progmune-runtime 2.1.5 → 3.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (356) hide show
  1. package/README.md +108 -468
  2. package/dist/ablation-study.js +144 -0
  3. package/dist/ablation-study.test.js +18 -0
  4. package/dist/action-runtime.js +3 -1
  5. package/dist/active-learning.js +211 -0
  6. package/dist/analytics.js +139 -0
  7. package/dist/asset-factory.js +309 -0
  8. package/dist/asset-growth.js +244 -0
  9. package/dist/asset-promotion.js +382 -0
  10. package/dist/asset-quality.js +550 -0
  11. package/dist/audit/business-translator.js +285 -0
  12. package/dist/audit/cli.js +66 -0
  13. package/dist/audit/formatters/html.js +379 -0
  14. package/dist/audit/formatters/json.js +11 -0
  15. package/dist/audit/formatters/markdown.js +192 -0
  16. package/dist/audit/formatters/terminal.js +189 -0
  17. package/dist/audit/index.js +25 -0
  18. package/dist/audit/report-builder.js +318 -0
  19. package/dist/audit/types.js +8 -0
  20. package/dist/audit.js +3 -3
  21. package/dist/auto-benchmark-generator.js +137 -0
  22. package/dist/auto-benchmark-generator.test.js +45 -0
  23. package/dist/auto-protocol-synthesizer.js +362 -0
  24. package/dist/auto-protocol-synthesizer.test.js +82 -0
  25. package/dist/autonomous-patch.js +175 -0
  26. package/dist/autonomous-patch.test.js +128 -0
  27. package/dist/badge/badge-server.js +98 -0
  28. package/dist/behavior-miner.js +442 -0
  29. package/dist/belief-layer.js +475 -0
  30. package/dist/benchmark-count.js +5 -0
  31. package/dist/benchmark-generator.js +211 -0
  32. package/dist/benchmark-harness.js +201 -0
  33. package/dist/benchmark-pass-rate.js +7 -0
  34. package/dist/benchmark-report.js +8 -3
  35. package/dist/benchmark-save.js +14 -1
  36. package/dist/bootstrap-validation.js +197 -0
  37. package/dist/bootstrap-validation.test.js +51 -0
  38. package/dist/branch-ledger.js +1 -1
  39. package/dist/capability-gap.js +130 -0
  40. package/dist/certify-html.js +351 -0
  41. package/dist/certify.js +326 -0
  42. package/dist/check.js +4 -4
  43. package/dist/compliance-miner.js +447 -0
  44. package/dist/continuous-benchmark.js +194 -0
  45. package/dist/continuous-benchmark.test.js +116 -0
  46. package/dist/corpus-stats.js +173 -0
  47. package/dist/counterfactual-engine.js +288 -0
  48. package/dist/coverage-dashboard.js +109 -0
  49. package/dist/coverage-system.test.js +205 -0
  50. package/dist/cross-repo-precision.js +352 -0
  51. package/dist/cve-benchmark.js +180 -0
  52. package/dist/cve-benchmark.test.js +28 -0
  53. package/dist/cve-collector.js +73 -0
  54. package/dist/data-quality.js +141 -0
  55. package/dist/decision-engine.js +388 -0
  56. package/dist/derive-metadata.js +250 -0
  57. package/dist/difficulty-active.test.js +198 -0
  58. package/dist/difficulty-map.js +244 -0
  59. package/dist/discovery-analytics.js +125 -0
  60. package/dist/discovery-model.js +149 -0
  61. package/dist/discovery-optimize.test.js +199 -0
  62. package/dist/discovery-trace.js +276 -0
  63. package/dist/discovery-trace.test.js +97 -0
  64. package/dist/emitter.js +83 -1
  65. package/dist/enterprise-dashboard.js +405 -0
  66. package/dist/eval-hardening.js +297 -0
  67. package/dist/eval-hardening.test.js +85 -0
  68. package/dist/evaluation-campaign.js +359 -0
  69. package/dist/evaluation-campaign.test.js +181 -0
  70. package/dist/evidence-growth.js +143 -0
  71. package/dist/evidence-repository.js +209 -0
  72. package/dist/evidence-system.js +441 -0
  73. package/dist/execute.js +15 -7
  74. package/dist/experimental/software-physics.js +291 -0
  75. package/dist/experimental/state-inference.js +516 -0
  76. package/dist/experimental/unsupervised-physics.js +230 -0
  77. package/dist/extract-ir-python.js +54 -7
  78. package/dist/extract-ir.js +376 -12
  79. package/dist/failure-collector.js +2 -2
  80. package/dist/failure-corpus.js +322 -9
  81. package/dist/feedback.js +16 -5
  82. package/dist/feedback.test.js +49 -0
  83. package/dist/file-lock.js +1 -1
  84. package/dist/flywheel-batch.js +292 -0
  85. package/dist/frameworks/express-cli.js +237 -0
  86. package/dist/frameworks/express-detector.js +445 -0
  87. package/dist/frameworks/express-detector.test.js +206 -0
  88. package/dist/frameworks/index.js +30 -0
  89. package/dist/frameworks/nestjs-detector.js +302 -0
  90. package/dist/frameworks/trpc-detector.js +161 -0
  91. package/dist/frameworks/version-awareness.js +179 -0
  92. package/dist/function-synonyms.js +164 -0
  93. package/dist/function-synonyms.test.js +68 -0
  94. package/dist/generalization.test.js +352 -0
  95. package/dist/goal-annotator.js +113 -0
  96. package/dist/goal-planner.js +563 -0
  97. package/dist/gold-cve.js +164 -0
  98. package/dist/gold-cve.test.js +104 -0
  99. package/dist/gold-quality.js +206 -0
  100. package/dist/gold-tiers.js +241 -0
  101. package/dist/governance-dashboard.js +327 -0
  102. package/dist/graph-viz.js +240 -0
  103. package/dist/guided-frontier.js +195 -0
  104. package/dist/hierarchical-planner.js +148 -0
  105. package/dist/identifier-parser.js +260 -0
  106. package/dist/immune-metrics.js +93 -0
  107. package/dist/immune-receiver.js +158 -0
  108. package/dist/immune-reporter.js +1 -1
  109. package/dist/improvement-orchestrator.js +206 -0
  110. package/dist/inject-p0-vocabulary.js +300 -0
  111. package/dist/intent-parser.js +218 -0
  112. package/dist/invariant-algebra.js +476 -0
  113. package/dist/invariant-calculus.js +533 -0
  114. package/dist/ir-utils.js +70 -0
  115. package/dist/ir-utils.test.js +50 -0
  116. package/dist/knowledge-api.js +312 -0
  117. package/dist/knowledge-evolution.js +452 -0
  118. package/dist/knowledge-explorer.js +506 -0
  119. package/dist/knowledge-flywheel.js +274 -0
  120. package/dist/knowledge-governance.js +338 -0
  121. package/dist/knowledge-governance.test.js +150 -0
  122. package/dist/knowledge-graph.js +181 -0
  123. package/dist/knowledge-guided-synth.js +246 -0
  124. package/dist/knowledge-loop.test.js +77 -0
  125. package/dist/knowledge-object.js +316 -0
  126. package/dist/knowledge-package.js +98 -0
  127. package/dist/kpi-dashboard.js +561 -0
  128. package/dist/l3-cross-function.js +280 -0
  129. package/dist/learning-ranker.js +148 -0
  130. package/dist/learning-ranker.test.js +291 -0
  131. package/dist/ledger/accountability.js +322 -0
  132. package/dist/ledger/chain-builder.js +185 -0
  133. package/dist/ledger/cli.js +222 -0
  134. package/dist/ledger/index.js +13 -0
  135. package/dist/ledger/signatures.js +193 -0
  136. package/dist/ledger/types.js +9 -0
  137. package/dist/llm.js +74 -3
  138. package/dist/load-benchmarks.js +8 -3
  139. package/dist/logger.js +66 -0
  140. package/dist/logger.test.js +37 -0
  141. package/dist/logistic-reward.js +339 -0
  142. package/dist/logistic-reward.test.js +180 -0
  143. package/dist/macro-graph.js +193 -0
  144. package/dist/macro-repair.js +183 -0
