euthyna 0.5.0 → 0.7.0

package/.agents/skills/euthyna/references/dependency-audit.md

@@ -48,6 +48,11 @@
 **目标目录必须有** `package.json` / `pyproject.toml` / `requirements*.txt` / `go.mod` 之一。
 没有就**直接说没有并停止**，不要为一个采集器不解析的生态即兴审计。
 
+**清单只按仓库根查找。**多包仓库里子包各自的 lock 不会被 `euthyna audit` 或 `euthyna deps --repo` 测到
+（🧪 实测 2026-10-10：根 `package-lock.json` 锁 `root-a`，子包 `packages/app/package-lock.json` 锁 `sub-b`/`sub-c`，
+输出只有 `root-a`，**并且没有任何声明**）。要管子包就逐包跑 `euthyna deps --lockfile <路径>`；
+不跑就明说没测——别把根清单当成整个 monorepo 的事实。
+
 **能精确解析版本的**：`package-lock.json`、`npm-shrinkwrap.json`、`uv.lock`、Go 1.17+ 的 `go.mod`。
 
 **不能的**：`yarn.lock`、`pnpm-lock.yaml`、`poetry.lock`。

package/.agents/skills/euthyna/references/fact-producers.md

@@ -146,14 +146,31 @@ node <euthyna 仓库>/bin/euthyna.js coverage `
   --symbol <符号名> --symbol <符号名>
 ```
 
-`--symbol` 可重复，一次查多个。加 `--file` 可限定到某个文件。
+`--symbol` 可重复，一次查多个。加 `--file` 可限定到某个文件。Go profile 另需 `--source`
+（见下）。
 
-**两种覆盖率格式都读**（自动识别，无需参数）：
+**三种覆盖率格式都读**（自动识别，无需参数）：
 
 | 格式 | 来源 | 说明 |
 |---|---|---|
 | c8 / v8-to-istanbul `coverage-final.json` | JS 项目（c8 默认落在 `coverage/coverage-final.json`） | 每文件有 `fnMap` + `f`（调用计数数组） |
 | coverage.py JSON（format 3） | Python 项目（`coverage json` 产出） | 顶层 `{meta, files}`；`functions` 里「函数名 → 已执行行列表」，**无调用计数**。从未调用的函数仍在列表中且 `executed_lines` 为空 |
+| Go `-coverprofile`（文本） | Go 项目（`go test -coverprofile` 产出） | `mode:` 头 + 每区块一行 `路径:起始行.列,结束行.列 语句数 命中数`，**无函数名**。必须加 `--source <模块根目录>`：产出器读源码里的顶层 `func` 把行区间映射回函数 |
+
+Go 的产出命令（Go 目标）：
+```bash
+go test ./包路径/ -coverprofile=<绝对路径>.out -run <测试名>
+node <euthyna 仓库>/bin/euthyna.js coverage `
+  --coverage <绝对路径>.out --symbol <符号名> --source <Go 模块根目录>
+```
+
+> Go 专属注意事项（在 act 案例研究中实测）：
+> 1. **文件不在 profile 里 ≠ 未执行**——该文件所在的包可能根本没被编译进测试二进制。
+>    产出器把这种情况报为「未评估」，绝不当「未被覆盖」。要测到某个包，用
+>    `-coverpkg=<包>` 或直接运行对应包的测试。
+> 2. profile 路径是模块导入路径（`module/pkg/file.go`）；`--source` 指向含 go.mod 的
+>    模块根，产出器据此把导入路径映射回磁盘文件。
+> 3. `mode: set` 就够用——两态语义（调用过/从未调用）不需要 `count`/`atomic` 的精确计数。
 
 coverage.py 的产出命令（Python 目标）：
 ```powershell
@@ -277,4 +294,9 @@ node <euthyna 仓库>/bin/euthyna.js gate <报告文件> --verify --cwd <被审
 - `coverage` **只能证伪**。见上文。
 - `coverage` 依赖调用计数，**不处理动态派发、反射、字符串调用**。
   计数为 0 的结论在存在这些机制时要打折扣。
+- `audit` 的两个半边**读的不是同一个东西**：`history` 取 `--base`/`--head` 命名的提交，`deps` 取
+  `--repo` 所在**仓库根**当前检出的那份清单（清单只按仓库根查找）。所以判据是**内容**：测到的清单与 `--head` 那份不一致、或在那个提交里根本
+  不存在（被 gitignore 的锁文件就是这种），「未评估的判据」里会多一条写明文件名与 `--head` 的理由；
+  `code`（`manifest-not-head` / `manifest-unverified`）只在 `--json` 通道上。**看到它就检出到范围的一端再重跑**
+  ——声明只保证你不静默踩坑，不会替你把事实测对。
 - 两者都**不产出分数、严重性、修复建议**。这是契约，不是遗漏。

package/.agents/skills/euthyna/references/verification-gates.md

@@ -291,3 +291,8 @@ Gate Review（被 P5 阻塞）: 6 门禁评估 → 裁定
 2. TRUE POSITIVE 列表：每条附简要漏洞描述
 3. FALSE POSITIVE 列表：每条附简要拒绝理由
 4. INCONCLUSIVE 列表：**每条附缺什么、为什么缺**
+
+5. **可触发性不能当驳回的承担者。** 靠「这条路径走不到／不会被执行／是死代码」来排除一条断言时：
+   - coverage 的两个出口都承担不了这个论证。**ESTABLISHED（从未被调用，含「文件未出现在覆盖率数据里」这一出口）只记录「本次运行未执行」**——可以写进证据栏作佐证，但它证明不了「不可能触发」；**UNKNOWN「符号未定位」等于没拿到覆盖事实**。
+   - 没有覆盖事实时，支撑该论证的那道门禁记**未评估**，原因写 `coverage=not-measured`。未评估是这道门禁的**完成态**，不是跳过：其余门禁照常全部评完。此后按折叠走——任一其他门禁 FAIL， FALSE POSITIVE 由那道 FAIL 承担（其论证不得依赖可触发性）；没有其他 FAIL，就是 INCONCLUSIVE。
+   - **因此依赖可触发性的 FALSE POSITIVE 只有一种合法形态**：另有一条不依赖可触发性的证伪在支撑它——数据流上根本不可能（参数硬编码、无攻击者可控输入），或 PoC 直接证否。覆盖率对这类论证既不增加也不减少，本条不适用。「这条路径没有触发」永远不等于「这条路径不可能触发」。

package/.agents/skills/euthyna-en/references/dependency-audit.md

@@ -48,6 +48,12 @@ Available discovery sources (use whichever is installed — **audit the source b
 **The target directory must have one of** `package.json` / `pyproject.toml` / `requirements*.txt` / `go.mod`.
 If none exists, **say so and stop** — do not improvise an audit for an ecosystem the collector does not parse.
 
