fini-proof 0.3.0

package/src/engines/hollow-tests.mjs

@@ -0,0 +1,121 @@
+// fini-proof engine: hollow-tests — tests that cannot fail.
+// JS/TS: a thin adapter over the ported Finipe F4 detector (./vendor/vacuous-spec-core.mjs, provenance there).
+// Python: NEW in fini-proof (Finipe has no Python test tree, so there was nothing to port); it applies the same
+// two load-bearing rules (NO_ASSERTION, TAUTOLOGICAL) to pytest/unittest functions.
+import { findVacuousSpecs, findTestBlocks, setRoot } from './vendor/vacuous-spec-core.mjs'
+
+// NEW (fini-proof): the ported F4 tautology rule is written for jest's expect(); node:assert tautologies
+// (assert(true), assert.ok(1), assert.equal(3, 3)) are added here for node:test / mocha+assert suites.
+const LIT = String.raw`(?:true|false|null|undefined|-?\d+(?:\.\d+)?|'[^']*'|"[^"]*")`
+const NODE_ASSERT_RE = /\bassert(?:\.(\w+))?\s*\(([^;\n]*)\)\s*;?\s*$/
+const NODE_TAUT_RE = new RegExp(String.raw`^\s*(?:(?:ok|strict)?\s*\(?\s*(?:true|1|'[^']+'|"[^"]+")\s*(?:,.*)?|(?:equal|strictEqual|deepEqual|deepStrictEqual)\s*\(?\s*(${LIT})\s*,\s*\1\s*(?:,.*)?)$`)
+function nodeAssertTautologies(source, already) {
+  const out = []
+  for (const b of findTestBlocks(source)) {
+    if (b.kind !== 'active' || already.has(b.line) || /\bexpect\s*\(/.test(b.bodyMasked)) continue
+    const calls = b.bodyText.split('\n').map((l) => NODE_ASSERT_RE.exec(l.trim())).filter(Boolean)
+    if (calls.length && calls.every((m) => NODE_TAUT_RE.test(`${m[1] ? m[1] + '(' : ''}${m[2]}`))) {
+      out.push({ line: b.line, rule: 'TAUTOLOGICAL', severity: 'high', message: 'every assertion in this test is a constant (assert(true) / assert.ok(true) / assert.equal(1, 1)) — it passes whatever the code does. FIX: assert on the real output of the unit under test.' })
+    }
+  }
+  return out
+}
+
+const JS_TEST_RE = /(^|\/)(__tests__\/.*\.(js|jsx|ts|tsx|mjs|cjs)$|[^/]+\.(spec|test)\.(js|jsx|ts|tsx|mjs|cjs)$)/
+const PY_TEST_RE = /(^|\/)(test_[^/]*\.py|[^/]*_test\.py)$/
+
+const SEVERITY = {
+  NO_ASSERTION: 'high', TAUTOLOGICAL: 'high', SWALLOWED_CATCH: 'high', PROMISE_NOT_AWAITED: 'high',
+  DONE_EARLY: 'high', EARLY_RETURN: 'medium', MOCK_ONLY_ASSERTION: 'medium', TYPE_ONLY_ASSERTION: 'medium',
+  KEY_PRESENCE_ONLY: 'medium',
+}
+// Skips are owned by the skip-only-ratchet engine (one finding per defect, never two).
+const SKIP_RULES = new Set(['UNLINKED_SKIP', 'CONDITIONAL_SKIP'])
+
+// ── Python (new) ───────────────────────────────────────────────────────────
+const PY_ASSERT_RE = /(^|[^\w.])assert\b|\bself\.assert\w*\s*\(|\bself\.fail\s*\(|\bpytest\.(raises|warns|fail|approx)\b|\.assert_\w+\s*\(|\braise\b/
+const PY_TAUTOLOGY_RE = /^\s*assert\s+(True|1|not\s+False|(["'][^"']*["']))\s*(,.*)?$|^\s*self\.assertTrue\(\s*True\s*\)\s*$|^\s*self\.assertEqual\(\s*(\d+|True|["'][^"']*["'])\s*,\s*\5\s*\)\s*$/
+
+export function scanPython(relPath, source) {
+  const lines = source.split('\n')
+  const out = []
+  for (let i = 0; i < lines.length; i++) {
+    const m = /^(\s*)(?:async\s+)?def\s+(test\w*)\s*\(/.exec(lines[i])
+    if (!m) continue
+    const indent = m[1].length
+    const body = []
+    let j = i + 1
+    // skip continuation of a multi-line signature
+    while (j < lines.length && !/\)\s*(->.*)?:\s*(#.*)?$/.test(lines[j - 1]) && j - i < 20) j++
+    for (; j < lines.length; j++) {
+      const l = lines[j]
+      if (l.trim() === '' || /^\s*#/.test(l)) continue
+      if (l.search(/\S/) <= indent) break
+      body.push(l)
+    }
+    const code = body.filter((l) => !/^\s*("""|''')/.test(l))
+    const asserting = code.filter((l) => PY_ASSERT_RE.test(l.replace(/(["'])(?:(?!\1).)*\1/g, '""')))
+    if (asserting.length === 0) {
+      out.push({ line: i + 1, rule: 'NO_ASSERTION', message: `test \`${m[2]}\` makes no assertion (no assert / self.assert* / pytest.raises / mock.assert_*) — it can never fail. FIX: assert the behaviour it claims to cover.` })
+    } else if (asserting.every((l) => PY_TAUTOLOGY_RE.test(l))) {
+      out.push({ line: i + 1, rule: 'TAUTOLOGICAL', message: `every assertion in \`${m[2]}\` is a constant (assert True / assertEqual(1, 1)) — it passes whatever the code does. FIX: assert on the real output of the unit under test.` })
+    }
+  }
+  return out
+}
+
+export default {
+  id: 'hollow-tests',
+  version: '0.1.0',
+  title: 'Hollow tests (tests that cannot fail)',
+  provenance: 'finipe scripts/ci/check-vacuous-spec.mjs @ 4ac53b367 (JS/TS); Python rules new',
+  appliesTo: (rel) => JS_TEST_RE.test(rel) || PY_TEST_RE.test(rel),
+  scanFile(rel, content, ctx) {
+    if (PY_TEST_RE.test(rel)) return scanPython(rel, content).map((f) => ({ ...f, severity: SEVERITY[f.rule] }))
+    setRoot(ctx.root)
+    const found = findVacuousSpecs(rel, content)
+      .filter((v) => !SKIP_RULES.has(v.rule))
+      .map((v) => ({ line: v.line, rule: v.rule, severity: SEVERITY[v.rule] || 'medium', message: v.message }))
+    return [...found, ...nodeAssertTautologies(content, new Set(found.map((f) => f.line)))].sort((a, b) => a.line - b.line)
+  },
+  rules: {
+    NO_ASSERTION: { severity: 'high', summary: 'the test calls code but asserts nothing — it can never fail', fix: 'assert the behaviour the test name claims' },
+    TAUTOLOGICAL: { severity: 'high', summary: 'every assertion is a constant (expect(true).toBe(true), assert True) — passes whatever the code does', fix: 'assert on the real output of the unit under test' },
+    SWALLOWED_CATCH: { severity: 'high', summary: 'the code under test runs inside try/catch whose catch does not fail the test — errors are swallowed', fix: 'let it throw, or assert on the error (expect(...).rejects / pytest.raises)' },
