progmune-runtime 3.7.21 → 3.7.23

package/dist/policy/engine.js

@@ -46,6 +46,10 @@ exports.loadEnterprisePolicyConfig = loadEnterprisePolicyConfig;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const types_1 = require("./types");
+// 静态导入（vitest 环境下 lazy require 的 CJS 互操作不可靠——engine.ts
+// 同款陷阱，2026-08-27 DSH 修复先例；两模块无环，静态导入安全）
+const risk_model_1 = require("../risk-model");
+const protocol_knowledge_1 = require("../protocol-knowledge");
 function confidenceToNumber(c) {
     if (c === "high")
         return 2;
@@ -93,8 +97,39 @@ function loadPolicyConfig(projectPath, configPath) {
         return { rules: merged, source: cfgFile };
     }
     catch (e) {
-        console.error(`⚠️  Failed to load policy config: ${e.message}. Using defaults.`);
-        return { rules: [...types_1.DEFAULT_POLICY], source: "built-in defaults (config error)" };
+        // 审计修复（fail-closed 信号）：解析失败不再静默回退——显式携带
+        // configError，由调用方（policy CLI / MCP）决定拒绝评估并报错
+        console.error(`⚠️  Failed to load policy config: ${e.message}.`);
+        return {
+            rules: [...types_1.DEFAULT_POLICY],
+            source: "built-in defaults (config error)",
+            configError: `Failed to parse ${cfgFile}: ${e.message}`,
+        };
+    }
+}
+/** 真实调用提取（certificate.file 的 best-effort 词法扫描，供 risk 规则
+ *  使用——不伪造输入；读不到文件时返回空数组，由调用方按 fail-closed
+ *  计为违规） */
+function extractCallsBestEffort(file) {
+    if (!file)
+        return [];
+    try {
+        const fs = require("fs");
+        const code = fs.readFileSync(file, "utf-8");
+        const calls = [];
+        const re = /(?<=^|[^\w$])([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\s*\(/g;
+        let m;
+        while ((m = re.exec(code)) !== null) {
+            const seg = m[1].split(".").pop() || "";
+            if (/^(if|for|while|switch|catch|return|new|case|do|super|this)$/.test(seg))
+                continue;
+            if (calls.length < 200 && !calls.includes(seg))
+                calls.push(seg);
+        }
+        return calls;
+    }
+    catch {
+        return [];
     }
 }
 function evaluatePolicy(ctx, rules) {
@@ -177,24 +212,44 @@ function evaluatePolicy(ctx, rules) {
                 const minSeverity = rule.threshold ?? 2;
                 const minConfidence = rule.require ?? 70;
                 try {
-                    const { assessRisk } = require("../risk-model");
-                    // Extract call sequence from file (best-effort)
-                    const calls = ctx.certificate.validated ? [] : ["SSL_CTX_new", "SSL_connect"]; // fallback
-                    const risk = assessRisk(calls.length > 0 ? calls : ["init", "connect"]);
-                    const criticalOrHigh = risk.patterns.filter((p) => {
-                        const sevOrder = ["Low", "Medium", "High", "Critical"];
-                        return sevOrder.indexOf(p.severity) >= minSeverity && p.confidence >= minConfidence;
-                    });
-                    if (criticalOrHigh.length > 0) {
+                    // 真实调用提取（certificate.file 的 best-effort 词法扫描）——
+                    // 审计修复（Kimi 2026-09-06）：不再伪造 ["SSL_CTX_new","SSL_connect"]
+                    // 假输入喂评估；输入不可得时按 fail-closed 计为违规
+                    const calls = extractCallsBestEffort(ctx.certificate.file);
+                    if (calls.length === 0) {
                         violations.push({
                             rule,
