrefix(await readFile(path.join(source, 'go.mod'), 'utf8'));
+    } catch {
+      // no go.mod at the root: relative import paths then cannot be resolved,
+      // and the per-file resolution below reports that honestly
+    }
+  }
+
+  const sourceCache = new Map();
+  async function resolveSource(profilePath) {
+    if (sourceCache.has(profilePath)) return sourceCache.get(profilePath);
+    let result = null;
+    if (source) {
+      const candidates = [];
+      if (path.isAbsolute(profilePath)) {
+        candidates.push(profilePath);
+      } else {
+        if (module && profilePath.startsWith(module + '/')) {
+          candidates.push(path.join(source, profilePath.slice(module.length + 1)));
+        }
+        candidates.push(path.join(source, profilePath));
+      }
+      for (const candidate of candidates) {
+        try {
+          result = { text: await readFile(candidate, 'utf8'), resolved: candidate };
+          break;
+        } catch {
+          // try the next candidate, then report honestly
+        }
+      }
+    }
+    sourceCache.set(profilePath, result);
+    return result;
+  }
+
+  if (!source) {
+    notEvaluated.push(
+      notEvaluatedEntry(
+        KIND.TEST_COVERAGE,
+        t(
+          'Go 的 -coverprofile 是文本格式且不含函数名，函数级裁定需要 --source <模块根目录> ' +
+            '把行区间映射回函数。没有源码，符号查询无法进行',
+          'A Go -coverprofile is text and carries no function names; a function-level verdict needs ' +
+            '--source <module root> to map line ranges back to functions. Without the source, symbol queries cannot run'
+        )
+      )
+    );
+    return { facts, evaluated, notEvaluated, measured: false };
+  }
+
+  const entries = [...coverage.files.entries()];
+
+  for (const target of targets) {
+    const scoped = target.file
+      ? entries.filter(([entryPath]) => matchesTarget(entryPath, target.file))
+      : entries;
+
+    if (target.file && scoped.length === 0) {
+      // For Go this must NOT read as "never executed": a file absent from the
+      // profile may simply not have been compiled into the test binary at all.
+      notEvaluated.push(
+        notEvaluatedEntry(
+          KIND.TEST_COVERAGE,
+          t(
+            `${target.file} 没有出现在 Go coverage profile 中 —— 该文件所在的包可能根本没被编译进这次测试二进制` +
+              '（--coverpkg 或运行对应包才能测到它），「未出现」不能当「未执行」',
+            `${target.file} does not appear in the Go coverage profile — its package may not have been compiled into the test binary at all ` +
+              '(-coverpkg or running that package is required to measure it), so "absent" must not be read as "never executed"'
+          )
+        )
+      );
+      continue;
+    }
+
+    let matched = 0;
+    let unresolved = false;
+    for (const [entryPath, blocks] of scoped) {
+      const src = await resolveSource(entryPath);
+      if (!src) {
+        unresolved = true;
+        notEvaluated.push(
+          notEvaluatedEntry(
+            KIND.TEST_COVERAGE,
+            t(
+              `profile 中的 ${entryPath} 无法在 --source ${source} 下定位（go.mod 模块前缀已尝试）—— ` +
+                '没有该源文件，行区间无法映射回函数',
+              `The profile entry ${entryPath} cannot be located under --source ${source} (the go.mod module prefix was tried) — ` +
+                'without that source file, line ranges cannot be mapped back to functions'
+            )
+          )
+        );
+        continue;
+      }
+
+      for (const fn of goFunctionRanges(src.text)) {
+        if (fn.name !== target.symbol) continue;
+        const inFn = blocks.filter(b => b.startLine >= fn.startLine && b.startLine <= fn.endLine);
+        if (inFn.length === 0) continue; // no measured block: cannot answer for this function
+        matched++;
+        const invoked = inFn.some(b => b.count > 0);
+
+        if (!invoked) {
+          facts.push(
+            makeFact({
+              id: `coverage-${++counter}`,
+              kind: KIND.TEST_COVERAGE,
+              statement:
+                t(
+                  `符号 ${target.symbol} 在本次测试运行中一次都没有被调用（函数体内所有覆盖区块的执行计数为 0）—— ` +
+                    `任何依赖它的行为都没有被执行验证`,