+    PROMISE_NOT_AWAITED: { severity: 'high', summary: 'an async assertion is not awaited/returned — the test finishes before it runs', fix: 'await or return the promise' },
+    DONE_EARLY: { severity: 'high', summary: 'done() is called before the async assertion runs', fix: 'call done() after the assertion, or use async/await' },
+    EARLY_RETURN: { severity: 'medium', summary: 'the test returns before its assertions', fix: 'remove the early return' },
+    MOCK_ONLY_ASSERTION: { severity: 'medium', summary: 'the only assertion is that a mock was called — the real result is never checked', fix: 'also assert on the returned value or state' },
+    TYPE_ONLY_ASSERTION: { severity: 'medium', summary: 'the only assertion is a type/defined check', fix: 'assert the actual value' },
+    KEY_PRESENCE_ONLY: { severity: 'medium', summary: 'the only assertion is that keys exist, not what they hold', fix: 'assert the values' },
+  },
+  negativeControls: [
+    { id: 'hollow-tests/NC-1', file: 'nc/sum.test.js', expect: 'NO_ASSERTION', content: "const sum = (a, b) => a + b\nit('adds', () => {\n  sum(1, 2)\n})\n" },
+    { id: 'hollow-tests/NC-2', file: 'nc/sum.spec.ts', expect: 'TAUTOLOGICAL', content: "it('adds', () => {\n  expect(true).toBe(true)\n})\n" },
+    { id: 'hollow-tests/NC-3', file: 'nc/pay.test.js', expect: 'SWALLOWED_CATCH', content: "it('pays', async () => {\n  try {\n    await pay(10)\n  } catch (e) {\n    console.log(e)\n  }\n  expect(pay).toBeDefined()\n})\n" },
+    { id: 'hollow-tests/NC-6', file: 'nc/gst.test.mjs', expect: 'TAUTOLOGICAL', content: "import assert from 'node:assert/strict'\ntest('gst', () => {\n  const tax = gst(1000)\n  assert.ok(true)\n})\n" },
+    { id: 'hollow-tests/NC-4', file: 'nc/test_sum.py', expect: 'NO_ASSERTION', content: 'def test_sum():\n    total = sum([1, 2])\n' },
+    { id: 'hollow-tests/NC-5', file: 'nc/test_ok.py', expect: 'TAUTOLOGICAL', content: 'def test_ok():\n    run()\n    assert True\n' },
+    { id: 'hollow-tests/NC-7', file: 'nc/load.test.js', expect: 'PROMISE_NOT_AWAITED', content: "it('loads', () => {\n  load().then((r) => {\n    expect(r.ok).toBe(true)\n  })\n})\n" },
+    { id: 'hollow-tests/NC-8', file: 'nc/fetch.test.js', expect: 'DONE_EARLY', content: "it('fetches', (done) => {\n  load().then((r) => {\n    expect(r.ok).toBe(true)\n  })\n  done()\n})\n" },
+    { id: 'hollow-tests/NC-9', file: 'nc/refund.test.js', expect: 'EARLY_RETURN', content: "it('refunds', () => {\n  if (!process.env.GATEWAY) return\n  expect(refund(10)).toBe(10)\n})\n" },
+    { id: 'hollow-tests/NC-10', file: 'nc/charge.test.js', expect: 'MOCK_ONLY_ASSERTION', content: "it('charges', () => {\n  const charge = jest.fn().mockReturnValue(10)\n  expect(charge(5)).toBe(10)\n})\n" },
+    { id: 'hollow-tests/NC-11', file: 'nc/status.test.ts', expect: 'TYPE_ONLY_ASSERTION', content: "it('reports status', async () => {\n  const r: { status?: 'ok' } = await fetchStatus()\n  expect(r).toBeDefined()\n})\n" },
+    { id: 'hollow-tests/NC-12', file: 'nc/pay.test.js', expect: 'KEY_PRESENCE_ONLY', content: "it('pays', () => {\n  const res = pay(10)\n  expect(res).toHaveProperty('status')\n})\n" },
+  ],
+  // Positive controls: each `rule` names the rule it is the NEAREST CLEAN LOOK-ALIKE for, so a detector that grows
+  // too lax for that rule's neighbour goes red here (SSOT PART 7 corpus). A control without `rule` is general.
+  positiveControls: [
+    { id: 'hollow-tests/PC-1', rule: 'NO_ASSERTION', file: 'pc/sum.test.js', content: "it('adds', () => {\n  expect(sum(1, 2)).toBe(3)\n})\n" },
+    { id: 'hollow-tests/PC-2', rule: 'TAUTOLOGICAL', file: 'pc/sum.test.mjs', content: "import assert from 'node:assert/strict'\ntest('adds', () => {\n  assert.equal(sum(1, 2), 3)\n})\n" },
+    { id: 'hollow-tests/PC-3', file: 'pc/test_sum.py', content: 'def test_sum():\n    assert sum([1, 2]) == 3\n\ndef test_raises():\n    with pytest.raises(ValueError):\n        parse("x")\n' },
+    { id: 'hollow-tests/PC-4', rule: 'SWALLOWED_CATCH', file: 'pc/pay.test.js', content: "it('rejects a negative amount', async () => {\n  try {\n    await pay(-1)\n    throw new Error('expected pay(-1) to reject')\n  } catch (e) {\n    expect(e.message).toMatch(/amount/)\n  }\n})\n" },
+    { id: 'hollow-tests/PC-5', rule: 'PROMISE_NOT_AWAITED', file: 'pc/load.test.js', content: "it('loads', () => {\n  return load().then((r) => {\n    expect(r.ok).toBe(true)\n  })\n})\n" },
+    { id: 'hollow-tests/PC-6', rule: 'DONE_EARLY', file: 'pc/fetch.test.js', content: "it('fetches', (done) => {\n  load().then((r) => {\n    expect(r.ok).toBe(true)\n    done()\n  })\n})\n" },
+    { id: 'hollow-tests/PC-7', rule: 'EARLY_RETURN', file: 'pc/refund.test.js', content: "it('refunds', () => {\n  const pick = (x) => { if (!x) return 0; return x }\n  expect(refund(pick(10))).toBe(10)\n})\n" },
+    { id: 'hollow-tests/PC-8', rule: 'MOCK_ONLY_ASSERTION', file: 'pc/charge.test.js', content: "it('charges through the gateway', () => {\n  const gateway = jest.fn().mockReturnValue(10)\n  expect(checkout(gateway, 5)).toBe(10)\n})\n" },
+    { id: 'hollow-tests/PC-9', rule: 'TYPE_ONLY_ASSERTION', file: 'pc/status.test.ts', content: "it('reports status', async () => {\n  const r: { status?: 'ok' } = await fetchStatus()\n  expect(r.status).toBe('ok')\n})\n" },
+    { id: 'hollow-tests/PC-10', rule: 'KEY_PRESENCE_ONLY', file: 'pc/pay.test.js', content: "it('pays', () => {\n  const res = pay(10)\n  expect(res).toHaveProperty('status', 'paid')\n})\n" },
+  ],
+}
+

package/src/engines/migrations.mjs

@@ -0,0 +1,316 @@
+// fini-proof engine: migrations — database migrations that lose data, lock or fail on a live table, or cannot be
+// rolled back. SQL (plain, Flyway, golang-migrate, goose, dbmate), Prisma, TypeORM, Knex, Alembic (and Django's
+// destructive operations).
