progmune-runtime 3.2.0 → 3.3.0

package/README.md

@@ -4,8 +4,8 @@
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![MCP](https://img.shields.io/badge/MCP-Compatible-blue)](https://modelcontextprotocol.io)
-[![TS Benchmark](https://img.shields.io/badge/TS%20F1-85.2%25-22c55e)]()
-[![Tests](https://img.shields.io/badge/Tests-92%20passing-22c55e)]()
+[![TS Benchmark](https://img.shields.io/badge/TS%20R98.5%25%20P100%25-22c55e)]()
+[![Python Benchmark](https://img.shields.io/badge/Python%20R100%25%20P100%25-22c55e)]()
 
 **Verify AI-generated code before it reaches production.** Progmune checks whether your AI-generated code follows correct protocol lifecycles — TLS handshakes, auth flows, payment integrity, resource management — violations that SAST and SCA tools cannot see because they span sequences of function calls, not single statements.
 
@@ -23,6 +23,21 @@ Output: `APPROVED` / `NEEDS_REVIEW` / `BLOCKED` — with Trust Score, evidence,
 
 ---
 
+## Two Paths: Intercept or Verify
+
+Progmune covers **two code sources** with two complementary mechanisms:
+
+| | **Generate path** (agent-time interception) | **Verify path** (post-hoc checking) |
+|---|---|---|
+| **Covers** | Code generated *through Progmune* (`progmune_generate` / `progmune_execute`) | Code written anywhere — Copilot, Cursor, humans (`progmune_trust_check` / SDK / CI) |
+| **Mechanism** | 8 validation gates inside the generation loop: JSON parse → schema → SVL-1 symbol → SVL-2 types → SVL-3 dataflow → SVL-4 protocol state machine → BFS deterministic repair → semantic contract. Violating code is **never written to disk** — it is corrected or retried before emission. | Trust Engine: 4-dimension weighted scoring (policy 35% / protocol 30% / coverage 20% / governance 15%) → Decision + evidence trail |
+| **When errors are handled** | At creation time — the error never exists | After the fact — the file already exists |
+| **Cost curve** | Zero — the violation never landed | Higher the later it's found |
+
+This is the core product thesis: **verify at generation time, not after the fact.** LLM outputs are proposals; the state machine is the referee. LLMs can be persuaded — state machines cannot.
+
+---
+
 ## What Progmune Detects
 
 AI code generators produce syntactically valid code that often violates **protocol lifecycles** — the correct sequence of operations like open→read→close or auth→validate→respond. These violations are invisible to traditional static analysis.
@@ -34,6 +49,10 @@ AI code generators produce syntactically valid code that often violates **protoc
 | **Payment** | Order without verification, refund without authorization, webhook without signature check |
 | **Resource** | File opened but not closed, connection without cleanup, malloc without free |
 | **Data Integrity** | Mutation without audit trail, missing input validation |
+| **Injection (Python, source-level)** | SQL built with f-string/`%`/`.format`/concatenation, command injection via dynamic subprocess args, SSRF via user-controlled URL fetches, SSTI via template-string sinks, XXE via external-entity parser config, eval/exec on user input |
+| **Web (Python, source-level)** | XSS via `{{ var\|safe }}`/autoescape-off templates, path traversal via user-controlled file paths, CSRF via `@csrf_exempt` or GET state changes, authorization by client cookies, hardcoded JWT secrets (incl. cross-module constants) |
+
+Source-level detections use an extractor-marker architecture: the IR extractor performs taint tracking, import resolution, and cross-file analysis (templates, module constants), emitting synthetic markers that rules consume — zero pipeline changes, fully auditable.
 
 ---
 
@@ -80,12 +99,20 @@ Progmune is honest about what it can and cannot verify.
 
 | Language | Status | Evidence |
 |----------|--------|----------|
-| **TypeScript / JavaScript** | ✅ Production | Blind benchmark: P=86.8%, R=83.6%, F1=85.2% (432 sequences, 10 projects) |
-| **C** | ⚠️ Research | Gold benchmark: curl F1=45.7%, libssh F1=46.2%. L3 cross-function experiment terminated — L4 (pointer/CFG) needed. |
-| **Python** | 🔨 IR only | IR extractor exists (`extract-ir-python.ts`), no verification rules yet |
+| **TypeScript / JavaScript** | ✅ Production | Blind benchmark: **recall 98.5% / precision 100%** (795 gold findings, 100 projects) |
+| **Python** | ✅ Production | Blind benchmark: **recall 100% / precision 100%** (729 gold findings, 90 projects); real-world validation: PyGoat (OWASP vulnerable-by-design Django app) **67 TP / 0 FP, 100% labeled precision**; three well-written apps (django/fastapi realworld, django-unicorn) with 0 false-positive true findings |
+| **C** | ⚠️ Research-only | Gold benchmark F1=16.5%. L3 cross-function experiment terminated; L4 not planned. See [C Language Status](docs/c-language-status.md). |
 | **Go, Java** | ❌ None | Planned |
 
-**Framework adapters: 1/13.** Express is the first. Next.js, NestJS, Fastify, Django, FastAPI — 12 remaining. Framework adaptation is the #1 product gap.
+**Framework adapters: 2/13.** Express ✅ and tRPC ✅ have dedicated detectors; Next.js has version-aware governance; NestJS is partial. Django, FastAPI and 8 more remain — framework adaptation is the #1 product gap.
+
+### What Progmune does NOT cover (honest boundaries)
+
+- **TS-side taint-based injection flaws** — the source-level SQLi/XSS/SSRF detections ship for Python; the TypeScript extractor is name/call-based, so TS injection classes remain uncovered (documented, not hidden).
+- **SCA / dependency vulnerabilities** — hallucinated package names, supply-chain issues. Separate tooling exists for this.
+- **Runtime behavior** — Progmune is static analysis only; no DAST/sandbox execution.
+- **Framework internals** — well-known framework dispatch/cache machinery (e.g. django-unicorn internals) can produce a small number of boundary false positives; they are documented per-corpus in the benchmark gold files.
+- **Known failure boundaries are documented** rather than hidden: if Progmune cannot verify a language (e.g. Go), Confidence is lowered instead of pretending 100%.
 
 → [Full Coverage Matrix](docs/coverage-matrix.md)
 
@@ -95,23 +122,35 @@ Progmune is honest about what it can and cannot verify.
 
 Public, reproducible precision data. All numbers measured against gold-annotated benchmarks.
 
