progmune-runtime 3.7.12 → 3.7.14

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## [3.7.14] — 2026-09-02
+
+### Go 提取器修复 + 恢复率裁决 + 框架诚实分层 + 三语料实验
+
+- **提取器两处修复**：①无函数体声明行（`//go:linkname` 类）吞并下一个函数（Getuid/RoundTrip 漏检根因——与 C 3.7.4「# 行吞函数」同族）；②接收者方法 receiver 括号组误当参数组（returnType 取到整签名）——回归测试锁定
+- **恢复率裁决**（评审第 3 条落地）：tools/go-fn-list.go（go/parser 金标，同一文件集+只计有体函数）+ scan-go-recovery.ts——stdlib 四包 **2434/2434 = 100.0%** → **维持纯词法，go/parser 桥推迟**
+- **命名鸿沟测量**（孵化器理论核心数据）：词段可桥接 0-1.9%——Go stdlib 惯用命名无法桥接内置规则词汇（与 C 命名鸿沟同构）
+- **框架诚实分层**（评审第 5 条落地）：「12/13 结构级」→「**12 专用检测器 = 4 结构级（AST：NestJS/FastAPI/Django/Flask）+ 8 启发式（代码串：Express/tRPC/Fastify/Next.js/Koa/Hapi/Gin/Fiber）**」；转正门槛 = 真实项目 FP 数据点；CLAUDE.md 矛盾行修复；落地页/矩阵/README 双语同步
+- **Go 三语料实验**（REALWORLD_GO_V1.md，评审第 4 条落地）：stdlib 4 FP 全 FP（readColonFile 词段桥接跨窗口类）；govwa（vendored benchmarks/go-apps/）B 路径 0 flags；**A 路径 demo-real-go-govwa**：真实代码 3 注解（loginAction=verify/SetSession=establish/AuthCheck=guard）→ 0 FP + 植入违规精确定位 + 3 注解/协议——**Go 定位维持注解驱动（Beta）**
+- **TS 795 完整复跑**（评审第 6 条落地）：recall 98.5%（有效 100%）/ precision 100% / FP 0——12 个框架探测器全上线后与历史基线一致
+- 验证：35 定向测试；Python 盲测 v1.2 64 零漂移；check 免疫正常
+
+## [3.7.13] — 2026-09-02
+
+### Go 语言支持 + Gin/Fiber 框架适配——12/13
+
+- **Go IR 提取器**（`src/extract-ir-go.ts`，纯 TS 词法——与 C 提取器同哲学：零外部工具链，npm 安装态可用，不重蹈 Python 桥的安装态覆辙）：func 签名（多行/接收者方法）、调用提取（obj.Method() 取 Method）、注释注解 `// @progmune(...)` + 文档标签、exported=首字母大写、vendor/testdata/*_test.go 表面过滤、Go 关键字排除、反引号 raw string 掩码；8 个单测
+- **注册表接入**：LANGUAGE_EXTRACTORS 第 4 语言（detect .go → extractIRGo）→ extractProjectIR/evaluateTrust 全链路自动生效；**引擎 autoExtractor 补 go**（修复 Go 项目静默走正则回退的同类陷阱——首轮金标全错暴露）
+- **Go 协议盲测 v1**（`scan-protocol-golang.ts`，自包含生成+扫描）：3 干净（直连/方法/helper）× 3 植入违规（missing_auth/read_without_open/leak）——**TP 5 / FP 0 / FN 0 → P=100% / R=100%**
+- **Gin（第 11 个）**：`gin-detector.ts`——GIN_ROUTE_NO_AUTH（r.POST 中间件链 + Use/Group 组级认证）；Go 方法名大写（r.POST）正则 i 标志修复；"middleware" 词误撞修复（loggerMiddleware 类工具中间件≠认证）
+- **Fiber（第 12 个）**：`fiber-detector.ts`——FIBER_ROUTE_NO_AUTH（app.Post 中间件链 + Use）；同款修复
+- **引擎**：collectGinViolations/collectFiberViolations（Go 目录结构特殊：cmd/internal/pkg + 根目录 main.go）+ ginCoverage/fiberCoverage
+- **文档**：Go 语言行 ❌→✅ 注解驱动（Beta）（README 双语/矩阵双语/CLAUDE.md/落地页 + i18n）；框架 **12/13** 口径（剩余 Spring Boot 需 Java 支持先行）
+- **验证**：23 个新单测（Go 提取器 8 + Gin 8 + Fiber 7）；全套件 **204/204**；Python 盲测 v1.2 64 零漂移；C 演示不变；check 免疫正常
+
 ## [3.7.12] — 2026-09-01
 
 ### Koa + Hapi 框架结构适配——10/13

package/README.md

@@ -104,11 +104,12 @@ Progmune is honest about what it can and cannot verify.
 | **TypeScript / JavaScript** | ✅ Production | Blind benchmark: **recall 98.5% / precision 100%** (795 gold findings, 100 projects) |
 | **Python** | ✅ Production | Blind benchmark: **recall 100% / precision 100%** (729 gold findings, 90 projects); real-world validation: PyGoat (OWASP vulnerable-by-design Django app) **67 TP / 0 FP, 100% labeled precision**; three well-written apps (django/fastapi realworld, django-unicorn) with 0 false-positive true findings |
 | **C** | ✅ Annotation-driven (Beta) | IR extraction via the registry + SSG state machine; **annotate ~2-3 protocol primitives per protocol to get trusted verification** (gold 5/5 on real modules: redis ACL / libssh client / libssh server / libssh callback-dispatch / uftpd transfer-auth — all 0 FP with precise violation localization; app-level gold v2: **P=91.7% / R=100% / F1=95.7%**). Unannotated auto-detection stays out of scope (0 TP on real corpus — positioning decision recorded in the C Language Status doc); TLS-level coverage still absent. See [C Language Status](https://github.com/shenlian19831109/progmune-runtime/blob/main/docs/c-language-status.md). |
-| **Go, Java** | ❌ None | Planned |
+| **Go** | ✅ Annotation-driven (Beta) | IR extraction via registry + SSG state machine; synthetic gold v1: **P=100% / R=100%** (clean×3 + violations×3); zero external toolchain (pure-TS lexical extractor — works from npm installs) |
+| **Java** | ❌ None | Planned |
 
 **Multi-language IR (registry-based).** TypeScript (ts-morph) and Python (AST) extractors are registered entries in one registry (`src/extract-project-ir.ts`); `extractProjectIR` merges every detected language into a single function IR shared by the agent loop, `execute()`, and the MCP server — the agent composes function-protocol chains across both languages. Adding a language (Go, Java, …) = register one extractor entry; callers don't change.
 