+**Manifests are located from the repository root only.** A multi-package repository's per-package locks are not measured by
+`euthyna audit` or `euthyna deps --repo` (🧪 measured 2026-10-10: the root `package-lock.json` pins `root-a` while
+`packages/app/package-lock.json` pins `sub-b` and `sub-c`, and the output reports only `root-a`, **with no declaration at
+all**). Measuring a sub-package means running `euthyna deps --lockfile <path>` per package; if that is not done, say the
+sub-packages were not measured — do not treat the root manifest's facts as facts about the whole monorepo.
+
 **Exactly resolvable**: `package-lock.json`, `npm-shrinkwrap.json`, `uv.lock`, `go.mod` for Go 1.17+.
 
 **Not resolvable**: `yarn.lock`, `pnpm-lock.yaml`, `poetry.lock`.

package/.agents/skills/euthyna-en/references/fact-producers.md

@@ -135,13 +135,33 @@ node <euthyna repo>/bin/euthyna.js coverage `
 ```
 
 `--symbol` is repeatable — query several at once. Add `--file` to restrict to a single file.
+Go profiles additionally need `--source` (see below).
 
-**Both coverage formats are read** (auto-detected, no parameters needed):
+**Three coverage formats are read** (auto-detected, no parameters needed):
 
 | Format | Source | Notes |
 |---|---|---|
 | c8 / v8-to-istanbul `coverage-final.json` | JS projects (c8 lands at `coverage/coverage-final.json` by default) | Per-file `fnMap` + `f` (invocation-count array) |
 | coverage.py JSON (format 3) | Python projects (produced by `coverage json`) | Top-level `{meta, files}`; in `functions`, "function name → list of executed lines", **no invocation counts**. Functions never called are still in the list with empty `executed_lines` |
+| Go `-coverprofile` (text) | Go projects (produced by `go test -coverprofile`) | A `mode:` header plus one line per block (`path:startL.startC,endL.endC stmts count`), **no function names**. `--source <module root>` is required: the producer reads top-level `func` declarations in the source to map line ranges back to functions |
+
+The Go production commands (Go targets):
+
+```bash
+go test ./<package>/ -coverprofile=<absolute path>.out -run <test name>
+node <euthyna repo>/bin/euthyna.js coverage `
+  --coverage <absolute path>.out --symbol <symbol> --source <Go module root>
+```
+
+> Go-specific notes (measured in the act case study):
+> 1. **A file absent from the profile is not "never executed"** — its package may not have
+>    been compiled into the test binary at all. The producer reports this as "not evaluated",
+>    never as "not covered". To measure a package, use `-coverpkg=<package>` or run that
+>    package's tests directly.
+> 2. Profile paths are module import paths (`module/pkg/file.go`); point `--source` at the
+>    module root containing go.mod, and the producer maps import paths back to disk files.
+> 3. `mode: set` is enough — the two-state semantics (invoked / never invoked) do not need
+>    the exact counts of `count`/`atomic`.
 
 The coverage.py production commands (Python targets):
 
@@ -260,4 +280,5 @@ that a conclusion without evidence is not handed over wearing the face of "estab
 - `history` only covers **deleted lines**. It does not handle newly added code (except with `--pickaxe`).
 - `coverage` **can only falsify**. See above.
 - `coverage` relies on invocation counts and **does not handle dynamic dispatch, reflection, or string-based calls**. Conclusions of count 0 must be discounted when such mechanisms exist.
+- The two halves of `audit` **do not read the same thing**: `history` takes the commits named by `--base`/`--head`, while `deps` takes the manifest **currently checked out at the root of the repository** `--repo` points into (manifests are located from the root only). So the criterion is **content**: when the manifest measured differs from the one at `--head`, or does not exist in that commit at all (a gitignored lockfile is exactly that), *Criteria not evaluated* gains an entry naming the file and `--head`. The `code` (`manifest-not-head` / `manifest-unverified`) appears only on the `--json` channel. **Seeing one means checking out an end of the range and re-running** — the declaration keeps the trap from being silent; it does not measure the fact for you.
 - Neither **produces scores, severity, or fix suggestions**. That is the contract, not an omission.

package/.agents/skills/euthyna-en/references/verification-gates.md

@@ -289,3 +289,8 @@ When there are multiple suspected bugs:
 2. TRUE POSITIVE list: each with a brief vulnerability description
 3. FALSE POSITIVE list: each with a brief rejection reason
 4. INCONCLUSIVE list: **each with what is missing and why**
+
+5. **Triggerability cannot carry a dismissal.** When a claim is excluded because "this path cannot be reached / never runs / is dead code":
+   - Neither outlet of the coverage producer can carry that argument. **ESTABLISHED (never invoked — including the "file does not appear in the coverage data" outlet) records only "not exercised in this run"**: it may sit in the evidence column as corroboration, but it proves nothing about whether the path *can* fire; **the UNKNOWN "symbol not located" is the absence of a coverage fact**.
+   - When no coverage fact was obtained, the gate that would carry the argument is recorded **NOT EVALUATED** with the reason `coverage=not-measured`. Not-evaluated is that gate's **completed state**, not a skipped step: every other gate is still evaluated in full. The verdict then follows the folding — any other gate FAILs and the FALSE POSITIVE is carried by that gate (whose own argument must not rest on triggerability); with no other FAIL, the verdict is INCONCLUSIVE.
+   - **So a triggerability-based FALSE POSITIVE has exactly one legal form**: some refutation that does not rest on triggerability carries it — impossibility by data flow (hardcoded arguments, no attacker-controlled input), or a PoC that disproves it directly. Coverage adds nothing to and takes nothing from such an argument, and this rule does not apply to it. "This path did not fire" is never "this path cannot fire".

package/README.md

@@ -31,12 +31,19 @@ When an AI coding agent touches security, it fails in two specific ways:
 
 1. **It reports things that are not real.** Code that *looks* dangerous gets called a
    vulnerability, without tracing the data. In validation runs on real codebases — a
-   JavaScript one and a Python one — the pattern-matched "vulnerabilities" were mostly
-   false: **5 out of 5** refuted at the gates on the first run; **2 out of 3** refuted,
-   the third unresolved (INCONCLUSIVE, supply-chain-dependent) on the second. See the
+   JavaScript one, a Python one, a Go one, and a Rust one — the pattern-matched
+   "vulnerabilities" were mostly false: **5 out of 5** refuted at the gates on the first run;
+   **2 out of 3** refuted, the third unresolved (INCONCLUSIVE, supply-chain-dependent) on the
+   second; **4 out of 4** refuted on the third. The fourth run is the one that tests the other
+   half: it faced a real vulnerability, and the gates let it through — **1 TRUE POSITIVE**
+   (fourth gate evidenced by a PoC run against both the fixed and the unfixed release), 3
+   refuted, 1 INCONCLUSIVE. A sieve that only ever says no would have refuted that one too. See
+   the
    [case studies](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-crewai.md)
    ([Python/crewAI](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-crewai.md),
-   [JavaScript/axe-core](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-axe-core.md)).
+   [JavaScript/axe-core](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-axe-core.md),
+   [Go/nektos-act](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-act.md),
+   [Rust/rustls](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-rust.md)).
 2. **Its reassurances cannot be checked.** "I'm done." "The tests cover this." "It's
    safe now." These are assertions. You cannot tell a done-claim from a done-deal.
 
@@ -185,7 +192,7 @@ From a checkout instead (development):
 