-                            actual: `${criticalOrHigh.length} risk pattern(s) ≥ severity threshold`,
-                            expected: `0 patterns at this severity+confidence level`,
-                            detail: criticalOrHigh.map((p) => `${p.patternName} (${p.severity}, ${p.confidence}%): ${p.detail}`).join("; "),
+                            actual: "no call data extractable from certificate file",
+                            expected: "risk assessment over real call sequence",
+                            detail: "risk rule requires a readable file with calls; unavailable input is a violation (fail-closed)",
+                        });
+                    }
+                    else {
+                        const risk = (0, risk_model_1.assessRisk)(calls);
+                        const criticalOrHigh = risk.patterns.filter((p) => {
+                            const sevOrder = ["Low", "Medium", "High", "Critical"];
+                            return sevOrder.indexOf(p.severity) >= minSeverity && p.confidence >= minConfidence;
                         });
+                        if (criticalOrHigh.length > 0) {
+                            violations.push({
+                                rule,
+                                actual: `${criticalOrHigh.length} risk pattern(s) ≥ severity threshold`,
+                                expected: `0 patterns at this severity+confidence level`,
+                                detail: criticalOrHigh.map((p) => `${p.patternName} (${p.severity}, ${p.confidence}%): ${p.detail}`).join("; "),
+                            });
+                        }
                     }
                 }
-                catch { /* risk model unavailable */ }
+                catch {
+                    // fail-closed：risk model 不可用 → 显式违规，而非静默跳过
+                    // （审计修复：原空 catch 使整条规则无声失效）
+                    violations.push({
+                        rule,
+                        actual: "risk model unavailable",
+                        expected: "risk assessment completed",
+                        detail: "risk-model module failed to load — failing closed (explicit violation)",
+                    });
+                }
                 break;
             }
             // ── Knowledge Base Coverage ──
@@ -202,11 +257,20 @@ function evaluatePolicy(ctx, rules) {
                 const minStable = rule.threshold ?? 3;
                 let stableCount = 0;
                 try {
-                    const { buildKnowledgeBase } = require("../protocol-knowledge");
-                    const kb = buildKnowledgeBase();
+                    const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();
                     stableCount = kb.units.filter((u) => u.maturity === "stable").length;
                 }
-                catch { /* KB unavailable */ }
+                catch {
+                    // fail-closed 显式化（审计修复）：原空 catch 后 stableCount=0 恰好
+                    // 触发违规，但消息误导为「0 stable assets」——改为明确的不可用违规
+                    violations.push({
+                        rule,
+                        actual: "knowledge base unavailable",
+                        expected: `>= ${minStable} stable assets`,
+                        detail: "protocol-knowledge module failed to load — failing closed (explicit violation)",
+                    });
+                    break;
+                }
                 if (stableCount < minStable) {
                     violations.push({
                         rule,

