progmune-runtime 3.7.22 → 3.7.24

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [3.7.24] — 2026-09-06
+
+### 审计复检三项修复
+
+- **空规则集 fail-closed**：`evaluatePolicy` 对空规则数组直接 BLOCK（合成 `policy_config` 违规）——空数组是 truthy，原实现零规则→零违规→ALLOW；写盘门 / policy CLI / MCP 三路径同步收口，测试锁定
+- **loadEnterprisePolicyConfig 解析失败显式携带 configError**（与 loadPolicyConfig 同口径，六条 fail-open 中第 4 条全修）
+- **写盘门口径修正**（README 双语 / TIERED_POLICY / AUDIT_RESPONSE）：「写盘策略门」→「**写后回滚门——BLOCK 时文件不残留**」，明确为补偿控制而非写前拦截，写盘与回滚之间进程中断的残留为已知边界
+- **落地页 66 金标口径自解释**：「66 金标 检出 64（97%）/ 100% / 0 FP——2 条为注解依赖前置的已知漏检（基线文档单列）」，与发布门 64 一致
+- npm gitHead 溯源核对：npm gitHead = tag v3.7.23 commit，三点对齐（发布产物 ↔ tag ↔ 发布 commit）
+- 回归 29 green；check 免疫正常
+
+## [3.7.23] — 2026-09-06
+
+### 第三方审计修复批次 + Oracle 隔离政策 + 分资产分级策略
+
+- **治理层 fail-open 修复**（Kimi 行号级审计 P0）：risk 规则 fail-closed（不再伪造 SSL 输入，真实调用提取，无数据/模块不可用 → 显式违规）；kb_coverage 显式化；策略配置解析失败拒绝静默评估（policy CLI exit 2）；**execute 写后回滚门**（项目 opt-in `.progmune-policy.json` 后写盘随即验证，BLOCK 时文件不残留——补偿控制而非写前拦截，写盘与回滚间进程中断为已知边界；策略引擎首次获得写盘强制力）；`PROGMUNE_STRICT=false` 逃生门写入审计事件日志；决策层注释与实现对齐（乘积→加权平均）；证书时间戳贯通 PolicyContext；**潜伏 bug**：certify 的 plsbRecall 恒为 0（metadata 从未有 recall 字段，HIGH 置信度门槛永远不可达）→ 修为 verified/total
+- **跨命名空间死规则归位 + 活性守卫**（Kimi 发现 3 系统化）：全量扫描 14 条死规则——4 条归位（logout_without_invalidate/admin_action_without_check/double_commit/check_resource_ownership 挪进 pre 状态所在命名空间）、10 条 printlab 业务链为文档化例外（待跨命名空间状态引用特性）；`protocol-rules-liveness.test.ts` 使死规则永久回归可防
+- **P1 批**：SUPPRESS 等全部决策持久化审计事件日志（含 fpRate/envFactor/importance 全输入）；截断序列覆盖率显式降级上报（truncatedSequences + summary 标注）；README 双语边界声明（刻意规避不在防护目标内 / BLOCK 强制力三执行点）；FAQ 澄清 LLM 密钥为可选增强；落地页免疫叙事收敛
+- **Oracle 隔离政策**（Hunyuan 定律 5 落地，`docs/ORACLE_ISOLATION_POLICY.md`）：四类评估体系变更（规则/匹配策略/阈值/别名）必须人工确认，AI 只提案；protocols.json 全量 `status: "confirmed"` + 加载端跳过 proposed + `scripts/rule-propose.js` 提案脚手架；evaluateTrust 输出 **oracleIndependence**（confirmedRules / sameSourceAnnotations / confirmedAliases）
+- **分资产分级策略**（`docs/TIERED_POLICY.md` + `templates/` 三档 + `progmune-init-policy` bin）：Tier-1 强制（致命资产，写盘门激活）/ Tier-2 标准（violations 阻断，其余 WARN）/ Tier-3 观察（只报告）——「出错代价 × AI 参与度」二维分级，一条命令落地
+- **审计回应文档** `docs/AUDIT_RESPONSE_2026-09.md`：逐条回应智谱 + Kimi 两份审查（已修复 12 项 / 事实澄清 5 项 / 设计边界 3 项 / 计划 4 项）
+- 发布门：套件全绿（含 policy 新测试 6 项）；Python 盲测 64 / TS 795 / C 应用金标零漂移；check 免疫正常
+
 ## [3.7.22] — 2026-09-06
 