 ```sh
 git clone https://github.com/slow-stack/euthyna
-cd euthyna && npm test                                 # 207 tests; no install step exists
+cd euthyna && npm test                                 # the whole suite; no install step exists
 node bin/euthyna.js audit --repo <path> --base main --head HEAD
 ```
 
@@ -239,19 +246,23 @@ This project tries to be explicit about the difference. Current state:
 
 ### Verified
 
-- **`history` attribution against real repositories — in two languages.** Run against
+- **`history` attribution against real repositories — in four languages.** Run against
   [axe-core](https://github.com/dequelabs/axe-core) (JavaScript) and
   [crewAI](https://github.com/crewAIInc/crewAI) (Python); deleted lines attributed to the
   commits that introduced them, then checked **by hand** against `git blame`. The checks
-  developed for that comparison now run as regression tests in the suite.
+  developed for that comparison now run as regression tests in the suite. The producer ran
+  unchanged on a Go repository ([nektos/act](https://github.com/nektos/act), where the deleted
+  lines of a security fix were traced back to the commit that introduced them) and on a Rust one
+  ([rustls](https://github.com/rustls/rustls), whose fix range yielded 43 provenance facts).
 - **`coverage` on real output in three formats** — c8/V8 JSON, classic istanbul (jest/nyc, same
   fnMap/f shape) and coverage.py JSON (format 3) — distinguishing all three states correctly, and
   refusing anything that is not a recognizable coverage report instead of answering "symbol not
   located" against it.
-- **`deps` against a real lockfile** — resolved versions reported with a line-level evidence
+- **`deps` against real manifests** — resolved versions reported with a line-level evidence
   pointer into the lockfile, and absent dependencies reported as established absences rather
-  than silent skips. Verified against a populated npm v3 lockfile and fixture lockfiles for
-  Cargo.lock and go.mod.
+  than silent skips. Verified against a populated npm v3 lockfile, a real `go.mod` (the *declared*
+  requirement, not a resolved build graph) and a real `Cargo.lock` (366 pinned-version facts on
+  the rustls run), plus fixture lockfiles for npm v1/v2/v3, Cargo.lock and go.mod in the suite.
 - **Adjudication recall and specificity**, measured blind: **10/10 cases**, 4 real
   vulnerabilities all caught, 6 non-vulnerabilities all correctly cleared, no abstentions.
   Round 2 repeated every case three times — **30 adjudications, zero flips**, four of them
@@ -288,9 +299,12 @@ This project tries to be explicit about the difference. Current state:
   discipline reaches the right verdict *on a claim*. It does not measure whether the claims would
   be found in the first place. The cases are deliberately constructed. The crewAI case study
   surfaced one INCONCLUSIVE (pickle deserialization, supply-chain-dependent) and refuted the
-  rest — a directional signal, not a rate.
-- **Recall in the field.** The benchmark's real-bug cases are constructed; whether the
-  discipline helps on code nobody staged for it is unmeasured.
+  rest — a directional signal, not a rate. The rustls run reached a TRUE POSITIVE on a real
+  flaw, but the range was chosen *from* the published advisory, so it shows the gates let a
+  genuine finding through; it does not show the coarse screen would have found it unaided.
+- **Recall in the field.** The benchmark's real-bug cases are constructed, and the real-repository
+  runs so far aimed at ranges already known to contain a fix. Whether the discipline helps on code
+  nobody staged for it is unmeasured.
 - **Source maps, bundlers, monorepos** for the coverage producer. Untested.
 - **A real model round on CI.** The golden round is deterministic plumbing, not an
   adjudication: it writes the ground truth into the reports by design. A model round needs
@@ -302,10 +316,18 @@ This project tries to be explicit about the difference. Current state:
   detected but not parsed (reported as *not evaluated*, never guessed at); go.mod reports the
   *declared* requirement, not the resolved build version; and the producer never maps a version
   to a CVE — that mapping is deliberately left to the adjudication layer.
-- **Anything about the case-study targets' security** — the runs found nothing to endorse or
-  condemn; that is not a statement about either project. See
-  [`docs/case-study-crewai.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-crewai.md) and
-  [`docs/case-study-axe-core.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-axe-core.md).
+- **Anything about the case-study targets' security.** These are method runs, not assessments.
+  Three of them found nothing to report. The fourth confirmed a real flaw in rustls 0.23.44, but
+  one already published and already fixed upstream (RUSTSEC-2026-0285 / GHSA-2mjx-qc3c-rqvc) which
+  the run re-verified rather than discovered, so none of them is a statement about any project's
+  security posture. See
+  [`docs/case-study-crewai.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-crewai.md),
+  [`docs/case-study-axe-core.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-axe-core.md),
+  [`docs/case-study-act.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-act.md),
+  and [`docs/case-study-rust.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-rust.md).
+- **A CI recipe, by running it on GitHub.** The exit-code gate and the workflow wiring are
+  documented in [`docs/ci-integration.md`](https://github.com/slow-stack/euthyna/blob/main/docs/ci-integration.md);
+  the workflow snippet has not been exercised as a live Actions run.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "euthyna",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Deterministic fact producers for security auditing: which deleted code came from a security fix, and which changed symbols no test ever executed.",
   "type": "module",
   "main": "./plugin/index.js",

package/plugin.yaml

@@ -1,5 +1,5 @@
 name: euthyna
-version: 0.5.0
+version: 0.7.0