  145. package/dist/mcp-server.mjs +1202 -483
  146. package/dist/memory-layer.js +42 -5
  147. package/dist/multi-repo-precision.js +422 -0
  148. package/dist/name-free-protocol.js +425 -0
  149. package/dist/name-free-protocol.test.js +170 -0
  150. package/dist/name-scrambling.js +138 -0
  151. package/dist/name-scrambling.test.js +16 -0
  152. package/dist/p3-observability.test.js +281 -0
  153. package/dist/p5-orchestrator.test.js +225 -0
  154. package/dist/pairwise-preference.js +294 -0
  155. package/dist/pairwise-preference.test.js +140 -0
  156. package/dist/planner-constraints.js +104 -0
  157. package/dist/planner-prompts.js +155 -0
  158. package/dist/planner-telemetry.js +415 -0
  159. package/dist/planner-trace.js +214 -0
  160. package/dist/planner.js +162 -167
  161. package/dist/plsb/artifact.js +116 -0
  162. package/dist/plsb/cli.js +71 -0
  163. package/dist/plsb/index.js +19 -0
  164. package/dist/plsb/leaderboard.js +249 -0
  165. package/dist/plsb/report-md.js +156 -0
  166. package/dist/plsb/schema.js +179 -0
  167. package/dist/plsb-benchmark.js +284 -0
  168. package/dist/plsb-benchmark.test.js +119 -0
  169. package/dist/policy/cli.js +134 -0
  170. package/dist/policy/engine.js +333 -0
  171. package/dist/policy/index.js +12 -0
  172. package/dist/policy/types.js +59 -0
  173. package/dist/policy-miner.js +505 -0
  174. package/dist/precision-analyze.js +229 -0
  175. package/dist/precision-benchmark.js +147 -0
  176. package/dist/precision-label-c.js +134 -0
  177. package/dist/precision-label.js +193 -0
  178. package/dist/precision-report-c.js +149 -0
  179. package/dist/precision-report.js +246 -0
  180. package/dist/progmune-status.js +108 -0
  181. package/dist/proof-engine.js +479 -0
  182. package/dist/proof-provenance.js +315 -0
  183. package/dist/protocol-coverage.js +294 -0
  184. package/dist/protocol-detector.js +1189 -0
  185. package/dist/protocol-embedding-expanded.js +297 -0
  186. package/dist/protocol-embedding-expanded.test.js +97 -0
  187. package/dist/protocol-embedding.js +195 -0
  188. package/dist/protocol-embedding.test.js +82 -0
  189. package/dist/protocol-extractor-v2.js +354 -0
  190. package/dist/protocol-extractor-v2.test.js +140 -0
  191. package/dist/protocol-extractor.js +310 -0
  192. package/dist/protocol-extractor.test.js +113 -0
  193. package/dist/protocol-foundation.js +322 -0
  194. package/dist/protocol-foundation.test.js +163 -0
  195. package/dist/protocol-frontier.js +243 -0
  196. package/dist/protocol-frontier.test.js +92 -0
  197. package/dist/protocol-gap-analyzer.js +228 -0
  198. package/dist/protocol-gap-analyzer.test.js +49 -0
  199. package/dist/protocol-invariants.js +276 -0
  200. package/dist/protocol-invariants.test.js +111 -0
  201. package/dist/protocol-knowledge.js +464 -0
  202. package/dist/protocol-miner.js +343 -0
  203. package/dist/protocol-mining.js +207 -0
  204. package/dist/protocol-mining.test.js +37 -0
  205. package/dist/protocol-registry.js +1 -1
  206. package/dist/protocol-security-benchmark.js +222 -0
  207. package/dist/protocol-vulnerability.js +257 -0
  208. package/dist/protocol-vulnerability.test.js +60 -0
  209. package/dist/python-benchmark.js +120 -0
  210. package/dist/python-emitter.js +163 -45
  211. package/dist/python-protocol-extractor.js +187 -0
  212. package/dist/python-protocol-extractor.test.js +116 -0
  213. package/dist/realworld-benchmark.js +646 -0
  214. package/dist/realworld-benchmark.test.js +36 -0
  215. package/dist/repair-arch.test.js +411 -0
  216. package/dist/repair-evolution.test.js +454 -0
  217. package/dist/repair-executor.js +719 -0
  218. package/dist/repair-proposal.js +4 -4
  219. package/dist/repair-ranker.js +141 -0
  220. package/dist/repair-strategies.js +419 -0
  221. package/dist/repair-taxonomy.js +234 -0
  222. package/dist/repair-types.js +12 -0
  223. package/dist/repo-evaluator.js +250 -0
  224. package/dist/repo-evaluator.test.js +128 -0
  225. package/dist/resource-abstraction.js +242 -0
  226. package/dist/resource-detector.js +211 -0
  227. package/dist/result.test.js +43 -0
  228. package/dist/reward-system.js +411 -0
  229. package/dist/reward-system.test.js +175 -0
  230. package/dist/risk-model.js +215 -0
  231. package/dist/rule-miner.js +234 -7
  232. package/dist/rule-specificity.js +254 -0
  233. package/dist/runtime-types.js +27 -0
  234. package/dist/scaffold.js +208 -0
  235. package/dist/scale-collector.test.js +101 -0
  236. package/dist/scale-trajectory-collector.js +128 -0
  237. package/dist/sdk.js +250 -0
  238. package/dist/search-planner.js +4 -41
  239. package/dist/semantic-snapshot.js +1 -1
  240. package/dist/semantic-topology.js +121 -0
  241. package/dist/semantic-trace.js +310 -317
  242. package/dist/sequence-extractor.js +343 -0
  243. package/dist/skill-library.js +245 -0
  244. package/dist/skill-planner.test.js +189 -0
  245. package/dist/software-physics.js +291 -0
  246. package/dist/software-physics.test.js +81 -0
  247. package/dist/ssg-precision.js +478 -0
  248. package/dist/ssg-validator.js +71 -21
  249. package/dist/state-inference-doubleblind.test.js +160 -0
  250. package/dist/state-inference.js +516 -0
  251. package/dist/state-inference.test.js +115 -0
  252. package/dist/state-machine-fingerprint.js +345 -0
  253. package/dist/state-machine-fingerprint.test.js +120 -0
  254. package/dist/state-miner.js +386 -0
  255. package/dist/state-name-inference.js +213 -0
  256. package/dist/state-name-inference.test.js +69 -0
  257. package/dist/strategy-planner.js +326 -59
  258. package/dist/strategy-planner.test.js +135 -0
  259. package/dist/telemetry-analytics.test.js +402 -0
  260. package/dist/terminal-format.js +68 -0
  261. package/dist/terminal-format.test.js +83 -0
  262. package/dist/topology-factory.js +196 -0
  263. package/dist/topology-representation.js +242 -0
  264. package/dist/topology-representation.test.js +27 -0
  265. package/dist/trajectory-augmentation.js +254 -0
  266. package/dist/trajectory-augmentation.test.js +63 -0
  267. package/dist/trajectory-corpus.js +440 -0
  268. package/dist/trajectory-corpus.test.js +32 -0
  269. package/dist/trajectory-feedback.test.js +116 -0
  270. package/dist/transition-synthesizer.js +286 -0
  271. package/dist/transition-synthesizer.test.js +123 -0
  272. package/dist/trust/api-semantic-mapper.js +809 -0
  273. package/dist/trust/call-graph-propagator.js +225 -0
  274. package/dist/trust/cli.js +122 -0
  275. package/dist/trust/compliance-scorer.js +283 -0
  276. package/dist/trust/confidence-calculator.js +261 -0
  277. package/dist/trust/engine.js +1145 -0
  278. package/dist/trust/explainability.js +85 -0
  279. package/dist/trust/formatters/ci.js +42 -0
  280. package/dist/trust/formatters/json.js +11 -0
  281. package/dist/trust/formatters/terminal.js +152 -0
  282. package/dist/trust/index.js +39 -0
  283. package/dist/trust/phase1-verify.js +171 -0