-### TypeScript (Blind Benchmark v6)
+### TypeScript (Blind Benchmark v6 — 100 projects)
 
 | Metric | Value |
 |--------|-------|
-| Precision | 86.8% |
-| Recall | 83.6% |
-| F1 | 85.2% |
-| Projects | 10 (ecommerce, blog, chat, crm, forum, wiki, issuetracker, filestorage, todo, scheduler) |
+| Precision | **100%** (0 factual FPs) |
+| Recall | **98.5%** (effective 100% — the 12 non-detected findings are excluded by methodology) |
+| Gold findings | 795 across 100 projects (90 style-variants + 10 model-variants) |
+
+### Python (Blind Benchmark v1 — 90 projects)
+
+| Metric | Value |
+|--------|-------|
+| Precision | **100%** |
+| Recall | **100%** |
+| Gold findings | 729 across 90 style-variant projects |
+
+### Real-world validation (PyGoat, OWASP vulnerable-by-design Django app)
+
+| Metric | Value |
+|--------|-------|
+| Labeled precision | **100%** (67 true positives / 0 false positives, per-detection human review) |
+| Classes covered | 14 vulnerability classes incl. SQLi, SSRF, path traversal, XSS, SSTI, XXE, command injection, deserialization, CSRF (both shapes), cookie authorization, hardcoded secrets |
+| Well-written apps | django-realworld, fastapi-realworld, django-unicorn — 0 false-positive true findings; 3 documented framework-internal boundary FPs |
+
+→ [Real-world validation report](blind-benchmark/REALWORLD_APP_V1.md) · [Benchmark baseline](blind-benchmark/BASELINE_v6.md)
 
-### C (Gold Benchmark v7)
+### C (Gold Benchmark — research status)
 
-| Repo | Precision | Recall | F1 | Samples |
-|------|-----------|--------|-----|---------|
-| curl | 30.9% | 87.5% | 45.7% | 85 |
-| libssh | 36.0% | 64.3% | 46.2% | 47 |
-| nginx | — | — | 0 FP | 50 |
-| redis | — | — | 0 FP | 50 |
+C analysis is **research-only**: gold benchmark F1=16.5% across 4 repos (curl, libssh, nginx, openssl). The bottleneck is rule coverage, not context. L3 (cross-function) was terminated with data; L4 (pointer/CFG) is a multi-year research problem and not planned. See [C Language Status](docs/c-language-status.md) for the full picture and reasoning.
 