 description: euthyna audit discipline — slash commands that drive the euthyna fact-producing CLI (history / coverage / deps / gate)
 license: Apache-2.0
 homepage: https://github.com/slow-stack/euthyna

package/src/cli.js

@@ -21,7 +21,7 @@ import { collectCoverageFacts } from './facts/coverage.js';
 import { collectDependencyFacts, listDependencies, detectManifest, manifestTypeForFile } from './facts/deps.js';
 import { parseGateReport, validateFindings, verifyFinding, renderGateReport } from './gate.js';
 import { makeReport, renderReport, safeTextLines, KIND } from './contract.js';
-import { repoToplevel, revParse } from './git.js';
+import { repoToplevel, revParse, git } from './git.js';
 import { resolveLang, T, isLang, DEFAULT_LANG } from './lang.js';
 
 export const EXIT = Object.freeze({
@@ -73,7 +73,7 @@ euthyna —— 给 AI 编码 agent 用的确定性事实产出器
 用法:
   euthyna audit    --base <rev> [--head <rev>] [--repo <dir>] [--pickaxe] [--no-origins] [--json]
   euthyna history  --base <rev> [--head <rev>] [--repo <dir>] [--pickaxe] [--no-origins] [--json]
-  euthyna coverage --coverage <file> --symbol <name> [--file <path>] [--json]
+  euthyna coverage --coverage <file> --symbol <name> [--file <path>] [--source <dir>] [--json]
   euthyna deps     [--repo <dir>] [--lockfile <file>] (--dep <name> | --all) [--json]
   euthyna gate     <报告文件> [--verify] [--cwd <dir>] [--json]
 
@@ -92,6 +92,8 @@ euthyna —— 给 AI 编码 agent 用的确定性事实产出器
              --coverage  覆盖率数据文件，c8 的 coverage-final.json
              --symbol    要查询的符号名，可重复
              --file      可选，限定到某个文件
+             --source    可选，Go profile（go test -coverprofile）必需：模块根目录，
+                         用于把行区间映射回函数（profile 不含函数名）
   deps       某个依赖在 lockfile 里被锁定/声明成什么版本（供应链声明的裁决依据）
              --repo      可选，依赖清单所在目录（默认当前目录，自动检测）
              --lockfile  可选，显式指定清单文件（支持 package-lock.json / Cargo.lock / go.mod）
@@ -123,7 +125,7 @@ reliably, and writes the answers as facts with evidence.
 Usage:
   euthyna audit    --base <rev> [--head <rev>] [--repo <dir>] [--pickaxe] [--no-origins] [--json]
   euthyna history  --base <rev> [--head <rev>] [--repo <dir>] [--pickaxe] [--no-origins] [--json]
-  euthyna coverage --coverage <file> --symbol <name> [--file <path>] [--json]
+  euthyna coverage --coverage <file> --symbol <name> [--file <path>] [--source <dir>] [--json]
   euthyna deps     [--repo <dir>] [--lockfile <file>] (--dep <name> | --all) [--json]
   euthyna gate     <report file> [--verify] [--cwd <dir>] [--json]
 
@@ -147,6 +149,9 @@ Commands:
              --coverage  the coverage data file, c8's coverage-final.json
              --symbol    symbol name(s) to query, repeatable
              --file      optional, restrict to one file
+             --source    optional, required for Go profiles (go test -coverprofile):
+                         the module root, used to map line ranges back to
+                         functions (the profile carries no function names)
   deps       what version does the lockfile pin or declare for a dependency? (the basis for supply-chain claims)
              --repo      optional, directory containing the manifest (default cwd, auto-detected)
              --lockfile  optional, explicit manifest path (package-lock.json / Cargo.lock / go.mod)
@@ -305,6 +310,7 @@ async function runCoverage(flags, lang) {
   );
   const symbols = asArray(flags.symbol).map(String);
   const file = flags.file ? String(flags.file) : undefined;
+  const source = flags.source ? path.resolve(String(flags.source)) : undefined;
 
   // Asking for nothing is a caller mistake, not a measurement failure.
   if (symbols.length === 0) {
@@ -318,12 +324,13 @@ async function runCoverage(flags, lang) {
   const { facts, evaluated, notEvaluated, measured } = await collectCoverageFacts({
     coverageFile,
     targets,
+    source,
     lang
   });
 
   const report = makeReport({
     producer: producerFor(COVERAGE_PRODUCER, lang),
-    subject: { coverageFile, symbols, file },
+    subject: { coverageFile, symbols, file, ...(source ? { source } : {}) },
     facts,
     evaluated,
     notEvaluated
@@ -402,6 +409,50 @@ async function runDeps(flags, lang) {
  * symbol names only the adjudicator knows, so there is nothing honest to
  * auto-measure there.
  */
+/**
+ * Decide whether the manifest `audit` measured is the manifest --head holds.
+ *
+ * Pure, so that the fail-closed branch — a probe that could not run — is reachable
+ * from a test. Nothing else here can make git fail on demand.
+ */
+export function manifestVersionGap({ probeFailed, existsAtHead, differsFromHead, head, worktree, manifest }, t) {
+  const short = (sha) => (sha ?? '').slice(0, 10);
+  const where = worktree && worktree !== head ? `（工作区检出在 ${short(worktree)}）` : '';
+  const whereEn = worktree && worktree !== head ? ` (the worktree is at ${short(worktree)})` : '';
+
+  if (probeFailed) {
+    return {
+      kind: KIND.DEPENDENCY,
+      code: 'manifest-unverified',
+      reason: t(
+        `无法确认依赖清单 ${manifest} 与 --head ${short(head)} 的关系：git 探测失败，这不是匹配的证据`,
+        `the relationship between the manifest ${manifest} and --head ${short(head)} could not be probed: git failed, which is not evidence of a match`
+      )
+    };
+  }
+  if (!existsAtHead) {
+    return {
+      kind: KIND.DEPENDENCY,
+      code: 'manifest-not-head',
+      reason: t(
+        `测到的依赖清单 ${manifest} 在 --head ${short(head)} 里不存在，它不属于任何被审的提交${where}`,
+        `the dependency manifest ${manifest} measured here does not exist at --head ${short(head)}; it belongs to no reviewed commit${whereEn}`
+      )
+    };
+  }
+  if (differsFromHead) {
+    return {
+      kind: KIND.DEPENDENCY,
+      code: 'manifest-not-head',
+      reason: t(
+        `测到的依赖清单 ${manifest} 与 --head ${short(head)} 那份内容不一致${where}，这些事实不是该提交的声明版本`,
+        `the dependency manifest ${manifest} measured here differs in content from the one at --head ${short(head)}${whereEn}, so these facts are not that commit's declared versions`
+      )
+    };
+  }
+  return null;
+}
+
 async function runAudit(flags, lang) {
   const t = T(lang);
   const cwd = path.resolve(flags.repo ? String(flags.repo) : process.cwd());
@@ -469,6 +520,38 @@ async function runAudit(flags, lang) {