 ### Java 方法学三连——恢复率裁决 + 真实闭环 + 名碰撞消除

package/README.md

@@ -118,6 +118,16 @@ Progmune is honest about what it can and cannot verify.
 - **Runtime behavior** — Progmune is static analysis only; no DAST/sandbox execution.
 - **Framework internals** — well-known framework dispatch/cache machinery (e.g. django-unicorn internals) can produce a small number of boundary false positives; they are documented per-corpus in the benchmark gold files.
 - **Known failure boundaries are documented** rather than hidden: if Progmune cannot verify a language (e.g. Go), Confidence is lowered instead of pretending 100%.
+- **Deliberate evasion is out of scope** — the annotation-driven model catches *accidental* AI protocol mistakes (missing prerequisites, wrong ordering); it does not defend against adversarial renaming/obfuscation (true of any static tool).
+- **BLOCK enforcement is the integrator's responsibility** — Progmune outputs decisions and evidence; it does not intercept at runtime. OS-level enforcement points: `trust --ci` exit code (CI gates), `policy CLI` exit code, and the opt-in **write-then-rollback gate** (with `.progmune-policy.json`, `execute` writes then verifies immediately; on BLOCK the file does not persist. This is a compensating control, not pre-write interception: a process killed between write and rollback may leave the content behind — a known boundary).
+
+**Tiered adoption by asset class** ([TIERED_POLICY](https://github.com/shenlian19831109/progmune-runtime/blob/main/docs/TIERED_POLICY.md)): don't gate all code alike — pick a tier by "cost of failure × AI involvement", one command to install:
+
+```bash
+npx progmune-init-policy --tier 1   # Enforce: auth/payment/resource lifecycle — write-gate active
+npx progmune-init-policy --tier 2   # Standard: business logic — violations block, rest WARN
+npx progmune-init-policy --tier 3   # Observe: tools/demos — report only
+```
 
 → [Full Coverage Matrix](https://github.com/shenlian19831109/progmune-runtime/blob/main/docs/coverage-matrix-en.md)
 

package/README.zh-CN.md

@@ -118,6 +118,16 @@ Progmune 对能验证什么、不能验证什么保持诚实。
 - **运行时行为**——Progmune 仅做静态分析；无 DAST/沙箱执行。
 - **框架内部件**——知名框架的分发/缓存机制（如 django-unicorn 内部件）可能产生少量边界误报；各语料基准 gold 文件中已逐条记录。
 - **已知失败边界一律记录**而非隐藏：如果 Progmune 无法验证某语言（如 Go），置信度会降低而不是假装 100%。
+- **刻意规避不在防护目标内**——注解驱动模型拦截的是 AI 的「意外」协议错误（漏写前置步骤、顺序颠倒）；对故意改名/混淆的对抗性规避不设防（任何静态工具同理）。
+- **BLOCK 的强制力由集成方承担**——Progmune 输出判定与证据，不运行时拦截。OS 级强制执行点：`trust --ci` 退出码（CI 门禁）、`policy CLI` 退出码、以及 opt-in 的**写后回滚门**（项目配置 `.progmune-policy.json` 后，execute 写盘随即验证，BLOCK 时文件不残留。注意这是补偿控制而非写前拦截：写盘与回滚之间若进程被中断，违规内容可能短暂/持续残留——已知边界）。
+
+**分资产分级接入**（[TIERED_POLICY](https://github.com/shenlian19831109/progmune-runtime/blob/main/docs/TIERED_POLICY.md)）：不要给所有代码同一套门禁——按「出错代价 × AI 参与度」选档，一条命令落地：
+
+```bash
+npx progmune-init-policy --tier 1   # 强制：鉴权/支付/资源生命周期——写盘策略门激活
+npx progmune-init-policy --tier 2   # 标准：业务逻辑——violations 阻断，其余 WARN
+npx progmune-init-policy --tier 3   # 观察：工具/demo——只报告不拦截
+```
 