+//
+// PROVENANCE. Ported from finipe scripts/ci/lib/migration-invariants.cjs @ 4ac53b367 (last changed 18ce3086b):
+//   - expandStatic() (VERBATIM, ./vendor/migration-invariants-core.mjs) expands `for (const t of [...])` loops so the
+//     up()/down() table sets are read per table, exactly as Finipe's preflight stage 3 does;
+//   - the "no down() — the migration is not reversible" rule and the "down() must drop what up() created, in reverse
+//     order" rule (downReversal(), adapted there) are Finipe's.
+// NEW in fini-proof (Finipe's gate is RLS-shaped for one Postgres schema; customer repos need the destructive-change
+// class): DROP TABLE / DROP COLUMN, column type changes, ADD COLUMN … NOT NULL without DEFAULT, SET NOT NULL, the
+// per-framework readers (SQL markers, Knex, TypeORM API, Alembic op.*, Django), and the acknowledgement comment
+// `fini-proof: allow <RULE> <reason>` for a destructive step a human has decided on (expand/contract).
+// v0.3 (false-positive pass on 3 public SaaS repos): (a) a DROP of a table/column that the same up step created
+// earlier is a temp object, not data loss; (b) the APPLIED-MIGRATIONS BASELINE — `fini-proof baseline` records the
+// migrations already applied (path → sha256) in .fini-proof/baseline.json; an applied, unchanged migration cannot be
+// fixed any more, so it is not re-judged (counted in the evidence as appliedBaselined). Editing an applied migration
+// changes its hash and puts it back in scope; changing the baseline is itself a gated change (codex agent-gate).
+import { createHash } from 'node:crypto'
+import { balanced, expandStatic, downReversal } from './vendor/migration-invariants-core.mjs'
+
+export const MIGRATION_PATH_RE = /(^|\/)(migrations?|migrate|db\/migrate|alembic\/versions)\//i
+const EXT_RE = /\.(sql|ts|js|mjs|cjs|py)$/
+const TEST_RE = /\.(spec|test)\.[a-z]+$|(^|\/)(__tests__|__mocks__)\//
+const DOWN_SQL_RE = /(\.down\.sql$|(^|\/)down\.sql$|(^|\/)U\d[\w.]*__[^/]*\.sql$)/i
+const FLYWAY_RE = /(^|\/)[VR]\d[\w.]*__[^/]*\.sql$/i
+const PRISMA_RE = /(^|\/)prisma\/migrations\//i
+const INLINE_UP_RE = /^\s*--\s*(?:\+goose\s+up|\+migrate\s+up|migrate:up)\b/im
+const INLINE_DOWN_RE = /^\s*--\s*(?:\+goose\s+down|\+migrate\s+down|migrate:down)\b/im
+
+const lineOf = (src, idx) => src.slice(0, idx).split('\n').length
+
+/** Blank out comments (keep strings, keep offsets). lang: 'sql' | 'js' | 'py'. */
+function stripComments(src, lang) {
+  let out = ''
+  let i = 0
+  const n = src.length
+  let quote = null
+  while (i < n) {
+    const c = src[i]
+    if (quote) {
+      out += c
+      if (c === '\\' && lang !== 'sql') { out += src[i + 1] || ''; i += 2; continue }
+      if (c === quote) quote = null
+      i++; continue
+    }
+    if (c === "'" || c === '"' || (c === '`' && lang === 'js')) { quote = c; out += c; i++; continue }
+    const two = src.slice(i, i + 2)
+    if ((lang === 'sql' && two === '--') || (lang === 'js' && two === '//') || (lang === 'py' && c === '#')) {
+      while (i < n && src[i] !== '\n') { out += ' '; i++ }
+      continue
+    }
+    if ((lang === 'sql' || lang === 'js') && two === '/*') {
+      while (i < n && src.slice(i, i + 2) !== '*/') { out += src[i] === '\n' ? '\n' : ' '; i++ }
+      out += '  '; i += 2; continue
+    }
+    out += c; i++
+  }
+  return out
+}
+
+const RULE_TEXT = {
+  DROP_TABLE: 'drops a table — every row in it is deleted, and the running application version may still read it. FIX: expand/contract — stop using the table in one release, drop it in a later one after a backup; acknowledge with `fini-proof: allow DROP_TABLE <ticket>`.',
+  DROP_COLUMN: 'drops a column — its data is gone and the app version still running during the deploy may still read or write it. FIX: stop reading/writing it first, drop it in a later release; acknowledge with `fini-proof: allow DROP_COLUMN <ticket>`.',
+  ALTER_COLUMN_TYPE: 'changes a column type — this can rewrite and lock the whole table, and can truncate or reject existing values. FIX: add a new column, back-fill in batches, switch reads, then drop the old one.',
+  ADD_NOT_NULL_NO_DEFAULT: 'adds a NOT NULL column without a DEFAULT — on a table that already has rows the migration fails (or forces a table rewrite). FIX: add it nullable (or with a DEFAULT), back-fill, then SET NOT NULL.',
+  SET_NOT_NULL: 'sets NOT NULL on an existing column — it fails if any row holds NULL and scans the table under lock. FIX: back-fill first; on Postgres add a NOT VALID CHECK constraint and VALIDATE it, then SET NOT NULL.',
+  MISSING_DOWN: 'has no down / rollback step — if this deploy goes wrong there is no scripted way back. FIX: write the down migration (or the .down.sql / downgrade()).',
+  DOWN_INCOMPLETE: 'rollback does not drop a table that the up step creates — rolling back leaves the schema half-migrated.',
+  DOWN_ORDER: 'rollback drops tables in a different order than the reverse of up — foreign keys unwind in reverse or not at all.',
+}
+const SEVERITY = { DROP_TABLE: 'high', DROP_COLUMN: 'high', ALTER_COLUMN_TYPE: 'high', ADD_NOT_NULL_NO_DEFAULT: 'high', SET_NOT_NULL: 'medium', MISSING_DOWN: 'medium', DOWN_INCOMPLETE: 'medium', DOWN_ORDER: 'low' }
+
+function mk(src, idx, rule, detail) {
+  return { line: lineOf(src, idx), rule, severity: SEVERITY[rule], message: `${detail ? detail + ' — ' : 'this migration '}${RULE_TEXT[rule]}` }
+}
+
+/** End of an ADD COLUMN clause: `,` / `)` at depth 0, `;`, or a closing JS template/quote run-out. */
+function clauseEnd(text, from) {
+  let depth = 0
+  for (let i = from; i < text.length; i++) {
+    const c = text[i]
+    if (c === '(') depth++
+    else if (c === ')') { if (depth === 0) return i; depth-- }
+    else if ((c === ',' && depth === 0) || c === ';' || c === '`') return i
+  }
+  return text.length
+}
+