-**Framework adapters: 10/13.** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis), NestJS ✅ (decorator route parsing + global APP_GUARD recognition + @Public exemption), Koa ✅ (route/auth-middleware chain analysis) and Hapi ✅ (route-config auth strategy analysis) have dedicated detectors. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
+**Framework adapters: 12 dedicated detectors (4 structural + 8 heuristic).** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis), NestJS ✅ (decorator route parsing + global APP_GUARD recognition + @Public exemption), Koa ✅, Hapi ✅ (route-config auth strategy analysis), Gin ✅ and Fiber ✅ (Go route/auth-middleware analysis) have dedicated detectors. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
 
 ### What Progmune does NOT cover (honest boundaries)
 
@@ -234,7 +235,7 @@ High-impact contribution areas:
 - **Runtime Pipeline:** Detect → Explain → Repair → Validate (L1–L4)
 - **Trust Engine:** 4-dimension scoring with binary explainability gate
 - **MCP Tools:** 19 — `progmune_trust_check`, `progmune_score`, `progmune_policy_check`, `progmune_certify`, and more
-- **Framework Adapters:** Express ✅, tRPC ✅, FastAPI ✅, Django ✅, Flask ✅, Fastify ✅, Next.js ✅, NestJS ✅ (10/13)
+- **Framework Adapters:** 12 dedicated detectors — 4 structural (NestJS/FastAPI/Django/Flask) + 8 heuristic (Express/tRPC/Fastify/Next.js/Koa/Hapi/Gin/Fiber)
 - **Knowledge Base:** 31 domains, 148 protocol rules, 22 detectors, 26 safeguards, PLSB 13/13 categories — plus 15 source-level detection rules (Python)
 - **Corpus:** 2,500+ trajectories across 6+ repositories; blind benchmarks 100 (TS) + 90 (Python) projects; real-world validation on 4 application repos
 - **Current focus:** Enterprise PoC validation + remaining framework-internal boundary FPs

package/README.zh-CN.md

@@ -104,11 +104,12 @@ Progmune 对能验证什么、不能验证什么保持诚实。
 | **TypeScript / JavaScript** | ✅ 生产 | 盲测基准：**召回 98.5% / 精确率 100%**（795 条 gold finding，100 个项目） |
 | **Python** | ✅ 生产 | 盲测基准：**召回 100% / 精确率 100%**（729 条 gold finding，90 个项目）；真实应用验证：PyGoat（OWASP 故意脆弱 Django 应用）**67 TP / 0 FP，标记精确率 100%**；三个良构应用（django/fastapi realworld、django-unicorn）0 误报真阳性 |
 | **C** | ✅ 注解驱动（Beta） | IR 提取接入注册表 + SSG 状态机；**每协议标注 ~2-3 个原语即获得可信验证**（真实模块金标 5/5：redis ACL / libssh 客户端 / libssh 服务端 / libssh 回调分发 / uftpd 传送授权——全部 0 误报 + 违规精确定位；应用级金标 v2：**P=91.7% / R=100% / F1=95.7%**）。未注解自动检测不在范围（真实语料 0 TP——定位决议见 C 语言状态文档）；TLS 级覆盖仍无。见 [C 语言状态](https://github.com/shenlian19831109/progmune-runtime/blob/main/docs/c-language-status.md)。 |
-| **Go, Java** | ❌ 无 | 规划中 |
+| **Go** | ✅ 注解驱动（Beta） | IR 提取接入注册表 + SSG 状态机；合成金标 v1：**P=100% / R=100%**（3 干净 × 3 植入违规）；零外部工具链（纯 TS 词法提取，npm 安装态可用） |
+| **Java** | ❌ 无 | 规划中 |
 
 **多语言 IR（注册表式）。** TypeScript（ts-morph）与 Python（AST）提取器是同一注册表（`src/extract-project-ir.ts`）中的注册项；`extractProjectIR` 把检测到的所有语言合并为一份函数 IR，由 agent loop、`execute()` 与 MCP server 共享——agent 可在两种语言上编排函数协议链。新增语言（Go、Java……）= 注册一条提取器，调用方零改动。
 
-**框架适配器：10/13。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）、NestJS ✅（装饰器路由解析 + 全局 APP_GUARD 守卫识别 + @Public 豁免）、Koa ✅（路由/认证中间件链分析）与 Hapi ✅（路由配置认证策略分析）有专用检测器；Next.js 另有版本感知治理。Spring Boot、Go 框架及少数 TS 框架待适配——框架适配是 #1 产品缺口。
+**框架适配器：12 专用检测器（4 结构级 + 8 启发式）。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）、NestJS ✅（装饰器路由解析 + 全局 APP_GUARD 守卫识别 + @Public 豁免）、Koa ✅、Hapi ✅（路由配置认证策略分析）、Gin ✅ 与 Fiber ✅（Go 路由/认证中间件分析）有专用检测器；Next.js 另有版本感知治理。结构级 = AST 解析（NestJS/FastAPI/Django/Flask——合成金标 P=R=100%）；启发式 = 代码串模式（Express/tRPC/Fastify/Next.js/Koa/Hapi/Gin/Fiber——单测覆盖，真实项目 FP 数据待补）。Spring Boot 待适配——框架适配是 #1 产品缺口。
 
 ### Progmune 不覆盖什么（诚实边界）
 
@@ -233,7 +234,7 @@ Progmune 建立在"**LLM 输出是统计表演而非推理**"这一前提上—
 - **运行时管线：** 检测 → 解释 → 修复 → 验证（L1–L4）
 - **信任引擎：** 四维评分 + 二元可解释性门
 - **MCP 工具：** 19 个——`progmune_trust_check`、`progmune_score`、`progmune_policy_check`、`progmune_certify` 等
-- **框架适配器：** Express ✅、tRPC ✅、FastAPI ✅、Django ✅、Flask ✅、Fastify ✅、Next.js ✅、NestJS ✅（10/13）
+- **框架适配器：** 12 专用检测器——4 结构级（NestJS/FastAPI/Django/Flask）+ 8 启发式（Express/tRPC/Fastify/Next.js/Koa/Hapi/Gin/Fiber）
 - **知识库：** 31 个域、148 条协议规则、22 个检测器、26 条防护规则、PLSB 13/13 类别——另加 15 条源码级检测规则（Python）
 - **语料：** 6+ 仓库 2,500+ 轨迹；盲测基准 100（TS）+ 90（Python）个项目；4 个应用仓库真实验证
 - **当前重点：** 企业 PoC 验证 + 剩余框架内部边界误报