 ### P0-P3 Rule Injection (2026-08)
 
@@ -131,7 +170,9 @@ SDK (src/sdk.ts)           verify() → APPROVED / NEEDS_REVIEW / BLOCKED
        ├─ Policy Engine     Enterprise policy enforcement (ALLOW/WARN/BLOCK)
        ├─ SSG Validator     Protocol state machine verification
        ├─ Protocol Detector  Regex-based protocol step detection (22 detectors)
-       ├─ IR Extractor      TypeScript AST → function IR (ts-morph)
+       ├─ IR Extractors     TypeScript (ts-morph) + Python (ast module) → function IR;
+       │                    source-level markers: taint tracking, import resolution,
+       │                    qualified call chains, cross-file template analysis
        ├─ Repair Executor   detect → plan → fix → validate → commit/rollback
        └─ Knowledge Base    31 domains, 140 rules, evidence chains
 ```
@@ -150,9 +191,9 @@ SDK (src/sdk.ts)           verify() → APPROVED / NEEDS_REVIEW / BLOCKED
 
 ## Scientific Foundation
 
-Progmune is built on the premise that **LLM outputs are statistical performances, not reasoning** (Kambhampati et al., ICML 2026). Rather than trusting what the model says about code, Progmune verifies what the program actually does — using protocol state machines, IR extraction, and evidence-backed decision chains.
+Progmune is built on the premise that **LLM outputs are statistical performances, not reasoning** — a view developed by Subbarao Kambhampati et al. in the position paper ["Stop Anthropomorphizing Intermediate Tokens as Reasoning/Thinking Traces!"](https://arxiv.org/abs/2505.22285) (arXiv:2505.22285, 2025) and elaborated in his ICML 2026 talk "On the Role of Verifiers and Thinking Traces in Reasoning Models". Rather than trusting what the model says about code, Progmune verifies what the program actually does — using protocol state machines, IR extraction, and evidence-backed decision chains.
 
-Recent work applies Sergei Gukov's "Two-Hump Problem" framework to understand and systematically close detection capability gaps.
+Coverage-gap analysis borrows the "two-hump problem" terminology **as a cross-domain analogy** from Sergei Gukov's work in mathematical physics (the Andrews-Curtis conjecture in group theory, 2026) — it describes a bimodal coverage distribution, not a collaboration. See [Two-Hump Report](docs/two-hump-report.md) for the full methodology.
 
 → [Investor Whitepaper](docs/Progmune_投资人白皮书_v2.0.html) · [Trust Decision Model](docs/ai-trust-decision-model-v1.md)
 
@@ -174,10 +215,10 @@ High-impact contribution areas:
 - **Runtime Pipeline:** Detect → Explain → Repair → Validate (L1–L4)
 - **Trust Engine:** 4-dimension scoring with binary explainability gate
 - **MCP Tools:** 19 — `progmune_trust_check`, `progmune_score`, `progmune_policy_check`, `progmune_certify`, and more
-- **Framework Adapters:** Express ✅ (1/13)
-- **Knowledge Base:** 31 domains, 140 protocol rules, 22 detectors, 26 safeguards
-- **Corpus:** 2,500+ trajectories across 6+ repositories
-- **Current focus:** Framework adaptation + enterprise PoC validation
+- **Framework Adapters:** Express ✅, tRPC ✅, NestJS partial (2/13)
+- **Knowledge Base:** 31 domains, 148 protocol rules, 22 detectors, 26 safeguards, PLSB 13/13 categories — plus 15 source-level detection rules (Python)
+- **Corpus:** 2,500+ trajectories across 6+ repositories; blind benchmarks 100 (TS) + 90 (Python) projects; real-world validation on 4 application repos
+- **Current focus:** Enterprise PoC validation + remaining framework-internal boundary FPs
 
 ---
 

package/dist/extract-ir.js

@@ -352,6 +352,19 @@ function extractDirectCalls(func) {
         if (ts_morph_1.Node.isFunctionDeclaration(node) || ts_morph_1.Node.isArrowFunction(node))
             traversal.skip();
     });
+    // Semantic markers (mirroring the Python extractor):
+    // - token issuance: set_cookie calls or token/session-named assignments —
+    //   the Token Security rule's requireMarker precondition consumes it.
+    // - inline ownership comparison: ownerId/authorId compared with ==/!== —
+    //   the Ownership Check rules' satisfier consumes it (the call-name
+    //   interface cannot see inline comparisons).
+    const text = func.getText();
+    if (/set_cookie\(|setCookie\(|\btoken\s*[:=]|\bsession_token\s*[:=]/.test(text)) {
+        calls.push("__progmune_token_issued__");
+    }
+    if (/ownerId\s*[!=]==?|authorId\s*[!=]==?|createdBy\s*[!=]==?|\.owner\s*[!=]==?|userId\s*[!=]==?/.test(text)) {
+        calls.push("__progmune_ownership_checked__");
+    }
     return [...new Set(calls)];
 }
 /**

package/dist/protocol-detector.js

@@ -272,9 +272,16 @@ const SAFEGUARD_RULES = [
     {
         name: "Password Hashing",
         category: "password_hashing",
-        trigger: /\b(register|signUp|createUser|createAccount|registerUser)\b/i,
+        trigger: /\b(register|signUp|createUser|createAccount|registerUser|sign_up|create_user|create_account|register_user|register_new_user)\b/i,
         safeguards: [
             { pattern: /\b(bcrypt|argon2|scrypt|pbkdf2|hash|hashPassword|createHash|hashSync|hash_password)\b/i, label: "secure_hash" },
+            // Framework delegation (qualified chains only — a bare custom create_user
+            // is NOT treated as secure): Django's built-in user manager and password
+            // setters hash internally; repository/service create_user methods delegate
+            // to the model (users_repo.create_user, self.create_user). Also
+            // XForm(request.POST).save() — Django form validation + hashing
+            // (extractor marker).
+            { pattern: /\.create_user\b|\.(change_password|set_password)\b|__progmune_django_form__|__progmune_template_tag__/i, label: "framework_hashing" },
         ],
         violationMessage: "User registration function does not call a secure password hashing function (bcrypt/argon2/scrypt). Passwords may be stored in plaintext or with weak hashing.",
         conceptMissing: ["PasswordHash", "KeyDerivation"],
@@ -284,9 +291,14 @@ const SAFEGUARD_RULES = [
     {
         name: "Password Hashing (Weak)",
         category: "password_hashing",
-        trigger: /\b(register|signUp|createUser|createAccount|registerUser)\b/i,
+        trigger: /\b(register|signUp|createUser|createAccount|registerUser|sign_up|create_user|create_account|register_user|register_new_user)\b/i,
         safeguards: [
             { pattern: /\b(bcrypt|argon2|scrypt|pbkdf2)\b/i, label: "strong_hash" },
+            // Framework delegation (qualified chains only)
+            { pattern: /\.create_user\b|\.(change_password|set_password)\b|__progmune_django_form__|__progmune_template_tag__/i, label: "framework_hashing" },
+        ],
+        excludePatterns: [
+            /register\.(simple_tag|tag|filter|inclusion_tag)/, // Django template-tag registration
         ],
         violationMessage: "User registration uses weak or no password hashing. SHA256/MD5 detected — use bcrypt/argon2 instead.",
         conceptMissing: ["StrongHash", "SaltGeneration"],
@@ -294,16 +306,26 @@ const SAFEGUARD_RULES = [
     },
     // ── Authorization / Ownership Check ──
     // v2: narrowed triggers — removed "process" and "set" (too generic for C libraries)