+/** SQL rules over (comment-stripped) text: the up part of a .sql file, or SQL inside JS/Python strings. */
+function sqlRules(text, base = 0, full = text) {
+  const out = []
+  const at = (i, rule, d) => out.push(mk(full, base + i, rule, d))
+  const bare = (x) => x.replace(/["`]/g, '').split('.').pop().toLowerCase()
+  // created earlier in this same step → a temp object; dropping it loses no existing data
+  const madeBefore = (re, name, i) => [...text.slice(0, i).matchAll(re)].some((c) => bare(c[1]) === bare(name))
+  const CREATED_TABLE_RE = /CREATE\s+(?:TEMP(?:ORARY)?\s+)?TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?([\w."`]+)/gi
+  const ADDED_COLUMN_RE = /\bADD\s+(?:COLUMN\s+)?(?:IF\s+NOT\s+EXISTS\s+)?(?!CONSTRAINT\b|PRIMARY\b|FOREIGN\b|UNIQUE\b|INDEX\b|KEY\b|CHECK\b)([\w"`]+)\s/gi
+  for (const m of text.matchAll(/\bDROP\s+TABLE\s+(?:IF\s+EXISTS\s+)?([\w."`]+)/gi)) if (!madeBefore(CREATED_TABLE_RE, m[1], m.index)) at(m.index, 'DROP_TABLE', `DROP TABLE ${m[1].replace(/["`]/g, '')}`)
+  for (const m of text.matchAll(/\bDROP\s+COLUMN\s+(?:IF\s+EXISTS\s+)?([\w"`]+)/gi)) if (!madeBefore(ADDED_COLUMN_RE, m[1], m.index)) at(m.index, 'DROP_COLUMN', `DROP COLUMN ${m[1].replace(/["`]/g, '')}`)
+  for (const m of text.matchAll(/\bALTER\s+COLUMN\s+([\w"`]+)\s+(?:SET\s+DATA\s+)?TYPE\b|\b(?:MODIFY|CHANGE)\s+COLUMN\s+([\w"`]+)/gi)) at(m.index, 'ALTER_COLUMN_TYPE', `column ${(m[1] || m[2]).replace(/["`]/g, '')} changes type`)
+  for (const m of text.matchAll(/\bALTER\s+COLUMN\s+([\w"`]+)\s+SET\s+NOT\s+NULL\b/gi)) at(m.index, 'SET_NOT_NULL', `column ${m[1].replace(/["`]/g, '')} SET NOT NULL`)
+  for (const m of text.matchAll(/\bADD\s+(?:COLUMN\s+)?(?:IF\s+NOT\s+EXISTS\s+)?(?!CONSTRAINT\b|PRIMARY\b|FOREIGN\b|UNIQUE\b|INDEX\b|KEY\b|CHECK\b)([\w"`]+)\s/gi)) {
+    if (!/\bALTER\s+TABLE\b/i.test(text.slice(Math.max(0, m.index - 400), m.index))) continue
+    const clause = text.slice(m.index, clauseEnd(text, m.index + m[0].length))
+    if (/\bNOT\s+NULL\b/i.test(clause) && !/\bDEFAULT\b/i.test(clause) && !/\b(SERIAL|BIGSERIAL|SMALLSERIAL|GENERATED|IDENTITY|AUTO_INCREMENT)\b/i.test(clause)) {
+      at(m.index, 'ADD_NOT_NULL_NO_DEFAULT', `ADD COLUMN ${m[1].replace(/["`]/g, '')} NOT NULL`)
+    }
+  }
+  return out
+}
+const sqlCreates = (t) => [...t.matchAll(/CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:[\w"`]+\.)?["`]?(\w+)["`]?\s*\(/gi)].map((m) => m[1].toLowerCase())
+const sqlDrops = (t) => [...t.matchAll(/DROP\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:[\w"`]+\.)?["`]?(\w+)["`]?/gi)].map((m) => m[1].toLowerCase())
+
+// ── SQL files ───────────────────────────────────────────────────────────────
+function scanSql(rel, content, ctx) {
+  if (DOWN_SQL_RE.test(rel)) return [] // a rollback file is expected to drop things
+  const text = stripComments(content, 'sql')
+  const downAt = content.search(INLINE_DOWN_RE)
+  const up = downAt >= 0 ? text.slice(0, downAt) : text
+  const out = sqlRules(up, 0, content)
+  if (PRISMA_RE.test(rel) || FLYWAY_RE.test(rel)) return out // these tools have no down migration by design
+  const down = downAt >= 0 ? text.slice(downAt) : null
+  if (/\.up\.sql$/i.test(rel) || /(^|\/)up\.sql$/i.test(rel)) {
+    const sib = rel.replace(/\.up\.sql$/i, '.down.sql').replace(/(^|\/)up\.sql$/i, '$1down.sql')
+    if (!ctx.exists?.(sib)) out.push(mk(content, 0, 'MISSING_DOWN', `no ${sib.split('/').pop()} next to it`))
+    else out.push(...reversal(content, 0, sqlCreates(up), sqlDrops(ctx.read?.(sib) || '')))
+  } else if (INLINE_UP_RE.test(content)) {
+    if (!down || !down.replace(INLINE_DOWN_RE, '').trim()) out.push(mk(content, content.search(INLINE_UP_RE), 'MISSING_DOWN', 'the Up section has no (non-empty) Down section'))
+    else out.push(...reversal(content, downAt, sqlCreates(up), sqlDrops(down)))
+  }
+  return out
+}
+
+function reversal(src, idx, creates, drops) {
+  return downReversal(creates, drops).map((p) => p.rule === 'DOWN_INCOMPLETE'
+    ? mk(src, idx, 'DOWN_INCOMPLETE', `down never drops ${p.tables.join(', ')}`)
+    : mk(src, idx, 'DOWN_ORDER', `down drops ${p.actual.join(' → ')}; reverse of up is ${p.expected.join(' → ')}`))
+}
+
+// ── JS / TS (TypeORM, Knex, generic up/down exports) ─────────────────────────
+const UP_DEF_RE = /(?:async\s+up\s*\(|\bup\s*\([^)]*\)\s*(?::\s*[^{]+)?\{|exports\.up\s*=|export\s+(?:async\s+)?function\s+up\b|export\s+const\s+up\b|\bup\s*:\s*(?:async\s*)?(?:function|\())/
+const DOWN_DEF_RE = /(?:async\s+down\s*\(|\bdown\s*\([^)]*\)\s*(?::\s*[^{]+)?\{|exports\.down\s*=|export\s+(?:async\s+)?function\s+down\b|export\s+const\s+down\b|\bdown\s*:\s*(?:async\s*)?(?:function|\())/
+
+function bodyAfter(text, idx) {
+  const open = text.indexOf('{', idx)
+  if (open < 0) return null
+  const close = balanced(text, open, '{', '}')
+  return close < 0 ? null : { open, close, body: text.slice(open + 1, close) }
+}
+
+function scanJs(rel, content) {
+  const text = stripComments(content, 'js')
+  const upAt = text.search(UP_DEF_RE)
+  if (upAt < 0) return [] // not a migration module (helpers, index files)
+  const downAt = text.search(DOWN_DEF_RE)
+  const upEnd = downAt > upAt ? downAt : text.length
+  const up = text.slice(upAt, upEnd)
+  const out = sqlRules(up, upAt, content)
+  const at = (i, rule, d) => out.push(mk(content, upAt + i, rule, d))
+  for (const m of up.matchAll(/\.\s*(dropTable|dropTableIfExists)\s*\(\s*['"`]?([\w.]*)/g)) at(m.index, 'DROP_TABLE', `${m[1]}(${m[2] || '…'})`)
+  for (const m of up.matchAll(/\.\s*dropColumns?\s*\(\s*([^)]{0,80})/g)) at(m.index, 'DROP_COLUMN', `dropColumn(${m[1].trim().slice(0, 40)})`)
+  for (const m of up.matchAll(/\.\s*changeColumns?\s*\(/g)) at(m.index, 'ALTER_COLUMN_TYPE', 'queryRunner.changeColumn(…)')
+  // TypeORM addColumn(table, new TableColumn({...})): TableColumn is NOT NULL unless isNullable: true.