+                  `Symbol ${target.symbol} was never invoked in this test run (every coverage block inside the function has a hit count of 0) — ` +
+                    `any behavior depending on it was never exercised`
+                ),
+              status: STATUS.ESTABLISHED,
+              evidence: { file: entryPath, line: fn.startLine },
+              method: 'command',
+              command: reproduceCommand({ coverageFile, symbol: target.symbol, file: entryPath, source }),
+              detail: { symbol: target.symbol, invocationCount: 0, reason: 'invocation_count_zero' }
+            })
+          );
+        } else {
+          facts.push(
+            makeFact({
+              id: `coverage-${++counter}`,
+              kind: KIND.TEST_COVERAGE,
+              statement:
+                t(
+                  `符号 ${target.symbol} 至少被调用过一次，但被调用**不能**证明任何特定调用点执行过 —— ` +
+                    `本事实只能证伪，不能证实`,
+                  `Symbol ${target.symbol} was invoked at least once, but being invoked **cannot** prove any specific call site ran — ` +
+                    `this fact can only falsify, never confirm`
+                ),
+              status: STATUS.UNKNOWN,
+              evidence: { file: entryPath, line: fn.startLine },
+              method: 'command',
+              command: reproduceCommand({ coverageFile, symbol: target.symbol, file: entryPath, source }),
+              detail: {
+                symbol: target.symbol,
+                invocationCount: 1,
+                reason: 'nonzero_count_cannot_prove_call_site_execution'
+              }
+            })
+          );
+        }
+      }
+    }
+
+    // "could not locate" implies we searched the data; when the source file
+    // needed to even read the data was missing, the notEvaluated entry above
+    // is the honest record and no locating claim is made.
+    if (matched === 0 && !unresolved) {
+      // With --source we can tell "not located" apart from "lives in a file the
+      // profile never saw": a symbol declared in a file absent from the profile
+      // is a refusal (its package was probably not compiled in), not an answer.
+      const elsewhere = await findGoSymbolOutsideProfile(coverage, source, module, target.symbol);
+      if (elsewhere) {
+        notEvaluated.push(
+          notEvaluatedEntry(
+            KIND.TEST_COVERAGE,
+            t(
+              `符号 ${target.symbol} 在 ${elsewhere} 中有顶层声明，但该文件没有出现在 Go coverage profile 里 —— ` +
+                '它所在的包多半没被编译进这次测试二进制（-coverpkg 或运行对应包才能测到它）。' +
+                '这是「未评估」，既不是「从未调用」也不是「无法定位」',
+              `Symbol ${target.symbol} is declared in ${elsewhere}, but that file does not appear in the Go coverage profile — ` +
+                'its package was probably not compiled into this test binary (-coverpkg or running that package is required to measure it). ' +
+                'This is "not evaluated": neither "never invoked" nor "could not locate"'
+            )
+          )
+        );
+        continue;
+      }
+      facts.push(
+        makeFact({
+          id: `coverage-${++counter}`,
+          kind: KIND.TEST_COVERAGE,
+          statement:
+            t(
+              `未能在覆盖率数据中定位符号 ${target.symbol}`,
+              `Could not locate symbol ${target.symbol} in the coverage data`
+            ) +
+            (target.file ? t(`（限定文件 ${target.file}）`, ` (restricted to file ${target.file})`) : '') +
+            t(
+              ' —— 可能是被重命名、被内联，或它不是顶层 func 声明（Go profile 只携带行区间，' +
+                '函数边界来自源码中的顶层 func）',
+              ' — it may have been renamed, inlined, or it is not a top-level func declaration (a Go profile carries line ranges only; ' +
+                'function boundaries come from top-level funcs in the source)'
+            ),
+          status: STATUS.UNKNOWN,
+          evidence: { file: target.file ?? t('(未限定文件)', '(unrestricted file)') },
+          method: 'static',
+          detail: { symbol: target.symbol, reason: 'symbol_not_located_in_fnmap' }
+        })
+      );
+    }
+  }
+
+  // A query that produced no fact and only refusals was not answered —
+  // "measured" must not let CI read it as clean.