package/dist/extract-ir-go.js

@@ -0,0 +1,419 @@
+"use strict";
+/**
+ * Go IR Extractor — pure-TS function extraction for the merged multi-language
+ * registry (extract-project-ir.ts LANGUAGE_EXTRACTORS)。无子进程、无 Go
+ * 工具链依赖（npm 安装态可用——与 C 提取器同哲学，区别于 Python 桥）。
+ *
+ * Route: the registry "go" entry calls extractIRGo; the result merges into
+ * the same FunctionInfo list as TypeScript/Python/C and flows into
+ * call-sequence (P4.6), SSG validation and the agent loop with no rewiring.
+ *
+ * Extraction is a best-effort lexical parse of Go definitions:
+ *   - func Name(params) returns { ... }       普通函数
+ *   - func (r *Repo) Name(params) returns { } 接收者方法（方法名=Name）
+ *   - 多行签名（平衡括号）、返回值类型 best-effort 记录
+ *   - 直接调用提取（obj.Method() 取 Method——与 C 成员调用同规则）
+ *   - 注释注解：// @progmune(namespace=..., pre=[...], post=[...])
+ *     + @purpose/@tags/@requires/@produces/@useWhen/@inputs/@outputs 文档标签
+ *   - exported = 首字母大写（Go 语言约定）
+ *
+ * Known limits（如实）:
+ *   - 接口方法/函数值分发静态不可见（interface 与 func 变量同 L3 边界）
+ *   - 泛型类型参数（func F[T any](...)）best-effort 剥除，不做完整解析
+ *   - 无数据流/指针分析——与 C 的 L3/L4 结论同源
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractIRGo = extractIRGo;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+// ── Constants ──
+const GO_EXTENSIONS = new Set([".go"]);
+/** Walk skip set（生产表面守卫，与 C/Python 提取器口径一致）。 */
+const SKIP_DIRS = new Set([
+    "vendor", "testdata", "test", "tests", "examples", "example", "docs",
+    "doc", "third_party", "node_modules", ".git", "scripts", "tools",
+]);
+/** Go 关键字/内置（调用提取时排除）。 */
+const GO_KEYWORDS = new Set([
+    "break", "case", "chan", "const", "continue", "default", "defer", "else",
+    "fallthrough", "for", "func", "go", "goto", "if", "import", "interface",
+    "map", "package", "range", "return", "select", "struct", "switch", "type",
+    "var", "append", "cap", "close", "complex", "copy", "delete", "imag",
+    "len", "make", "new", "panic", "print", "println", "real", "recover",
+]);
+function isTestFilename(name) {
+    return name.endsWith("_test.go");
+}
+function maskLine(line, state) {
+    let out = "";
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        const next = line[i + 1];
+        if (state.inBlock) {
+            if (ch === "*" && next === "/") {
+                state.inBlock = false;
+                i++;
+            }
+            out += " ";
+        }
+        else if (state.inString) {
+            if (ch === "\\") {
+                out += "  ";
+                i++;
+            }
+            else if (ch === '"') {
+                state.inString = false;
+                out += " ";
+            }
+            else
+                out += " ";
+        }
+        else if (state.inRaw) {
+            if (ch === "`") {
+                state.inRaw = false;
+                out += " ";
+            }
+            else
+                out += " ";
+        }
+        else if (state.inRune) {
+            if (ch === "\\") {
+                out += "  ";
+                i++;
+            }
+            else if (ch === "'") {
+                state.inRune = false;
+                out += " ";
+            }
+            else
+                out += " ";
+        }
+        else {
+            if (ch === "/" && next === "*") {
+                state.inBlock = true;
+                i++;
+                out += "  ";
+            }
+            else if (ch === "/" && next === "/") {
+                out += "  ";
+                break;
+            }
+            else if (ch === '"') {
+                state.inString = true;
+                out += " ";
+            }
+            else if (ch === "`") {
+                state.inRaw = true;
+                out += " ";
+            }
+            else if (ch === "'") {
+                state.inRune = true;
+                out += " ";
+            }
+            else
+                out += ch;
+        }
+    }
+    return out;
+}
+function parseGoAnnotation(text) {
+    const m = text.match(/@progmune\s*\(\s*([^)]*)\)/);
+    if (!m)
+        return null;
+    const body = m[1];
+    const ann = { pre_states: [], post_states: [] };
+    const ns = body.match(/namespace\s*=\s*"([^"]+)"/);
+    if (ns)
+        ann.namespace = ns[1];
+    const states = (key) => {
+        const mm = body.match(new RegExp(`${key}\\s*=\\s*\\[([^\\]]*)\\]`));
+        if (!mm)
+            return [];
+        const vals = mm[1].match(/"([^"]+)"/g) || [];
+        return vals.map((v) => v.slice(1, -1));
+    };
+    ann.pre_states = states("pre");
+    ann.post_states = states("post");
+    const inv = states("invalidate");
+    if (inv.length > 0)
+        ann.invalidate = inv;
+    return ann;
+}
+function docTag(text, tag) {
+    const m = text.match(new RegExp(`@${tag}\\s+([^\\n*]+)`));
+    return m ? m[1].trim() : undefined;
+}
+// ── 调用提取 ──
+function extractCallsFromBody(body) {
+    const calls = new Set();
+    const re = /([A-Za-z_][A-Za-z0-9_]*)\s*\(/g;
+    let m;
+    while ((m = re.exec(body)) !== null) {
+        const name = m[1];
+        if (GO_KEYWORDS.has(name))
+            continue;
+        if (GO_KEYWORDS.has(name))
+            continue;
+        calls.add(name);
+    }
+    return Array.from(calls);
+}
+// ── 顶层参数切分 ──
+function splitTopLevelParams(s) {
+    const parts = [];
+    let depth = 0;
+    let cur = "";
+    for (const ch of s) {
+        if (ch === "(" || ch === "[" || ch === "{")
+            depth++;
+        if (ch === ")" || ch === "]" || ch === "}")
+            depth--;
+        if (ch === "," && depth === 0) {
+            parts.push(cur.trim());
+            cur = "";
+        }
+        else
+            cur += ch;
+    }
+    if (cur.trim())
+        parts.push(cur.trim());
+    return parts.filter(Boolean);
+}
+// ── 单文件提取 ──
+function extractGoFile(filePath) {
+    let content;
+    try {
+        content = fs.readFileSync(filePath, "utf-8");
+    }
+    catch {
+        return [];
+    }
+    const lines = content.split("\n");
+    const functions = [];
+    for (let i = 0; i < lines.length; i++) {
+        // 函数定义行：func Name( 或 func (receiver) Name(
+        const plain = lines[i].match(/^\s*func\s+([A-Za-z_][A-Za-z0-9_]*)/);
+        const receiver = lines[i].match(/^\s*func\s*\([^)]*\)\s*([A-Za-z_][A-Za-z0-9_]*)/);
+        const name = plain ? plain[1] : receiver ? receiver[1] : null;
+        if (!name)
+            continue;
+        // 多行签名：从 func 起拼接直到找到 { 或 ;——遇到下一个 func 行即停
+        // （无函数体声明行如 `func runtime_args() []string // in package runtime`
+        // 不能吞掉紧随其后的函数定义——proc.go::Getuid 漏检根因）
+        let sigText = lines[i];
+        let j = i;