package/dist/policy/engine.test.js

@@ -0,0 +1,135 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * policy/engine.test.ts — 策略引擎 fail-closed 回归（审计修复 2026-09-06）
+ *
+ * 锁定 Kimi 审计的三条修复：
+ * 1. risk 规则不再伪造 ["SSL_CTX_new","SSL_connect"] 输入——无真实调用
+ *    数据时按 fail-closed 计违规
+ * 2. 配置解析失败显式携带 configError（不再静默回退默认）
+ * 3. execute 写盘策略门：项目 opt-in（.progmune-policy.json）时 BLOCK
+ *    回滚写盘；未配置时无操作
+ */
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const engine_1 = require("./engine");
+const execute_1 = require("../execute");
+let dir;
+(0, vitest_1.beforeEach)(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-policy-")); });
+(0, vitest_1.afterEach)(() => { fs.rmSync(dir, { recursive: true, force: true }); });
+function baseCtx(file) {
+    return {
+        certificate: {
+            validated: true,
+            confidence: "high",
+            provenanceIntact: true,
+            fingerprint: "test-fp",
+            violations: 0,
+            plsbCoverage: "10/13",
+            plsbRecall: 1,
+            degraded: false,
+            sessionId: "test-session",
+            file,
+            timestamp: new Date().toISOString(),
+        },
+        accountability: {
+            humanEvents: 1,
+            aiEvents: 1,
+            automatedEvents: 0,
+            custodyGap: false,
+        },
+    };
+}
+(0, vitest_1.describe)("policy engine（fail-closed 回归）", () => {
+    (0, vitest_1.it)("risk 规则：无可提取调用数据 → 显式违规（fail-closed，不再伪造输入）", () => {
+        const f = path.join(dir, "empty.ts");
+        fs.writeFileSync(f, "");
+        const result = (0, engine_1.evaluatePolicy)(baseCtx(f));
+        const riskViolations = result.violations.filter((v) => v.rule.type === "risk");
+        (0, vitest_1.expect)(riskViolations.length).toBeGreaterThanOrEqual(1);
+        (0, vitest_1.expect)(riskViolations[0].detail).toContain("fail-closed");
+    });
+    (0, vitest_1.it)("risk 规则：真实调用提取后良性代码不产生风险违规", () => {
+        const f = path.join(dir, "benign.ts");
+        fs.writeFileSync(f, "function hello() { console.log('x'); return computeSum(a, b); }");
+        const result = (0, engine_1.evaluatePolicy)(baseCtx(f));
+        const riskViolations = result.violations.filter((v) => v.rule.type === "risk");
+        (0, vitest_1.expect)(riskViolations).toHaveLength(0);
+    });
+    (0, vitest_1.it)("loadPolicyConfig：JSON 解析失败显式携带 configError（不再静默回退）", () => {
+        fs.writeFileSync(path.join(dir, ".progmune-policy.json"), "{ broken json !!!");
+        const res = (0, engine_1.loadPolicyConfig)(dir);
+        (0, vitest_1.expect)(res.configError).toBeDefined();
+        (0, vitest_1.expect)(res.configError).toContain("Failed to parse");
+    });
+});
+(0, vitest_1.describe)("execute 写盘策略门（opt-in）", () => {
+    const MARKED = `// @progmune-generated session=s1 timestamp=2026-09-06T00:00:00.000Z
+function doThing() { return 1; }
+`;
+    (0, vitest_1.it)("未配置 .progmune-policy.json → 无操作（旧行为）", () => {
+        const f = path.join(dir, "out.ts");
+        fs.writeFileSync(f, MARKED);
+        const gate = (0, execute_1.applyPolicyGateAfterWrite)(dir, f);
+        (0, vitest_1.expect)(gate.blocked).toBe(false);
+        (0, vitest_1.expect)(fs.existsSync(f)).toBe(true);
+    });
+    (0, vitest_1.it)("配置阻断规则 → BLOCK 回滚（新文件删除）", () => {
+        fs.writeFileSync(path.join(dir, ".progmune-policy.json"), JSON.stringify({
+            inherit: false,
+            rules: [{ type: "confidence", severity: "block", threshold: 2 }],
+        }));
+        const f = path.join(dir, "out.ts");
+        fs.writeFileSync(f, MARKED);
+        const gate = (0, execute_1.applyPolicyGateAfterWrite)(dir, f);
+        (0, vitest_1.expect)(gate.blocked).toBe(true);
+        (0, vitest_1.expect)(gate.decision).toBe("BLOCK");
+        (0, vitest_1.expect)(fs.existsSync(f)).toBe(false); // 回滚 = 删除新文件
+    });
+    (0, vitest_1.it)("配置阻断规则 → BLOCK 回滚（已有文件恢复原内容）", () => {
+        fs.writeFileSync(path.join(dir, ".progmune-policy.json"), JSON.stringify({
+            inherit: false,
+            rules: [{ type: "confidence", severity: "block", threshold: 2 }],
+        }));
+        const f = path.join(dir, "out.ts");
+        const prev = "// original content\n";
+        const gate = (0, execute_1.applyPolicyGateAfterWrite)(dir, f, prev);
+        (0, vitest_1.expect)(gate.blocked).toBe(true);
+        (0, vitest_1.expect)(fs.readFileSync(f, "utf-8")).toBe(prev); // 恢复原内容
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.21";
+exports.RUNTIME_VERSION = "3.7.23";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/ssg-validator.js