     depNotEvaluated.push({ kind: KIND.DEPENDENCY, reason: depResult.error });
   }
 
+  // history takes the commits named by --base/--head; deps takes the manifest
+  // checked out in --repo. The honest question is therefore about CONTENT: is the
+  // file that was measured the file --head holds? Comparing commit shas instead was
+  // measured to be wrong in both directions — it fired on a PR merge commit whose
+  // lockfile is byte-identical to --head's (which, per fact-contract rule 1, forces
+  // every finding citing a dependency fact to not_evaluated), and stayed silent on a
+  // gitignored lockfile that belongs to no commit at all.
+  const manifest = typeof depResult.report?.subject?.lockfile === 'string'
+    ? depResult.report.subject.lockfile
+    : undefined;
+  if (manifest) {
+    const probe = { probeFailed: false, existsAtHead: false, differsFromHead: true };
+    if (path.isAbsolute(manifest)) {
+      const rel = path.relative(toplevel, manifest).split(path.sep).join('/');
+      try {
+        probe.existsAtHead = (await git(['ls-tree', head, '--', rel], { cwd: toplevel })).trim() !== '';
+        probe.differsFromHead = !probe.existsAtHead ||
+          (await git(['diff', '--name-only', head, '--', rel], { cwd: toplevel })).trim() !== '';
+      } catch {
+        // A probe that could not run is not evidence of a match.
+        probe.probeFailed = true;
+      }
+    } else {
+      probe.probeFailed = true;
+    }
+    const versionGap = manifestVersionGap(
+      { ...probe, head, worktree: await revParse(toplevel, 'HEAD'), manifest: path.basename(manifest) },
+      t
+    );
+    if (versionGap) depNotEvaluated.push(versionGap);
+  }
+
   const facts = [...history.facts, ...depFacts];
   const evaluated = [...history.evaluated, ...depEvaluated];
   const notEvaluated = [...history.notEvaluated, ...depNotEvaluated];

package/src/facts/coverage.js

@@ -17,11 +17,10 @@
  * There is no code path here that emits "executed". That is the design, not an
  * omission. See docs/fact-contract-zh.md section 6.2.
  */
-import { readFile } from 'node:fs/promises';
+import { readFile, readdir } from 'node:fs/promises';
 import path from 'node:path';
 import { makeFact, notEvaluated as notEvaluatedEntry, KIND, STATUS, shellQuote } from '../contract.js';
 import { T, DEFAULT_LANG } from '../lang.js';
-
 /** c8's default exclusions. A production file matching one of these vanishes from the report. */
 const C8_DEFAULT_EXCLUDES = [
   /(^|\/)node_modules\//,
@@ -52,11 +51,12 @@ function matchesTarget(entryPath, target) {
  * break on any path containing a quote, and the point of the field is that a
  * reader can re-derive the claim without trusting this report.
  */
-function reproduceCommand({ coverageFile, symbol, file }) {
+function reproduceCommand({ coverageFile, symbol, file, source }) {
   return (
     `euthyna coverage --coverage ${shellQuote(coverageFile)} ` +
     `--symbol ${shellQuote(symbol)}` +
-    (file ? ` --file ${shellQuote(file)}` : '')
+    (file ? ` --file ${shellQuote(file)}` : '') +
+    (source ? ` --source ${shellQuote(source)}` : '')
   );
 }
 
@@ -82,6 +82,12 @@ function reproduceCommand({ coverageFile, symbol, file }) {
  *    evidence that the function was never entered. coverage.py reports
  *    functions that were never called as long as their module was loaded,
  *    which is exactly what makes "never invoked" an established fact.
+ * 4. Go coverage profiles (`go test -coverprofile`) — text, `mode:` header
+ *    plus one line per block (`path:startL.startC,endL.endC stmts count`).
+ *    No function names: the two-state mapping runs through function ranges
+ *    parsed from the gofmt'd source under --source (module root). A file
+ *    absent from the profile is *not* evidence of "never executed" (the
+ *    package may not be in the test binary), so absence is notEvaluated.
  *
  * Anything that matches none of these shapes is **not a coverage report this
  * producer can read**, and is reported as notEvaluated — never fed through the
@@ -89,9 +95,160 @@ function reproduceCommand({ coverageFile, symbol, file }) {
  */
 export async function loadCoverage(coverageFile) {
   const raw = await readFile(coverageFile, 'utf8');
+  if (isGoProfileText(raw)) {
+    const parsed = parseGoProfile(raw);
+    if (!parsed) {
+      throw new Error(
+        'the file starts like a Go coverage profile ("mode:" header) but the body has lines that do not match ' +
+          '"file:startLine.startCol,endLine.endCol numStatements count" — refusing to interpret it as coverage'
+      );
+    }
+    return parsed;
+  }
   return JSON.parse(raw);
 }
 
+/**
+ * Go coverage profiles (`go test -coverprofile`) are text, not JSON:
+ *
+ *   mode: set
+ *   github.com/nektos/act/pkg/artifacts/artifact.pb.go:42.2,43.29 2 0
+ *
+ * One line per *block* — a line range with a statement count and a hit count.
+ * There are **no function names**, so a symbol query needs the source tree
+ * (via --source, the module root) to map line ranges back to functions:
+ * goFunctionRanges() reads the gofmt'd source, whose top-level `func`
+ * declarations start at column 0 and end at a `}` at column 0.
+ */
+function isGoProfileText(raw) {
+  const first = String(raw).split(/\r?\n/, 1)[0];
+  return /^mode:\s*(set|count|atomic)\s*$/.test(first);
+}
+
+const GO_BLOCK_RE = /^(.+):(\d+)\.(\d+),(\d+)\.(\d+)\s+(\d+)\s+(\d+)$/;
+
+/** Parse a Go profile into `{ __go, mode, files: Map<path, blocks[]> }`, or null if malformed. */
+export function parseGoProfile(raw) {
+  const lines = String(raw).split(/\r?\n/);
+  const mode = /^mode:\s*(set|count|atomic)\s*$/.exec((lines[0] ?? '').trim())?.[1];
+  if (!mode) return null;
+
+  const files = new Map();
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line.trim()) continue;
+    const m = GO_BLOCK_RE.exec(line);
+    if (!m) return null;
+    const [, file, startLine, , endLine, , statements, count] = m;
+    let blocks = files.get(file);
+    if (!blocks) {
+      blocks = [];
+      files.set(file, blocks);
+    }
+    blocks.push({
+      startLine: Number(startLine),
+      endLine: Number(endLine),