+        while (!sigText.includes("{") && !sigText.includes(";") && j < lines.length - 1) {
+            j++;
+            if (/^\s*func\b/.test(lines[j]) && j > i)
+                break;
+            sigText += "\n" + lines[j];
+        }
+        const braceIdx = sigText.indexOf("{");
+        if (braceIdx < 0)
+            continue; // 接口方法声明（无函数体）
+        const signature = sigText.slice(0, braceIdx);
+        // 注释块注解：函数定义行上方的连续注释（// 与 /* */）
+        const commentLines = [];
+        for (let k = i - 1; k >= 0; k--) {
+            const t = lines[k].trim();
+            if (t.startsWith("//") || t.startsWith("/*") || t.startsWith("*")) {
+                commentLines.unshift(t);
+            }
+            else if (t === "") {
+                if (commentLines.length === 0)
+                    continue;
+                break;
+            }
+            else {
+                break;
+            }
+        }
+        const commentText = commentLines.join("\n");
+        // 注解解析
+        let protocol;
+        const ann = parseGoAnnotation(commentText);
+        if (ann) {
+            protocol = {
+                pre_states: ann.pre_states,
+                post_states: ann.post_states,
+                ...(ann.invalidate ? { invalidate: ann.invalidate } : {}),
+                ...(ann.namespace ? { namespace: ann.namespace } : {}),
+            };
+        }
+        const purpose = docTag(commentText, "purpose");
+        const tags = docTag(commentText, "tags")?.split(/[,\s]+/).filter(Boolean);
+        const requires = docTag(commentText, "requires")?.split(/[,\s]+/).filter(Boolean);
+        const produces = docTag(commentText, "produces")?.split(/[,\s]+/).filter(Boolean);
+        const useWhen = docTag(commentText, "useWhen")?.split(/[,\s]+/).filter(Boolean);
+        // 参数列表：签名中第一个 ( ... )——接收者方法的 receiver 括号组要先跳过
+        // （bug 修复：func (s *Service) Login(...) 的 (s *Service) 曾被当作参数组，
+        // returnType 取到整个签名）
+        let sigAfterReceiver = signature;
+        if (receiver) {
+            let depth = 0;
+            for (let ci = signature.indexOf("("); ci < signature.length; ci++) {
+                if (signature[ci] === "(")
+                    depth++;
+                else if (signature[ci] === ")") {
+                    depth--;
+                    if (depth === 0) {
+                        sigAfterReceiver = signature.slice(ci + 1);
+                        break;
+                    }
+                }
+            }
+        }
+        const openParen = sigAfterReceiver.indexOf("(");
+        let closeParen = -1;
+        if (openParen >= 0) {
+            // 平衡括号匹配（参数可含 func 类型嵌套括号）
+            let depth = 0;
+            for (let ci = openParen; ci < sigAfterReceiver.length; ci++) {
+                if (sigAfterReceiver[ci] === "(")
+                    depth++;
+                else if (sigAfterReceiver[ci] === ")") {
+                    depth--;
+                    if (depth === 0) {
+                        closeParen = ci;
+                        break;
+                    }
+                }
+            }
+        }
+        let params = [];
+        if (openParen >= 0 && closeParen > openParen) {
+            params = splitTopLevelParams(sigAfterReceiver.slice(openParen + 1, closeParen));
+        }
+        // 返回类型：签名尾部（剥除泛型括号）
+        const returnType = sigAfterReceiver.slice(closeParen + 1).replace(/\[[^\]]*\]/g, "").trim();
+        // 函数体：从签名行（j）的 { 起逐行扫描到匹配 }（掩码后括号平衡，
+        // 增量计数——每行只数一次，避免累积体重复计数）
+        let body = "";
+        let depth = 0;
+        let started = false;
+        let endLine = j;
+        const bodyMask = { inBlock: false, inString: false, inRaw: false, inRune: false };
+        for (let li = j; li < lines.length; li++) {
+            const maskedLine = maskLine(lines[li], bodyMask);
+            if (!started) {
+                const b = maskedLine.indexOf("{");
+                if (b < 0)
+                    continue; // 多行签名的后续行还没到 {
+                started = true;
+                for (const ch of maskedLine.slice(b)) {
+                    if (ch === "{")
+                        depth++;
+                    else if (ch === "}")
+                        depth--;
+                }
+            }
+            else {
+                for (const ch of maskedLine) {
+                    if (ch === "{")
+                        depth++;
+                    else if (ch === "}")
+                        depth--;
+                }
+            }
+            body += lines[li] + "\n";
+            if (depth === 0) {
+                endLine = li;
+                break;
+            }
+        }
+        if (!started || depth !== 0)
+            continue;
+        // 调用提取（掩码态重置后重扫完整函数体）
+        const resetMask = { inBlock: false, inString: false, inRaw: false, inRune: false };
+        const maskedBody = body.split("\n").map((l) => maskLine(l, resetMask)).join("\n");
+        const calls = extractCallsFromBody(maskedBody).filter((c) => c !== name);
+        functions.push({
+            name,
+            file: filePath,
+            params: params.map((p) => ({ name: p.split(/[\s\[\]]/)[0] || p, type: p })),
+            returnType: returnType || "unknown",
+            calls,
+            exported: /^[A-Z]/.test(name),
+            tags: tags && tags.length > 0 ? tags : undefined,
+            ...(purpose ? { purpose } : {}),
+            ...(requires && requires.length > 0 ? { requires } : {}),
+            ...(produces && produces.length > 0 ? { produces } : {}),
+            ...(useWhen && useWhen.length > 0 ? { useWhen } : {}),
+            ...(protocol ? { protocol } : {}),
+        });
+        i = endLine; // 跳过已消费的行
+    }
+    return functions;
+}
+// ── 项目级入口（注册表调用） ──
+function collectGoFiles(root) {
+    const files = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (e.isSymbolicLink())
+                continue;
+            const full = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                if (SKIP_DIRS.has(e.name))
+                    continue;
+                walk(full);
+            }
+            else if (GO_EXTENSIONS.has(path.extname(e.name)) && !isTestFilename(e.name)) {
+                files.push(full);
+            }
+        }
+    };
+    walk(root);
+    return files;
+}
+function extractIRGo(projectRoot) {
+    const files = collectGoFiles(projectRoot);
+    const all = [];
+    for (const file of files) {
+        for (const fn of extractGoFile(file)) {
+            fn.file = path.relative(projectRoot, fn.file);
+            all.push(fn);
+        }
+    }
+    return all;
+}