+  for (const m of up.matchAll(/\.\s*addColumns?\s*\(/g)) {
+    const open = m.index + m[0].length - 1
+    const close = balanced(up, open, '(', ')')
+    const args = up.slice(open, close < 0 ? up.length : close)
+    if (/TableColumn/.test(args) && !/isNullable\s*:\s*true/.test(args) && !/\bdefault\s*:/.test(args) && !/isGenerated\s*:\s*true/.test(args)) at(m.index, 'ADD_NOT_NULL_NO_DEFAULT', 'addColumn(new TableColumn) without isNullable: true or default')
+  }
+  // Knex alterTable / table callbacks: a column chain with .notNullable() and no .defaultTo(); `.alter()` = type change.
+  for (const m of up.matchAll(/\.\s*(alterTable|table)\s*\(/g)) {
+    const open = m.index + m[0].length - 1
+    const close = balanced(up, open, '(', ')')
+    const args = up.slice(open, close < 0 ? up.length : close)
+    // one statement = a line plus the following lines that continue its chain (`.notNullable()` on its own line)
+    let off = 0
+    const stmts = []
+    for (const line of args.split('\n')) {
+      if (/^\s*\./.test(line) && stmts.length) stmts[stmts.length - 1].text += line
+      else stmts.push({ at: off, text: line })
+      off += line.length + 1
+    }
+    for (const st of stmts) {
+      if (/\.\s*alter\s*\(\s*\)/.test(st.text)) at(open + st.at, 'ALTER_COLUMN_TYPE', 'knex column .alter()')
+      else if (/\.\s*notNullable\s*\(\s*\)/.test(st.text) && !/\.\s*defaultTo\s*\(/.test(st.text) && !/\.\s*(increments|bigIncrements)\s*\(/.test(st.text)) at(open + st.at, 'ADD_NOT_NULL_NO_DEFAULT', 'knex .notNullable() without .defaultTo() on an existing table')
+    }
+  }
+  // Reversibility (Finipe rule): no down → not reversible; empty down → same; down must drop what up created.
+  const downBody = downAt >= 0 ? bodyAfter(text, downAt) : null
+  if (downAt < 0) out.push(mk(content, upAt, 'MISSING_DOWN', 'no down() / exports.down'))
+  else if (downBody && !downBody.body.replace(/\breturn\b|Promise\.resolve\(\s*\)|[;\s]/g, '')) out.push(mk(content, downAt, 'MISSING_DOWN', 'down() is empty'))
+  else if (downBody) {
+    const upX = expandStatic(up).text
+    const downX = expandStatic(downBody.body).text
+    const creates = [...sqlCreates(upX), ...[...upX.matchAll(/\.\s*createTable\s*\(\s*(?:['"`](\w+)|new\s+Table\s*\(\s*\{[^}]*?name\s*:\s*['"`](\w+))/g)].map((x) => (x[1] || x[2]).toLowerCase())]
+    const drops = [...sqlDrops(downX), ...[...downX.matchAll(/\.\s*dropTable(?:IfExists)?\s*\(\s*['"`](\w+)/g)].map((x) => x[1].toLowerCase())]
+    out.push(...reversal(content, downAt, [...new Set(creates)], drops))
+  }
+  return out
+}
+
+// ── Python (Alembic, Django) ──────────────────────────────────────────────
+function pyFunc(text, name) {
+  const m = new RegExp(`^def\\s+${name}\\s*\\([^)]*\\)[^:]*:`, 'm').exec(text)
+  if (!m) return null
+  const rest = text.slice(m.index + m[0].length)
+  const next = rest.search(/^\S/m)
+  const body = next < 0 ? rest : rest.slice(0, next)
+  return { at: m.index, body, text: text.slice(m.index, m.index + m[0].length + body.length) }
+}
+
+function scanPy(rel, content) {
+  const text = stripComments(content, 'py')
+  const out = []
+  const up = pyFunc(text, 'upgrade')
+  if (up) {
+    const base = up.at
+    const upText = up.text
+    out.push(...sqlRules(upText, base, content))
+    const at = (i, rule, d) => out.push(mk(content, base + i, rule, d))
+    for (const m of upText.matchAll(/\bop\.drop_table\s*\(\s*['"](\w+)/g)) at(m.index, 'DROP_TABLE', `op.drop_table('${m[1]}')`)
+    for (const m of upText.matchAll(/\bop\.drop_column\s*\(\s*['"](\w+)['"]\s*,\s*['"](\w+)/g)) at(m.index, 'DROP_COLUMN', `op.drop_column('${m[1]}', '${m[2]}')`)
+    for (const m of upText.matchAll(/\bop\.alter_column\s*\(/g)) {
+      const close = balanced(upText, m.index + m[0].length - 1, '(', ')')
+      const args = upText.slice(m.index, close < 0 ? upText.length : close)
+      if (/\btype_\s*=/.test(args)) at(m.index, 'ALTER_COLUMN_TYPE', 'op.alter_column(type_=…)')
+      if (/\bnullable\s*=\s*False\b/.test(args) && !/server_default\s*=/.test(args)) at(m.index, 'SET_NOT_NULL', 'op.alter_column(nullable=False)')
+    }
+    for (const m of upText.matchAll(/\bop\.add_column\s*\(/g)) {
+      const close = balanced(upText, m.index + m[0].length - 1, '(', ')')
+      const args = upText.slice(m.index, close < 0 ? upText.length : close)
+      if (/\bnullable\s*=\s*False\b/.test(args) && !/server_default\s*=/.test(args)) at(m.index, 'ADD_NOT_NULL_NO_DEFAULT', 'op.add_column(nullable=False) without server_default')
+    }
+    const down = pyFunc(text, 'downgrade')
+    if (!down) out.push(mk(content, base, 'MISSING_DOWN', 'no downgrade()'))
+    else if (!down.body.replace(/("""|''')[\s\S]*?\1/g, '').replace(/\bpass\b/g, '').trim()) out.push(mk(content, down.at, 'MISSING_DOWN', 'downgrade() does nothing'))
+    else {
+      const creates = [...upText.matchAll(/\bop\.create_table\s*\(\s*['"](\w+)/g)].map((m) => m[1].toLowerCase())
+      const drops = [...down.body.matchAll(/\bop\.drop_table\s*\(\s*['"](\w+)/g)].map((m) => m[1].toLowerCase())
+      out.push(...reversal(content, down.at, creates, drops))
+    }
+    return out
+  }
+  if (/\bmigrations\.Migration\b/.test(text)) {
+    const at = (i, rule, d) => out.push(mk(content, i, rule, d))
+    for (const m of text.matchAll(/\bmigrations\.DeleteModel\s*\(\s*(?:name\s*=\s*)?['"](\w+)/g)) at(m.index, 'DROP_TABLE', `DeleteModel('${m[1]}')`)