  284. package/dist/trust/protocol-domain-validator.js +697 -0
  285. package/dist/trust/score-calculator.js +282 -0
  286. package/dist/trust/ssg-bridge.js +641 -0
  287. package/dist/trust/ssg-bridge.test.js +269 -0
  288. package/dist/trust/types.js +67 -0
  289. package/dist/trust/violation-trace.js +335 -0
  290. package/dist/trust-api.js +179 -0
  291. package/dist/trust-calibration.js +279 -0
  292. package/dist/unknown-protocol-discovery.js +339 -0
  293. package/dist/unknown-protocol-discovery.test.js +102 -0
  294. package/dist/unsupervised-physics.js +230 -0
  295. package/dist/unsupervised-physics.test.js +95 -0
  296. package/dist/utils.test.js +37 -0
  297. package/dist/validator.js +187 -10
  298. package/dist/verification-intelligence.js +475 -0
  299. package/dist/verify-api.js +432 -0
  300. package/dist/vi-impact-report.js +293 -0
  301. package/dist/wl-fingerprint.js +162 -0
  302. package/dist/wl-fingerprint.test.js +130 -0
  303. package/dist/zeroshot-strategy.js +139 -0
  304. package/docs/Progmune_/346/212/225/350/265/204/344/272/272/347/231/275/347/232/256/344/271/246_v2.0.html +576 -0
  305. package/docs/Progmune_/351/241/271/347/233/256/345/205/250/350/247/243.html +710 -0
  306. package/package.json +74 -7
  307. package/protocols.json +1956 -50
  308. package/.dockerignore +0 -14
  309. package/.mcp.json +0 -11
  310. package/.progmune_allowlist +0 -50
  311. package/.test_report/test_report.md +0 -87
  312. package/Dockerfile +0 -9
  313. package/FAQ.md +0 -167
  314. package/WHITEPAPER.md +0 -540
  315. package/demo-project/auth.ts +0 -55
  316. package/demo-project/tsconfig.json +0 -8
  317. package/dist/acl-breakdown.js +0 -13
  318. package/dist/all-sessions.js +0 -11
  319. package/dist/antibody-stats.js +0 -11
  320. package/dist/branch-tree-count.js +0 -14
  321. package/dist/common-fixpath.js +0 -12
  322. package/dist/constraint-types.js +0 -12
  323. package/dist/exec-metrics.js +0 -11
  324. package/dist/failure-report.js +0 -11
  325. package/dist/fast-path-hits.js +0 -13
  326. package/dist/fingerprint-list.js +0 -15
  327. package/dist/gen-history-log.js +0 -13
  328. package/dist/heatmap-data.js +0 -11
  329. package/dist/recent-session.js +0 -12
  330. package/dist/svl-distribution.js +0 -11
  331. package/dist/terminal-status.js +0 -11
  332. package/dist/token-savings.js +0 -11
  333. package/dist/total-repairs.js +0 -12
  334. package/dist/unresolved-count.js +0 -12
  335. package/dist/valid-fingerprints.js +0 -13
  336. package/dist/verify-ledgers.js +0 -11
  337. package/docs/whitepaper-style.css +0 -77
  338. package/docs/whitepaper-v2.1.md +0 -609
  339. package/docs/whitepaper-v2.2.md +0 -1064
  340. package/docs/whitepaper-v2.2.pdf +0 -0
  341. package/fly.toml +0 -31
  342. package/public/dashboard.html +0 -119
  343. package/server/hub.js +0 -116
  344. package/test/replay-golden/sess_1780063202050_mgeld.json +0 -9
  345. package/test/replay-golden/sess_1780064032560_gocld.json +0 -354
  346. package/test/replay-golden/sess_1780064413331_s2709.json +0 -606
  347. package/test/replay-golden/sess_1780064792710_y3avo.json +0 -614
  348. package/test/replay-golden.ts +0 -84
  349. package/test_benchmark.js +0 -165
  350. package/test_comprehensive.mjs +0 -638
  351. package/test_concurrency.js +0 -129
  352. package/test_ir_robustness.js +0 -85
  353. package/test_semantic_contracts.js +0 -269
  354. package/test_ssg_stress.js +0 -156
  355. package/test_svl3.js +0 -58
  356. package/tsconfig.json +0 -17
package/docs/Progmune_/351/241/271/347/233/256/345/205/250/350/247/243.html ADDED
@@ -0,0 +1,710 @@
1
+ <!DOCTYPE html>
2
+ <html lang="zh-CN">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>Progmune 项目全解 — AI 代码信任决策引擎</title>
7
+ <style>
8
+ :root {
9
+ --bg: #fafbfc; --card: #ffffff; --ink: #1f2937; --ink-2: #4b5563; --ink-3: #6b7280;
10
+ --accent: #1a73e8; --accent-dark: #1557b0; --accent-light: #e8f0fe;
11
+ --green: #1e8e3e; --green-light: #e6f4ea;
12
+ --amber: #b45309; --amber-light: #fef3c7;
13
+ --red: #c5221f; --red-light: #fce8e6;
14
+ --border: #e5e7eb; --shadow: 0 1px 3px rgba(0,0,0,.06), 0 1px 2px rgba(0,0,0,.04);
15
+ --mono: "SF Mono", "Fira Code", Menlo, Consolas, monospace;
16
+ }
17
+ * { margin: 0; padding: 0; box-sizing: border-box; }
18
+ body {
19
+ font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans SC", "PingFang SC", "Microsoft YaHei", sans-serif;
20
+ background: var(--bg); color: var(--ink); line-height: 1.85; font-size: 16px;
21
+ -webkit-font-smoothing: antialiased;
22
+ }
23
+ .wrap { max-width: 880px; margin: 0 auto; padding: 24px 20px 64px; }
24
+
25
+ /* ── Hero ── */
26
+ .hero {
27
+ background: linear-gradient(135deg, #0b1c33 0%, #12335c 55%, #1a4d8f 100%);
28
+ color: #fff; border-radius: 20px; padding: 56px 44px 44px; margin-bottom: 32px;
29
+ position: relative; overflow: hidden;
30
+ }
31
+ .hero::after {
32
+ content: ""; position: absolute; right: -80px; top: -80px; width: 280px; height: 280px;
33
+ background: radial-gradient(circle, rgba(255,255,255,.08) 0%, transparent 70%); border-radius: 50%;
34
+ }
35
+ .hero .kicker { font-size: .82em; letter-spacing: .12em; text-transform: uppercase; color: #9ec1e8; margin-bottom: 10px; }
36
+ .hero h1 { font-size: 2.1em; font-weight: 800; line-height: 1.25; margin-bottom: 10px; }
37
+ .hero .sub { font-size: 1.05em; color: #c8daf0; margin-bottom: 26px; max-width: 640px; }
38
+ .hero .meta { display: flex; flex-wrap: wrap; gap: 10px; }
39
+ .hero .meta span {
40
+ background: rgba(255,255,255,.1); border: 1px solid rgba(255,255,255,.18);
41
+ padding: 5px 14px; border-radius: 20px; font-size: .82em; color: #dbe7f5;
42
+ }
43
+
44
+ /* ── TOC ── */
45
+ .toc { background: var(--card); border: 1px solid var(--border); border-radius: 14px; padding: 26px 30px; margin-bottom: 32px; box-shadow: var(--shadow); }
46
+ .toc h2 { font-size: 1em; color: var(--ink-2); text-transform: uppercase; letter-spacing: .08em; margin-bottom: 14px; }
47
+ .toc ol { columns: 2; column-gap: 36px; }
48
+ .toc li { margin: 5px 0 5px 18px; font-size: .92em; }
49
+ .toc a { color: var(--ink-2); text-decoration: none; }
50
+ .toc a:hover { color: var(--accent); }
51
+ .toc .num { color: var(--accent); font-weight: 700; margin-right: 6px; }
52
+
53
+ /* ── Sections ── */
54
+ section { background: var(--card); border: 1px solid var(--border); border-radius: 16px; padding: 34px 36px; margin-bottom: 26px; box-shadow: var(--shadow); }
55
+ section h2 {
56
+ font-size: 1.45em; font-weight: 800; color: #0f172a; margin-bottom: 6px;
57
+ display: flex; align-items: center; gap: 10px;
58
+ }
59
+ section h2 .chap {
60
+ background: var(--accent); color: #fff; font-size: .62em; font-weight: 800;
61
+ padding: 3px 10px; border-radius: 6px; letter-spacing: .06em; flex-shrink: 0;
62
+ }
63
+ section h3 { font-size: 1.1em; font-weight: 700; color: #111827; margin: 26px 0 10px; }
64