+    // v3 (2026-08-15): identity lookups (getUser/validateToken/getCurrentUser...) removed
+    // from satisfiers — authentication is NOT ownership. A mutation calling only
+    // getUser(token) without comparing ownerId/authorId is the 90-FN class found by
+    // the 100-project gold benchmark. Satisfiers are now: explicit ownership
+    // comparison names, owner-check helpers, or permission/role gates.
+    // Limitation: inline `p.ownerId !== u.id` comparisons are not visible in the
+    // call-list interface of this detector (would need AST-level analysis).
     {
         name: "Authorization (Ownership Check)",
         category: "authorization",
-        trigger: /\b(delete|remove|toggle|modify|edit|lock|ban|refund|assign|transfer|share|schedule|upload)(?:[A-Z]\w*|_\w+)|(?:[A-Z]\w*|_\w+)(Delete|Remove|Toggle|Modify|Edit|Lock|Ban|Refund|Assign|Transfer|Share|Schedule|Upload)\b/i,
+        paramGated: true,
+        trigger: /\b(delete|remove|toggle|modify|edit|lock|ban|refund|assign|transfer|share|schedule|upload|update)(?:[A-Z]\w*|_\w+)|(?:[A-Z]\w*|_\w+)(Delete|Remove|Toggle|Modify|Edit|Lock|Ban|Refund|Assign|Transfer|Share|Schedule|Upload|Update)\b/i,
         safeguards: [
-            { pattern: /\b(getUser|validateToken|verifySession|getSessionUser|getCurrentUser|checkOwner|authorId\s*[!=]==?|ownerId\s*[!=]==?|userId\s*[!=]==?|\.owner\s*[!=]==?|hasPermission|checkPermission|checkAccess|isAuthorized|checkRole|requireRole|adminCheck|isAdmin|canModify|canDelete|canEdit)\b/i, label: "auth_check" },
+            { pattern: /\b(checkOwner|isOwner|ownerId\s*[!=]==?|authorId\s*[!=]==?|userId\s*[!=]==?|createdBy\s*[!=]==?|\.owner\s*[!=]==?|\.user\s*[!=]==?)\b/i, label: "ownership_check" },
+            { pattern: /\b(hasPermission|checkPermission|checkAccess|isAuthorized|checkRole|requireRole|adminCheck|isAdmin|canModify|canDelete|canEdit)\b/i, label: "authz_check" },
+            { pattern: /\b(__progmune_ownership_checked__)\b/, label: "inline_ownership_check" },
         ],
-        violationMessage: "Mutation operation does not verify user ownership or authorization before modifying data.",
+        violationMessage: "Mutation operation does not verify that the acting user owns the resource or holds the required permission before modifying data.",
         conceptMissing: ["OwnershipCheck", "AuthorizationGuard"],
-        conceptExpected: ["getUser", "validateToken", "ownerId check"],
+        conceptExpected: ["ownerId comparison", "authorId check", "permission check"],
         excludePatterns: [
             /_hd_/, // HPACK header compression internals
             /_frame_/, // protocol frame handlers
@@ -323,9 +345,10 @@ const SAFEGUARD_RULES = [
         name: "Authorization (Unauthenticated Access)",
         category: "authorization",
         languages: ["typescript", "javascript", "python"],
+        paramGated: true,
         trigger: /\b(list|download|view|fetch)(?:[A-Z]\w*|_\w+)|get(?:[A-Z]\w+|_\w+)/i,
         safeguards: [
-            { pattern: /\b(getUser|validateToken|verifySession|getSessionUser|getCurrentUser|token\w*(Check|Verify|Valid)|session\w*(Check|Verify|Valid)|auth\w*(Check|Verify|Valid|Guard|Middleware|Required)|requireAuth|withAuth|authenticate\w*(User|Request|Token)?|checkAuth|isAuth|hasAuth|checkAccess|hasAccess)\b/i, label: "auth_check" },
+            { pattern: /\b(getUser|validateToken|verifySession|getSessionUser|getCurrentUser|token\w*(Check|Verify|Valid)|session\w*(Check|Verify|Valid)|auth\w*(Check|Verify|Valid|Guard|Middleware|Required)|requireAuth|withAuth|authenticate\w*(User|Request|Token)?|checkAuth|isAuth|hasAuth|checkAccess|hasAccess|get_user|get_session_user|get_current_user|validate_session|verify_token|require_auth|with_auth|check_auth|auth_required|authenticate_user|authenticate_request|authenticate_token|token_check|token_verify|token_valid|session_check|session_verify|session_valid|auth_check|auth_guard|auth_middleware|get_current_user_authorizer|current_user_authorizer|login_required|permission_required|user_passes_test|check_authorization|check_permission|jwt\.decode|decode_token|__progmune_auth_checked__|__progmune_credential_check__|__progmune_drf_permissions__|__progmune_auth_machinery__)\b/i, label: "auth_check" },
         ],
         violationMessage: "Data access function does not check authentication. Anyone can access data without credentials.",
         conceptMissing: ["AuthenticationCheck", "AccessControl"],
@@ -342,8 +365,38 @@ const SAFEGUARD_RULES = [
             /findBig|findKey|findPk/, // internal search (not API)
         ],
     },
+    // Mutations without any authentication. The Unauthenticated Access rule above
+    // only covers read verbs (list/get/download/view/fetch); create/add/post/update/
+    // set verbs had no auth coverage (3 gold FNs: addProduct, addCategory, setMilestone).
+    // v3 (2026-08-15)
+    {
+        name: "Authorization (Unauthenticated Mutation)",
+        category: "authorization",
+        languages: ["typescript", "javascript", "python"],
+        paramGated: true,
+        // Note: "post" deliberately excluded — it collides with the Post entity name
+        // (listPosts/getPost/deletePost fire via identifier-parsed words).
+        trigger: /\b(add|create|update|set|publish|insert|submit)(?:[A-Z]\w*|_\w+)|(?:[A-Z]\w*|_\w+)(Add|Create|Update|Set|Publish|Insert|Submit)\b/i,
+        safeguards: [
+            { pattern: /\b(getUser|validateToken|verifyToken|verifySession|validateSession|getSessionUser|getSession\b|getCurrentUser|token\w*(Check|Verify|Valid)|session\w*(Check|Verify|Valid)|auth\w*(Check|Verify|Valid|Guard|Middleware|Required)|requireAuth|withAuth|authenticate\w*(User|Request|Token)?|checkAuth|isAuth|hasAuth|checkAccess|hasAccess|get_user|get_session_user|get_current_user|validate_session|verify_token|require_auth|with_auth|check_auth|auth_required|authenticate_user|authenticate_request|authenticate_token|token_check|token_verify|token_valid|session_check|session_verify|session_valid|auth_check|auth_guard|auth_middleware|get_current_user_authorizer|current_user_authorizer|login_required|permission_required|user_passes_test|check_authorization|check_permission|create_access_token|create_refresh_token|create_jwt_token|__progmune_auth_checked__|__progmune_credential_check__|__progmune_drf_permissions__|__progmune_auth_machinery__)\b/i, label: "auth_check" },
+        ],
+        violationMessage: "Mutation function does not check authentication. Anyone can create or modify data without credentials.",
+        conceptMissing: ["AuthenticationCheck", "AccessControl"],
+        conceptExpected: ["token validation", "session check", "auth middleware"],
+        excludePatterns: [
+            /set_authn_id/, // internal auth setter
+            /set_ssl_/, // SSL config setter
+            /set_config/, // configuration setter
+            /set_option/, // option setter
+        ],
+    },
     // ── Data Integrity (Foreign Key Validation) ──
     // v2: removed "process" and "send" (too generic for C)
+    // v3 (2026-08-15): param-aware. The old safeguard counted ANY get*/find* call
+    // as a foreign-key check — including getSessionUser/getUser auth lookups, which
+    // suppressed the rule on addComment/addNote/createReply (4 gold FNs). When param