 → [完整覆盖矩阵](https://github.com/shenlian19831109/progmune-runtime/blob/main/docs/coverage-matrix.md)
 

package/dist/certify.js

@@ -49,6 +49,14 @@ exports.certify = certify;
 exports.formatCertificate = formatCertificate;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+// 静态导入（vitest 下 lazy require CJS 互操作不可靠——engine.ts 同款
+// 陷阱，2026-08-27 DSH 修复先例；以下模块均不反向依赖 certify，无环）
+const failure_corpus_1 = require("./failure-corpus");
+const ssg_validator_1 = require("./ssg-validator");
+const protocol_registry_1 = require("./protocol-registry");
+const ledger_registry_1 = require("./ledger-registry");
+const plsb_benchmark_1 = require("./plsb-benchmark");
+const protocol_knowledge_1 = require("./protocol-knowledge");
 // ── Core ──
 function certify(filePath) {
     const absPath = path.resolve(filePath);
@@ -66,8 +74,7 @@ function certify(filePath) {
     const sessionId = markerMatch[1];
     const markerTimestamp = markerMatch[2];
     // 2. Load session from corpus
-    const { getAllSessions } = require("./failure-corpus");
-    const sessions = getAllSessions();
+    const sessions = (0, failure_corpus_1.getAllSessions)();
     const session = sessions.find((s) => s.sessionId === sessionId || s.sessionId?.startsWith(sessionId));
     // 3. Collect transitions
     let allTransitions = [];
@@ -85,9 +92,7 @@ function certify(filePath) {
     let violations = 0;
     try {
         if (session && allTransitions.length > 0) {
-            const { checkLedgerConsistency } = require("./ssg-validator");
-            const { getNsInit } = require("./protocol-registry");
-            const result = checkLedgerConsistency(allTransitions, getNsInit());
+            const result = (0, ssg_validator_1.checkLedgerConsistency)(allTransitions, (0, protocol_registry_1.getNsInit)());
             validated = result.consistent;
             violations = (result.violations || []).length;
         }
@@ -102,12 +107,10 @@ function certify(filePath) {
     let fingerprint = "";
     let provenanceIntact = true;
     try {
-        const { verifyFingerprint } = require("./ledger-registry");
-        const fp = verifyFingerprint(sessionId, allTransitions);
+        const fp = (0, ledger_registry_1.verifyFingerprint)(sessionId, allTransitions);
         fingerprint = fp.stored?.ledgerHash || fp.stored?.ledgerHash || "";
         if (!fingerprint) {
-            const { getFingerprint } = require("./ledger-registry");
-            const fp2 = getFingerprint(sessionId);
+            const fp2 = (0, ledger_registry_1.getFingerprint)(sessionId);
             fingerprint = fp2?.ledgerHash || "";
         }
         provenanceIntact = !fp.tampered;
@@ -120,11 +123,14 @@ function certify(filePath) {
     let plsbCoverage = "unknown";
     let plsbRecall = 0;
     try {
-        const { buildPLSB, PROTOCOL_WEAKNESS_TAXONOMY } = require("./plsb-benchmark");
-        const benchmark = buildPLSB();
+        const benchmark = (0, plsb_benchmark_1.buildPLSB)();
         plsbVersion = benchmark.version || "1.0";
-        plsbRecall = benchmark.metadata?.recall || 0;
-        const taxonomy = PROTOCOL_WEAKNESS_TAXONOMY;
+        // recall = verified/total（类型修复暴露的潜伏 bug：metadata 从未有
+        // recall 字段，原写法恒为 0 → HIGH 置信度门槛永远不可达）
+        plsbRecall = benchmark.metadata
+            ? benchmark.metadata.verified / Math.max(1, benchmark.metadata.total)
+            : 0;
+        const taxonomy = plsb_benchmark_1.PROTOCOL_WEAKNESS_TAXONOMY;
         const byPLS = benchmark.metadata?.byPLS || {};
         const covered = taxonomy.filter((t) => (byPLS[t.id] || 0) > 0).length;
         plsbCoverage = `${covered}/${taxonomy.length}`;
@@ -161,8 +167,7 @@ function certify(filePath) {
     let kbVersion;
     let kbAssets;
     try {
-        const { buildKnowledgeBase } = require("./protocol-knowledge");
-        const kb = buildKnowledgeBase();
+        const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();
         kbVersion = kb.version;
         const stableAssets = kb.units.filter((u) => u.maturity === "stable");
         kbAssets = stableAssets.map((u) => ({