@@ -759,6 +759,9 @@ function rejectionToJSON(rejection) {
 function parseProtocolsFromJSON(protocolDef) {
     const protocols = [];
     for (const [funcName, rule] of Object.entries(protocolDef.rules)) {
+        // 未人工确认的提案规则不加载——AI 只提案，人不签字不生效
+        if (rule.status && rule.status !== "confirmed")
+            continue;
         protocols.push({
             function: funcName,
             protocol: {

package/dist/trust/engine.js

@@ -1192,6 +1192,11 @@ async function collectProtocolViolations(ctx, callGraph) {
     let ssgTotalCalls = 0;
     let ssgMatchedCalls = 0;
     let ssgViolationCount = 0;
+    // 截断序列计数（预算耗尽——尾部调用未验证，覆盖率降级信号）
+    let truncatedSeqCount = 0;
+    // Oracle 隔离政策（docs/ORACLE_ISOLATION_POLICY.md）：注解合并注册的
+    // 绑定与代码作者同源——单独统计并在报告中披露（独立度指标）
+    const annotationRuleNames = new Set();
     // C 注解建议（函数级作用域——返回值在 try 外组装）
     let annotationSuggestions;
     try {
@@ -1248,24 +1253,64 @@ async function collectProtocolViolations(ctx, callGraph) {
                     // ir.json 两种形态：extractIR/extractIRPython 的裸数组、extractProjectIR
                     // 的 { typeMap, functions } 合并对象（execute/MCP 写盘）——统一取函数列表。
                     const functions = Array.isArray(ir) ? ir : (ir.functions || []);
+                    // 裸名出现次数（Java 接收者限定匹配：碰撞名不注册裸键——
+                    // User.update 与 Article.update 同名时裸键 "update" 会命中所有
+                    // .update( 调用点，REALWORLD_JAVA_ANNOTATION_V1 名碰撞 9 FP 根因）
+                    const nameCounts = new Map();
+                    for (const f of functions) {
+                        const n = String(f.name);
+                        nameCounts.set(n, (nameCounts.get(n) || 0) + 1);
+                    }
                     for (const f of functions) {
                         if (!f.protocol)
                             continue;
                         const protocol = { ...f.protocol };
-                        const existing = protocolRulesData.rules.get(String(f.name));
+                        const fname = String(f.name);
+                        const existing = protocolRulesData.rules.get(fname);
                         if (existing?.namespace && !protocol.namespace) {
                             protocol.namespace = existing.namespace;
                         }
                         // 修复路径渲染真实函数名（fixPath 输出项目原语而非通用规则名）
-                        protocol.displayName = String(f.name);
-                        protocolRulesData.rules.set(String(f.name), protocol);
+                        protocol.displayName = fname;
+                        // Java（className 存在且 name 无点）：总是注册 Class.method 限定键；
+                        // 裸键仅在项目内唯一时注册（碰撞名只留限定键，匹配走限定调用）
+                        const qualified = f.className && !fname.includes(".")
+                            ? `${f.className}.${fname}` : undefined;
+                        const nameUnique = (nameCounts.get(fname) || 0) === 1;
+                        if (qualified) {
+                            protocolRulesData.rules.set(qualified, protocol);
+                            annotationRuleNames.add(qualified);
+                        }
+                        if (!f.className || nameUnique) {
+                            protocolRulesData.rules.set(fname, protocol);
+                            annotationRuleNames.add(fname);
+                        }