+    // names are known, the rule only applies to functions taking a parent-reference
+    // parameter (…Id / entityType) and requires a NON-auth lookup call.
     {
         name: "Data Integrity (Foreign Key)",
         category: "data_integrity",
@@ -354,6 +407,11 @@ const SAFEGUARD_RULES = [
         violationMessage: "Creates a child entity without verifying the parent entity exists. Orphaned references possible.",
         conceptMissing: ["ForeignKeyValidation", "ReferentialIntegrity"],
         conceptExpected: ["checkExists", "getParent", "validateReference"],
+        parentRefGated: true,
+        strictSafeguards: [
+            // Entity lookups only — authentication lookups do NOT verify a parent exists.
+            { pattern: /\b(?!get(Session|Current)?User\b|getClient\b|verifyToken\b|validateSession\b)(get|find|check|exists|lookup|status|validate|verify)(?:[A-Z]\w*|_\w+)\b/i, label: "fk_check_strict" },
+        ],
         excludePatterns: [
             /_hd_/, // HPACK header compression
             /add_auth_info/, // internal auth metadata
@@ -388,7 +446,7 @@ const SAFEGUARD_RULES = [
     {
         name: "TLS Enforcement",
         category: "tls_enforcement",
-        trigger: /\b(createServer|listen|handleRequest|app\.listen|express)\b/i,
+        trigger: /\b(createServer|listen|handleRequest|handle_request|app\.listen|express)\b/i,
         safeguards: [
             { pattern: /\b(https|tls|ssl|cert|key|TLS|SSL|HTTPS|createSecureContext|credentials)\b/i, label: "tls_config" },
         ],
@@ -401,9 +459,21 @@ const SAFEGUARD_RULES = [
         name: "Token Security (Weak Generation)",
         category: "token_security",
         languages: ["typescript", "javascript", "python"],
-        trigger: /\b(authenticate|login|signIn|logIn|createSession|generateToken)\b/i,
+        trigger: /\b(authenticate|login|signIn|logIn|createSession|generateToken|do_login|sign_in|log_in|generate_token|create_session|reset_password|password_reset|forgot_password|reset_token|create_reset_token|generate_reset_token)\b/i,
+        // Semantic precondition: only fire when the function actually issues
+        // token material (set_cookie / token-named assignment — extractor marker).
+        // Login-named page renderers (login_otp) no longer fire.
+        requireMarker: "__progmune_token_issued__",
         safeguards: [
-            { pattern: /\b(crypto\.randomUUID|jwt\.sign|jsonwebtoken|nanoid|randomBytes|cryptoRandomString)\b/i, label: "secure_token" },
+            { pattern: /\b(crypto\.randomUUID|jwt\.sign|jsonwebtoken|nanoid|randomBytes|cryptoRandomString|secrets\.token_urlsafe|secrets\.token_hex|token_urlsafe|token_hex|uuid\.uuid4|os\.urandom)\b/i, label: "secure_token" },
+            // Framework delegation: calling a token-issuing layer means the session
+            // material is handled by that layer, not generated inline. NOTE: bare
+            // jwt.encode is deliberately NOT here — a hardcoded secret key makes the
+            // JWT layer itself the vulnerability (PyGoat sec_misconfig_lab3).
+            { pattern: /\b(create_access_token|create_refresh_token|create_jwt_token|\.check_password\b|get_current_user_authorizer|login_required|permission_required|__progmune_framework_auth__|__progmune_auth_machinery__)\b/i, label: "framework_token" },
+        ],
+        excludePatterns: [
+            /login_not_required|login_required/, // decorators — the auth layer itself
         ],
         violationMessage: "Token/session generated without cryptographically secure random source. Tokens may be predictable or forgeable.",
         conceptMissing: ["SecureRandom", "TokenEntropy", "CryptographicSignature"],
@@ -413,9 +483,11 @@ const SAFEGUARD_RULES = [
     {
         name: "Authorization (Resource Ownership)",
         category: "authorization",
+        paramGated: true,
         trigger: /\b(toggle|remove)(?:[A-Z]\w*|_\w+)\b/i,
         safeguards: [
             { pattern: /\b(ownerId\s*[!=]==?|authorId\s*[!=]==?|userId\s*[!=]==?|createdBy|\.owner\s*[!=]==?)/i, label: "ownership_comparison" },
+            { pattern: /\b(__progmune_ownership_checked__)\b/, label: "inline_ownership_check" },
         ],
         violationMessage: "Resource mutation checks authentication but does NOT verify the resource belongs to the requesting user. Missing ownerId/authorId comparison.",
         conceptMissing: ["ResourceOwnership", "HorizontalAuthorization"],
@@ -461,7 +533,7 @@ const SAFEGUARD_RULES = [
     {
         name: "Rate Limiting",
         category: "rate_limiting",
-        trigger: /\b(createServer|listen|handleRequest|app\.listen|express|router\.(post|get|put|delete|patch))\b/i,
+        trigger: /\b(createServer|listen|handleRequest|handle_request|app\.listen|express|router\.(post|get|put|delete|patch))\b/i,
         safeguards: [
             { pattern: /\b(rateLimit|rate_limit|throttle|RateLimiter|expressRateLimit|rateLimiterMiddleware|limiter)\b/i, label: "rate_limit" },
         ],
@@ -513,9 +585,14 @@ const SAFEGUARD_RULES = [
         name: "Command Injection",
         category: "input_validation",
         languages: ["python"],
-        trigger: /\b(os\.system|os\.popen|subprocess\.(call|check_call|Popen|run)|commands\.getoutput|pty\.spawn)\b/i,
+        // Marker-driven: the extractor emits __progmune_command_dynamic__ only
+        // when a subprocess/os command receives a NON-static argument (static
+        // string/list invocations like installers stay silent), and
+        // __progmune_command_taint_flow__ when a tainted value flows to a
+        // command-named helper.
+        trigger: /\b(__progmune_command_dynamic__|__progmune_command_taint_flow__)\b/,
         safeguards: [
-            { pattern: /\b(shlex\.quote|shlex\.split|pipes\.quote|shell\s*=\s*False)\b/i, label: "safe_command" },
+            { pattern: /\b(shlex\.quote|shlex\.split|pipes\.quote)\b/i, label: "safe_command" },
         ],
         violationMessage: "Shell command execution without input quoting. Vulnerable to command injection.",
         conceptMissing: ["CommandInjectionPrevention", "InputSanitization"],
@@ -525,10 +602,12 @@ const SAFEGUARD_RULES = [
         name: "Hardcoded Secrets",
         category: "token_security",
         languages: ["python"],
-        trigger: /\b(password|secret|api_key|API_KEY|token|\w*TOKEN\w*)\s*=\s*["'][^"']+["']/i,
-        safeguards: [
-            { pattern: /\b(os\.environ|os\.getenv|config|\.env|python-dotenv|load_dotenv|SecretStr|Secret)\b/i, label: "env_secret" },
-        ],
+        trigger: /\b(password|secret|api_key|API_KEY|token|\w*TOKEN\w*)\s*=\s*["'][^"']+["']|__progmune_hardcoded_secret__/i,
+        // Empty safeguards: the extractor marker is the complete evidence. (The old
+        // env-secret safeguard suppressed the marker itself — identifierParse of
+        // __progmune_hardcoded_secret__ yields the word "secret", matching the
+        // safeguard's "Secret" alternative.)
+        safeguards: [],
         violationMessage: "Sensitive credentials hardcoded in source code. Use environment variables or a secrets manager.",
         conceptMissing: ["SecretManagement", "ConfigurationSecurity"],