package/dist/check.js

@@ -473,6 +473,24 @@ step("4/6 Ledger 不变量");
             fail("PROGMUNE_STRICT=true — 严格不变量断言发现违规");
         }
     }
+    else if (process.env.PROGMUNE_STRICT === "false") {
+        // 逃生门记账（审计修复 2026-09-06）：降级必须留痕——
+        // 不变量违规降级为提示时，向审计事件日志追加一条记录
+        warn("PROGMUNE_STRICT=false — 不变量违规降级为提示（已记入审计事件日志）");
+        try {
+            const fs = require("fs");
+            const path = require("path");
+            const auditDir = path.join(process.cwd(), ".progmune_memory");
+            if (!fs.existsSync(auditDir))
+                fs.mkdirSync(auditDir, { recursive: true });
+            fs.appendFileSync(path.join(auditDir, "audit-events.jsonl"), JSON.stringify({
+                event: "PROGMUNE_STRICT_DISABLED",
+                timestamp: new Date().toISOString(),
+                cwd: process.cwd(),
+            }) + "\n", "utf-8");
+        }
+        catch { /* audit log write — best-effort */ }
+    }
     // P0: Fingerprint registration — ensure every session has an execution certificate
     {
         const registered = (0, ledger_registry_1.registerAllMissingFingerprints)();

package/dist/decision-engine.js

@@ -17,7 +17,9 @@
  *   Output: BLOCK/WARN/ALLOW | promote/demote/hold | fix/retry/rollback | accept/reject
  *
  * Importance is COMPUTED, not configured:
- *   Importance = Impact × Universality × Criticality
+ *   Importance = 0.4×Impact + 0.25×Universality + 0.35×Criticality
+ * （加权平均，权重之和为 1；Impact 权重最高——安全影响优先于
+ *  出现广度。审计修复 2026-09-06：原注释写乘积公式，与实现矛盾）
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DecisionEngine = void 0;
@@ -105,7 +107,7 @@ function computeImportance(asset) {
     const impact = computeImpact(asset);
     const universality = computeUniversality(asset);
     const criticality = computeCriticality(asset);
-    // Weighted product: Impact is most important, Universality is secondary
+    // Weighted average (weights sum to 1): Impact is most important, Universality secondary
     return Math.round((impact * 0.4 + universality * 0.25 + criticality * 0.35) * 100);
 }
 /**
@@ -181,7 +183,9 @@ class DecisionEngine {
             reason: action === "BLOCK"
                 ? `High-confidence violation (${(confidence * 100).toFixed(0)}%, importance ${importance})`
                 : action === "SUPPRESS"
-                    ? `Low confidence (${(confidence * 100).toFixed(0)}%), ${context.recentFPs || 0} recent FPs`
+                    // 审计修复 2026-09-06：抑制决策的输入全部入审计记录
+                    // （FP 率/环境因子/资产），可追溯为何被压、被谁压
+                    ? `Suppressed (silent) at ${(confidence * 100).toFixed(0)}% confidence — fpRate=${(fpRate * 100).toFixed(0)}%, envFactor=${envFactor}, importance=${importance}, ${context.recentFPs || 0} recent FPs`
                     : `Moderate confidence (${(confidence * 100).toFixed(0)}%) — ${action}`,
             provenance: {
                 assets: [asset.id],
@@ -373,6 +377,25 @@ class DecisionEngine {
         const id = `DEC-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
         const decision = { id, ...partial };
         this.history.push(decision);
+        // 审计修复 2026-09-06：决策（尤其 SUPPRESS 静默抑制）持久化到审计
+        // 事件日志——此前仅内存记录，抑制决策对外不可见、不可追溯
+        try {
+            const fs = require("fs");
+            const path = require("path");
+            const auditDir = path.join(process.cwd(), ".progmune_memory");
+            if (!fs.existsSync(auditDir))
+                fs.mkdirSync(auditDir, { recursive: true });
+            fs.appendFileSync(path.join(auditDir, "audit-events.jsonl"), JSON.stringify({
+                event: "DECISION_RECORDED",
+                decisionId: id,
+                kind: decision.kind,
+                action: decision.action,
+                confidence: decision.confidence,
+                reason: decision.reason,
+                timestamp: decision.provenance.timestamp,
+            }) + "\n", "utf-8");
+        }
+        catch { /* audit log write — best-effort */ }
         return decision;
     }
 }