package/dist/extract-ir-go.test.js

@@ -0,0 +1,196 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * extract-ir-go.test.ts — Go IR 提取器回归（临时目录夹具）
+ *
+ * 纯 TS 词法提取（与 C 提取器同哲学）：函数签名（多行/接收者方法）、
+ * 调用（obj.Method() 取 Method）、注释注解 @progmune + 文档标签、
+ * exported=首字母大写、非生产表面过滤。
+ */
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const extract_ir_go_1 = require("./extract-ir-go");
+let dir;
+(0, vitest_1.beforeEach)(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), "go-ir-"));
+});
+(0, vitest_1.afterEach)(() => {
+    fs.rmSync(dir, { recursive: true, force: true });
+});
+function write(rel, content) {
+    const full = path.join(dir, rel);
+    fs.mkdirSync(path.dirname(full), { recursive: true });
+    fs.writeFileSync(full, content);
+}
+(0, vitest_1.describe)("extract-ir-go", () => {
+    (0, vitest_1.it)("普通函数 + 调用提取（含 obj.Method() 成员调用）", () => {
+        write("main.go", `
+package main
+
+func doWork() {
+	helper()
+	obj.Save()
+}
+
+func helper() {}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        const doWork = ir.find((f) => f.name === "doWork");
+        (0, vitest_1.expect)(doWork?.calls).toEqual(vitest_1.expect.arrayContaining(["helper", "Save"]));
+    });
+    (0, vitest_1.it)("接收者方法（func (r *Repo) Name）", () => {
+        write("repo.go", `
+package main
+
+func (r *Repo) SaveUser(u User) error {
+	return nil
+}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        (0, vitest_1.expect)(ir.some((f) => f.name === "SaveUser")).toBe(true);
+        (0, vitest_1.expect)(ir.find((f) => f.name === "SaveUser")?.exported).toBe(true);
+    });
+    (0, vitest_1.it)("接收者方法 returnType 与参数正确（receiver 括号组不被误取——回归）", () => {
+        write("svc.go", `
+package main
+
+func (s *Service) Login(ctx Context, user, password string) (Token, error) {
+	return Token{}, nil
+}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        const fn = ir.find((f) => f.name === "Login");
+        (0, vitest_1.expect)(fn?.returnType).toBe("(Token, error)");
+        // Go 语义：ctx / user / password 是 3 个参数（user 与 password 共享类型）
+        (0, vitest_1.expect)(fn?.params).toHaveLength(3);
+        (0, vitest_1.expect)(fn?.params[0].type).toContain("ctx");
+        (0, vitest_1.expect)(fn?.params[1].type).toContain("user");
+        (0, vitest_1.expect)(fn?.params[2].type).toContain("string");
+    });
+    (0, vitest_1.it)("多行签名 + 返回类型", () => {
+        write("multi.go", `
+package main
+
+func Process(
+	name string,
+	count int,
+) (string, error) {
+	return name, nil
+}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        const fn = ir.find((f) => f.name === "Process");
+        (0, vitest_1.expect)(fn).toBeTruthy();
+        (0, vitest_1.expect)(fn?.returnType).toContain("string");
+    });
+    (0, vitest_1.it)("注释注解 @progmune + 文档标签", () => {
+        write("auth.go", `
+package main
+
+// @progmune(namespace="auth", pre=["UNAUTHENTICATED"], post=["PASSWORD_VERIFIED"])
+// @purpose 凭证比对
+// @tags auth
+func VerifyPassword(user, password string) bool {
+	return password == "secret"
+}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        const fn = ir.find((f) => f.name === "VerifyPassword");
+        (0, vitest_1.expect)(fn?.protocol?.pre_states).toEqual(["UNAUTHENTICATED"]);
+        (0, vitest_1.expect)(fn?.protocol?.post_states).toEqual(["PASSWORD_VERIFIED"]);
+        (0, vitest_1.expect)(fn?.protocol?.namespace).toBe("auth");
+        (0, vitest_1.expect)(fn?.purpose).toBe("凭证比对");
+        (0, vitest_1.expect)(fn?.tags).toContain("auth");
+        (0, vitest_1.expect)(fn?.exported).toBe(true);
+    });
+    (0, vitest_1.it)("接口方法声明（无函数体）不提取", () => {
+        write("iface.go", `
+package main
+
+type Store interface {
+	Save(u User) error
+}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        (0, vitest_1.expect)(ir.some((f) => f.name === "Save")).toBe(false);
+    });
+    (0, vitest_1.it)("字符串/注释里的伪调用不提取", () => {
+        write("str.go", `
+package main
+
+func tricky() {
+	s := "notAFunction() inside string"
+	// notAFunction() in comment
+	realCall()
+}
+
+func realCall() {}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        const fn = ir.find((f) => f.name === "tricky");
+        (0, vitest_1.expect)(fn?.calls).toContain("realCall");
+        (0, vitest_1.expect)(fn?.calls).not.toContain("notAFunction");
+    });
+    (0, vitest_1.it)("非生产表面过滤：vendor/testdata/测试文件跳过", () => {
+        write("main.go", `package main\nfunc Keep() {}\n`);
+        write("vendor/dep.go", `package dep\nfunc SkipVendor() {}\n`);
+        write("testdata/sample.go", `package sample\nfunc SkipTestdata() {}\n`);
+        write("x_test.go", `package main\nfunc SkipTest() {}\n`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        (0, vitest_1.expect)(ir.map((f) => f.name)).toEqual(["Keep"]);
+    });
+    (0, vitest_1.it)("Go 关键字不提取为调用（for/if/go/defer 等）", () => {
+        write("ctrl.go", `
+package main
+
+func run() {
+	for i := 0; i < 3; i++ {
+		go step(i)
+		defer cleanup()
+	}
+}
+
+func step(i int) {}
+func cleanup() {}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        const fn = ir.find((f) => f.name === "run");
+        (0, vitest_1.expect)(fn?.calls).toEqual(vitest_1.expect.arrayContaining(["step", "cleanup"]));
+        (0, vitest_1.expect)(fn?.calls).not.toEqual(vitest_1.expect.arrayContaining(["for", "go", "defer", "if"]));
+    });
+});

package/dist/extract-project-ir.js

@@ -54,6 +54,7 @@ const path = __importStar(require("path"));
 const extract_ir_1 = require("./extract-ir");
 const extract_ir_python_1 = require("./extract-ir-python");
 const extract_ir_c_1 = require("./extract-ir-c");
+const extract_ir_go_1 = require("./extract-ir-go");
 const SKIP_DIRS = new Set([
     "node_modules", "dist", "build", ".git", ".progmune_corpus",
     "__pycache__", "venv", ".venv",
@@ -105,6 +106,11 @@ exports.LANGUAGE_EXTRACTORS = [
         detect: (p) => hasSourceFiles(p, new Set([".c", ".h"])),
         extract: (p) => (0, extract_ir_c_1.extractIRC)(p),
     },
+    {
+        language: "go",
+        detect: (p) => hasSourceFiles(p, new Set([".go"])),
+        extract: (p) => (0, extract_ir_go_1.extractIRGo)(p),
+    },
 ];
 /** 项目检测到的语言列表（审计/标签用）。 */
 function detectLanguages(projectRoot) {