                         // CamelCase 真实命名（C 代码普遍，如 ACLCheckAllPerm）注册的规则
                         // 原样无法被任何匹配策略触达（normalize 只作用于调用名；词段匹配
                         // 要求 ≥2 个下划线词段）——同步注册规范化形态使注解原语可被按名命中。
                         // 加性改动：snake_case 注解（TS/Python 惯例）normalized === 原名，无变化。
-                        const normalized = (0, ssg_bridge_1.normalizeName)(String(f.name));
-                        if (normalized !== String(f.name)) {
+                        const normalized = (0, ssg_bridge_1.normalizeName)(fname);
+                        if (normalized !== fname && (!f.className || nameUnique)) {
                             protocolRulesData.rules.set(normalized, protocol);
+                            annotationRuleNames.add(normalized);
+                        }
+                    }
+                }
+            }
+            catch { /* best-effort */ }
+        }
+        // ── 项目别名重校验（注解合并后）──
+        // 注解合并注册的限定键（Java Class.method）在 loadProtocolRules 时还不
+        // 存在，指向它们的别名当时被「规则不存在」校验拒绝——合并后重跑一次，
+        // 把「变量名→限定规则」映射补进 aliasIndex（如 jwtservice.getsubfromtoken
+        // → DefaultJwtService.getSubFromToken；变量名≠类名的文档化桥接通道）
+        if (protocolRulesData) {
+            try {
+                const pa = (0, ssg_bridge_1.loadProjectAliases)(ctx.projectPath, new Set(protocolRulesData.rules.keys()));
+                if (pa) {
+                    for (const [callName, ruleName] of Object.entries(pa.aliases)) {
+                        if (!protocolRulesData.aliasIndex.has(callName)) {
+                            protocolRulesData.aliasIndex.set(callName, ruleName);
                         }
                     }
                 }
@@ -1298,6 +1343,8 @@ async function collectProtocolViolations(ctx, callGraph) {
         }
         catch { /* best-effort */ }
         for (const seq of callSequences) {
+            if (seq.truncated)
+                truncatedSeqCount++;
             try {
                 const semantic = await (0, api_semantic_mapper_1.mapSequenceToSemanticWithLLM)(seq.calls);
                 // ── Phase 5: Cross-function propagation ──
@@ -1444,9 +1491,22 @@ async function collectProtocolViolations(ctx, callGraph) {
             totalCalls: ssgTotalCalls,
             matchedCalls: ssgMatchedCalls,
             ssgViolations: ssgViolationCount,
-            summary: (0, ssg_bridge_1.summarizeSSGCoverage)(ssgResults),
+            // 截断序列显式上报（审计修复 2026-09-06）：预算耗尽时尾部调用
+            // （close_file 类释放操作）不可见——覆盖率降级信号，不再静默
+            truncatedSequences: truncatedSeqCount,
+            summary: (0, ssg_bridge_1.summarizeSSGCoverage)(ssgResults) +
+                (truncatedSeqCount > 0
+                    ? ` (${truncatedSeqCount} sequence(s) truncated — tail calls unverified)`
+                    : ""),
             aliasWarnings: protocolRulesData.aliasWarnings?.length
                 ? protocolRulesData.aliasWarnings : undefined,
+            // Oracle 独立度（docs/ORACLE_ISOLATION_POLICY.md）：规则/别名均为
+            // 人工确认（加载端过滤）；项目注解与代码作者同源，单独披露
+            oracleIndependence: {
+                confirmedRules: protocolRulesData.rules.size - annotationRuleNames.size,
+                sameSourceAnnotations: annotationRuleNames.size,
+                confirmedAliases: protocolRulesData.aliasIndex.size,
+            },
         } : undefined,
         annotationSuggestions,
     };