package/dist/execute.js

@@ -43,6 +43,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.recordGeneration = recordGeneration;
 exports.getExecutionMetrics = getExecutionMetrics;
+exports.applyPolicyGateAfterWrite = applyPolicyGateAfterWrite;
 exports.execute = execute;
 exports.verifyCompiles = verifyCompiles;
 exports.verifyFileMarker = verifyFileMarker;
@@ -52,6 +53,9 @@ const planner_1 = require("./planner");
 const extract_project_ir_1 = require("./extract-project-ir");
 const failure_collector_1 = require("./failure-collector");
 const emitter_1 = require("./emitter");
+// 静态导入（vitest 下 lazy require CJS 互操作不可靠；certify/policy 无环）
+const certify_1 = require("./certify");
+const engine_1 = require("./policy/engine");
 const METRICS_FILE = ".progmune_corpus/metrics.json";
 function loadMetrics() {
     try {
@@ -95,6 +99,68 @@ function getExecutionMetrics() {
  * @param projectPath - Absolute path to project root
  * @param filePath - Optional: write generated code to this file
  */
+/**
+ * 策略门（审计修复 2026-09-06）：项目配置 .progmune-policy.json 时，
+ * 写盘后即时 certify + evaluatePolicy；BLOCK 或验证自身失败 → 回滚写盘
+ * （恢复 prevContent 或删除新文件）——策略引擎 BLOCK 至此获得写盘强制力。
+ * 未配置策略文件时无操作（旧行为保持）。
+ */
+function applyPolicyGateAfterWrite(projectPath, resolvedPath, prevContent) {
+    const policyOptIn = fs.existsSync(path.join(projectPath, ".progmune-policy.json"));
+    if (!policyOptIn)
+        return { blocked: false };
+    const rollback = () => {
+        if (prevContent !== undefined) {
+            fs.writeFileSync(resolvedPath, prevContent, "utf-8");
+        }
+        else if (fs.existsSync(resolvedPath)) {
+            fs.unlinkSync(resolvedPath);
+        }
+    };
+    try {
+        const cert = (0, certify_1.certify)(resolvedPath);
+        const { rules, configError } = (0, engine_1.loadPolicyConfig)(projectPath);
+        if (configError) {
+            throw new Error(configError);
+        }
+        const policyResult = (0, engine_1.evaluatePolicy)({
+            certificate: {
+                validated: cert.validated,
+                confidence: cert.confidence,
+                provenanceIntact: cert.provenanceIntact,
+                fingerprint: cert.fingerprint,
+                violations: cert.violations,
+                plsbCoverage: cert.plsbCoverage,
+                plsbRecall: cert.plsbRecall,
+                degraded: cert.degraded,
+                sessionId: cert.sessionId,
+                file: cert.file,
+                timestamp: cert.timestamp,
+            },
+        }, rules);
+        if (!policyResult.passed) {
+            rollback();
+            return {
+                blocked: true,
+                decision: policyResult.verdict,
+                violations: policyResult.violations.map((v) => ({
+                    ruleType: v.rule.type,
+                    detail: v.detail || v.actual,
+                })),
+                error: `Policy gate BLOCKED the write: ${policyResult.violations.map((v) => v.rule.type).join(", ")} — file rolled back`,
+            };
+        }
+        return { blocked: false };
+    }
+    catch (e) {
+        // fail-closed：策略验证自身失败 → 回滚写盘
+        rollback();
+        return {
+            blocked: true,
+            error: `Policy gate failed (fail-closed): ${e.message} — file rolled back`,
+        };
+    }
+}
 /** @requires INTENT @produces CODE */
 /** @requires INTENT @produces CODE */
 async function execute(intent, projectPath, filePath) {
@@ -149,14 +215,31 @@ async function execute(intent, projectPath, filePath) {
         irFunctionCount: ir.length,
         protocolRuleCount,
     });
-    // 5. Write to file if requested
+    // 5. Write to file if requested（策略门：项目配置了 .progmune-policy.json
+    //    时，写盘后即时验证；BLOCK → 回滚写盘并返回策略违规——审计修复
+    //    2026-09-06：此前策略引擎与代码生成管道完全脱节，BLOCK 无强制力）
     if (filePath) {
         const resolvedPath = path.isAbsolute(filePath) ? filePath : path.resolve(projectPath, filePath);
         const dir = path.dirname(resolvedPath);
         if (!fs.existsSync(dir)) {
             fs.mkdirSync(dir, { recursive: true });
         }
+        const prevContent = fs.existsSync(resolvedPath)
+            ? fs.readFileSync(resolvedPath, "utf-8") : undefined;
         fs.writeFileSync(resolvedPath, code, "utf-8");
+        const gate = applyPolicyGateAfterWrite(projectPath, resolvedPath, prevContent);
+        if (gate.blocked) {
+            return {
+                success: false, degraded: planResult.degraded ?? false, code,
+                sessionId: planResult.sessionId, hash: "", ruleHash: planResult.ruleHash || "",
+                irFunctionCount: ir.length, protocolRuleCount, violations: 0,
+                repairApplied: false, repairCount: 0, repairBranchIds: [],
+                branchWinner: undefined,
+                policyDecision: gate.decision,
+                policyViolations: gate.violations,
+                error: gate.error,
+            };
+        }
     }
     // 6. Compute hash (from code content)
     const crypto = require("crypto");

