euthyna 0.6.0 → 0.7.0

package/.agents/skills/euthyna/references/dependency-audit.md

@@ -48,6 +48,11 @@
 **目标目录必须有** `package.json` / `pyproject.toml` / `requirements*.txt` / `go.mod` 之一。
 没有就**直接说没有并停止**，不要为一个采集器不解析的生态即兴审计。
 
+**清单只按仓库根查找。**多包仓库里子包各自的 lock 不会被 `euthyna audit` 或 `euthyna deps --repo` 测到
+（🧪 实测 2026-10-10：根 `package-lock.json` 锁 `root-a`，子包 `packages/app/package-lock.json` 锁 `sub-b`/`sub-c`，
+输出只有 `root-a`，**并且没有任何声明**）。要管子包就逐包跑 `euthyna deps --lockfile <路径>`；
+不跑就明说没测——别把根清单当成整个 monorepo 的事实。
+
 **能精确解析版本的**：`package-lock.json`、`npm-shrinkwrap.json`、`uv.lock`、Go 1.17+ 的 `go.mod`。
 
 **不能的**：`yarn.lock`、`pnpm-lock.yaml`、`poetry.lock`。

package/.agents/skills/euthyna/references/fact-producers.md

@@ -294,4 +294,9 @@ node <euthyna 仓库>/bin/euthyna.js gate <报告文件> --verify --cwd <被审
 - `coverage` **只能证伪**。见上文。
 - `coverage` 依赖调用计数，**不处理动态派发、反射、字符串调用**。
   计数为 0 的结论在存在这些机制时要打折扣。
+- `audit` 的两个半边**读的不是同一个东西**：`history` 取 `--base`/`--head` 命名的提交，`deps` 取
+  `--repo` 所在**仓库根**当前检出的那份清单（清单只按仓库根查找）。所以判据是**内容**：测到的清单与 `--head` 那份不一致、或在那个提交里根本
+  不存在（被 gitignore 的锁文件就是这种），「未评估的判据」里会多一条写明文件名与 `--head` 的理由；
+  `code`（`manifest-not-head` / `manifest-unverified`）只在 `--json` 通道上。**看到它就检出到范围的一端再重跑**
+  ——声明只保证你不静默踩坑，不会替你把事实测对。
 - 两者都**不产出分数、严重性、修复建议**。这是契约，不是遗漏。

package/.agents/skills/euthyna-en/references/dependency-audit.md

@@ -48,6 +48,12 @@ Available discovery sources (use whichever is installed — **audit the source b
 **The target directory must have one of** `package.json` / `pyproject.toml` / `requirements*.txt` / `go.mod`.
 If none exists, **say so and stop** — do not improvise an audit for an ecosystem the collector does not parse.
 
+**Manifests are located from the repository root only.** A multi-package repository's per-package locks are not measured by
+`euthyna audit` or `euthyna deps --repo` (🧪 measured 2026-10-10: the root `package-lock.json` pins `root-a` while
+`packages/app/package-lock.json` pins `sub-b` and `sub-c`, and the output reports only `root-a`, **with no declaration at
+all**). Measuring a sub-package means running `euthyna deps --lockfile <path>` per package; if that is not done, say the
+sub-packages were not measured — do not treat the root manifest's facts as facts about the whole monorepo.
+
 **Exactly resolvable**: `package-lock.json`, `npm-shrinkwrap.json`, `uv.lock`, `go.mod` for Go 1.17+.
 
 **Not resolvable**: `yarn.lock`, `pnpm-lock.yaml`, `poetry.lock`.

package/.agents/skills/euthyna-en/references/fact-producers.md

@@ -280,4 +280,5 @@ that a conclusion without evidence is not handed over wearing the face of "estab
 - `history` only covers **deleted lines**. It does not handle newly added code (except with `--pickaxe`).
 - `coverage` **can only falsify**. See above.
 - `coverage` relies on invocation counts and **does not handle dynamic dispatch, reflection, or string-based calls**. Conclusions of count 0 must be discounted when such mechanisms exist.
+- The two halves of `audit` **do not read the same thing**: `history` takes the commits named by `--base`/`--head`, while `deps` takes the manifest **currently checked out at the root of the repository** `--repo` points into (manifests are located from the root only). So the criterion is **content**: when the manifest measured differs from the one at `--head`, or does not exist in that commit at all (a gitignored lockfile is exactly that), *Criteria not evaluated* gains an entry naming the file and `--head`. The `code` (`manifest-not-head` / `manifest-unverified`) appears only on the `--json` channel. **Seeing one means checking out an end of the range and re-running** — the declaration keeps the trap from being silent; it does not measure the fact for you.
 - Neither **produces scores, severity, or fix suggestions**. That is the contract, not an omission.