+    for (const m of text.matchAll(/\bmigrations\.RemoveField\s*\(/g)) at(m.index, 'DROP_COLUMN', 'RemoveField(…)')
+    out.push(...sqlRules(text, 0, content))
+  }
+  return out
+}
+
+/** `fini-proof: allow <RULE> <reason>` on the line or the 2 lines above acknowledges one destructive step. */
+function acknowledged(content, f) {
+  const lines = content.split('\n')
+  const win = lines.slice(Math.max(0, f.line - 3), f.line).join('\n')
+  const m = new RegExp(`fini-proof:\\s*allow\\s+${f.rule}\\b\\s*[-—:]*\\s*(\\S.{2,})`).exec(win)
+  return Boolean(m)
+}
+
+export default {
+  id: 'migrations',
+  version: '0.3.0',
+  title: 'Dangerous database migrations',
+  provenance: 'finipe scripts/ci/lib/migration-invariants.cjs expandStatic + down() rules @ 4ac53b367 (last changed 18ce3086b); destructive-change rules new',
+  optionalScope: true,
+  notApplicableReason: 'no migration file in this repository (paths under migrations/, migrate/, db/migrate/, alembic/versions/)',
+  appliesTo: (rel) => MIGRATION_PATH_RE.test(rel) && EXT_RE.test(rel) && !TEST_RE.test(rel) && !/\.d\.ts$/.test(rel),
+  scanFile(rel, content, ctx = {}) {
+    const applied = ctx.baseline?.migrations?.applied?.[rel] === createHash('sha256').update(content).digest('hex')
+    const found = rel.endsWith('.sql') ? scanSql(rel, content, ctx) : rel.endsWith('.py') ? scanPy(rel, content) : scanJs(rel, content)
+    const seen = new Set()
+    return found
+      .filter((f) => { const k = `${f.line}:${f.rule}`; if (seen.has(k)) return false; seen.add(k); return true })
+      .filter((f) => !acknowledged(content, f))
+      .map((f) => (applied ? { ...f, applied: true } : f))
+      .sort((a, b) => a.line - b.line)
+  },
+  /** Applied, unchanged migrations (baseline) are history, not a change under review: counted, not reported. */
+  finalize(findings, ctx = {}) {
+    const applied = findings.filter((f) => f.applied)
+    const byRule = {}
+    for (const f of applied) byRule[f.rule] = (byRule[f.rule] || 0) + 1
+    const n = Object.keys(ctx.baseline?.migrations?.applied || {}).length
+    return {
+      findings: findings.filter((f) => !f.applied),
+      measurements: n ? { appliedBaselineFiles: n, appliedBaselined: applied.length, appliedBaselinedByRule: byRule } : {},
+    }
+  },
+  rules: Object.fromEntries(Object.entries(RULE_TEXT).map(([k, v]) => [k, { severity: SEVERITY[k], summary: v.split(' FIX: ')[0], fix: (v.split(' FIX: ')[1] || '').trim() || null }])),
+  negativeControls: [
+    { id: 'migrations/NC-1', file: 'db/migrations/0042_orders.sql', expect: 'DROP_COLUMN', content: 'ALTER TABLE orders DROP COLUMN legacy_total;\n' },
+    { id: 'migrations/NC-2', file: 'prisma/migrations/20260901_add_region/migration.sql', expect: 'ADD_NOT_NULL_NO_DEFAULT', content: '-- AlterTable\nALTER TABLE "Order" ADD COLUMN "region" TEXT NOT NULL;\n' },
+    { id: 'migrations/NC-3', file: 'src/migrations/1727000000000-Amount.ts', expect: 'ALTER_COLUMN_TYPE', content: "export class Amount1727000000000 implements MigrationInterface {\n  async up(queryRunner: QueryRunner) {\n    await queryRunner.query(`ALTER TABLE invoices ALTER COLUMN amount TYPE numeric(12,2)`)\n  }\n  async down(queryRunner: QueryRunner) {\n    await queryRunner.query(`ALTER TABLE invoices ALTER COLUMN amount TYPE integer`)\n  }\n}\n" },
+    { id: 'migrations/NC-4', file: 'migrations/20260901_users.js', expect: 'MISSING_DOWN', content: "exports.up = function (knex) {\n  return knex.schema.createTable('users', (t) => { t.increments('id') })\n}\n" },
+    { id: 'migrations/NC-5', file: 'alembic/versions/3f2a_drop_notes.py', expect: 'DROP_TABLE', content: "def upgrade():\n    op.drop_table('notes')\n\n\ndef downgrade():\n    op.create_table('notes', sa.Column('id', sa.Integer()))\n" },
+    { id: 'migrations/NC-7', file: 'prisma/migrations/20260904_orgs/migration.sql', expect: 'DROP_COLUMN', content: 'ALTER TABLE "Group" ADD COLUMN team_role TEXT;\nALTER TABLE "Team" DROP COLUMN legacy_role;\n' },
+    { id: 'migrations/NC-6', file: 'migrations/20260902_tenant.js', expect: 'ADD_NOT_NULL_NO_DEFAULT', content: "exports.up = (knex) => knex.schema.alterTable('orders', (t) => {\n  t.string('tenant_id').notNullable()\n})\nexports.down = (knex) => knex.schema.alterTable('orders', (t) => { t.dropColumn('tenant_id') })\n" },
+    { id: 'migrations/NC-8', file: 'db/migrations/0045_region_required.sql', expect: 'SET_NOT_NULL', content: '-- migrate:up\nALTER TABLE orders ALTER COLUMN region SET NOT NULL;\n\n-- migrate:down\nALTER TABLE orders ALTER COLUMN region DROP NOT NULL;\n' },
+    { id: 'migrations/NC-9', file: 'migrations/20260905_roles.js', expect: 'DOWN_INCOMPLETE', content: "exports.up = async (knex) => {\n  await knex.schema.createTable('roles', (t) => { t.increments('id') })\n  await knex.schema.createTable('grants', (t) => { t.increments('id') })\n}\nexports.down = async (knex) => {\n  await knex.schema.dropTable('grants')\n}\n" },
+    { id: 'migrations/NC-10', file: 'migrations/20260906_teams.js', expect: 'DOWN_ORDER', content: "exports.up = async (knex) => {\n  await knex.schema.createTable('teams', (t) => { t.increments('id') })\n  await knex.schema.createTable('members', (t) => { t.increments('id') })\n}\nexports.down = async (knex) => {\n  await knex.schema.dropTable('teams')\n  await knex.schema.dropTable('members')\n}\n" },
+  ],
+  // Positive controls: `rule` names the rule each is the nearest clean look-alike for.