+ section h4 { font-size: .98em; font-weight: 700; color: var(--ink); margin: 18px 0 6px; }
65
+ section p { margin: 10px 0; }
66
+ section .lead { color: var(--ink-2); font-size: 1.02em; margin-bottom: 16px; }
67
+
68
+ /* ── Callouts ── */
69
+ .plain {
70
+ background: var(--accent-light); border-left: 4px solid var(--accent);
71
+ padding: 14px 18px; border-radius: 0 10px 10px 0; margin: 14px 0; font-size: .93em; color: #1e3a5f;
72
+ }
73
+ .plain strong { color: var(--accent-dark); }
74
+ .warn-box {
75
+ background: var(--amber-light); border-left: 4px solid #d97706;
76
+ padding: 14px 18px; border-radius: 0 10px 10px 0; margin: 14px 0; font-size: .93em;
77
+ }
78
+ .good-box {
79
+ background: var(--green-light); border-left: 4px solid var(--green);
80
+ padding: 14px 18px; border-radius: 0 10px 10px 0; margin: 14px 0; font-size: .93em;
81
+ }
82
+ .risk-box {
83
+ background: var(--red-light); border-left: 4px solid var(--red);
84
+ padding: 14px 18px; border-radius: 0 10px 10px 0; margin: 14px 0; font-size: .93em;
85
+ }
86
+
87
+ /* ── Tables ── */
88
+ table { width: 100%; border-collapse: collapse; margin: 16px 0; font-size: .92em; }
89
+ th { background: #f3f4f6; text-align: left; padding: 10px 14px; font-weight: 700; color: #374151; border-bottom: 2px solid var(--border); white-space: nowrap; }
90
+ td { padding: 9px 14px; border-bottom: 1px solid #f1f3f5; vertical-align: top; }
91
+ tr:last-child td { border-bottom: none; }
92
+
93
+ /* ── Stat cards ── */
94
+ .stats { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 14px; margin: 20px 0; }
95
+ .stat {
96
+ background: #f8fafc; border: 1px solid var(--border); border-radius: 12px;
97
+ padding: 18px 16px; text-align: center;
98
+ }
99
+ .stat .n { font-size: 1.9em; font-weight: 800; color: var(--accent); line-height: 1.2; }
100
+ .stat .l { font-size: .82em; color: var(--ink-3); margin-top: 5px; }
101
+
102
+ /* ── Bar chart ── */
103
+ .bar { display: flex; align-items: center; gap: 10px; margin: 7px 0; }
104
+ .bar .bl { width: 130px; text-align: right; font-size: .85em; color: var(--ink-2); flex-shrink: 0; }
105
+ .bar .bt { flex: 1; background: #f1f5f9; height: 12px; border-radius: 6px; overflow: hidden; }
106
+ .bar .bf { height: 100%; border-radius: 6px; background: var(--accent); }
107
+ .bar .bv { width: 52px; font-size: .85em; font-weight: 700; color: var(--ink); flex-shrink: 0; }
108
+
109
+ /* ── Glossary cards ── */
110
+ .glossary { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; margin: 16px 0; }
111
+ .term {
112
+ background: #f8fafc; border: 1px solid var(--border); border-radius: 10px; padding: 14px 16px;
113
+ }
114
+ .term .t { font-weight: 700; color: #0f172a; font-size: .93em; }
115
+ .term .t .en { color: var(--ink-3); font-weight: 400; font-size: .85em; }
116
+ .term .d { font-size: .88em; color: var(--ink-2); margin-top: 5px; }
117
+
118
+ /* ── Flow diagram ── */
119
+ .flow { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; margin: 16px 0; }
120
+ .flow .node {
121
+ background: var(--accent-light); border: 1px solid #b6d4fb; color: var(--accent-dark);
122
+ border-radius: 10px; padding: 10px 16px; font-size: .9em; font-weight: 600; text-align: center;
123
+ }
124
+ .flow .arrow { color: var(--ink-3); font-size: 1.1em; }
125
+
126
+ /* ── Code ── */
127
+ code {
128
+ font-family: var(--mono); background: #f1f5f9; color: #c2410c;
129
+ padding: 2px 7px; border-radius: 5px; font-size: .88em;
130
+ }
131
+ pre {
132
+ background: #0f172a; color: #e2e8f0; border-radius: 12px; padding: 18px 22px;
133
+ overflow-x: auto; margin: 14px 0; font-size: .85em; line-height: 1.6;
134
+ }
135
+ pre code { background: none; color: inherit; padding: 0; }
136
+
137
+ /* ── Verdict banner ── */
138
+ .verdict {
139
+ display: flex; align-items: center; gap: 16px; border-radius: 14px; padding: 18px 24px; margin: 16px 0;
140
+ }
141
+ .verdict.approved { background: var(--green-light); border: 2px solid #4ade80; }
142
+ .verdict .icon { width: 52px; height: 52px; border-radius: 50%; background: var(--green); color: #fff; display: flex; align-items: center; justify-content: center; font-size: 1.5em; flex-shrink: 0; }
143
+ .verdict h4 { margin: 0; color: #14532d; font-size: 1.15em; }
144
+ .verdict p { margin: 2px 0 0; font-size: .88em; color: #3f6212; }
145
+
146
+ /* ── Footer ── */
147
+ .foot { text-align: center; color: var(--ink-3); font-size: .84em; padding: 28px 0 8px; }
148
+ .foot a { color: var(--accent); }
149
+
150
+ @media print {
151
+ body { background: #fff; }
152
+ section, .toc, .stat, .term { box-shadow: none; }
153
+ .hero { border-radius: 0; }
154
+ }
155
+ @media (max-width: 720px) {
156
+ .hero { padding: 36px 24px; }
157
+ .hero h1 { font-size: 1.6em; }
158
+ .toc ol { columns: 1; }
159
+ .glossary { grid-template-columns: 1fr; }
160
+ section { padding: 24px 20px; }
161
+ .bar .bl { width: 90px; }
162
+ table { font-size: .82em; }
163
+ }
164
+ </style>
165
+ </head>
166
+ <body>
167
+ <div class="wrap">
168
+
169
+ <!-- ═══════════ HERO ═══════════ -->
170
+ <div class="hero">
171
+ <div class="kicker">Project Overview · 项目全解</div>
172
+ <h1>Progmune<br>AI 代码信任决策引擎</h1>
173
+ <div class="sub">让 AI 生成的每一行代码，在进入生产环境之前，都经过可解释、可审计、可追溯的验证。
174
+ 本文档面向两类读者：想快速理解的初学者，与需要专业判断的投资人。</div>
175
+ <div class="meta">
176
+ <span>📄 版本 v1.0 · 2026-08</span>
177
+ <span>🧪 引擎版本 v3.2.0</span>
178
+ <span>📊 13/13 安全类别覆盖</span>
179
+ <span>🔓 开源 MIT</span>
180
+ <span>📦 npm install progmune-runtime</span>
181
+ </div>
182
+ </div>
183
+
184
+ <!-- ═══════════ TOC ═══════════ -->
185
+ <div class="toc">
186
+ <h2>目录 · Contents</h2>
187
+ <ol>
188
+ <li><span class="num">01</span><a href="#s1">三十秒理解 Progmune</a></li>
189
+ <li><span class="num">02</span><a href="#s2">名词解释（先读这个）</a></li>
190
+ <li><span class="num">03</span><a href="#s3">项目背景：AI 代码的信任危机</a></li>
191
+ <li><span class="num">04</span><a href="#s4">框架逻辑：为什么这样做能解决问题</a></li>
192
+ <li><span class="num">05</span><a href="#s5">技术方法：具体怎么做</a></li>
193
+ <li><span class="num">06</span><a href="#s6">产品与能力现状</a></li>
194
+ <li><span class="num">07</span><a href="#s7">实测案例：PrintLab 治理全过程</a></li>
195
+ <li><span class="num">08</span><a href="#s8">竞争格局</a></li>
196
+ <li><span class="num">09</span><a href="#s9">市场机会与商业模式</a></li>
197
+ <li><span class="num">10</span><a href="#s10">风险分析（客观）</a></li>
198
+ <li><span class="num">11</span><a href="#s11">路线图</a></li>
199
+ <li><span class="num">12</span><a href="#s12">给投资人的总结论</a></li>
200
+ </ol>
201
+ </div>
202
+
203
+ <!-- ═══════════ 1. 三十秒理解 ═══════════ -->
204
+ <section id="s1">
205
+ <h2><span class="chap">01</span>三十秒理解 Progmune</h2>
206
+ <p class="lead">一句话：<strong>Progmune 不生成代码，它给 AI 生成的代码做"上岗体检"，并给出一个明确结论——能不能部署。</strong></p>
207
+
208
+ <div class="plain">
209
+ <strong>一个类比：</strong>飞机在起飞前有完整的检查单——油量、襟翼、液压、仪表。AI 现在以 10 倍速度"造飞机"，但绝大多数企业让这些飞机<strong>没有检查就直接起飞</strong>。Progmune 就是那张检查单：不是替飞行员开飞机，而是确保每一架飞机在起飞前都通过了必检项。