         conceptExpected: ["os.environ", "os.getenv", "dotenv"],
@@ -537,7 +616,7 @@ const SAFEGUARD_RULES = [
         name: "Dynamic Code Execution",
         category: "input_validation",
         languages: ["python"],
-        trigger: /\b(eval|exec|compile|__import__)\s*\(/i,
+        trigger: /\b(eval|exec|compile|__import__)\s*\(|__progmune_eval_user_input__/i,
         safeguards: [
             { pattern: /\b(ast\.literal_eval|json\.loads|safe_eval)\b/i, label: "safe_eval" },
         ],
@@ -561,14 +640,134 @@ const SAFEGUARD_RULES = [
         name: "SQL Injection (Python)",
         category: "input_validation",
         languages: ["python"],
-        trigger: /\b(execute|executemany)\b/i,
-        safeguards: [
-            { pattern: /\b(%s|\?|:\w+|parameterize|\.execute\s*\(\s*\w+\s*,\s*[\[(])/i, label: "parameterized_query" },
-        ],
-        violationMessage: "SQL executed with string formatting instead of parameterized queries. Vulnerable to SQL injection.",
+        // Source-level detection: the Python extractor emits a synthetic marker
+        // call when a SQL-executing call (execute/executemany/raw/...) builds its
+        // SQL text with dynamic formatting (f-string / % / .format / concatenation).
+        // Parameterized calls (execute("... %s", (args,))) produce no marker and
+        // are correctly NOT flagged. No satisfier possible — the marker IS the
+        // violation evidence.
+        trigger: /\b(__progmune_sql_unparameterized__)\b/,
+        safeguards: [],
+        violationMessage: "SQL built with string formatting (f-string / % / .format / concatenation) instead of parameterized queries. Vulnerable to SQL injection.",
         conceptMissing: ["SQLInjectionPrevention", "ParameterizedQueries"],
         conceptExpected: ["parameterized query", "%s placeholder"],
     },
+    {
+        name: "SSRF (User-Controlled URL Fetch)",
+        category: "ssrf",
+        languages: ["python"],
+        // Source-level detection: the Python extractor emits a synthetic marker
+        // call when an HTTP fetch (requests.*/urllib.*/httpx.*/aiohttp.*/urlopen)
+        // receives a URL tainted by request-derived user input (directly or via
+        // single-hop assignment). No satisfier possible — the marker IS the
+        // violation evidence.
+        trigger: /\b(__progmune_ssrf_user_url__)\b/,
+        safeguards: [],
+        violationMessage: "HTTP fetch whose URL derives from user-controlled request input — server-side request forgery.",
+        conceptMissing: ["SSRFPrevention", "URLValidation"],
+        conceptExpected: ["URL allowlist", "scheme validation"],
+    },
+    {
+        name: "Path Traversal (User-Controlled File Path)",
+        category: "path_traversal",
+        languages: ["python"],
+        // Source-level detection: the Python extractor emits a synthetic marker
+        // call when a file sink (open / io.open / os.open / Path(...).read_text)
+        // receives a path tainted by request-derived user input (directly or via
+        // single-hop assignment — os.path.join chains resolve through assignment
+        // tracking). No satisfier possible — the marker IS the violation evidence.
+        trigger: /\b(__progmune_path_traversal__)\b/,
+        safeguards: [],
+        violationMessage: "File opened with a path derived from user-controlled request input — path traversal / arbitrary file access.",
+        conceptMissing: ["PathTraversalPrevention", "InputPathValidation"],
+        conceptExpected: ["path allowlist", "basename normalization", "path sanitization"],
+    },
+    {
+        name: "XSS (Unsafe Template Rendering)",
+        category: "xss",
+        languages: ["python"],
+        // Cross-file detection: the Python extractor scans templates for variables
+        // rendered without escaping ({{ var|safe }}, {% autoescape off %}) and emits
+        // a synthetic marker when a render/render_to_string call binds tainted
+        // request-derived values to those variables — or when mark_safe() is
+        // applied to tainted input.
+        trigger: /\b(__progmune_xss_unsafe_render__)\b/,
+        safeguards: [],
+        violationMessage: "User-controlled input rendered in a template without escaping (|safe / autoescape off / mark_safe) — stored or reflected XSS.",
+        conceptMissing: ["XSSPrevention", "OutputEncoding"],
+        conceptExpected: ["template autoescape", "output escaping"],
+    },
+    {
+        name: "SSTI (Template Injection)",
+        category: "ssti",
+        languages: ["python"],
+        // Source-level detection: the Python extractor emits a synthetic marker
+        // when (S1) a template-string sink (render_template_string / Template /
+        // from_string) receives tainted input, or (S2) tainted content is written
+        // to a file opened under a template path — the Django dynamic-template
+        // pattern where user input becomes template source.
+        trigger: /\b(__progmune_ssti_template_injection__)\b/,
+        safeguards: [],
+        violationMessage: "User-controlled input used as template source — server-side template injection.",
+        conceptMissing: ["SSTIPrevention", "TemplateSandbox"],
+        conceptExpected: ["static template files", "no user template syntax"],
+    },
+    {
+        name: "XXE (External Entity Processing)",
+        category: "xxe",
+        languages: ["python"],
+        // Source-level detection: the Python extractor emits a synthetic marker
+        // when BOTH signals co-occur — an explicitly unsafe parser configuration
+        // (setFeature(feature_external_*, True) / XMLParser(resolve_entities=True))
+        // AND parsing of tainted request-derived XML (parse/parseString/fromstring).
+        // Config-only or taint-only alone is not flagged.
+        trigger: /\b(__progmune_xxe_external_entities__)\b/,
+        safeguards: [],
+        violationMessage: "XML parsed from user-controlled input with external entity processing explicitly enabled — XXE.",
+        conceptMissing: ["XXEPrevention", "EntityExpansionControl"],
+        conceptExpected: ["disable external entities", "secure parser config"],
+    },
+    {
+        name: "CSRF Protection Disabled",
+        category: "csrf",
+        languages: ["python"],
+        // Source-level detection: the Python extractor emits a synthetic marker
+        // when a function carries the @csrf_exempt decorator — Django CSRF
+        // protection explicitly disabled on the view.
+        trigger: /\b(__progmune_csrf_disabled__)\b/,
+        safeguards: [],
+        violationMessage: "View decorated with @csrf_exempt — CSRF protection explicitly disabled.",
+        conceptMissing: ["CSRFProtection", "StateChangingRequestValidation"],
+        conceptExpected: ["csrf token validation", "SameSite cookies"],
+    },
+    {
+        name: "CSRF Exposed GET State Change",
+        category: "csrf",
+        languages: ["python"],
+        // Source-level detection: the Python extractor emits a synthetic marker
+        // when a `request.method == 'GET'` branch performs state-changing calls
+        // (.save/.update/.delete/.create) — state change on GET, CSRF-exposed