+      statements: Number(statements),
+      count: Number(count)
+    });
+  }
+  return { __go: true, mode, files };
+}
+
+/**
+ * The code visible on each line: comments and raw-string contents blanked out,
+ * with multi-line `/*...*​/` and `...` regions tracked across lines.
+ *
+ * Without this, a commented-out function, a `}` at column 0 inside a block
+ * comment, or a raw string with a column-0 brace would create phantom function
+ * ranges or split real ones — and coverage blocks would be assigned to the
+ * wrong function, which is a false coverage result.
+ */
+function goSignificantLines(text) {
+  const out = [];
+  let inBlock = false;
+  let inRaw = false;
+  for (const line of String(text).split(/\r?\n/)) {
+    let sig = '';
+    let i = 0;
+    while (i < line.length) {
+      const ch = line[i];
+      if (inBlock) {
+        if (ch === '*' && line[i + 1] === '/') {
+          inBlock = false;
+          i += 2;
+          continue;
+        }
+        i++;
+        continue;
+      }
+      if (inRaw) {
+        if (ch === '`') inRaw = false;
+        i++;
+        continue;
+      }
+      if (ch === '`') {
+        inRaw = true;
+        i++;
+        continue;
+      }
+      if (ch === '/' && line[i + 1] === '/') break; // rest of the line is a comment
+      if (ch === '/' && line[i + 1] === '*') {
+        inBlock = true;
+        i += 2;
+        continue;
+      }
+      sig += ch;
+      i++;
+    }
+    out.push(sig);
+  }
+  return out;
+}
+
+/**
+ * Top-level function ranges of a gofmt'd Go source file.
+ *
+ * Only `func` at column 0 of *significant* code matches: nested (indented)
+ * declarations are left alone, which is the point — a closure inside a
+ * function is part of that function's range. A function ends at the next `}`
+ * at column 0, or on its own declaration line when the whole function sits on
+ * that line (`func f() {}`), so a later package-level block is not absorbed.
+ * Methods are reported under their bare method name (two types may share it;
+ * every match is reported, mirroring how c8 reports every fnMap entry with a
+ * given name).
+ */
+export function goFunctionRanges(text) {
+  const lines = goSignificantLines(text);
+  const funcs = [];
+  let current = null;
+  const declRe = /^func\s*(?:\([^)]*\))?\s*([A-Za-z_]\w*)/;
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (current && /^}/.test(line)) {
+      funcs.push({ ...current, endLine: i + 1 });
+      current = null;
+      continue;
+    }
+    if (/^func\s/.test(line)) {
+      // a new decl with no closing brace in between: close the previous range
+      // at the previous line rather than swallowing the new declaration
+      if (current) funcs.push({ ...current, endLine: i });
+      const name = declRe.exec(line)?.[1];
+      current = name ? { name, startLine: i + 1 } : null;
+      // the whole function on one line (gofmt keeps empty ones there): close
+      // it on its own line
+      if (current && /\}\s*$/.test(line)) {
+        funcs.push({ ...current, endLine: i + 1 });
+        current = null;
+      }
+    }
+  }
+  if (current) funcs.push({ ...current, endLine: lines.length });
+  return funcs;
+}
+
 /**
  * True for coverage.py's `{"meta": {...}, "files": {...}}` shape.
  * A c8 report never has a top-level `meta` key.
@@ -115,6 +272,7 @@ function isCoveragePyReport(coverage) {
  * honestly is still part of the fact, so the distinction is kept.
  */
 export function detectCoverageFormat(coverage) {
+  if (coverage && typeof coverage === 'object' && coverage.__go) return 'go';
   if (isCoveragePyReport(coverage)) return 'coverage.py';
 
   const entries = Object.entries(coverage).filter(([, v]) => v && typeof v === 'object');
@@ -210,8 +368,10 @@ function locateSymbolInEntry(entry, symbol) {
  * @param {object} options
  * @param {string} options.coverageFile
  * @param {Array<{file?: string, symbol: string}>} options.targets
+ * @param {string} [options.source] module root for Go profiles (--source), whose
+ *   source files are needed to map profile line ranges back to functions
  */
-export async function collectCoverageFacts({ coverageFile, targets = [], lang = DEFAULT_LANG } = {}) {
+export async function collectCoverageFacts({ coverageFile, targets = [], source, lang = DEFAULT_LANG } = {}) {
   const t = T(lang);
   const facts = [];
   const evaluated = [];
@@ -238,6 +398,13 @@ export async function collectCoverageFacts({ coverageFile, targets = [], lang =
 
   const isPy = isCoveragePyReport(coverage);
 
+  // Go profiles take a dedicated path: the report is a block list with no
+  // function names, so symbol location needs the source tree and the
+  // two-state mapping runs through function ranges, not per-file function maps.
+  if (coverage.__go) {
+    return collectGoCoverageFacts({ coverage, coverageFile, targets, source, lang });
+  }
+
   // c8: entries are the report's file keys directly.
   // coverage.py: the file entries live under `files`.
   const entries = Object.entries(isPy ? (coverage.files ?? {}) : coverage).filter(
@@ -435,3 +602,316 @@ export async function collectCoverageFacts({ coverageFile, targets = [], lang =
 
   return { facts, evaluated, notEvaluated, measured: true };
 }
+
+/**
+ * The Go-profile path.
+ *
+ * Profile lines carry no function names, so the two-state mapping goes:
+ * block list -> function ranges from the gofmt'd source -> per-function hit.
+ * The module root (--source) is required; profile paths are import paths
+ * (`module/dir/file.go`) or absolute paths, so resolution tries go.mod's
+ * module prefix and the plain path under the root before giving up — and a
+ * file it cannot resolve is reported as notEvaluated, never as uncovered.
+ */
+async function collectGoCoverageFacts({ coverage, coverageFile, targets, source, lang }) {
+  const t = T(lang);
+  const facts = [];
+  const evaluated = [];
+  const notEvaluated = [];
+  let counter = 0;
+
+  if (coverage.files.size === 0) {
+    notEvaluated.push(
+      notEvaluatedEntry(
+        KIND.TEST_COVERAGE,
+        t(
+          'Go coverage profile 为空（只有 mode 头）。测试没有加载到任何被编译的包，' +
+            '或 -coverpkg 没有指向被测代码',