210
+ </div>
211
+
212
+ <p>Progmune 检查的不是"代码风格好不好"，而是四类传统工具看不见的问题：</p>
213
+ <table>
214
+ <tr><th>问题类型</th><th>通俗解释</th><th>例子</th></tr>
215
+ <tr><td><strong>符号幻觉</strong></td><td>AI 调用了项目里根本不存在的函数</td><td>代码里写 <code>getUserByPhone()</code>，但项目只有 <code>getUserByEmail()</code></td></tr>
216
+ <tr><td><strong>类型漂移</strong></td><td>参数数量或类型对不上</td><td>函数要 3 个参数，AI 只传了 2 个</td></tr>
217
+ <tr><td><strong>数据流错误</strong></td><td>变量没定义就使用</td><td>用了 <code>userName</code> 但它从未被赋值</td></tr>
218
+ <tr><td><strong>协议违规</strong> ★核心</td><td>关键步骤顺序错了或漏了</td><td>没验证密码就签发令牌；支付完成但没验证签名</td></tr>
219
+ </table>
220
+
221
+ <p>检查结果不是一份问题清单，而是<strong>一个决策</strong>：</p>
222
+ <div class="flow">
223
+ <div class="node">信任评分 0–100</div>
224
+ <span class="arrow">+</span>
225
+ <div class="node">决策：批准 / 需复审 / 阻止</div>
226
+ <span class="arrow">+</span>
227
+ <div class="node">置信度：高 / 中 / 低 / 不确定</div>
228
+ <span class="arrow">+</span>
229
+ <div class="node">证据：每个扣分点都可追溯到代码行</div>
230
+ </div>
231
+
232
+ <div class="good-box">
233
+ <strong>为什么企业需要它：</strong>企业真正关心的问题是"这段 AI 代码能不能上线？"——不是"它的分数是 58 还是 61"。Progmune 把这个问题的答案做成了一条 CI/CD 命令：<code>BLOCKED</code> 就阻止合并，<code>APPROVED</code> 就放行。
234
+ </div>
235
+ </section>
236
+
237
+ <!-- ═══════════ 2. 名词解释 ═══════════ -->
238
+ <section id="s2">
239
+ <h2><span class="chap">02</span>名词解释（建议先读）</h2>
240
+ <p class="lead">本文档用到的所有专业术语，按"先易后难"排列。读完这一节，后面不会再被术语挡住。</p>
241
+
242
+ <h3>基础层</h3>
243
+ <div class="glossary">
244
+ <div class="term">
245
+ <div class="t">大语言模型（LLM）<span class="en">Large Language Model</span></div>
246
+ <div class="d">就是 ChatGPT、Claude、DeepSeek 这类 AI 的"大脑"。它会"猜"最可能正确的下一个词——写代码对它来说就是"猜下一行"。</div>
247
+ </div>
248
+ <div class="term">
249
+ <div class="t">AI 生成代码 <span class="en">AI-Generated Code</span></div>
250
+ <div class="d">由 AI 工具（如 GitHub Copilot、Cursor）写出或协助写出的代码。它的特点是：语法通常正确，但语义可能错。</div>
251
+ </div>
252
+ <div class="term">
253
+ <div class="t">幻觉 <span class="en">Hallucination</span></div>
254
+ <div class="d">AI 一本正经地输出不存在的东西。写代码时表现为：调用不存在的函数、用不存在的参数——而且不报错。</div>
255
+ </div>
256
+ <div class="term">
257
+ <div class="t">开源 <span class="en">Open Source / MIT</span></div>
258
+ <div class="d">代码完全公开，任何人可免费使用、修改、商用。Progmune 采用 MIT 协议，与 GitLab、VS Code 同类。</div>
259
+ </div>
260
+ </div>
261
+
262
+ <h3>概念层</h3>
263
+ <div class="glossary">
264
+ <div class="term">
265
+ <div class="t">中间表示 IR <span class="en">Intermediate Representation</span></div>
266
+ <div class="d">把项目源码解析成一份"函数清单"（名字、参数、类型、调用关系）。这份清单从真实代码提取，不依赖 AI 的记忆——是系统的"唯一真相来源"。</div>
267
+ </div>
268
+ <div class="term">
269
+ <div class="t">协议 <span class="en">Protocol</span></div>
270
+ <div class="d">事情必须按特定顺序做的规则。例如：登录 = 先验证密码 → 再签发令牌 → 再创建会话。顺序错了就是安全漏洞。</div>
271
+ </div>
272
+ <div class="term">
273
+ <div class="t">状态机 <span class="en">State Machine</span></div>
274
+ <div class="d">一种数学工具，用来描述"现在处于什么状态、允许做什么操作"。交通信号灯就是状态机：红灯不能变黄灯，绿灯不能直接跳红灯。</div>
275
+ </div>
276
+ <div class="term">
277
+ <div class="t">SVL 四层验证 <span class="en">Semantic Validation Levels</span></div>
278
+ <div class="d">Progmune 的检查体系，共四层：SVL-1 函数存在性 → SVL-2 类型正确性 → SVL-3 数据流 → SVL-4 协议顺序。层层递进，越往后越难、越关键。</div>
279
+ </div>
280
+ <div class="term">
281
+ <div class="t">SSG <span class="en">State-Guided Generation</span></div>
282
+ <div class="d">Progmune 的核心技术：用状态机"引导"AI 生成代码——AI 每提出一步，状态机就检查这一步是否合法，不合法就纠正。</div>
283
+ </div>
284
+ <div class="term">
285
+ <div class="t">免疫记忆 / 抗体 <span class="en">Immune Memory / Antibody</span></div>
286
+ <div class="d">比喻：系统把每次发现的错误模式记下来。同类错误再出现时，直接调用已知解法（像人得了一次水痘后终身免疫）。</div>
287
+ </div>
288
+ </div>
289
+
290
+ <h3>产品层</h3>
291
+ <div class="glossary">
292
+ <div class="term">
293
+ <div class="t">信任评分 <span class="en">Trust Score</span></div>
294
+ <div class="d">0–100 的量化分数，衡量一段 AI 代码的可信程度。由四个维度加权得出（见第 4 章）。</div>
295
+ </div>
296
+ <div class="term">
297
+ <div class="t">部署决策 <span class="en">Decision</span></div>
298
+ <div class="d">APPROVED（批准）/ NEEDS_REVIEW（需人工复审）/ BLOCKED（阻止）。这是产品的最终输出——CI/CD 管道直接按它行动。</div>
299
+ </div>
300
+ <div class="term">
301
+ <div class="t">置信度 <span class="en">Confidence</span></div>
302
+ <div class="d">这个评分本身有多可靠。Progmune 的原则是"诚实"：对没能力检查的语言（如 Go），明确说"置信度低"，不假装 100%。</div>
303
+ </div>
304
+ <div class="term">
305
+ <div class="t">PLSB <span class="en">Protocol Lifecycle Security Benchmark</span></div>
306
+ <div class="d">协议生命周期安全基准——13 类协议安全弱点的分类体系（如资源泄漏、认证绕过、会话劫持）。Progmune 是首个覆盖全部 13 类的验证引擎。</div>
307
+ </div>
308
+ <div class="term">
309
+ <div class="t">MCP <span class="en">Model Context Protocol</span></div>
310
+ <div class="d">AI 客户端（如 Claude Code）与工具服务器之间的标准接口——相当于 AI 世界的"USB 接口"。Progmune 通过它接入各种 AI 编程工具。</div>
311
+ </div>
312
+ <div class="term">
313
+ <div class="t">CI/CD <span class="en">Continuous Integration/Deployment</span></div>
314
+ <div class="d">软件开发中的自动化流水线：代码提交后自动测试、自动部署。Progmune 的决策就嵌入在这里——不合格的代码自动被拦下。</div>
315
+ </div>
316
+ <div class="term">
317
+ <div class="t">SAST / 静态分析 <span class="en">Static Application Security Testing</span></div>
318
+ <div class="d">逐行扫描代码找已知漏洞模式的传统工具（CodeQL、Semgrep 属于此类）。它们的盲区：看不见跨函数的调用顺序错误。</div>
319
+ </div>
320
+ <div class="term">
321
+ <div class="t">tRPC / Express <span class="en">Web Frameworks</span></div>
322
+ <div class="d">两个流行的 Web 后端框架。可以理解为"搭建网站后端的脚手架"——Progmune 针对这些框架做专项适配。</div>
323
+ </div>
324
+ </div>
325
+
326
+ <div class="plain">
327
+ <strong>阅读提示：</strong>如果后面再遇到不懂的词，回到这里。核心记住三件事就够了：<strong>① IR = 真相清单</strong>（真实代码里有什么函数）；<strong>② 协议 = 顺序规则</strong>（必须先做什么再做什么）；<strong>③ 决策 = 最终答案</strong>（能上线 / 不能上线）。
328
+ </div>
329
+ </section>
330
+
331
+ <!-- ═══════════ 3. 项目背景 ═══════════ -->
332
+ <section id="s3">
333
+ <h2><span class="chap">03</span>项目背景：AI 代码的信任危机</h2>
334
+
335
+ <h3>3.1 时代背景：代码生产速度暴涨，验证能力原地踏步</h3>
336
+ <div class="stats">
337
+ <div class="stat"><div class="n">76%</div><div class="l">企业已采用 AI 编码工具</div></div>
338
+ <div class="stat"><div class="n">180万+</div><div class="l">Copilot 付费用户</div></div>
339
+ <div class="stat"><div class="n">$100亿+</div><div class="l">Cursor 估值</div></div>
340
+ <div class="stat"><div class="n">~40%</div><div class="l">AI 生成代码含潜在缺陷</div></div>
341
+ </div>
342
+
343
+ <p>AI 编码工具让代码的生产速度提升了约 10 倍，但<strong>验证环节几乎没有变化</strong>——仍然靠人工审查和传统测试。GitClear 2024 报告显示，AI 代码的变更回滚率比传统代码高 14%。这形成了一个清晰的剪刀差：</p>
344
+
345
+ <div class="bar"><span class="bl">代码生产速度</span><div class="bt"><div class="bf" style="width:100%"></div></div><span class="bv">10x</span></div>
346
+ <div class="bar"><span class="bl">人工审查能力</span><div class="bt"><div class="bf" style="width:10%"></div></div><span class="bv">1x</span></div>
347
+
348
+ <h3>3.2 问题本质：AI 写代码的原理决定了它"看不见"错误</h3>
349
+ <p>大语言模型生成代码的方式是<strong>统计预测</strong>——根据训练数据猜"下一个最可能的词"。学术研究（Kambhampati et al., ICML 2026）明确指出：LLM 输出的"逐步推理"是统计表演，中间 token 与真实推理之间没有可靠的因果对应。</p>
350
+ <p>这意味着：AI 写出"看似合理的代码"和"实际正确的代码"是两件事。它会一本正经地调用不存在的函数、跳过关键的认证步骤——<strong>而且完全静默，不报错</strong>。</p>