package/dist/trust/protocol-rules-liveness.test.js

@@ -0,0 +1,114 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * protocol-rules-liveness.test.ts — 协议规则活性守卫（2026-09-06）
+ *
+ * Kimi 源码审计发现：SSG 验证器按命名空间隔离状态（stateMap 以
+ * namespace 为键），而 protocols.json 中多条规则的 pre_states 引用
+ * 其他命名空间建立的状态（如 session_fixation 的规则 pre SESSION_ACTIVE，
+ * SESSION_ACTIVE 由 auth 的 create_session 建立）——规则在本命名空间
+ * 永远无法满足前置，实际永不触发（G5 同族：2026-08-28 data_integrity
+ * 的 check_resource_ownership pre AUTHENTICATED 已发现一次个案）。
+ *
+ * 本测试把该现象固化为硬性校验：每条规则的 pre_states 必须能在其
+ * 命名空间内到达（初始状态 + 本命名空间规则的 post_states 闭包）。
+ * 例外（printlab 业务链跨命名空间依赖）显式列入 KNOWN_CROSS_NS，
+ * 待跨命名空间状态引用特性实现后移除。
+ */
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+function loadProtocols() {
+    const p = path.join(__dirname, "..", "..", "protocols.json");
+    return JSON.parse(fs.readFileSync(p, "utf-8"));
+}
+/** 命名空间内可到达状态：初始状态 + post_states 闭包（同验证器语义） */
+function reachableStates(ns, rules, nsInit) {
+    const states = new Set([nsInit[ns] ?? "INIT"]);
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const r of Object.values(rules)) {
+            if ((r.namespace ?? "_global") !== ns)
+                continue;
+            const pre = new Set(r.pre_states ?? []);
+            if (![...pre].every((s) => states.has(s)))
+                continue;
+            for (const p of r.post_states ?? []) {
+                if (!states.has(p)) {
+                    states.add(p);
+                    changed = true;
+                }
+            }
+        }
+    }
+    return states;
+}
+(0, vitest_1.describe)("protocol rules liveness（跨命名空间死规则守卫）", () => {
+    (0, vitest_1.it)("每条 confirmed 规则的 pre_states 在其命名空间内可达（跨命名空间引用为显式例外）", () => {
+        const { rules, namespaceInitialStates } = loadProtocols();
+        const nsInit = namespaceInitialStates ?? {};
+        // Oracle 隔离政策：proposed 规则不参与判定，也不做活性断言
+        // （在人工确认时由 rule-propose 流程检查）
+        const activeRules = {};
+        for (const [name, r] of Object.entries(rules)) {
+            if (!r.status || r.status === "confirmed")
+                activeRules[name] = r;
+        }
+        // 文档化例外：printlab 业务链（printlab_order ↔ printlab_print 跨
+        // 命名空间依赖：queue_order → start_print、upload_stl pre AUTHENTICATED
+        // 等）——待跨命名空间状态引用特性后移除
+        const KNOWN_CROSS_NS = new Set([
+            "upload_stl", "slice_model", "generate_gcode", "estimate_cost",
+            "queue_order", "start_print", "complete_print", "ship_order",
+            "deliver_order", "fail_print",
+        ]);
+        const dead = [];
+        for (const [name, r] of Object.entries(activeRules)) {
+            const ns = r.namespace ?? "_global";
+            const reach = reachableStates(ns, activeRules, nsInit);
+            for (const s of r.pre_states ?? []) {
+                if (!reach.has(s)) {
+                    dead.push(`${name} (ns=${ns}, pre=${s} 不可达)`);
+                }
+            }
+        }
+        (0, vitest_1.expect)(dead.filter((d) => !KNOWN_CROSS_NS.has(d.split(" ")[0]))).toEqual([]);
+        // 例外清单必须与实际死规则一致（防止例外清单腐化）
+        (0, vitest_1.expect)(dead.map((d) => d.split(" ")[0]).sort())
+            .toEqual([...KNOWN_CROSS_NS].sort());
+    });
+});

package/dist/trust/ssg-bridge.js

@@ -265,12 +265,16 @@ function inferRuleName(apiName, domain, description, ruleNames, namespace, alias
     // 仅项目函数适用——真实 C 语料验证中 ReadFile/WriteFile/DeleteFile 经
     // normalized 撞上 read_file/write_file/delete_file 是 11/24 FP 的主导源，
     // 而注解桥接（ACLCheckAllPerm → acl_check_all_perm）全是项目函数，不受影响。
+    // Java 限定键（Class.method）与限定调用（user.update）大小写不敏感精确
+    // 匹配（变量名 user vs 类名 User）；带点调用不参与规范化/词段形态匹配——
+    // 末段回退会重造名碰撞（article.update 撞 User.update 的裸键/词段）。
+    const isDotted = dotIdx >= 0;
     for (const ruleName of ruleNames) {
-        if (lowerApi === ruleName) {
+        if (lowerApi === ruleName.toLowerCase()) {
             return ruleName;
         }
     }
-    if (isProjectFn) {
+    if (isProjectFn && !(projectFunctions && isDotted)) {
         for (const ruleName of ruleNames) {
             if (normalized === ruleName) {
                 return ruleName;
@@ -280,6 +284,8 @@ function inferRuleName(apiName, domain, description, ruleNames, namespace, alias
     for (const ruleName of ruleNames) {
         if (projectFunctions && !isProjectFn)
             continue;
+        if (projectFunctions && isDotted)
+            continue; // 带点调用只走限定精确匹配（+别名/域提示）
         const ruleWords = ruleName.split("_");
         const callWords = normalized.split("_");
         // Rule must have at least 2 words for this strategy (single-word rules