+          'The Go coverage profile is empty (mode header only). The test run loaded no compiled package, ' +
+            'or -coverpkg did not point at the code under test'
+        )
+      )
+    );
+    return { facts, evaluated, notEvaluated, measured: false };
+  }
+
+  if (targets.length === 0) {
+    notEvaluated.push(
+      notEvaluatedEntry(
+        KIND.TEST_COVERAGE,
+        t('没有指定要查询的符号（--symbol）', 'no symbol requested for query (--symbol)')
+      )
+    );
+    return { facts, evaluated, notEvaluated, measured: false };
+  }
+
+  let module = null;
+  if (source) {
+    try {
+      module = modulePrefix(await readFile(path.join(source, 'go.mod'), 'utf8'));
+    } catch {
+      // no go.mod at the root: relative import paths then cannot be resolved,
+      // and the per-file resolution below reports that honestly
+    }
+  }
+
+  const sourceCache = new Map();
+  async function resolveSource(profilePath) {
+    if (sourceCache.has(profilePath)) return sourceCache.get(profilePath);
+    let result = null;
+    if (source) {
+      const candidates = [];
+      if (path.isAbsolute(profilePath)) {
+        candidates.push(profilePath);
+      } else {
+        if (module && profilePath.startsWith(module + '/')) {
+          candidates.push(path.join(source, profilePath.slice(module.length + 1)));
+        }
+        candidates.push(path.join(source, profilePath));
+      }
+      for (const candidate of candidates) {
+        try {
+          result = { text: await readFile(candidate, 'utf8'), resolved: candidate };
+          break;
+        } catch {
+          // try the next candidate, then report honestly
+        }
+      }
+    }
+    sourceCache.set(profilePath, result);
+    return result;
+  }
+
+  if (!source) {
+    notEvaluated.push(
+      notEvaluatedEntry(
+        KIND.TEST_COVERAGE,
+        t(
+          'Go 的 -coverprofile 是文本格式且不含函数名，函数级裁定需要 --source <模块根目录> ' +
+            '把行区间映射回函数。没有源码，符号查询无法进行',
+          'A Go -coverprofile is text and carries no function names; a function-level verdict needs ' +
+            '--source <module root> to map line ranges back to functions. Without the source, symbol queries cannot run'
+        )
+      )
+    );
+    return { facts, evaluated, notEvaluated, measured: false };
+  }
+
+  const entries = [...coverage.files.entries()];
+
+  for (const target of targets) {
+    const scoped = target.file
+      ? entries.filter(([entryPath]) => matchesTarget(entryPath, target.file))
+      : entries;
+
+    if (target.file && scoped.length === 0) {
+      // For Go this must NOT read as "never executed": a file absent from the
+      // profile may simply not have been compiled into the test binary at all.
+      notEvaluated.push(
+        notEvaluatedEntry(
+          KIND.TEST_COVERAGE,
+          t(
+            `${target.file} 没有出现在 Go coverage profile 中 —— 该文件所在的包可能根本没被编译进这次测试二进制` +
+              '（--coverpkg 或运行对应包才能测到它），「未出现」不能当「未执行」',
+            `${target.file} does not appear in the Go coverage profile — its package may not have been compiled into the test binary at all ` +
+              '(-coverpkg or running that package is required to measure it), so "absent" must not be read as "never executed"'
+          )
+        )
+      );
+      continue;
+    }
+
+    let matched = 0;
+    let unresolved = false;
+    for (const [entryPath, blocks] of scoped) {
+      const src = await resolveSource(entryPath);
+      if (!src) {
+        unresolved = true;
+        notEvaluated.push(
+          notEvaluatedEntry(
+            KIND.TEST_COVERAGE,
+            t(
+              `profile 中的 ${entryPath} 无法在 --source ${source} 下定位（go.mod 模块前缀已尝试）—— ` +
+                '没有该源文件，行区间无法映射回函数',
+              `The profile entry ${entryPath} cannot be located under --source ${source} (the go.mod module prefix was tried) — ` +
+                'without that source file, line ranges cannot be mapped back to functions'
+            )
+          )
+        );
+        continue;
+      }
+
+      for (const fn of goFunctionRanges(src.text)) {
+        if (fn.name !== target.symbol) continue;
+        const inFn = blocks.filter(b => b.startLine >= fn.startLine && b.startLine <= fn.endLine);
+        if (inFn.length === 0) continue; // no measured block: cannot answer for this function
+        matched++;
+        const invoked = inFn.some(b => b.count > 0);
+
+        if (!invoked) {
+          facts.push(
+            makeFact({
+              id: `coverage-${++counter}`,
+              kind: KIND.TEST_COVERAGE,
+              statement:
+                t(
+                  `符号 ${target.symbol} 在本次测试运行中一次都没有被调用（函数体内所有覆盖区块的执行计数为 0）—— ` +
+                    `任何依赖它的行为都没有被执行验证`,
+                  `Symbol ${target.symbol} was never invoked in this test run (every coverage block inside the function has a hit count of 0) — ` +
+                    `any behavior depending on it was never exercised`
+                ),
+              status: STATUS.ESTABLISHED,
+              evidence: { file: entryPath, line: fn.startLine },
+              method: 'command',
+              command: reproduceCommand({ coverageFile, symbol: target.symbol, file: entryPath, source }),
+              detail: { symbol: target.symbol, invocationCount: 0, reason: 'invocation_count_zero' }
+            })
+          );
+        } else {
+          facts.push(
+            makeFact({
+              id: `coverage-${++counter}`,
+              kind: KIND.TEST_COVERAGE,
+              statement:
+                t(
+                  `符号 ${target.symbol} 至少被调用过一次，但被调用**不能**证明任何特定调用点执行过 —— ` +
+                    `本事实只能证伪，不能证实`,
+                  `Symbol ${target.symbol} was invoked at least once, but being invoked **cannot** prove any specific call site ran — ` +
+                    `this fact can only falsify, never confirm`
+                ),
+              status: STATUS.UNKNOWN,
+              evidence: { file: entryPath, line: fn.startLine },
+              method: 'command',
+              command: reproduceCommand({ coverageFile, symbol: target.symbol, file: entryPath, source }),
+              detail: {