+  positiveControls: [
+    { id: 'migrations/PC-6', rule: 'SET_NOT_NULL', file: 'db/migrations/0046_region_optional.sql', content: '-- migrate:up\nALTER TABLE orders ALTER COLUMN region DROP NOT NULL;\n\n-- migrate:down\nALTER TABLE orders ALTER COLUMN region SET DEFAULT \'IN\';\n' },
+    { id: 'migrations/PC-7', rule: 'DOWN_INCOMPLETE', file: 'migrations/20260905_roles.js', content: "exports.up = async (knex) => {\n  await knex.schema.createTable('roles', (t) => { t.increments('id') })\n  await knex.schema.createTable('grants', (t) => { t.increments('id') })\n}\nexports.down = async (knex) => {\n  await knex.schema.dropTable('grants')\n  await knex.schema.dropTable('roles')\n}\n" },
+    { id: 'migrations/PC-8', rule: 'MISSING_DOWN', file: 'migrations/20260901_users.js', content: "exports.up = function (knex) {\n  return knex.schema.createTable('users', (t) => { t.increments('id') })\n}\nexports.down = function (knex) {\n  return knex.schema.dropTable('users')\n}\n" },
+    { id: 'migrations/PC-9', rule: 'ALTER_COLUMN_TYPE', file: 'db/migrations/0047_amount_default.sql', content: '-- migrate:up\nALTER TABLE invoices ALTER COLUMN amount SET DEFAULT 0;\n\n-- migrate:down\nALTER TABLE invoices ALTER COLUMN amount DROP DEFAULT;\n' },
+    { id: 'migrations/PC-1', rule: 'ADD_NOT_NULL_NO_DEFAULT', file: 'db/migrations/0043_safe.sql', content: '-- migrate:up\nCREATE TABLE audit_log (id BIGSERIAL PRIMARY KEY, note TEXT NOT NULL);\nALTER TABLE orders ADD COLUMN region TEXT NOT NULL DEFAULT \'IN\';\n\n-- migrate:down\nALTER TABLE orders DROP COLUMN region;\nDROP TABLE audit_log;\n' },
+    { id: 'migrations/PC-2', rule: 'DOWN_ORDER', file: 'src/migrations/1727000000001-Audit.ts', content: "export class Audit1727000000001 implements MigrationInterface {\n  async up(queryRunner: QueryRunner) {\n    for (const t of ['audit_a', 'audit_b']) {\n      await queryRunner.query(`CREATE TABLE ${t} (id serial PRIMARY KEY)`)\n    }\n  }\n  async down(queryRunner: QueryRunner) {\n    await queryRunner.query(`DROP TABLE audit_b`)\n    await queryRunner.query(`DROP TABLE audit_a`)\n  }\n}\n" },
+    { id: 'migrations/PC-3', rule: 'DROP_COLUMN', file: 'db/migrations/0044_contract.sql', content: '-- fini-proof: allow DROP_COLUMN CHG-812 column unused since release 41, backup taken\nALTER TABLE orders DROP COLUMN legacy_total;\n' },
+    { id: 'migrations/PC-5', rule: 'DROP_TABLE', file: 'prisma/migrations/20260903_orgs/migration.sql', content: 'ALTER TABLE "Group" ADD COLUMN temp_team_id INTEGER;\nUPDATE "Group" SET temp_team_id = 1;\nALTER TABLE "Group" DROP COLUMN temp_team_id;\nCREATE TABLE tmp_map (id INT);\nDROP TABLE tmp_map;\n' },
+    { id: 'migrations/PC-4', file: 'alembic/versions/4b1c_region.py', content: "def upgrade():\n    op.add_column('orders', sa.Column('region', sa.String(), nullable=False, server_default='IN'))\n\n\ndef downgrade():\n    op.drop_column('orders', 'region')\n" },
+  ],
+}

package/src/engines/secrets.mjs

@@ -0,0 +1,88 @@
+// fini-proof engine: secrets — committed secret material.
+// Adapter over the ported Finipe gate (./vendor/secrets-core.mjs, provenance there). Additions for customer
+// repos (not in the Finipe gate, marked NEW): GitHub tokens, Google API keys, OpenAI/Anthropic-style keys,
+// and a generic `password = "…"` literal in source code.
+import { scanContentForSecrets, BINARY_EXT_RE, lineOf } from './vendor/secrets-core.mjs'
+
+// NEW patterns (fini-proof 0.1). Each has a negative control below.
+const EXTRA = [
+  ['github-token', /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{50,}\b/g],
+  ['google-api-key', /\bAIza[0-9A-Za-z_-]{35}\b/g],
+  ['llm-api-key', /\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{32,}\b/g],
+]
+const SRC_RE = /\.(js|jsx|ts|tsx|mjs|cjs|py|rb|go|java|kt|cs|php|ya?ml|json|properties|toml|ini|cfg|conf)$/i
+const PASSWORD_LITERAL_RE = /\b([A-Za-z_]*(?:password|passwd|secret|api_?key|access_?token)[A-Za-z_]*)\s*[:=]\s*['"]([^'"\s]{8,})['"]/gi
+// A value that names its own kind ('gh-secret', 'my-password', 'token-123') is a fixture label, not a credential.
+const PLACEHOLDER_RE = /change.?me|example|placeholder|dummy|fake|sample|your[-_]|xxx|\*\*\*|<|\$\{|process\.env|os\.environ|test|secret|passw(or)?d|token/i
+
+// Reports, CI logs and evidence files must not re-leak the secret: keep 4 leading + 2 trailing characters.
+const redact = (m) => m.replace(/[A-Za-z0-9_\-+/=.]{9,}/g, (t) => `${t.slice(0, 4)}…${t.slice(-2)}`)
+
+function extra(rel, content) {
+  const out = []
+  for (const [kind, re] of EXTRA) {
+    re.lastIndex = 0
+    let m
+    while ((m = re.exec(content)) !== null) out.push({ kind, line: lineOf(content, m.index), match: m[0].slice(0, 12) + '…' })
+  }
+  if (SRC_RE.test(rel)) {
+    PASSWORD_LITERAL_RE.lastIndex = 0
+    let m
+    while ((m = PASSWORD_LITERAL_RE.exec(content)) !== null) {
+      if (PLACEHOLDER_RE.test(m[2])) continue
+      out.push({ kind: 'hardcoded-credential', line: lineOf(content, m.index), match: `${m[1]} = <redacted>` })
+    }
+  }
+  return out
+}
+
+export default {
+  id: 'secrets',
+  version: '0.1.0',
+  title: 'Committed secrets',
+  provenance: 'finipe scripts/ci/check-secrets-and-log-redaction.mjs part (a) @ 4ac53b367; 4 patterns new',
+  appliesTo: (rel) => !BINARY_EXT_RE.test(rel) && !/(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|poetry\.lock)$/.test(rel),
+  scanFile(rel, content) {
+    const seen = new Set()
+    return [...scanContentForSecrets(rel, content), ...extra(rel, content)]
+      .filter((f) => { const k = `${f.line}:${f.kind}`; if (seen.has(k)) return false; seen.add(k); return true })
+      .map((f) => ({
+        line: f.line,
+        rule: `SECRET_${f.kind.toUpperCase().replace(/-/g, '_')}`,
+        severity: 'high',
+        message: `${f.kind} committed to the repository (${redact(f.match)}). Anyone with read access has it. FIX: rotate it now, then load it from the environment or a secret manager.`,
+      }))
+  },
+  rules: Object.fromEntries(['aws-access-key', 'private-key-block', 'slack-token', 'stripe-live-key', 'sendgrid-key', 'jwt-assigned-to-config', 'env-secret-assignment', 'github-token', 'google-api-key', 'llm-api-key', 'hardcoded-credential']
+    .map((k) => [`SECRET_${k.toUpperCase().replace(/-/g, '_')}`, { severity: 'high', summary: `${k} committed to the repository — anyone with read access has it`, fix: 'rotate it now, then load it from the environment or a secret manager' }])),
+  // Planted material is assembled at runtime so this source file never contains a secret-shaped literal.