+        // even without @csrf_exempt.
+        trigger: /\b(__progmune_get_state_change__)\b/,
+        safeguards: [],
+        violationMessage: "State-changing operation executed in a GET branch — CSRF-exposed without token validation.",
+        conceptMissing: ["CSRFProtection", "SafeMethodEnforcement"],
+        conceptExpected: ["POST for state changes", "csrf token validation"],
+    },
+    {
+        name: "Authorization via Client Cookie",
+        category: "authorization",
+        languages: ["python"],
+        // Source-level detection: the Python extractor emits a synthetic marker
+        // when a client-controlled cookie value (request.COOKIES, incl. single-hop
+        // assignment chains like cookie.split('|')[0]) participates in a comparison
+        // or branch test — authorization decided by cookie contents.
+        trigger: /\b(__progmune_cookie_authorization__)\b/,
+        safeguards: [],
+        violationMessage: "Authorization decision based on a client-controlled cookie value — cookie contents are user-editable.",
+        conceptMissing: ["ServerSideAuthorization", "SessionIntegrity"],
+        conceptExpected: ["server-side session checks", "signed sessions"],
+    },
     // ═══════════════════════════════════════════════════════════════
     // P0 Injection: Payment + Session safeguard rules
     // ═══════════════════════════════════════════════════════════════
@@ -612,7 +811,7 @@ const SAFEGUARD_RULES = [
     {
         name: "Session No Timeout",
         category: "session",
-        trigger: /\b(\w*session\w*create|\w*create\w*session|\w*session\w*new|\w*session\w*start|\w*login\w*session|\w*session\w*init|signIn|signin|login\b|authenticate\b|createSession|create_session)\b/i,
+        trigger: /\b(\w*session\w*create|\w*create\w*session|\w*session\w*new|\w*session\w*start|\w*login\w*session|\w*session\w*init|signIn|signin|login\b|authenticate\b|createSession|create_session|do_login|sign_in|log_in)\b/i,
         safeguards: [
             { pattern: /\b(\w*expir|\w*ttl|\w*timeout|\w*max\w*age|\w*maxAge|\w*max_age|\w*lifetime|\w*duration|\w*expires|\w*deadline|\w*valid\w*for|\w*valid\w*until)/i, label: "timeout_set" },
         ],
@@ -636,6 +835,8 @@ const SAFEGUARD_RULES = [
         trigger: /\b(\w*password\w*change|\w*password\w*reset|\w*change\w*password|\w*reset\w*password|\w*update\w*password|\w*privilege|\w*role\w*change|\w*escalat|\w*enable\w*2fa|\w*mfa\w*enable|\w*email\w*change)\b/i,
         safeguards: [
             { pattern: /\b(\w*revoke|\w*rotate|\w*invalidate|\w*reissue|\w*regenerate|\w*new\w*token|\w*token\w*refresh|\w*session\w*refresh|\w*renew)/i, label: "token_rotate" },
+            // Password-change machinery itself (the material IS rotated/reissued here).
+            { pattern: /\.(change_password|set_password|update_password|generate_salt|get_password_hash)\b/i, label: "password_machinery" },
         ],
         violationMessage: "Privilege-changing operation detected without subsequent token rotation or session invalidation. Stolen pre-change tokens remain valid.",
         conceptMissing: ["TokenRotation", "SessionInvalidation", "FixationPrevention"],
@@ -648,7 +849,7 @@ const SAFEGUARD_RULES = [
     {
         name: "Registration Without Email Verification",
         category: "registration",
-        trigger: /\b(register|signup|signUp|registerUser|createUser|createAccount)\b/i,
+        trigger: /\b(register|signup|signUp|registerUser|createUser|createAccount|sign_up|create_user|create_account|register_user|register_new_user)\b/i,
         safeguards: [
             { pattern: /\b(send\w*(Code|Otp|Token|Verif|Email|Sms|Link)|(code|otp|token|verif)\w*send|verification|confirmEmail|verifyEmail|sendVerification|verify_user_email)\b/i, label: "email_verify" },
         ],
@@ -793,13 +994,23 @@ const SAFEGUARD_RULES = [
     //              Privilege Escalation, API Contract
     // ═══════════════════════════════════════════════════════════════
     // ── PLS-005: Session Fixation — session not invalidated on logout ──
+    // v2 (2026-08-15): recognize store-based invalidation — splicing/filtering the
+    // session store IS invalidation (144 FPs on the 100-project benchmark came from
+    // logouts that do `sessions.splice(idx, 1)`). Also, a function that delegates to
+    // a logout-named function is not itself failing to invalidate — the logout
+    // function's own body is where the check belongs (callsOnly guard).
     {
         name: "Session Fixation (Logout without Invalidation)",
         category: "session_fixation",
         languages: ["typescript", "javascript", "python"],
-        trigger: /\b(logout|signOut|logOut|signout|doLogout|handleLogout|endSession|clearSession)\b/i,
+        trigger: /\b(logout|signOut|logOut|signout|doLogout|handleLogout|endSession|clearSession|do_logout|sign_out|log_out|handle_logout|end_session|clear_session|invalidate_session)\b/i,
         safeguards: [
             { pattern: /\b(session\w*destroy|destroy\w*session|session\w*invalidate|invalidate\w*session|session\w*revoke|revoke\w*session|session\w*clear|clear\w*session|session\w*end|end\w*session|session\w*expire|expire\w*session|token\w*revoke|revoke\w*token|token\w*blacklist|blacklist\w*token|invalidate\w*token)\b/i, label: "session_invalidate" },
+            // Store-based invalidation: remove the session entry from the store.
+            { pattern: /\b(splice|filter|pop|shift|clear|delete_cookie|delete_cookies)\b/i, label: "store_invalidate" },
+            // Delegation: calling a logout-named function hands invalidation to that
+            // function (its own body is checked separately).
+            { pattern: /\b(logout|signOut|logOut|signout|doLogout|handleLogout|endSession|clearSession|do_logout|sign_out|log_out|handle_logout|end_session|clear_session|invalidate_session)\b/i, label: "delegated_logout", callsOnly: true },
         ],
         violationMessage: "Logout function does not destroy/invalidate the session. Old session tokens remain valid, enabling session hijacking (session fixation).",
         conceptMissing: ["SessionInvalidation", "SessionRevocation"],
@@ -869,10 +1080,14 @@ function identifierParse(name) {
  * Detect missing safeguards in function call sequences.
  * Uses identifier parsing to match compound names (registerNewUser → register).
  */
-function detectSafeguardViolations(calls, enclosingFuncName, language) {
+function detectSafeguardViolations(calls, enclosingFuncName, language, params, exposed) {
     const violations = [];
-    // Build effective calls: raw names + identifier-parsed words
-    const rawCalls = enclosingFuncName ? [enclosingFuncName, ...calls] : [...calls];
+    // Build effective calls: raw names + identifier-parsed words.
+    // Class-qualified names (Class.method) contribute only their METHOD name —
+    // a class name like SetCommands/ListCommands must not leak "Set"/"List"
+    // words into trigger matching (real-world collision class found in redis-py).
+    const ownName = enclosingFuncName ? (enclosingFuncName.split(".").pop() || enclosingFuncName) : undefined;
+    const rawCalls = ownName ? [ownName, ...calls] : [...calls];
     const parsedWords = [];