package/README.md

@@ -31,14 +31,19 @@ When an AI coding agent touches security, it fails in two specific ways:
 
 1. **It reports things that are not real.** Code that *looks* dangerous gets called a
    vulnerability, without tracing the data. In validation runs on real codebases — a
-   JavaScript one, a Python one, and a Go one — the pattern-matched "vulnerabilities" were
-   mostly false: **5 out of 5** refuted at the gates on the first run; **2 out of 3**
-   refuted, the third unresolved (INCONCLUSIVE, supply-chain-dependent) on the second;
-   **4 out of 4** refuted on the third. See the
+   JavaScript one, a Python one, a Go one, and a Rust one — the pattern-matched
+   "vulnerabilities" were mostly false: **5 out of 5** refuted at the gates on the first run;
+   **2 out of 3** refuted, the third unresolved (INCONCLUSIVE, supply-chain-dependent) on the
+   second; **4 out of 4** refuted on the third. The fourth run is the one that tests the other
+   half: it faced a real vulnerability, and the gates let it through — **1 TRUE POSITIVE**
+   (fourth gate evidenced by a PoC run against both the fixed and the unfixed release), 3
+   refuted, 1 INCONCLUSIVE. A sieve that only ever says no would have refuted that one too. See
+   the
    [case studies](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-crewai.md)
    ([Python/crewAI](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-crewai.md),
    [JavaScript/axe-core](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-axe-core.md),
-   [Go/nektos-act](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-act.md)).
+   [Go/nektos-act](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-act.md),
+   [Rust/rustls](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-rust.md)).
 2. **Its reassurances cannot be checked.** "I'm done." "The tests cover this." "It's
    safe now." These are assertions. You cannot tell a done-claim from a done-deal.
 
@@ -187,7 +192,7 @@ From a checkout instead (development):
 
 ```sh
 git clone https://github.com/slow-stack/euthyna
-cd euthyna && npm test                                 # 207 tests; no install step exists
+cd euthyna && npm test                                 # the whole suite; no install step exists
 node bin/euthyna.js audit --repo <path> --base main --head HEAD
 ```
 
@@ -241,19 +246,23 @@ This project tries to be explicit about the difference. Current state:
 