package/dist/mcp-server.mjs

@@ -1090,6 +1090,7 @@ ${result.code.split("\n").slice(0, 80).join("\n")}` }] };
                         degraded: cert.degraded,
                         sessionId: cert.sessionId,
                         file: cert.file,
+                        timestamp: cert.timestamp,
                     },
                     accountability: acct ? {
                         humanEvents: acct.humanEvents,

package/dist/policy/cli.js

@@ -69,7 +69,13 @@ catch {
 }
 // 3. Load policy (from project config or defaults)
 const projectDir = process.env.PROGMUNE_PROJECT_DIR || process.cwd();
-const { rules, source } = (0, engine_1.loadPolicyConfig)(projectDir, policyPath);
+const { rules, source, configError } = (0, engine_1.loadPolicyConfig)(projectDir, policyPath);
+// 配置解析失败：拒绝静默评估（fail-closed 信号，审计修复 2026-09-06）
+if (configError) {
+    console.error(`❌ ${configError}`);
+    console.error(`   拒绝在损坏的策略配置下评估——请修复配置后重试。`);
+    process.exit(2);
+}
 // 4. Evaluate policy
 const ctx = {
     certificate: {
@@ -83,6 +89,7 @@ const ctx = {
         degraded: cert.degraded,
         sessionId: cert.sessionId,
         file: cert.file,
+        timestamp: cert.timestamp,
     },
     accountability: acct ? {
         humanEvents: acct.humanEvents,