package/dist/frameworks/fiber-detector.js

@@ -0,0 +1,125 @@
+"use strict";
+/**
+ * Fiber Framework Adapter — Protocol Detection for Fiber (Go)
+ *
+ * 第 12 个框架适配（Go 第 2 个，代码串级——Fiber 路由与 Express 同构）：
+ *
+ *   app.Post("/x", authMW, handler)     路由级认证中间件链
+ *   app.Use(authMW) / group.Use(authMW) 全局/组级认证中间件
+ *
+ * 规则：
+ *   FIBER_ROUTE_NO_AUTH       mutation 路由（post/put/patch/delete）中间件
+ *                             链无认证名中间件，且文件内无认证 Use 中间件
+ *
+ * 口径（如实）：
+ *   - get 读操作不检查；认证入口路径词汇豁免（login/regist/auth/token）
+ *   - 认证中间件按名字词表识别（auth/jwt/login/permission/token/session/
+ *     verify/guard/passport）
+ *   - 文件级窗口（与 Express/Koa 检测器同款）
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeFiberApp = analyzeFiberApp;
+exports.analyzeFiberFile = analyzeFiberFile;
+const fs = __importStar(require("fs"));
+const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health",
+];
+const AUTH_FN_WORDS = [
+    "auth", "login", "permission", "token", "credential", "session",
+    "jwt", "verify", "guard", "protect", "passport",
+];
+function isAuthEntryPath(pathName) {
+    const lower = pathName.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
+}
+function isAuthFnName(name) {
+    const lower = name.toLowerCase();
+    return AUTH_FN_WORDS.some((w) => lower.includes(w));
+}
+// ── Analysis（代码串级） ──
+function analyzeFiberApp(code) {
+    const issues = [];
+    const routes = [];
+    const authMiddleware = [];
+    const hasFiber = /fiber\.New\(|"github.com\/gofiber\/fiber/.test(code);
+    if (!hasFiber) {
+        return { hasFiber: false, routes, authMiddleware, issues };
+    }
+    // 全局/组级认证中间件：app.Use(authMW) / group.Use(authMW)
+    const useRe = /\.Use\s*\(\s*([A-Za-z_][\w]*)/g;
+    let m;
+    while ((m = useRe.exec(code)) !== null) {
+        if (isAuthFnName(m[1]))
+            authMiddleware.push(m[1]);
+    }
+    // 路由注册：app.Post("/x", mw1, mw2, handler)——Go 方法名大写（Post 惯例）
+    const routeRe = /\.(get|post|put|patch|delete)\s*\(\s*"([^"]+)"/gi;
+    while ((m = routeRe.exec(code)) !== null) {
+        const method = m[1].toLowerCase();
+        const pathName = m[2];
+        const window = code.slice(m.index + m[0].length, m.index + m[0].length + 300);
+        const mwNames = window.match(/[A-Za-z_][\w]*/g) || [];
+        const hasAuthMw = mwNames.some((name) => isAuthFnName(name));
+        routes.push({
+            method,
+            path: pathName,
+            protected: hasAuthMw,
+            line: code.slice(0, m.index).split("\n").length,
+        });
+        if (MUTATION_METHODS.has(method) && !hasAuthMw
+            && authMiddleware.length === 0 && !isAuthEntryPath(pathName)) {
+            issues.push({
+                severity: "medium",
+                rule: "FIBER_ROUTE_NO_AUTH",
+                message: `Route ${method.toUpperCase()} ${pathName} has no auth middleware ` +
+                    `and no auth Use middleware — any caller can reach it.`,
+                route: `${method.toUpperCase()} ${pathName}`,
+                line: code.slice(0, m.index).split("\n").length,
+            });
+        }
+    }
+    return { hasFiber: true, routes, authMiddleware, issues };
+}
+function analyzeFiberFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    const code = fs.readFileSync(filePath, "utf-8");
+    if (!/gofiber|fiber\.New\(/.test(code))
+        return null;
+    return analyzeFiberApp(code);
+}

package/dist/frameworks/fiber-detector.test.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * fiber-detector.test.ts — Fiber 框架适配器规则回归（纯函数，无文件 I/O）
+ */
+const vitest_1 = require("vitest");
+const fiber_detector_1 = require("./fiber-detector");
+const app = (routes, extra = "") => `
+import "github.com/gofiber/fiber/v2"
+
+func main() {
+	app := fiber.New()
+	${extra}
+	${routes}
+}
+`;
+(0, vitest_1.describe)("fiber-detector", () => {
+    (0, vitest_1.it)("R1：无认证中间件的 mutation 路由 → FIBER_ROUTE_NO_AUTH", () => {
+        const { issues } = (0, fiber_detector_1.analyzeFiberApp)(app(`
+	app.Post("/transfer", func(c *fiber.Ctx) error { return nil })
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("FIBER_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：路由级认证中间件保护不报", () => {
+        const { issues } = (0, fiber_detector_1.analyzeFiberApp)(app(`
+	app.Post("/transfer", authMiddleware, func(c *fiber.Ctx) error { return nil })
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：全局 Use 认证中间件保护不报", () => {
+        const { issues } = (0, fiber_detector_1.analyzeFiberApp)(app(`app.Post("/transfer", func(c *fiber.Ctx) error { return nil })`, `app.Use(authMiddleware)`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：非认证中间件不视为保护", () => {
+        const { issues } = (0, fiber_detector_1.analyzeFiberApp)(app(`
+	app.Post("/transfer", logger, func(c *fiber.Ctx) error { return nil })
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("FIBER_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：GET 读操作不报", () => {
+        const { issues } = (0, fiber_detector_1.analyzeFiberApp)(app(`
+	app.Get("/articles", func(c *fiber.Ctx) error { return nil })
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login 认证入口路径不报", () => {
+        const { issues } = (0, fiber_detector_1.analyzeFiberApp)(app(`
+	app.Post("/login", func(c *fiber.Ctx) error { return nil })
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("非 Fiber 代码不产生任何问题", () => {
+        const { hasFiber, issues } = (0, fiber_detector_1.analyzeFiberApp)(`import express from "express";`);
+        (0, vitest_1.expect)(hasFiber).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/frameworks/gin-detector.js