+  const measured = facts.length > 0;
+  if (measured) {
+    evaluated.push({
+      kind: KIND.TEST_COVERAGE,
+      producer: 'euthyna-coverage',
+      format: 'go',
+      count: facts.length
+    });
+  }
+
+  return { facts, evaluated, notEvaluated, measured };
+}
+
+function modulePrefix(goModText) {
+  return /^\s*module\s+(\S+)/m.exec(goModText)?.[1] ?? null;
+}
+
+const GO_WALK_SKIP = new Set(['vendor', 'testdata', 'node_modules', '.git']);
+
+/**
+ * Does the symbol exist in a .go file that the profile does not cover?
+ *
+ * Walks the module root (skipping vendor/testdata and hidden dirs), maps each
+ * file to its import path, and reports the first file — relative to the
+ * module root — whose top-level functions include the symbol while the file
+ * itself is absent from the profile. The whole-tree scan only runs on the
+ * rare "matched 0" path, so the common query pays nothing for it.
+ */
+async function findGoSymbolOutsideProfile(coverage, source, module, symbol) {
+  if (!source) return null;
+
+  // absolute disk paths the profile already accounts for
+  const covered = new Set();
+  for (const profilePath of coverage.files.keys()) {
+    if (path.isAbsolute(profilePath)) {
+      covered.add(path.resolve(profilePath).replace(/\\/g, '/').toLowerCase());
+    }
+  }
+
+  async function* walk(dir) {
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name.endsWith('.go')) yield path.join(dir, entry.name);
+      else if (entry.isDirectory() && !GO_WALK_SKIP.has(entry.name) && !entry.name.startsWith('.')) {
+        yield* walk(path.join(dir, entry.name));
+      }
+    }
+  }
+
+  for await (const file of walk(source)) {
+    const abs = path.resolve(file).replace(/\\/g, '/').toLowerCase();
+    if (covered.has(abs)) continue;
+    const rel = path.relative(source, file).replace(/\\/g, '/');
+    const importPath = module ? `${module}/${rel}` : rel;
+    if (coverage.files.has(importPath) || coverage.files.has(rel)) continue;
+    let text;
+    try {
+      text = await readFile(file, 'utf8');
+    } catch {
+      continue;
+    }
+    if (goFunctionRanges(text).some(fn => fn.name === symbol)) return rel;
+  }
+  return null;
+}

package/src/facts/deps.js

@@ -425,11 +425,11 @@ export async function collectDependencyFacts({ cwd = process.cwd(), lockfile, de
             t(
               `依赖 ${dep} 在 ${listLabel}（${target.type}）中被${verb}为版本 ${versions.join(' / ')}` +
                 (isGo
-                  ? ' —— 这是声明的需求版本，非最终解析版本（go.sum 不含版本，无法在此验证解析结果）'
+                  ? ' —— 这是声明的需求版本，非最终解析版本（选定版本由 MVS 对整个模块图求解，go.sum 记录版本与哈希但不含选定的构建清单，deps 不做模块图解析）'
                   : ''),
               isGo
                 ? `Dependency ${dep} is declared as version ${versions.join(' / ')} in the ${listLabel} (${target.type})` +
-                  ' — this is the declared requirement version, not the final resolved version (go.sum carries no versions, so the resolution cannot be verified here)'
+                  ' — this is the declared requirement version, not the final resolved version (the selected version comes from MVS over the whole module graph; go.sum records version-hash pairs but not the selected build list, and this producer does not resolve the module graph)'
                 : `Dependency ${dep} is locked to version ${versions.join(' / ')} in the ${listLabel} (${target.type})`
             ),
           status: STATUS.ESTABLISHED,