package/dist/policy/engine.js

@@ -46,6 +46,10 @@ exports.loadEnterprisePolicyConfig = loadEnterprisePolicyConfig;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const types_1 = require("./types");
+// 静态导入（vitest 环境下 lazy require 的 CJS 互操作不可靠——engine.ts
+// 同款陷阱，2026-08-27 DSH 修复先例；两模块无环，静态导入安全）
+const risk_model_1 = require("../risk-model");
+const protocol_knowledge_1 = require("../protocol-knowledge");
 function confidenceToNumber(c) {
     if (c === "high")
         return 2;
@@ -93,13 +97,66 @@ function loadPolicyConfig(projectPath, configPath) {
         return { rules: merged, source: cfgFile };
     }
     catch (e) {
-        console.error(`⚠️  Failed to load policy config: ${e.message}. Using defaults.`);
-        return { rules: [...types_1.DEFAULT_POLICY], source: "built-in defaults (config error)" };
+        // 审计修复（fail-closed 信号）：解析失败不再静默回退——显式携带
+        // configError，由调用方（policy CLI / MCP）决定拒绝评估并报错
+        console.error(`⚠️  Failed to load policy config: ${e.message}.`);
+        return {
+            rules: [...types_1.DEFAULT_POLICY],
+            source: "built-in defaults (config error)",
+            configError: `Failed to parse ${cfgFile}: ${e.message}`,
+        };
+    }
+}
+/** 真实调用提取（certificate.file 的 best-effort 词法扫描，供 risk 规则
+ *  使用——不伪造输入；读不到文件时返回空数组，由调用方按 fail-closed
+ *  计为违规） */
+function extractCallsBestEffort(file) {
+    if (!file)
+        return [];
+    try {
+        const fs = require("fs");
+        const code = fs.readFileSync(file, "utf-8");
+        const calls = [];
+        const re = /(?<=^|[^\w$])([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\s*\(/g;
+        let m;
+        while ((m = re.exec(code)) !== null) {
+            const seg = m[1].split(".").pop() || "";
+            if (/^(if|for|while|switch|catch|return|new|case|do|super|this)$/.test(seg))
+                continue;
+            if (calls.length < 200 && !calls.includes(seg))
+                calls.push(seg);
+        }
+        return calls;
+    }
+    catch {
+        return [];
     }
 }
 function evaluatePolicy(ctx, rules) {
     const activeRules = rules || types_1.DEFAULT_POLICY;
     const violations = [];
+    // fail-closed（审计复检 2026-09-06）：空数组是 truthy，原实现会
+    // 零规则 → 零违规 → ALLOW——空规则集必须拒绝而非放行
+    if (activeRules.length === 0) {
+        return {
+            passed: false,
+            verdict: "BLOCK",
+            rules: 0,
+            passed_rules: 0,
+            failed_rules: 1,
+            violations: [{
+                    rule: {
+                        type: "policy_config",
+                        severity: "block",
+                        description: "Empty policy ruleset is rejected (fail-closed)",
+                    },
+                    actual: "0 active rules",
+                    expected: ">= 1 active rule",
+                    detail: "empty ruleset passes nothing — refusing to ALLOW (fail-closed)",
+                }],
+            summary: "BLOCK: empty policy ruleset",
+        };
+    }
     for (const rule of activeRules) {
         switch (rule.type) {
             // ── Confidence ──
@@ -177,24 +234,44 @@ function evaluatePolicy(ctx, rules) {
                 const minSeverity = rule.threshold ?? 2;
                 const minConfidence = rule.require ?? 70;
                 try {
-                    const { assessRisk } = require("../risk-model");
-                    // Extract call sequence from file (best-effort)
-                    const calls = ctx.certificate.validated ? [] : ["SSL_CTX_new", "SSL_connect"]; // fallback
-                    const risk = assessRisk(calls.length > 0 ? calls : ["init", "connect"]);
-                    const criticalOrHigh = risk.patterns.filter((p) => {
-                        const sevOrder = ["Low", "Medium", "High", "Critical"];
-                        return sevOrder.indexOf(p.severity) >= minSeverity && p.confidence >= minConfidence;
-                    });
-                    if (criticalOrHigh.length > 0) {
+                    // 真实调用提取（certificate.file 的 best-effort 词法扫描）——
+                    // 审计修复（Kimi 2026-09-06）：不再伪造 ["SSL_CTX_new","SSL_connect"]