@@ -0,0 +1,133 @@
+"use strict";
+/**
+ * Gin Framework Adapter — Protocol Detection for Gin (Go)
+ *
+ * 第 11 个框架适配（Go 第 1 个，代码串级——Go 路由注册与 Koa/Express 同构）：
+ *
+ *   r.POST("/x", authMW, handler)        路由级认证中间件链
+ *   r.Use(authMW) / r.Group("/api", mw)  组级认证中间件
+ *
+ * 规则：
+ *   GIN_ROUTE_NO_AUTH        mutation 路由（post/put/patch/delete）中间件
+ *                            链无认证名中间件，且文件内无认证 Use/Group
+ *                            中间件——路由级 missing-auth
+ *
+ * 口径（如实）：
+ *   - get 读操作不检查；认证入口路径词汇豁免（login/regist/auth/token）
+ *   - 认证中间件按名字词表识别（auth/jwt/login/permission/token/session/
+ *     verify/guard/passport）
+ *   - 文件级窗口（与 Express/Koa 检测器同款）
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeGinApp = analyzeGinApp;
+exports.analyzeGinFile = analyzeGinFile;
+const fs = __importStar(require("fs"));
+const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health",
+];
+const AUTH_FN_WORDS = [
+    "auth", "login", "permission", "token", "credential", "session",
+    "jwt", "verify", "guard", "protect", "passport",
+];
+function isAuthEntryPath(pathName) {
+    const lower = pathName.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
+}
+function isAuthFnName(name) {
+    const lower = name.toLowerCase();
+    // 注意：不含 "middleware" 词——loggerMiddleware 等工具中间件不该撞认证
+    // （authMiddleware 类靠 "auth" 命中）
+    return AUTH_FN_WORDS.some((w) => lower.includes(w));
+}
+// ── Analysis（代码串级） ──
+function analyzeGinApp(code) {
+    const issues = [];
+    const routes = [];
+    const authGroupMiddleware = [];
+    const hasGin = /gin\.(Default|New)\(|"github.com\/gin-gonic\/gin"/.test(code);
+    if (!hasGin) {
+        return { hasGin: false, routes, authGroupMiddleware, issues };
+    }
+    // 组级认证中间件：r.Use(authMW) / r.Group("/api", authMW) / g.Use(authMW)
+    const useRe = /\.Use\s*\(\s*([A-Za-z_][\w]*)/g;
+    let m;
+    while ((m = useRe.exec(code)) !== null) {
+        if (isAuthFnName(m[1]))
+            authGroupMiddleware.push(m[1]);
+    }
+    const groupRe = /\.Group\s*\(\s*"[^"]*"\s*,\s*([A-Za-z_][\w]*)/g;
+    while ((m = groupRe.exec(code)) !== null) {
+        if (isAuthFnName(m[1]))
+            authGroupMiddleware.push(m[1]);
+    }
+    // 路由注册：r.POST("/x", mw1, mw2, handler)——Go 方法名大写（POST 惯例）
+    const routeRe = /\.(get|post|put|patch|delete)\s*\(\s*"([^"]+)"/gi;
+    while ((m = routeRe.exec(code)) !== null) {
+        const method = m[1].toLowerCase();
+        const pathName = m[2];
+        const window = code.slice(m.index + m[0].length, m.index + m[0].length + 300);
+        const mwNames = window.match(/[A-Za-z_][\w]*/g) || [];
+        const hasAuthMw = mwNames.some((name) => isAuthFnName(name));
+        routes.push({
+            method,
+            path: pathName,
+            protected: hasAuthMw,
+            line: code.slice(0, m.index).split("\n").length,
+        });
+        if (MUTATION_METHODS.has(method) && !hasAuthMw
+            && authGroupMiddleware.length === 0 && !isAuthEntryPath(pathName)) {
+            issues.push({
+                severity: "medium",
+                rule: "GIN_ROUTE_NO_AUTH",
+                message: `Route ${method.toUpperCase()} ${pathName} has no auth middleware ` +
+                    `and no auth Use/Group middleware — any caller can reach it.`,
+                route: `${method.toUpperCase()} ${pathName}`,
+                line: code.slice(0, m.index).split("\n").length,
+            });
+        }
+    }
+    return { hasGin: true, routes, authGroupMiddleware, issues };
+}
+function analyzeGinFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    const code = fs.readFileSync(filePath, "utf-8");
+    if (!/gin-gonic|gin\.(Default|New)\(/.test(code))
+        return null;
+    return analyzeGinApp(code);
+}

package/dist/frameworks/gin-detector.test.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * gin-detector.test.ts — Gin 框架适配器规则回归（纯函数，无文件 I/O）
+ */
+const vitest_1 = require("vitest");
+const gin_detector_1 = require("./gin-detector");
+const app = (routes, extra = "") => `
+import "github.com/gin-gonic/gin"
+
+func main() {
+	r := gin.Default()
+	${extra}
+	${routes}
+}
+`;
+(0, vitest_1.describe)("gin-detector", () => {
+    (0, vitest_1.it)("R1：无认证中间件的 mutation 路由 → GIN_ROUTE_NO_AUTH", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	r.POST("/transfer", func(c *gin.Context) {})
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("GIN_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：路由级认证中间件保护不报", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	r.POST("/transfer", authMiddleware, func(c *gin.Context) {})
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：组级 Use 认证中间件保护不报", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`r.POST("/transfer", func(c *gin.Context) {})`, `r.Use(authMiddleware)`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：Group 认证中间件保护不报", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	api := r.Group("/api", authMiddleware)
+	api.POST("/transfer", func(c *gin.Context) {})
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：非认证中间件（logger）不视为保护", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	r.POST("/transfer", loggerMiddleware, func(c *gin.Context) {})
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("GIN_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：GET 读操作不报", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	r.GET("/articles", func(c *gin.Context) {})
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login 认证入口路径不报", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	r.POST("/login", func(c *gin.Context) {})
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("非 Gin 代码不产生任何问题", () => {
+        const { hasGin, issues } = (0, gin_detector_1.analyzeGinApp)(`import express from "express";`);
+        (0, vitest_1.expect)(hasGin).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/frameworks/index.js

@@ -12,7 +12,7 @@
  * Next.js (App Router) — 7 dedicated detectors.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateVersionAwarenessReport = exports.checkFileRename = exports.checkFrameworkConventions = exports.detectFrameworks = exports.analyzeNestJSFile = exports.analyzeNestJSProject = exports.analyzeHapiFile = exports.analyzeHapiApp = exports.analyzeKoaFile = exports.analyzeKoaApp = exports.readNextMiddleware = exports.analyzeNextApp = exports.analyzeFastifyFile = exports.analyzeFastifyApp = exports.analyzeFlaskStructure = exports.analyzeDjangoStructure = exports.analyzeFastapiStructure = exports.formatExpressReport = exports.classifyMiddleware = exports.extractGlobalMiddleware = exports.extractRoutes = exports.detectExpressApp = exports.analyzeExpressProject = exports.analyzeExpressFile = exports.analyzeExpressApp = void 0;
+exports.generateVersionAwarenessReport = exports.checkFileRename = exports.checkFrameworkConventions = exports.detectFrameworks = exports.analyzeNestJSFile = exports.analyzeNestJSProject = exports.analyzeFiberFile = exports.analyzeFiberApp = exports.analyzeGinFile = exports.analyzeGinApp = exports.analyzeHapiFile = exports.analyzeHapiApp = exports.analyzeKoaFile = exports.analyzeKoaApp = exports.readNextMiddleware = exports.analyzeNextApp = exports.analyzeFastifyFile = exports.analyzeFastifyApp = exports.analyzeFlaskStructure = exports.analyzeDjangoStructure = exports.analyzeFastapiStructure = exports.formatExpressReport = exports.classifyMiddleware = exports.extractGlobalMiddleware = exports.extractRoutes = exports.detectExpressApp = exports.analyzeExpressProject = exports.analyzeExpressFile = exports.analyzeExpressApp = void 0;
 var express_detector_1 = require("./express-detector");
 Object.defineProperty(exports, "analyzeExpressApp", { enumerable: true, get: function () { return express_detector_1.analyzeExpressApp; } });
 Object.defineProperty(exports, "analyzeExpressFile", { enumerable: true, get: function () { return express_detector_1.analyzeExpressFile; } });
@@ -40,6 +40,12 @@ Object.defineProperty(exports, "analyzeKoaFile", { enumerable: true, get: functi
 var hapi_detector_1 = require("./hapi-detector");
 Object.defineProperty(exports, "analyzeHapiApp", { enumerable: true, get: function () { return hapi_detector_1.analyzeHapiApp; } });
 Object.defineProperty(exports, "analyzeHapiFile", { enumerable: true, get: function () { return hapi_detector_1.analyzeHapiFile; } });
+var gin_detector_1 = require("./gin-detector");
+Object.defineProperty(exports, "analyzeGinApp", { enumerable: true, get: function () { return gin_detector_1.analyzeGinApp; } });
+Object.defineProperty(exports, "analyzeGinFile", { enumerable: true, get: function () { return gin_detector_1.analyzeGinFile; } });
+var fiber_detector_1 = require("./fiber-detector");
+Object.defineProperty(exports, "analyzeFiberApp", { enumerable: true, get: function () { return fiber_detector_1.analyzeFiberApp; } });
+Object.defineProperty(exports, "analyzeFiberFile", { enumerable: true, get: function () { return fiber_detector_1.analyzeFiberFile; } });
 var nestjs_detector_1 = require("./nestjs-detector");
 Object.defineProperty(exports, "analyzeNestJSProject", { enumerable: true, get: function () { return nestjs_detector_1.analyzeNestJSProject; } });
 Object.defineProperty(exports, "analyzeNestJSFile", { enumerable: true, get: function () { return nestjs_detector_1.analyzeNestJSFile; } });