351
+
352
+ <h3>3.3 现有方案为什么不够</h3>
353
+ <table>
354
+ <tr><th>方案</th><th>原理</th><th>根本缺陷</th></tr>
355
+ <tr><td><strong>Linter / SAST</strong><br><span style="font-size:.85em;color:var(--ink-3)">CodeQL, Semgrep, SonarQube</span></td><td>代码写完后逐行扫描已知漏洞模式</td><td>只看到"单行"，看不到"跨函数调用顺序"——协议违规是它们的系统性盲区</td></tr>
356
+ <tr><td><strong>RAG 上下文注入</strong></td><td>把项目信息塞进 AI 的提示词，降低幻觉</td><td>降低但<strong>不消除</strong>幻觉；AI 仍然是唯一仲裁者；无形式化保证</td></tr>
357
+ <tr><td><strong>提示词工程</strong></td><td>精心设计指令引导 AI</td><td>零合规保证；AI 版本一升级就失效</td></tr>
358
+ <tr><td><strong>人工审查</strong></td><td>人眼逐行检查</td><td>不可扩展——生产速度快 10 倍，人不会快 10 倍</td></tr>
359
+ <tr><td><strong>单元测试</strong></td><td>写测试用例验证行为</td><td>测试覆盖有限；测试本身也常由 AI 生成（自证循环）</td></tr>
360
+ </table>
361
+
362
+ <div class="warn-box">
363
+ <strong>关键洞察：</strong>以上所有方案有一个共同点——<strong>它们都是"事后补救"</strong>。错误已经写进代码，再去发现它。而真正的问题发生在代码生成的那一刻。这就是 Progmune 切入的角度：<strong>在生成环节植入确定性验证</strong>。
364
+ </div>
365
+
366
+ <h3>3.4 为什么是现在</h3>
367
+ <ul>
368
+ <li><strong>临界点已到</strong>：AI 编码从实验走向企业标配，但没有任何"编译器级"的验证机制保护它</li>
369
+ <li><strong>监管在收紧</strong>：金融（SOX）、医疗（HIPAA）等受监管行业开始要求 AI 代码可审计、可追溯</li>
370
+ <li><strong>事故在积累</strong>：AI 生成代码导致的线上事故（支付漏洞、认证绕过）开始进入公众视野</li>
371
+ <li><strong>技术窗口</strong>：协议状态机 + 中间表示的组合方案在学术界和工业界都还没有成熟竞争者</li>
372
+ </ul>
373
+ </section>
374
+
375
+ <!-- ═══════════ 4. 框架逻辑 ═══════════ -->
376
+ <section id="s4">
377
+ <h2><span class="chap">04</span>框架逻辑：为什么这样做能解决问题</h2>
378
+ <p class="lead">Progmune 的全部设计源于一个第一性原理：<strong>不信任 AI 说的，只验证程序实际做的。</strong></p>
379
+
380
+ <h3>4.1 核心思想：把 AI 从"预言机"降级为"受约束的提议器"</h3>
381
+ <p>传统模式下，AI 是系统的中心：它写什么，什么就是代码。Progmune 翻转了这个关系：</p>
382
+ <div class="flow">
383
+ <div class="node">传统模式<br><span style="font-size:.8em;font-weight:400">AI 提议 → 直接落地</span></div>
384
+ <span class="arrow">→</span>
385
+ <div class="node">Progmune 模式<br><span style="font-size:.8em;font-weight:400">AI 提议 → 四层验证 → 通过才落地</span></div>
386
+ </div>
387
+ <p>AI 仍然负责"创意"（写什么代码），但<strong>不再拥有"裁决权"</strong>（代码合不合格）。裁决权交给一个确定性的验证系统——同一段代码、同一套规则，永远得到同一个结果。</p>
388
+
389
+ <h3>4.2 三大支柱</h3>
390
+ <table>
391
+ <tr><th style="width:22%">支柱</th><th style="width:38%">通俗解释</th><th>为什么不可或缺</th></tr>
392
+ <tr><td><strong>① 程序真相层<br>（IR）</strong></td><td>把项目真实存在的函数、类型、调用关系解析成一份清单</td><td>AI 的"记忆"是概率性的，IR 是确定性的。没有它，验证无从谈起——它是所有检查的事实基础</td></tr>
393
+ <tr><td><strong>② 协议状态机<br>（SSG）</strong></td><td>把"必须按顺序做的事"建模成状态机，检查每一步是否合法</td><td>这是与传统 SAST 的本质区别：传统工具看"单行代码"，Progmune 看"调用顺序"。认证前签发令牌这种漏洞只有顺序检查能发现</td></tr>
394
+ <tr><td><strong>③ 免疫记忆</strong></td><td>每次拦截的错误都记入语料库，形成可复用的"抗体"</td><td>让系统越用越强：同类错误第二次出现时直接调用已知解法，甚至跳过 AI 重试——形成数据飞轮</td></tr>
395
+ </table>
396
+
397
+ <h3>4.3 四层验证（SVL）：从便宜到昂贵，层层递进</h3>
398
+ <table>
399
+ <tr><th>层级</th><th>检查什么</th><th>拦截的问题</th><th>检查成本</th></tr>
400
+ <tr><td><strong>SVL-1 符号存在性</strong></td><td>调用的函数在项目里真实存在吗？</td><td>幻觉函数名</td><td>极低（查表）</td></tr>
401
+ <tr><td><strong>SVL-2 类型完整性</strong></td><td>参数数量和类型与签名匹配吗？</td><td>类型漂移</td><td>低</td></tr>
402
+ <tr><td><strong>SVL-3 数据流正确性</strong></td><td>变量先声明后使用了吗？</td><td>未定义变量、循环引用</td><td>中</td></tr>
403
+ <tr><td><strong>SVL-4 协议合法性</strong> ★</td><td>调用顺序符合协议状态机吗？</td><td>认证绕过、支付篡改、会话劫持</td><td>较高（状态机 + BFS 搜索）</td></tr>
404
+ </table>
405
+
406
+ <h3>4.4 决策模型：四个维度加权出一个"能不能上线"</h3>
407
+ <p>Progmune 的最终输出不是问题清单，而是四维加权后的一个决策：</p>
408
+ <div class="bar"><span class="bl">① 策略合规 35%</span><div class="bt"><div class="bf" style="width:35%"></div></div><span class="bv">企业安全策略执行</span></div>
409
+ <div class="bar"><span class="bl">② 协议安全 30%</span><div class="bt"><div class="bf" style="width:30%"></div></div><span class="bv">认证/授权/支付等协议</span></div>
410
+ <div class="bar"><span class="bl">③ 验证覆盖 20%</span><div class="bt"><div class="bf" style="width:20%"></div></div><span class="bv">类型检查/SSG/测试</span></div>
411
+ <div class="bar"><span class="bl">④ 治理完整性 15%</span><div class="bt"><div class="bf" style="width:15%"></div></div><span class="bv">溯源链/防篡改</span></div>
412
+
413
+ <p>判定规则（简单明确）：</p>
414
+ <table>
415
+ <tr><th>条件</th><th>决策</th></tr>
416
+ <tr><td>存在<strong>严重违规</strong>（critical）</td><td><span style="color:var(--red);font-weight:700">BLOCKED</span> —— 不管分数多高，一律阻止</td></tr>
417
+ <tr><td>总分 ≥ 80</td><td><span style="color:var(--green);font-weight:700">APPROVED</span> —— 批准部署</td></tr>
418
+ <tr><td>60–79</td><td><span style="color:var(--amber);font-weight:700">NEEDS_REVIEW</span> —— 需人工复审</td></tr>
419
+ <tr><td>&lt; 60</td><td><span style="color:var(--red);font-weight:700">BLOCKED</span> —— 阻止</td></tr>
420
+ </table>
421
+
422
+ <div class="plain">
423
+ <strong>设计哲学（也是产品哲学）：Decision &gt; Score。</strong>企业关心"能不能上线"，不关心"58 分还是 61 分"。所以决策是产品，分数只是支撑决策的证据。同时坚持"诚实原则"：检查不到的能力边界，用置信度明确标注，绝不假装 100% 覆盖。
424
+ </div>
425
+
426
+ <h3>4.5 学习闭环：数据飞轮</h3>
427
+ <div class="flow">
428
+ <div class="node">AI 生成代码</div><span class="arrow">→</span>
429
+ <div class="node">四层验证</div><span class="arrow">→</span>
430
+ <div class="node">发现违规</div><span class="arrow">→</span>
431
+ <div class="node">记入失败语料库</div><span class="arrow">→</span>
432
+ <div class="node">沉淀为抗体</div><span class="arrow">→</span>
433
+ <div class="node">下次同类错误：直接拦截/跳过 AI</div>
434
+ </div>
435
+ <p>每次拦截都让系统更强大。ACL-4 级抗体（同模式出现 ≥10 次且跨 ≥5 个场景）能实现<strong>零 LLM 调用直接修复</strong>——既省钱又更可靠。这是 Progmune 网络效应的技术基础。</p>
436
+ </section>
437
+
438
+ <!-- ═══════════ 5. 技术方法 ═══════════ -->
439
+ <section id="s5">
440
+ <h2><span class="chap">05</span>技术方法：具体怎么做</h2>
441
+ <p class="lead">本章说明技术实现，尽量用类比解释。技术读者可关注括号内的模块名。</p>
442
+
443
+ <h3>5.1 IR 提取：建立"真相清单"</h3>
444
+ <p>用 TypeScript 编译器 API（<code>ts-morph</code>）解析项目源码，提取：函数声明、箭头函数、参数类型、返回类型、JSDoc 注解（<code>@protocol</code> 标记）、调用图、外部依赖（约 40 个常用库函数签名）。Python 项目也有对应提取器。</p>
445
+ <pre><code>源码: function createOrder(userId: number, items: Item[]): Order
446
+ ↓ 解析
447
+ IR: { name: "createOrder", params: [{name:"userId", type:"number"}...],
448
+ returnType: "Order", calls: ["verifyPayment", "insertRecord"] }</code></pre>
449
+
450
+ <h3>5.2 协议状态机：把"顺序规则"变成可执行检查</h3>
451
+ <p>每个关键协议被建模为一个状态机。以登录为例：</p>
452
+ <pre><code>规则（protocols.json，共 148 条，覆盖 21 个命名空间）:
453
+ verify_password: UNAUTHENTICATED → PASSWORD_VERIFIED
454
+ generate_jwt: PASSWORD_VERIFIED → TOKEN_ISSUED
455
+ create_session: TOKEN_ISSUED → SESSION_ACTIVE
456
+ logout: SESSION_ACTIVE → UNAUTHENTICATED
457
+
458
+ AI 生成: create_session(...) ← 当前状态 UNAUTHENTICATED
459
+ 验证器: ✗ 拒绝！create_session 需要前置状态 TOKEN_ISSUED
460
+ 修复器: BFS 搜索最短修复路径 → [verify_password, generate_jwt]
461
+ 自动插入这两个调用，重新验证 ✓</code></pre>
462
+ <p>修复是<strong>确定性</strong>的：BFS 图搜索保证找到最短修复路径，无需再次调用 AI。</p>
463
+
464
+ <h3>5.3 检测器与防护规则：静态模式的补充</h3>
465
+ <ul>
466
+ <li><strong>22 个协议检测器</strong>：TLS 握手、SSH 连接、HTTP 请求、支付处理、会话管理、文件上传、注册流程等</li>
467
+ <li><strong>26 条防护规则（safeguard）</strong>：触发式检查——"如果出现了 X，就必须有 Y"。例：注册函数必须调用安全哈希（bcrypt/argon2）；管理操作必须检查角色；tRPC mutation 必须有 <code>.input()</code> 校验 schema</li>
468
+ </ul>
469
+
470