 ### Verified
 
-- **`history` attribution against real repositories — in two languages.** Run against
+- **`history` attribution against real repositories — in four languages.** Run against
   [axe-core](https://github.com/dequelabs/axe-core) (JavaScript) and
   [crewAI](https://github.com/crewAIInc/crewAI) (Python); deleted lines attributed to the
   commits that introduced them, then checked **by hand** against `git blame`. The checks
-  developed for that comparison now run as regression tests in the suite.
+  developed for that comparison now run as regression tests in the suite. The producer ran
+  unchanged on a Go repository ([nektos/act](https://github.com/nektos/act), where the deleted
+  lines of a security fix were traced back to the commit that introduced them) and on a Rust one
+  ([rustls](https://github.com/rustls/rustls), whose fix range yielded 43 provenance facts).
 - **`coverage` on real output in three formats** — c8/V8 JSON, classic istanbul (jest/nyc, same
   fnMap/f shape) and coverage.py JSON (format 3) — distinguishing all three states correctly, and
   refusing anything that is not a recognizable coverage report instead of answering "symbol not
   located" against it.
-- **`deps` against a real lockfile** — resolved versions reported with a line-level evidence
+- **`deps` against real manifests** — resolved versions reported with a line-level evidence
   pointer into the lockfile, and absent dependencies reported as established absences rather
-  than silent skips. Verified against a populated npm v3 lockfile and fixture lockfiles for
-  Cargo.lock and go.mod.
+  than silent skips. Verified against a populated npm v3 lockfile, a real `go.mod` (the *declared*
+  requirement, not a resolved build graph) and a real `Cargo.lock` (366 pinned-version facts on
+  the rustls run), plus fixture lockfiles for npm v1/v2/v3, Cargo.lock and go.mod in the suite.
 - **Adjudication recall and specificity**, measured blind: **10/10 cases**, 4 real
   vulnerabilities all caught, 6 non-vulnerabilities all correctly cleared, no abstentions.
   Round 2 repeated every case three times — **30 adjudications, zero flips**, four of them
@@ -290,9 +299,12 @@ This project tries to be explicit about the difference. Current state:
   discipline reaches the right verdict *on a claim*. It does not measure whether the claims would
   be found in the first place. The cases are deliberately constructed. The crewAI case study
   surfaced one INCONCLUSIVE (pickle deserialization, supply-chain-dependent) and refuted the
-  rest — a directional signal, not a rate.
-- **Recall in the field.** The benchmark's real-bug cases are constructed; whether the
-  discipline helps on code nobody staged for it is unmeasured.
+  rest — a directional signal, not a rate. The rustls run reached a TRUE POSITIVE on a real
+  flaw, but the range was chosen *from* the published advisory, so it shows the gates let a
+  genuine finding through; it does not show the coarse screen would have found it unaided.
+- **Recall in the field.** The benchmark's real-bug cases are constructed, and the real-repository
+  runs so far aimed at ranges already known to contain a fix. Whether the discipline helps on code
+  nobody staged for it is unmeasured.
 - **Source maps, bundlers, monorepos** for the coverage producer. Untested.
 - **A real model round on CI.** The golden round is deterministic plumbing, not an
   adjudication: it writes the ground truth into the reports by design. A model round needs
@@ -304,11 +316,15 @@ This project tries to be explicit about the difference. Current state:
   detected but not parsed (reported as *not evaluated*, never guessed at); go.mod reports the
   *declared* requirement, not the resolved build version; and the producer never maps a version
   to a CVE — that mapping is deliberately left to the adjudication layer.
-- **Anything about the case-study targets' security** — the runs found nothing to endorse or
-  condemn; that is not a statement about any of the projects. See
+- **Anything about the case-study targets' security.** These are method runs, not assessments.
+  Three of them found nothing to report. The fourth confirmed a real flaw in rustls 0.23.44, but
+  one already published and already fixed upstream (RUSTSEC-2026-0285 / GHSA-2mjx-qc3c-rqvc) which
+  the run re-verified rather than discovered, so none of them is a statement about any project's
+  security posture. See
   [`docs/case-study-crewai.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-crewai.md),
   [`docs/case-study-axe-core.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-axe-core.md),
-  and [`docs/case-study-act.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-act.md).
+  [`docs/case-study-act.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-act.md),
+  and [`docs/case-study-rust.md`](https://github.com/slow-stack/euthyna/blob/main/docs/case-study-rust.md).
 - **A CI recipe, by running it on GitHub.** The exit-code gate and the workflow wiring are
   documented in [`docs/ci-integration.md`](https://github.com/slow-stack/euthyna/blob/main/docs/ci-integration.md);
   the workflow snippet has not been exercised as a live Actions run.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "euthyna",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Deterministic fact producers for security auditing: which deleted code came from a security fix, and which changed symbols no test ever executed.",
   "type": "module",
   "main": "./plugin/index.js",

package/plugin.yaml

@@ -1,5 +1,5 @@
 name: euthyna
-version: 0.6.0
+version: 0.7.0
 description: euthyna audit discipline — slash commands that drive the euthyna fact-producing CLI (history / coverage / deps / gate)
 license: Apache-2.0
 homepage: https://github.com/slow-stack/euthyna

package/src/cli.js

@@ -21,7 +21,7 @@ import { collectCoverageFacts } from './facts/coverage.js';
 import { collectDependencyFacts, listDependencies, detectManifest, manifestTypeForFile } from './facts/deps.js';
 import { parseGateReport, validateFindings, verifyFinding, renderGateReport } from './gate.js';
 import { makeReport, renderReport, safeTextLines, KIND } from './contract.js';
-import { repoToplevel, revParse } from './git.js';
+import { repoToplevel, revParse, git } from './git.js';
 import { resolveLang, T, isLang, DEFAULT_LANG } from './lang.js';
 