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.12";
+exports.RUNTIME_VERSION = "3.7.14";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -69,11 +69,14 @@ const fastify_detector_1 = require("../frameworks/fastify-detector");
 const nextjs_detector_1 = require("../frameworks/nextjs-detector");
 const koa_detector_1 = require("../frameworks/koa-detector");
 const hapi_detector_1 = require("../frameworks/hapi-detector");
+const gin_detector_1 = require("../frameworks/gin-detector");
+const fiber_detector_1 = require("../frameworks/fiber-detector");
 const ssg_bridge_1 = require("./ssg-bridge");
 const call_sequence_1 = require("../call-sequence");
 const extract_ir_1 = require("../extract-ir");
 const extract_ir_python_1 = require("../extract-ir-python");
 const extract_ir_c_1 = require("../extract-ir-c");
+const extract_ir_go_1 = require("../extract-ir-go");
 // ── Main Entry Point ──
 /**
  * Trust 决策主入口：收集 → 归一化 → 评分 → 决策 → 组装。
@@ -106,6 +109,8 @@ async function evaluateTrust(ctx) {
     const nextjsResult = collectNextjsViolations(ctx);
     const koaResult = collectKoaViolations(ctx);
     const hapiResult = collectHapiViolations(ctx);
+    const ginResult = collectGinViolations(ctx);
+    const fiberResult = collectFiberViolations(ctx);
     const coverageData = collectVerificationCoverage(ctx);
     const governanceDefects = collectGovernanceDefects(ctx);
     // ═══════════════════════════════════════
@@ -130,6 +135,8 @@ async function evaluateTrust(ctx) {
         ...nextjsResult.violations,
         ...koaResult.violations,
         ...hapiResult.violations,
+        ...ginResult.violations,
+        ...fiberResult.violations,
     ];
     // ═══════════════════════════════════════
     //  PHASE 3: SCORE
@@ -312,6 +319,24 @@ async function evaluateTrust(ctx) {
                     issuesFound: hapiResult.violations.length,
                 }
                 : undefined,
+            /** Gin framework adapter coverage — Go route/auth-middleware analysis */
+            ginCoverage: ginResult.coverage.routes > 0
+                ? {
+                    appsDetected: ginResult.coverage.apps,
+                    totalRoutes: ginResult.coverage.routes,
+                    filesScanned: ginResult.coverage.filesScanned,
+                    issuesFound: ginResult.violations.length,
+                }
+                : undefined,
+            /** Fiber framework adapter coverage — Go route/auth-middleware analysis */
+            fiberCoverage: fiberResult.coverage.routes > 0
+                ? {
+                    appsDetected: fiberResult.coverage.apps,
+                    totalRoutes: fiberResult.coverage.routes,
+                    filesScanned: fiberResult.coverage.filesScanned,
+                    issuesFound: fiberResult.violations.length,
+                }
+                : undefined,
         },
         dimensions: {
             policyCompliance: {
@@ -450,6 +475,70 @@ function mapPolicyViolation(rv, filePath, _enterprisePolicy) {
  * Collect Express-specific security violations from the framework detector.
  * Maps ExpressSecurityIssue[] → TrustViolation[].
  */
+function collectGoFrameworkViolations(ctx, analyzer, rulePrefix, fixText, policyRef) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    try {
+        const fs = require("fs");
+        // Go 项目结构特殊：cmd/internal/pkg + 根目录 main.go 都要扫
+        const candidateDirs = ["cmd", "internal", "pkg", "src", "server", "app", "api", "routes", "lib", "handlers", "middleware"];
+        const extensions = languageToExtensions(ctx.language);
+        const files = [];
+        for (const dir of candidateDirs) {
+            const dirPath = path.join(ctx.projectPath, dir);
+            if (!fs.existsSync(dirPath))
+                continue;
+            try {
+                files.push(...walkDir(dirPath, extensions, 100));
+            }
+            catch { /* skip */ }
+        }
+        try {
+            for (const entry of fs.readdirSync(ctx.projectPath)) {
+                const full = path.join(ctx.projectPath, entry);
+                if (!fs.statSync(full).isFile())
+                    continue;
+                if (extensions.some((ext) => entry.endsWith(ext)))
+                    files.push(full);
+            }
+        }
+        catch { /* best-effort */ }
+        for (const file of files) {
+            if (file.includes("_test."))
+                continue;
+            coverage.filesScanned++;
+            try {
+                const analysis = analyzer(file);
+                if (!analysis || !analysis[`has${rulePrefix}`])
+                    continue;
+                coverage.apps++;
+                coverage.routes += analysis.routes.length;
+                for (const issue of analysis.issues) {
+                    violations.push({
+                        severity: issue.severity === "low" ? "low" : issue.severity,
+                        rule_id: issue.rule,
+                        file: path.relative(ctx.projectPath, file),
+                        function: "unknown",
+                        message: issue.message,
+                        evidence: issue.route || "",
+                        why: `Framework structural analysis: ${issue.message}`,
+                        fix: fixText,
+                        policy_ref: policyRef,
+                    });
+                }
+            }
+            catch { /* skip unreadable files */ }
+        }
+    }
+    catch { /* best-effort */ }
+    return { violations, coverage };
+}
+function collectGinViolations(ctx) {
+    return collectGoFrameworkViolations(ctx, gin_detector_1.analyzeGinFile, "Gin", "Add an auth middleware to the route registration, or register auth middleware with r.Use/r.Group.", "framework-safety.gin");
+}
+function collectFiberViolations(ctx) {
+    return collectGoFrameworkViolations(ctx, fiber_detector_1.analyzeFiberFile, "Fiber", "Add an auth middleware to the route registration, or register auth middleware with app.Use.", "framework-safety.fiber");
+}
 function collectKoaViolations(ctx) {
     const violations = [];
     const coverage = { apps: 0, routes: 0, filesScanned: 0 };
@@ -1121,6 +1210,7 @@ async function collectProtocolViolations(ctx, callGraph) {
                 javascript: () => (0, extract_ir_1.extractIR)(ctx.projectPath),
                 python: () => (0, extract_ir_python_1.extractIRPython)(ctx.projectPath),
                 c: () => (0, extract_ir_c_1.extractIRC)(ctx.projectPath),
+                go: () => (0, extract_ir_go_1.extractIRGo)(ctx.projectPath),
             };
             const extractFn = autoExtractor[lang];
             if (extractFn) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.12",
+  "version": "3.7.14",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",