+ <h3>5.4 API 语义映射：让检查认识"陌生函数"</h3>
471
+ <p>真实项目使用的函数名千变万化（<code>createSessionToken</code>、<code>signSession</code>、<code>jwt.sign</code>……）。系统用三层策略把陌生函数映射到协议规则：① 本地前缀/别名表（含项目自定义 <code>.progmune_aliases.json</code>）→ ② 单词切分匹配 → ③ LLM 批量语义分类（带磁盘缓存，重复运行零 LLM 成本）。</p>
472
+
473
+ <h3>5.5 信任引擎：五阶段流水线</h3>
474
+ <div class="flow">
475
+ <div class="node">1. 收集<br><span style="font-size:.8em;font-weight:400">策略+协议+框架数据</span></div>
476
+ <span class="arrow">→</span>
477
+ <div class="node">2. 归一化<br><span style="font-size:.8em;font-weight:400">统一为7元组证据</span></div>
478
+ <span class="arrow">→</span>
479
+ <div class="node">3. 评分<br><span style="font-size:.8em;font-weight:400">四维加权</span></div>
480
+ <span class="arrow">→</span>
481
+ <div class="node">4. 决策<br><span style="font-size:.8em;font-weight:400">批准/复审/阻止</span></div>
482
+ <span class="arrow">→</span>
483
+ <div class="node">5. 组装<br><span style="font-size:.8em;font-weight:400">完整审计报告</span></div>
484
+ </div>
485
+ <p>每条违规都携带<strong>7 元组证据</strong>：规则 ID、文件、函数、代码证据、为什么违规、如何修复、关联策略。这是"可解释性"的技术基础——每一分的扣减都能追溯。</p>
486
+
487
+ <h3>5.6 框架适配器：让检查理解具体框架</h3>
488
+ <p>不同框架（Express、tRPC、NestJS、Next.js）的认证、校验、限流写法各不相同。适配器逐框架解析：Express 的中间件链、tRPC 的 procedure 声明、框架版本差异（如 Next.js 16 用 <code>proxy.ts</code> 而非 <code>middleware.ts</code>）。</p>
489
+
490
+ <h3>5.7 基准测试：用数据证明能力</h3>
491
+ <table>
492
+ <tr><th>基准</th><th>方法</th><th>结果</th></tr>
493
+ <tr><td><strong>盲测基准</strong>（TypeScript）</td><td>10 个真实项目、432 个序列、gold 标注</td><td>精确率 <strong>86.8%</strong> · 召回率 <strong>83.6%</strong> · F1 <strong>85.2%</strong></td></tr>
494
+ <tr><td><strong>黄金基准</strong>（C 语言）</td><td>curl/libssh/nginx/openssl 等真实 CVE 案例</td><td>F1 16.5% —— <strong>研究阶段</strong>，诚实披露</td></tr>
495
+ <tr><td><strong>PLSB v1.0</strong></td><td>13 类协议安全弱点、39 个手工验证缺陷案例</td><td>覆盖 <strong>13/13 全类别</strong>（业界唯一）</td></tr>
496
+ </table>
497
+ <div class="plain">
498
+ <strong>为什么披露 C 语言的低分？</strong>因为"诚实"是产品原则。一个只报告好消息的基准没有参考价值。TS 已生产可用、Python 规则开发中、C 为研究课题——能力边界清清楚楚。
499
+ </div>
500
+ </section>
501
+
502
+ <!-- ═══════════ 6. 产品与能力现状 ═══════════ -->
503
+ <section id="s6">
504
+ <h2><span class="chap">06</span>产品与能力现状</h2>
505
+
506
+ <h3>6.1 产品形态</h3>
507
+ <table>
508
+ <tr><th>形态</th><th>说明</th><th>状态</th></tr>
509
+ <tr><td><strong>MCP 服务器</strong></td><td>19 个工具：<code>progmune_generate</code>（受约束代码生成）、<code>progmune_trust_check</code>（信任决策）、<code>progmune_score</code>（生成前预检）、<code>progmune_certify</code>（证书签发）等，接入 Claude Code 等 AI 客户端</td><td>✅ 可用</td></tr>
510
+ <tr><td><strong>SDK</strong></td><td>一行调用：<code>verify(file) → BLOCK/WARN/ALLOW</code></td><td>✅ 可用</td></tr>
511
+ <tr><td><strong>CLI</strong></td><td><code>npm run trust</code>、<code>npm run governance</code>——命令行信任检查与治理报告（终端/JSON/Markdown/HTML 四种格式）</td><td>✅ 可用</td></tr>
512
+ <tr><td><strong>GitHub Action</strong></td><td>PR 合并前自动门禁</td><td>✅ 可用</td></tr>
513
+ <tr><td><strong>Trust API</strong></td><td><code>POST /trust/check</code> 机器间接口</td><td>✅ 可用</td></tr>
514
+ <tr><td><strong>SaaS 仪表盘</strong></td><td>多项目可视化管理</td><td>🔲 规划中（等 PoC 验证后）</td></tr>
515
+ </table>
516
+
517
+ <h3>6.2 语言与框架覆盖（诚实版）</h3>
518
+ <table>
519
+ <tr><th>能力</th><th>状态</th><th>说明</th></tr>
520
+ <tr><td>TypeScript / JavaScript</td><td><span style="color:var(--green);font-weight:700">✅ 生产</span></td><td>F1 85.2%，主战场</td></tr>
521
+ <tr><td>Python</td><td><span style="color:var(--amber);font-weight:700">⚠️ IR 就绪</span></td><td>代码提取可用，协议规则开发中（下一阶段优先）</td></tr>
522
+ <tr><td>C</td><td><span style="color:var(--amber);font-weight:700">⚠️ 研究</span></td><td>F1 16.5%，瓶颈已定位（规则覆盖），L3 实验已终止</td></tr>
523
+ <tr><td>Go / Java</td><td><span style="color:var(--ink-3)">❌ 未支持</span></td><td>路线图内</td></tr>
524
+ <tr><td>框架适配</td><td><span style="color:var(--amber);font-weight:700">2/13</span></td><td>Express ✅、tRPC ✅、NestJS 部分；Next.js 版本感知已实现</td></tr>
525
+ </table>
526
+
527
+ <h3>6.3 知识库规模</h3>
528
+ <div class="stats">
529
+ <div class="stat"><div class="n">148</div><div class="l">协议规则</div></div>
530
+ <div class="stat"><div class="n">21</div><div class="l">协议命名空间全覆盖</div></div>
531
+ <div class="stat"><div class="n">22+26</div><div class="l">检测器 + 防护规则</div></div>
532
+ <div class="stat"><div class="n">39</div><div class="l">黄金缺陷案例（人工验证）</div></div>
533
+ <div class="stat"><div class="n">19</div><div class="l">MCP 工具</div></div>
534
+ <div class="stat"><div class="n">71</div><div class="l">单元测试全部通过</div></div>
535
+ </div>
536
+ </section>
537
+
538
+ <!-- ═══════════ 7. 实测案例 ═══════════ -->
539
+ <section id="s7">
540
+ <h2><span class="chap">07</span>实测案例：PrintLab 治理全过程</h2>
541
+ <p class="lead">PrintLab 是一个真实的 3D 打印电商项目（Express + tRPC + React，59 个后端文件）。用 Progmune 对它做完整治理，结果如下——这是产品能力最直接的证据。</p>
542
+
543
+ <h3>7.1 第一轮：发现 46 个问题（其中大量误报）</h3>
544
+ <div class="verdict" style="background:var(--red-light);border-color:#fca5a5;">
545
+ <div class="icon" style="background:var(--red)">✗</div>
546
+ <div>
547
+ <h4 style="color:#7f1d1d">BLOCKED · 信任评分 44</h4>
548
+ <p style="color:#991b1b">46 个违规：1 critical + 1 high + 45 medium。但其中 43 个经分析是状态机规则粒度过细导致的误报。</p>
549
+ </div>
550
+ </div>
551
+
552
+ <h3>7.2 调优：状态机规则修正</h3>
553
+ <p>逐个分析误报根因并修正规则——例如：通知发送函数在真实代码中"组合+发送"一步完成，但状态机要求先显式"组合"；一次性文件读取 API（<code>readFileSync</code>）内部自带打开/关闭，但状态机要求显式 open。共修正 8 类状态机规则 + 2 处别名误配。</p>
554
+ <div class="plain">
555
+ <strong>这个过程本身就是产品价值的一部分：</strong>状态机规则不是死代码，而是像"公司制度"一样持续迭代。每次误报分析都在提升规则的精确度——这正是"越用越准"的飞轮在真实项目上的第一次完整运转。
556
+ </div>
557
+
558
+ <h3>7.3 真实发现（3 个）</h3>
559
+ <table>
560
+ <tr><th>严重度</th><th>位置</th><th>问题</th><th>修复</th></tr>
561
+ <tr><td><span style="color:#ea580c;font-weight:700">HIGH</span></td><td>优化商品路由</td><td>管理员 mutation 批量删除/更新商品，无输入校验 schema</td><td>添加 <code>.input(z.void())</code> 显式声明合约</td></tr>
562
+ <tr><td><span style="color:#ca8a04;font-weight:700">MEDIUM</span></td><td>认证工具</td><td>JWT 验证未指定算法白名单——"none"算法混淆攻击风险（CVE-2022-23540 模式）</td><td>添加 <code>algorithms: ["HS256"]</code></td></tr>
563
+ <tr><td><span style="color:#ca8a04;font-weight:700">MEDIUM</span></td><td>会话 SDK</td><td>第二处 JWT 验证同样缺少算法白名单</td><td>同上</td></tr>
564
+ </table>
565
+
566
+ <h3>7.4 最终结果</h3>
567
+ <div class="verdict approved">
568
+ <div class="icon">✓</div>
569
+ <div>
570
+ <h4>APPROVED · 信任评分 87 · 置信度 HIGH · 0 违规</h4>
571
+ <p>46 个问题 → 0 个问题；44 分 BLOCKED → 87 分 APPROVED。三个真实安全问题在代码进入生产前被修复。</p>
572
+ </div>
573
+ </div>
574
+ <p>治理报告生成为专业 HTML 文档（含通俗解释），可直接用于向 CTO/合规团队/投资人展示。</p>
575
+ </section>
576
+
577
+ <!-- ═══════════ 8. 竞争格局 ═══════════ -->
578
+ <section id="s8">
579
+ <h2><span class="chap">08</span>竞争格局</h2>
580
+
581
+ <h3>8.1 定位：不与 Copilot/Cursor 竞争，做它们的安全底盘</h3>
582
+ <p>AI 编码市场已由 GitHub Copilot、Cursor 等巨头占据——Progmune <strong>不与他们竞争</strong>。Progmune 处于另一层：<strong>验证层</strong>。类比：汽车厂商竞争造车，Progmune 做的是碰撞测试——所有车厂都需要，但没人会把它当作"竞争对手"。</p>
583
+
584
+ <h3>8.2 七维对比</h3>
585
+ <table>
586