package/dist/trust/ssg-bridge.test.js

@@ -113,6 +113,52 @@ function step(api, domain, description = "") {
             (0, vitest_1.expect)(result.stats.unmatchedCalls).toBe(steps.length);
         });
     });
+    // ── 接收者限定名匹配（Java 名碰撞根因修复，2026-09-06）──
+    (0, vitest_1.describe)("qualified call → rule inference", () => {
+        (0, vitest_1.it)("限定调用精确匹配限定规则（大小写不敏感：user.update → User.update）", () => {
+            const prev = rules.get("User.update");
+            rules.set("User.update", {
+                pre_states: ["PASSWORD_HASHED"],
+                post_states: ["PASSWORD_UPDATED"],
+                namespace: "registration",
+            });
+            try {
+                const result = (0, ssg_bridge_1.validateSequenceWithSSG)([step("user.update", "registration", "Update user data")], rules, nsInit, "test.java", aliasIndex, undefined, new Set(["user.update", "update"]));
+                (0, vitest_1.expect)(result.stats.matchedCalls).toBeGreaterThanOrEqual(1);
+            }
+            finally {
+                if (prev)
+                    rules.set("User.update", prev);
+                else
+                    rules.delete("User.update");
+            }
+        });
+        (0, vitest_1.it)("不同类限定调用不误配（article.update 不命中 User.update 规则）", () => {
+            const prev = rules.get("User.update");
+            rules.set("User.update", {
+                pre_states: ["PASSWORD_HASHED"],
+                post_states: ["PASSWORD_UPDATED"],
+                namespace: "registration",
+            });
+            try {
+                const result = (0, ssg_bridge_1.validateSequenceWithSSG)([step("article.update", "registration", "Update article content")], rules, nsInit, "test.java", aliasIndex, undefined, new Set(["article.update", "update"]));
+                (0, vitest_1.expect)(result.stats.matchedCalls).toBe(0);
+                (0, vitest_1.expect)(result.stats.unmatchedCalls).toBe(1);
+            }
+            finally {
+                if (prev)
+                    rules.set("User.update", prev);
+                else
+                    rules.delete("User.update");
+            }
+        });
+        (0, vitest_1.it)("带点调用不参与词段匹配（helper.verify_hash 不命中 verify_hash）", () => {
+            // 无 projectFunctions 时不限制（回退路径旧行为）；提供后带点调用
+            // 只走限定精确匹配 + 别名——末段词段回退会重造名碰撞
+            const result = (0, ssg_bridge_1.validateSequenceWithSSG)([step("helper.verify_hash", "auth", "Verify something")], rules, nsInit, "test.java", aliasIndex, undefined, new Set(["helper.verify_hash", "verify_hash"]));
+            (0, vitest_1.expect)(result.stats.matchedCalls).toBe(0);
+        });
+    });
     (0, vitest_1.describe)("alias-based matching (exact)", () => {
         (0, vitest_1.it)("matches bcrypt.compare to verify_hash via alias", () => {
             (0, vitest_1.expect)(aliasIndex.get("bcrypt.compare")).toBe("verify_hash");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.21",
+  "version": "3.7.23",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",
@@ -12,11 +12,14 @@
     "tools/extract_ir.py",
     "tools/extract_framework_py.py",
     "tools/extract_framework_django.py",
-    "tools/extract_framework_flask.py"
+    "tools/extract_framework_flask.py",
+    "scripts/init-policy.js",
+    "templates/"
   ],
   "main": "dist/mcp-server.mjs",
   "bin": {
-    "progmune-runtime": "dist/mcp-server.mjs"
+    "progmune-runtime": "dist/mcp-server.mjs",
+    "progmune-init-policy": "scripts/init-policy.js"
   },
   "scripts": {
     "prepare": "npm run build",