+  negativeControls: [
+    { id: 'secrets/NC-1', file: 'nc/config.js', expect: 'SECRET_AWS_ACCESS_KEY', content: `const key = '${'AKIA' + 'Q3VZ7K2M9P4XWT6B'}'\n` },
+    { id: 'secrets/NC-2', file: 'nc/.env', expect: 'SECRET_ENV_SECRET_ASSIGNMENT', content: `DB_PASSWORD=${'n9!Kq' + '2vLx8wZ'}\n` },
+    { id: 'secrets/NC-3', file: 'nc/deploy.pem.txt', expect: 'SECRET_PRIVATE_KEY_BLOCK', content: `-----BEGIN ${'RSA PRIVATE'} KEY-----\nMIIE\n` },
+    { id: 'secrets/NC-4', file: 'nc/gh.py', expect: 'SECRET_GITHUB_TOKEN', content: `TOKEN = "${'ghp_' + 'a'.repeat(18) + 'B7'.repeat(9)}"\n` },
+    { id: 'secrets/NC-5', file: 'nc/db.py', expect: 'SECRET_HARDCODED_CREDENTIAL', content: `db_password = "${'Tr0ub4' + 'dor&3x'}"\n` },
+    { id: 'secrets/NC-6', file: 'nc/notify.js', expect: 'SECRET_SLACK_TOKEN', content: `const slack = '${'xox' + 'b-'}4821907736-${'Qm7Zt2Lp9Xv4'}'\n` },
+    { id: 'secrets/NC-7', file: 'nc/billing.js', expect: 'SECRET_STRIPE_LIVE_KEY', content: `const stripe = '${'sk_' + 'live_'}${'51Hq8ZKp3Rt7Vw2Nx9'}'\n` },
+    { id: 'secrets/NC-8', file: 'nc/mail.js', expect: 'SECRET_SENDGRID_KEY', content: `const sg = '${'SG' + '.'}${'q7Lm2Xv9Pz4Kt8Rw1Nb6'}.${'Yc3Hd5Jf7Gs9Ua2Ei4Ok'}'\n` },
+    { id: 'secrets/NC-9', file: 'nc/client.js', expect: 'SECRET_JWT_ASSIGNED_TO_CONFIG', content: `const token = '${'ey' + 'J'}hbGciOiJIUzI1NiJ9.${'eyJzdWIiOiIxMjM0In0'}.${'Zm9vYmFyYmF6cXV4'}'\n` },
+    { id: 'secrets/NC-10', file: 'nc/maps.js', expect: 'SECRET_GOOGLE_API_KEY', content: `const maps = '${'AI' + 'za'}${'SyB7qL2mX9vZ4pT8kW3nR6cY1hJ5dF0gS2a'}'\n` },
+    { id: 'secrets/NC-11', file: 'nc/llm.py', expect: 'SECRET_LLM_API_KEY', content: `CLIENT_KEY = "${'sk-' + 'ant-'}${'api03-Q7mL2xV9pZ4kT8wR3nC6yH1jD5fG0sE2uB'}"\n` },
+  ],
+  // Positive controls: `rule` names the rule each is the nearest clean look-alike for (a shorter prefix, a test-mode
+  // key, a public key, a placeholder, an env read). A detector that grows too lax for that neighbour goes red here.
+  positiveControls: [
+    { id: 'secrets/PC-1', rule: 'SECRET_ENV_SECRET_ASSIGNMENT', file: 'pc/.env.example', content: 'DB_PASSWORD=change-me\nAPI_TOKEN=\nMAX_TOKEN_LIMIT=4000\n' },
+    { id: 'secrets/PC-3', file: 'pc/helpers.js', content: "const cfg = { webhookSecret: 'gh-secret', password: 'my-password' }\n" },
+    { id: 'secrets/PC-2', rule: 'SECRET_HARDCODED_CREDENTIAL', file: 'pc/config.js', content: "const password = process.env.DB_PASSWORD\nconst apiKey = '${API_KEY}'\n" },
+    { id: 'secrets/PC-4', rule: 'SECRET_AWS_ACCESS_KEY', file: 'pc/aws.js', content: "// an access key id starts with the 4-letter prefix and has 16 more characters\nconst prefix = 'AKIA'\nconst id = process.env.AWS_ACCESS_KEY_ID\n" },
+    { id: 'secrets/PC-5', rule: 'SECRET_PRIVATE_KEY_BLOCK', file: 'pc/signing.pem.txt', content: '-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE\n-----END PUBLIC KEY-----\n' },
+    { id: 'secrets/PC-6', rule: 'SECRET_GITHUB_TOKEN', file: 'pc/gh.py', content: 'TOKEN = os.environ["GITHUB_TOKEN"]  # classic tokens start with ghp_\n' },
+    { id: 'secrets/PC-7', rule: 'SECRET_SLACK_TOKEN', file: 'pc/notify.js', content: "const slack = process.env.SLACK_BOT_TOKEN // bot tokens start with xoxb-\n" },
+    { id: 'secrets/PC-8', rule: 'SECRET_STRIPE_LIVE_KEY', file: 'pc/billing.js', content: "const stripe = 'sk_test_51Hq8ZKp3Rt7Vw2Nx9'\n" },
+    { id: 'secrets/PC-9', rule: 'SECRET_SENDGRID_KEY', file: 'pc/mail.js', content: "const sg = process.env.SENDGRID_API_KEY // format SG.<id>.<secret>\n" },
+    { id: 'secrets/PC-10', rule: 'SECRET_JWT_ASSIGNED_TO_CONFIG', file: 'pc/client.js', content: "const header = 'eyJhbGciOiJIUzI1NiJ9'\nconst token = req.headers.authorization\n" },
+    { id: 'secrets/PC-11', rule: 'SECRET_GOOGLE_API_KEY', file: 'pc/maps.js', content: "const maps = process.env.GOOGLE_MAPS_KEY // keys start with AIza\n" },
+    { id: 'secrets/PC-12', rule: 'SECRET_LLM_API_KEY', file: 'pc/llm.py', content: 'CLIENT_KEY = os.environ["ANTHROPIC_API_KEY"]  # keys start with sk-ant-\n' },
+  ],
+}