+ <tr><th>能力维度</th><th>传统 SAST<br><span style="font-weight:400;font-size:.85em">CodeQL/Semgrep</span></th><th>Prompt 安全<br><span style="font-weight:400;font-size:.85em">Guardrails AI 等</span></th><th>Progmune</th></tr>
587
+ <tr><td>介入生成过程</td><td>✗ 事后扫描</td><td>△ 输入/输出过滤</td><td><strong>✓ 生成时验证</strong></td></tr>
588
+ <tr><td>协议顺序检测（跨函数）</td><td>✗</td><td>✗</td><td><strong>✓ SSG 状态机</strong></td></tr>
589
+ <tr><td>形式化保证</td><td>✗</td><td>✗</td><td><strong>✓ SVL 1–4</strong></td></tr>
590
+ <tr><td>可解释证据（每分可追溯）</td><td>部分</td><td>✗</td><td><strong>✓ 7 元组证据</strong></td></tr>
591
+ <tr><td>模型无关</td><td>✓</td><td>✗ 绑定模型</td><td><strong>✓ 支持任何 LLM</strong></td></tr>
592
+ <tr><td>越用越强（学习能力）</td><td>✗</td><td>✗</td><td><strong>✓ 免疫记忆飞轮</strong></td></tr>
593
+ <tr><td>输出部署决策</td><td>✗ 输出告警</td><td>✗</td><td><strong>✓ APPROVED/BLOCKED</strong></td></tr>
594
+ </table>
595
+
596
+ <h3>8.3 竞争壁垒（客观评估）</h3>
597
+ <table>
598
+ <tr><th>壁垒</th><th>性质</th><th>客观评估</th></tr>
599
+ <tr><td><strong>IR 真相层</strong></td><td>技术架构</td><td>从源码确定性提取，不可伪造。但实现难度中等——大厂有追赶能力</td></tr>
600
+ <tr><td><strong>SVL 分类法</strong></td><td>标准制定</td><td>类似 PCI-DSS 之于支付安全。标准一旦被行业采纳，先发优势巨大——但采纳与否未验证</td></tr>
601
+ <tr><td><strong>免疫记忆数据</strong></td><td>数据飞轮</td><td>最有价值的壁垒：每次拦截都积累数据。但需要足够的使用量才能形成规模效应</td></tr>
602
+ <tr><td><strong>协议规则库（148 条）</strong></td><td>领域知识</td><td>从真实 CVE 和缺陷案例提炼，难以从零复制。但可被持续追赶</td></tr>
603
+ <tr><td><strong>开源社区先发</strong></td><td>生态</td><td>MIT 协议 + MCP 原生集成，建立开发者心智——目前尚在早期</td></tr>
604
+ </table>
605
+ </section>
606
+
607
+ <!-- ═══════════ 9. 市场与商业模式 ═══════════ -->
608
+ <section id="s9">
609
+ <h2><span class="chap">09</span>市场机会与商业模式</h2>
610
+
611
+ <h3>9.1 市场规模</h3>
612
+ <div class="stats">
613
+ <div class="stat"><div class="n">$25B+</div><div class="l">AI 代码生成市场（2030E）</div></div>
614
+ <div class="stat"><div class="n">$9B+</div><div class="l">DevSecOps 市场（2024）</div></div>
615
+ <div class="stat"><div class="n">$3–5B</div><div class="l">AI 安全层近期可寻址市场</div></div>
616
+ </div>
617
+ <p class="lead" style="font-size:.95em">核心逻辑：AI 代码生成市场每增长 1%，对验证的需求就增长 1%——这是一个<strong>与 AI 编码同步增长的伴生市场</strong>。而且与 AI 编码不同，验证层目前没有巨头。</p>
618
+
619
+ <h3>9.2 目标客户</h3>
620
+ <table>
621
+ <tr><th>客户画像</th><th>痛点</th><th>Progmune 提供</th></tr>
622
+ <tr><td><strong>大规模部署 Copilot/Cursor 的企业</strong></td><td>AI 代码进生产无人把关</td><td>CI/CD 自动门禁 + 审计报告</td></tr>
623
+ <tr><td><strong>金融/医疗等受监管行业</strong></td><td>SOX/HIPAA 要求 AI 代码可审计</td><td>7 元组证据链 + 治理报告</td></tr>
624
+ <tr><td><strong>平台工程团队</strong></td><td>多工具 AI 编码各自为政</td><td>统一验证层 + 集中策略</td></tr>
625
+ <tr><td><strong>AI 原生初创公司</strong></td><td>Agent 直推生产无安全网</td><td>部署前最后一道确定性防线</td></tr>
626
+ </table>
627
+
628
+ <h3>9.3 商业模式：开源内核 + 企业增值</h3>
629
+ <table>
630
+ <tr><th>层级</th><th>定价</th><th>内容</th><th>定位</th></tr>
631
+ <tr><td><strong>开源版（MIT）</strong></td><td>永久免费</td><td>SVL 四层验证、TS/Python IR、MCP 集成、本地语料库</td><td>建立生态与信任</td></tr>
632
+ <tr><td><strong>企业版</strong></td><td>按席位/年</td><td>CI/CD 门禁集成、团队仪表盘、高性能验证器（Rust/WASM）、私有 Hub、SLA</td><td>营收主力</td></tr>
633
+ <tr><td><strong>免疫网络</strong></td><td>按组织/年</td><td>全球失败指纹联邦、行业协议模板、威胁情报推送</td><td>网络效应锁定</td></tr>
634
+ </table>
635
+ <p>此模式已被 GitLab、Databricks 验证：开源建立信任和分发，企业版解决付费问题。</p>
636
+ </section>
637
+
638
+ <!-- ═══════════ 10. 风险分析 ═══════════ -->
639
+ <section id="s10">
640
+ <h2><span class="chap">10</span>风险分析（客观）</h2>
641
+ <p class="lead">投资人需要知道风险，本节不粉饰。</p>
642
+
643
+ <table>
644
+ <tr><th>风险</th><th>等级</th><th>内容</th><th>缓解措施</th></tr>
645
+ <tr><td><strong>市场教育成本</strong></td><td><span style="color:var(--red);font-weight:700">高</span></td><td>多数企业尚未意识到"AI 代码需要验证"这个问题本身</td><td>公开缺陷基准库、从受监管行业切入、开源社区自然教育</td></tr>
646
+ <tr><td><strong>大厂竞争</strong></td><td><span style="color:var(--amber);font-weight:700">中</span></td><td>GitHub/Microsoft 可能内置类似功能</td><td>聚焦"验证层"差异化；大厂内置方案通常浅层；开源先发</td></tr>
647
+ <tr><td><strong>验证的边界性</strong></td><td><span style="color:var(--amber);font-weight:700">中</span></td><td>当前仅 TS 生产可用；协议规则不可能覆盖所有场景——存在漏检的可能</td><td>诚实披露置信度；数据飞轮持续补规则；规则来自真实 CVE 案例</td></tr>
648
+ <tr><td><strong>LLM 依赖</strong></td><td><span style="color:var(--green);font-weight:700">低</span></td><td>代码生成环节依赖底层模型能力</td><td>架构上模型无关；验证器本身不依赖任何 LLM；模型越强产品越有价值</td></tr>
649
+ <tr><td><strong>商业化节奏</strong></td><td><span style="color:var(--amber);font-weight:700">中</span></td><td>开源到付费的转化路径需要时间验证；尚无企业 PoC</td><td>GitLab/Databricks 模式已成熟；优先做 2-3 个企业 PoC 验证 PMF</td></tr>
650
+ <tr><td><strong>核心假说未验证</strong></td><td><span style="color:var(--amber);font-weight:700">中</span></td><td>"每个新代码库让所有验证更强"的知识网络假说尚无实证</td><td>以 Phase 2 的 PoC 数据为准；假说不成立也不影响单点验证的产品价值</td></tr>
651
+ </table>
652
+
653
+ <div class="risk-box">
654
+ <strong>最需要投资人关注的风险：</strong>市场教育成本。Progmune 卖的不是"更快的工具"，而是"信任"——这类产品的销售周期天然更长。对冲策略是：用公开基准数据（PLSB、盲测结果）让产品"自证"，而不是靠销售话术。
655
+ </div>
656
+ </section>
657
+
658
+ <!-- ═══════════ 11. 路线图 ═══════════ -->
659
+ <section id="s11">
660
+ <h2><span class="chap">11</span>路线图</h2>
661
+
662
+ <table>
663
+ <tr><th>阶段</th><th>时间</th><th>目标</th><th>关键交付</th></tr>
664
+ <tr><td><strong>当前</strong></td><td>2026-08</td><td>Trust Foundation 完成</td><td>信任引擎 ✅、策略引擎 ✅、PLSB 13/13 ✅、tRPC/Express 适配 ✅、PrintLab 案例 ✅</td></tr>
665
+ <tr><td><strong>Phase 1 收官</strong></td><td>2026 Q3</td><td>可信度校准</td><td>已知风险项目上的 Score 校准、真实项目验收、Trust Report PDF</td></tr>
666
+ <tr><td><strong>Phase 2</strong></td><td>2026 Q4</td><td>语言扩展 + 企业验证</td><td>Python 完整支持、企业 PoC × 2-3、Evolution 追踪、CI/CD 门禁集成</td></tr>
667
+ <tr><td><strong>Phase 3</strong></td><td>2027+</td><td>平台化</td><td>Go/Java、SaaS 仪表盘、公开基准排行榜、全球免疫网络、协议模板市场</td></tr>
668
+ </table>
669
+ </section>
670
+
671
+ <!-- ═══════════ 12. 总结论 ═══════════ -->
672
+ <section id="s12">
673
+ <h2><span class="chap">12</span>给投资人的总结论</h2>
674
+
675
+ <h3>为什么值得投</h3>
676
+ <ol>
677
+ <li><strong>真问题 + 真窗口</strong>：76% 企业已用 AI 编码，验证层是明确的基础设施缺口，且没有巨头占位</li>
678
+ <li><strong>差异化足够深</strong>：协议顺序验证是传统 SAST 的系统性盲区——这是"品类级"差异，不是"功能级"差异</li>
679
+ <li><strong>数据飞轮成立</strong>：每次拦截都沉淀为抗体，使用量即壁垒（与 Salesforce 的网络效应同构）</li>
680
+ <li><strong>开源已验证</strong>：19 个工具、148 条规则、85.2% F1、真实项目案例（PrintLab 从 BLOCKED 到 APPROVED 的完整过程可复现）</li>
681
+ </ol>
682
+
683
+ <h3>为什么需要谨慎</h3>
684
+ <ol>
685
+ <li>企业 PoC 为零——PMF 未验证，商业化路径尚需数据</li>
686
+ <li>语言覆盖有限（当前仅 TS 生产可用）</li>
687
+ <li>"信任"类产品教育成本高，销售周期长</li>
688
+ <li>大厂随时可能跟进（但架构先发 + 数据积累构成时间壁垒）</li>
689
+ </ol>
690
+
691
+ <div class="verdict approved">
692
+ <div class="icon">→</div>
693
+ <div>
694
+ <h4>建议的验证路径</h4>
695
+ <p>与其争论技术细节，不如用 3 个月做一件事：在 2-3 家真实企业跑 PoC——让企业用自己的 AI 代码、自己的事故案例，看到 Progmune 拦住真实问题的过程。PMF 一旦验证，后续的资本故事自然成立。</p>
696
+ </div>
697
+ </div>
698
+ </section>
699
+
700
+ <div class="foot">
701
+ <p><strong>Progmune</strong> — AI Trust Decision Engine · 本文档 v1.0 · 2026-08</p>
702
+ <p>
703
+ <a href="https://github.com/shenlian19831109/progmune-runtime">github.com/shenlian19831109/progmune-runtime</a>
704
+ · npm install progmune-runtime · MIT License
705
+ </p>
706
+ </div>
707
+
708
+ </div>
709
+ </body>
710
+ </html>