     for (const c of rawCalls) {
         parsedWords.push(...identifierParse(c));
@@ -880,7 +1095,7 @@ function detectSafeguardViolations(calls, enclosingFuncName, language) {
     const effectiveCalls = [...new Set([...rawCalls, ...parsedWords])];
     // Skip authorization rules for auth functions — check both raw lowercased name and parsed words
     const rawLower = enclosingFuncName?.toLowerCase() || "";
-    const AUTH_PATTERN = /\b(register|signup|signin|login|authenticate|createuser|createaccount|registeruser|registernewuser|dologin|verifytoken|validatesession|getuser|getsessionuser|getcurrentuser|endsession|logout|signout|dologout|destroysession|invalidatesession|invalidate|signout)\b/i;
+    const AUTH_PATTERN = /\b(register|signup|signin|login|authenticate|createuser|createaccount|registeruser|registernewuser|dologin|verifytoken|validatesession|getuser|getsessionuser|getcurrentuser|endsession|logout|signout|dologout|destroysession|invalidatesession|invalidate|signout|create_account|register_new_user|register_user|sign_up|create_user|do_login|sign_in|log_in|verify_token|validate_session|get_user|get_session_user|get_current_user|do_logout|sign_out|log_out|end_session|invalidate_session|clear_session)\b/i;
     const isAuthFunction = enclosingFuncName != null && (AUTH_PATTERN.test(rawLower) ||
         identifierParse(enclosingFuncName).some(w => AUTH_PATTERN.test(w)));
     // Filter rules by language
@@ -889,14 +1104,37 @@ function detectSafeguardViolations(calls, enclosingFuncName, language) {
         : SAFEGUARD_RULES;
     for (const rule of activeRules) {
         // Check if trigger matches
-        const triggerMatch = effectiveCalls.some(c => rule.trigger.test(c));
+        const triggerCalls = rule.triggerCallsOnly ? rawCalls : effectiveCalls;
+        const triggerMatch = triggerCalls.some(c => rule.trigger.test(c));
         if (!triggerMatch)
             continue;
+        // Semantic precondition marker (extractor-emitted)
+        if (rule.requireMarker && !effectiveCalls.includes(rule.requireMarker))
+            continue;
         // Skip authorization rules for auth functions — they ARE the auth
         if (isAuthFunction && rule.category === "authorization")
             continue;
+        // Param-gated rules (parentRefGated): only apply when the function takes a
+        // parent-reference parameter. Requires the caller to pass param names.
+        if (rule.parentRefGated && params) {
+            const hasParentRef = params.some(p => /Id$/i.test(p) || /^entityType$/i.test(p));
+            if (!hasParentRef)
+                continue;
+        }
+        // Surface gate (paramGated): only apply to functions that can plausibly
+        // authenticate — routed by a web handler (exposed) or taking an
+        // identity-ish parameter. Requires the caller to pass param names.
+        if (rule.paramGated && params) {
+            const hasIdentity = params.some(p => /\b(token|session|user|auth|request|scope|cookie|credential|permission|role|identity)\b/i.test(p));
+            if (!hasIdentity && !exposed)
+                continue;
+        }
         // Check if at least one safeguard matches
-        const matchedSafeguard = rule.safeguards.find(s => effectiveCalls.some(c => s.pattern.test(c)));
+        const guards = (params && rule.strictSafeguards) ? rule.strictSafeguards : rule.safeguards;
+        const matchedSafeguard = guards.find(s => {
+            const testCalls = s.callsOnly ? (calls || []) : effectiveCalls;
+            return testCalls.some(c => s.pattern.test(c));
+        });
         if (matchedSafeguard)
             continue;
         // Check excludePatterns (library functions where safeguard is deferred to separate API)
@@ -1001,7 +1239,7 @@ function detectSafeguardViolationsV7(calls, enclosingFuncName, callerMap, funcCa
         safeContext.add(c);
     // Skip authorization rules for auth functions
     const rawLower = enclosingFuncName?.toLowerCase() || "";
-    const AUTH_PATTERN = /\b(register|signup|signin|login|authenticate|createuser|createaccount|registeruser|registernewuser|dologin|verifytoken|validatesession|getuser|getsessionuser|getcurrentuser|endsession|logout|signout|dologout|destroysession|invalidatesession|invalidate|signout)\b/i;
+    const AUTH_PATTERN = /\b(register|signup|signin|login|authenticate|createuser|createaccount|registeruser|registernewuser|dologin|verifytoken|validatesession|getuser|getsessionuser|getcurrentuser|endsession|logout|signout|dologout|destroysession|invalidatesession|invalidate|signout|create_account|register_new_user|register_user|sign_up|create_user|do_login|sign_in|log_in|verify_token|validate_session|get_user|get_session_user|get_current_user|do_logout|sign_out|log_out|end_session|invalidate_session|clear_session)\b/i;
     const isAuthFunction = enclosingFuncName != null && (AUTH_PATTERN.test(rawLower) ||
         identifierParse(enclosingFuncName).some(w => AUTH_PATTERN.test(w)));
     // Filter rules by language

package/docs/Progmune_/351/241/271/347/233/256/345/205/250/350/247/243.html

@@ -346,7 +346,7 @@
   <div class="bar"><span class="bl">人工审查能力</span><div class="bt"><div class="bf" style="width:10%"></div></div><span class="bv">1x</span></div>
 
   <h3>3.2 问题本质：AI 写代码的原理决定了它"看不见"错误</h3>
-  <p>大语言模型生成代码的方式是<strong>统计预测</strong>——根据训练数据猜"下一个最可能的词"。学术研究（Kambhampati et al., ICML 2026）明确指出：LLM 输出的"逐步推理"是统计表演，中间 token 与真实推理之间没有可靠的因果对应。</p>
+  <p>大语言模型生成代码的方式是<strong>统计预测</strong>——根据训练数据猜"下一个最可能的词"。这一观点的代表性论述来自 Subbarao Kambhampati 等的立场论文《Stop Anthropomorphizing Intermediate Tokens as Reasoning/Thinking Traces!》（arXiv:2505.22285）及其 ICML 2026 关于 verifier 的主题演讲：LLM 输出的"逐步推理"是统计表演，中间 token 与真实推理之间没有可靠的因果对应。</p>
   <p>这意味着：AI 写出"看似合理的代码"和"实际正确的代码"是两件事。它会一本正经地调用不存在的函数、跳过关键的认证步骤——<strong>而且完全静默，不报错</strong>。</p>
 
   <h3>3.3 现有方案为什么不够</h3>
@@ -470,7 +470,18 @@ AI 生成: create_session(...)   ← 当前状态 UNAUTHENTICATED
   <h3>5.4 API 语义映射：让检查认识"陌生函数"</h3>
   <p>真实项目使用的函数名千变万化（<code>createSessionToken</code>、<code>signSession</code>、<code>jwt.sign</code>……）。系统用三层策略把陌生函数映射到协议规则：① 本地前缀/别名表（含项目自定义 <code>.progmune_aliases.json</code>）→ ② 单词切分匹配 → ③ LLM 批量语义分类（带磁盘缓存，重复运行零 LLM 成本）。</p>
 
-  <h3>5.5 信任引擎：五阶段流水线</h3>
+  <h3>5.5 双路径架构：生成时拦截 vs 事后检查</h3>
+  <p>Progmune 用两条互补路径覆盖两类代码来源——这是理解产品的关键，也是最容易被误读的地方：</p>
+  <table>
+    <tr><th></th><th><strong>生成路径</strong>（生成时拦截）</th><th><strong>验证路径</strong>（事后检查）</th></tr>
+    <tr><td>覆盖场景</td><td>通过 <code>progmune_generate</code> 生成的代码</td><td>任何来源的代码（Copilot、Cursor、人工）</td></tr>
+    <tr><td>机制</td><td>生成循环内 8 道验证关卡：JSON 解析 → 结构预检 → 符号纠正 → 类型修正 → 数据流 → 协议状态机 → BFS 确定性修复 → 语义合约。违规代码<strong>从不写入文件</strong></td><td>信任引擎五阶段流水线（收集→评分→决策→组装），四维加权输出部署决策</td></tr>
+    <tr><td>错误处理时机</td><td>创建时刻——错误从未存在</td><td>事后——文件已存在</td></tr>
+    <tr><td>成本曲线</td><td>零——违规没有落地</td><td>发现越晚越贵</td></tr>
+  </table>
+  <p>核心产品论：<strong>在生成时刻验证，而非事后补救。</strong>LLM 的输出只是提议，状态机才是裁判——LLM 可以被劝服，状态机不会。</p>
+
+  <h3>5.6 信任引擎：五阶段流水线</h3>
   <div class="flow">
     <div class="node">1. 收集<br><span style="font-size:.8em;font-weight:400">策略+协议+框架数据</span></div>
     <span class="arrow">→</span>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",
@@ -106,4 +106,4 @@
     "tsx": "^4.22.4",
     "vitest": "^3.2.6"
   }
-}
+}