 export const EXIT = Object.freeze({
@@ -409,6 +409,50 @@ async function runDeps(flags, lang) {
  * symbol names only the adjudicator knows, so there is nothing honest to
  * auto-measure there.
  */
+/**
+ * Decide whether the manifest `audit` measured is the manifest --head holds.
+ *
+ * Pure, so that the fail-closed branch — a probe that could not run — is reachable
+ * from a test. Nothing else here can make git fail on demand.
+ */
+export function manifestVersionGap({ probeFailed, existsAtHead, differsFromHead, head, worktree, manifest }, t) {
+  const short = (sha) => (sha ?? '').slice(0, 10);
+  const where = worktree && worktree !== head ? `（工作区检出在 ${short(worktree)}）` : '';
+  const whereEn = worktree && worktree !== head ? ` (the worktree is at ${short(worktree)})` : '';
+
+  if (probeFailed) {
+    return {
+      kind: KIND.DEPENDENCY,
+      code: 'manifest-unverified',
+      reason: t(
+        `无法确认依赖清单 ${manifest} 与 --head ${short(head)} 的关系：git 探测失败，这不是匹配的证据`,
+        `the relationship between the manifest ${manifest} and --head ${short(head)} could not be probed: git failed, which is not evidence of a match`
+      )
+    };
+  }
+  if (!existsAtHead) {
+    return {
+      kind: KIND.DEPENDENCY,
+      code: 'manifest-not-head',
+      reason: t(
+        `测到的依赖清单 ${manifest} 在 --head ${short(head)} 里不存在，它不属于任何被审的提交${where}`,
+        `the dependency manifest ${manifest} measured here does not exist at --head ${short(head)}; it belongs to no reviewed commit${whereEn}`
+      )
+    };
+  }
+  if (differsFromHead) {
+    return {
+      kind: KIND.DEPENDENCY,
+      code: 'manifest-not-head',
+      reason: t(
+        `测到的依赖清单 ${manifest} 与 --head ${short(head)} 那份内容不一致${where}，这些事实不是该提交的声明版本`,
+        `the dependency manifest ${manifest} measured here differs in content from the one at --head ${short(head)}${whereEn}, so these facts are not that commit's declared versions`
+      )
+    };
+  }
+  return null;
+}
+
 async function runAudit(flags, lang) {
   const t = T(lang);
   const cwd = path.resolve(flags.repo ? String(flags.repo) : process.cwd());
@@ -476,6 +520,38 @@ async function runAudit(flags, lang) {
     depNotEvaluated.push({ kind: KIND.DEPENDENCY, reason: depResult.error });
   }
 
+  // history takes the commits named by --base/--head; deps takes the manifest
+  // checked out in --repo. The honest question is therefore about CONTENT: is the
+  // file that was measured the file --head holds? Comparing commit shas instead was
+  // measured to be wrong in both directions — it fired on a PR merge commit whose
+  // lockfile is byte-identical to --head's (which, per fact-contract rule 1, forces
+  // every finding citing a dependency fact to not_evaluated), and stayed silent on a
+  // gitignored lockfile that belongs to no commit at all.
+  const manifest = typeof depResult.report?.subject?.lockfile === 'string'
+    ? depResult.report.subject.lockfile
+    : undefined;
+  if (manifest) {
+    const probe = { probeFailed: false, existsAtHead: false, differsFromHead: true };
+    if (path.isAbsolute(manifest)) {
+      const rel = path.relative(toplevel, manifest).split(path.sep).join('/');
+      try {
+        probe.existsAtHead = (await git(['ls-tree', head, '--', rel], { cwd: toplevel })).trim() !== '';
+        probe.differsFromHead = !probe.existsAtHead ||
+          (await git(['diff', '--name-only', head, '--', rel], { cwd: toplevel })).trim() !== '';
+      } catch {
+        // A probe that could not run is not evidence of a match.
+        probe.probeFailed = true;
+      }
+    } else {
+      probe.probeFailed = true;
+    }
+    const versionGap = manifestVersionGap(
+      { ...probe, head, worktree: await revParse(toplevel, 'HEAD'), manifest: path.basename(manifest) },
+      t
+    );
+    if (versionGap) depNotEvaluated.push(versionGap);
+  }
+
   const facts = [...history.facts, ...depFacts];
   const evaluated = [...history.evaluated, ...depEvaluated];
   const notEvaluated = [...history.notEvaluated, ...depNotEvaluated];