+                symbol: target.symbol,
+                invocationCount: 1,
+                reason: 'nonzero_count_cannot_prove_call_site_execution'
+              }
+            })
+          );
+        }
+      }
+    }
+
+    // "could not locate" implies we searched the data; when the source file
+    // needed to even read the data was missing, the notEvaluated entry above
+    // is the honest record and no locating claim is made.
+    if (matched === 0 && !unresolved) {
+      // With --source we can tell "not located" apart from "lives in a file the
+      // profile never saw": a symbol declared in a file absent from the profile
+      // is a refusal (its package was probably not compiled in), not an answer.
+      const elsewhere = await findGoSymbolOutsideProfile(coverage, source, module, target.symbol);
+      if (elsewhere) {
+        notEvaluated.push(
+          notEvaluatedEntry(
+            KIND.TEST_COVERAGE,
+            t(
+              `符号 ${target.symbol} 在 ${elsewhere} 中有顶层声明，但该文件没有出现在 Go coverage profile 里 —— ` +
+                '它所在的包多半没被编译进这次测试二进制（-coverpkg 或运行对应包才能测到它）。' +
+                '这是「未评估」，既不是「从未调用」也不是「无法定位」',
+              `Symbol ${target.symbol} is declared in ${elsewhere}, but that file does not appear in the Go coverage profile — ` +
+                'its package was probably not compiled into this test binary (-coverpkg or running that package is required to measure it). ' +
+                'This is "not evaluated": neither "never invoked" nor "could not locate"'
+            )
+          )
+        );
+        continue;
+      }
+      facts.push(
+        makeFact({
+          id: `coverage-${++counter}`,
+          kind: KIND.TEST_COVERAGE,
+          statement:
+            t(
+              `未能在覆盖率数据中定位符号 ${target.symbol}`,
+              `Could not locate symbol ${target.symbol} in the coverage data`
+            ) +
+            (target.file ? t(`（限定文件 ${target.file}）`, ` (restricted to file ${target.file})`) : '') +
+            t(
+              ' —— 可能是被重命名、被内联，或它不是顶层 func 声明（Go profile 只携带行区间，' +
+                '函数边界来自源码中的顶层 func）',
+              ' — it may have been renamed, inlined, or it is not a top-level func declaration (a Go profile carries line ranges only; ' +
+                'function boundaries come from top-level funcs in the source)'
+            ),
+          status: STATUS.UNKNOWN,
+          evidence: { file: target.file ?? t('(未限定文件)', '(unrestricted file)') },
+          method: 'static',
+          detail: { symbol: target.symbol, reason: 'symbol_not_located_in_fnmap' }
+        })
+      );
+    }
+  }
+
+  // A query that produced no fact and only refusals was not answered —
+  // "measured" must not let CI read it as clean.
+  const measured = facts.length > 0;
+  if (measured) {
+    evaluated.push({
+      kind: KIND.TEST_COVERAGE,
+      producer: 'euthyna-coverage',
+      format: 'go',
+      count: facts.length
+    });
+  }
+
+  return { facts, evaluated, notEvaluated, measured };
+}
+
+function modulePrefix(goModText) {
+  return /^\s*module\s+(\S+)/m.exec(goModText)?.[1] ?? null;
+}
+
+const GO_WALK_SKIP = new Set(['vendor', 'testdata', 'node_modules', '.git']);
+
+/**
+ * Does the symbol exist in a .go file that the profile does not cover?
+ *
+ * Walks the module root (skipping vendor/testdata and hidden dirs), maps each
+ * file to its import path, and reports the first file — relative to the
+ * module root — whose top-level functions include the symbol while the file
+ * itself is absent from the profile. The whole-tree scan only runs on the
+ * rare "matched 0" path, so the common query pays nothing for it.
+ */
+async function findGoSymbolOutsideProfile(coverage, source, module, symbol) {
+  if (!source) return null;
+
+  // absolute disk paths the profile already accounts for
+  const covered = new Set();
+  for (const profilePath of coverage.files.keys()) {
+    if (path.isAbsolute(profilePath)) {
+      covered.add(path.resolve(profilePath).replace(/\\/g, '/').toLowerCase());
+    }
+  }
+
+  async function* walk(dir) {
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name.endsWith('.go')) yield path.join(dir, entry.name);
+      else if (entry.isDirectory() && !GO_WALK_SKIP.has(entry.name) && !entry.name.startsWith('.')) {
+        yield* walk(path.join(dir, entry.name));
+      }
+    }
+  }
+
+  for await (const file of walk(source)) {
+    const abs = path.resolve(file).replace(/\\/g, '/').toLowerCase();
+    if (covered.has(abs)) continue;
+    const rel = path.relative(source, file).replace(/\\/g, '/');
+    const importPath = module ? `${module}/${rel}` : rel;
+    if (coverage.files.has(importPath) || coverage.files.has(rel)) continue;
+    let text;
+    try {
+      text = await readFile(file, 'utf8');
+    } catch {
+      continue;
+    }
+    if (goFunctionRanges(text).some(fn => fn.name === symbol)) return rel;
+  }
+  return null;
+}

package/src/facts/deps.js

@@ -425,11 +425,11 @@ export async function collectDependencyFacts({ cwd = process.cwd(), lockfile, de
             t(
               `依赖 ${dep} 在 ${listLabel}（${target.type}）中被${verb}为版本 ${versions.join(' / ')}` +
                 (isGo
-                  ? ' —— 这是声明的需求版本，非最终解析版本（go.sum 不含版本，无法在此验证解析结果）'
+                  ? ' —— 这是声明的需求版本，非最终解析版本（选定版本由 MVS 对整个模块图求解，go.sum 记录版本与哈希但不含选定的构建清单，deps 不做模块图解析）'
                   : ''),
               isGo
                 ? `Dependency ${dep} is declared as version ${versions.join(' / ')} in the ${listLabel} (${target.type})` +
-                  ' — this is the declared requirement version, not the final resolved version (go.sum carries no versions, so the resolution cannot be verified here)'
+                  ' — this is the declared requirement version, not the final resolved version (the selected version comes from MVS over the whole module graph; go.sum records version-hash pairs but not the selected build list, and this producer does not resolve the module graph)'
                 : `Dependency ${dep} is locked to version ${versions.join(' / ')} in the ${listLabel} (${target.type})`
             ),
           status: STATUS.ESTABLISHED,