+                    // 假输入喂评估；输入不可得时按 fail-closed 计为违规
+                    const calls = extractCallsBestEffort(ctx.certificate.file);
+                    if (calls.length === 0) {
                         violations.push({
                             rule,
-                            actual: `${criticalOrHigh.length} risk pattern(s) ≥ severity threshold`,
-                            expected: `0 patterns at this severity+confidence level`,
-                            detail: criticalOrHigh.map((p) => `${p.patternName} (${p.severity}, ${p.confidence}%): ${p.detail}`).join("; "),
+                            actual: "no call data extractable from certificate file",
+                            expected: "risk assessment over real call sequence",
+                            detail: "risk rule requires a readable file with calls; unavailable input is a violation (fail-closed)",
+                        });
+                    }
+                    else {
+                        const risk = (0, risk_model_1.assessRisk)(calls);
+                        const criticalOrHigh = risk.patterns.filter((p) => {
+                            const sevOrder = ["Low", "Medium", "High", "Critical"];
+                            return sevOrder.indexOf(p.severity) >= minSeverity && p.confidence >= minConfidence;
                         });
+                        if (criticalOrHigh.length > 0) {
+                            violations.push({
+                                rule,
+                                actual: `${criticalOrHigh.length} risk pattern(s) ≥ severity threshold`,
+                                expected: `0 patterns at this severity+confidence level`,
+                                detail: criticalOrHigh.map((p) => `${p.patternName} (${p.severity}, ${p.confidence}%): ${p.detail}`).join("; "),
+                            });
+                        }
                     }
                 }
-                catch { /* risk model unavailable */ }
+                catch {
+                    // fail-closed：risk model 不可用 → 显式违规，而非静默跳过
+                    // （审计修复：原空 catch 使整条规则无声失效）
+                    violations.push({
+                        rule,
+                        actual: "risk model unavailable",
+                        expected: "risk assessment completed",
+                        detail: "risk-model module failed to load — failing closed (explicit violation)",
+                    });
+                }
                 break;
             }
             // ── Knowledge Base Coverage ──
@@ -202,11 +279,20 @@ function evaluatePolicy(ctx, rules) {
                 const minStable = rule.threshold ?? 3;
                 let stableCount = 0;
                 try {
-                    const { buildKnowledgeBase } = require("../protocol-knowledge");
-                    const kb = buildKnowledgeBase();
+                    const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();
                     stableCount = kb.units.filter((u) => u.maturity === "stable").length;
                 }
-                catch { /* KB unavailable */ }
+                catch {
+                    // fail-closed 显式化（审计修复）：原空 catch 后 stableCount=0 恰好
+                    // 触发违规，但消息误导为「0 stable assets」——改为明确的不可用违规
+                    violations.push({
+                        rule,
+                        actual: "knowledge base unavailable",
+                        expected: `>= ${minStable} stable assets`,
+                        detail: "protocol-knowledge module failed to load — failing closed (explicit violation)",
+                    });
+                    break;
+                }
                 if (stableCount < minStable) {
                     violations.push({
                         rule,
@@ -327,7 +413,13 @@ function loadEnterprisePolicyConfig(projectPath, configPath) {
         };
     }
     catch (e) {
-        console.error(`⚠️  Failed to load enterprise policy config: ${e.message}. Using defaults.`);
-        return emptyResult;
+        console.error(`⚠️  Failed to load enterprise policy config: ${e.message}.`);
+        // fail-closed 信号（审计复检 2026-09-06）：与 loadPolicyConfig 同口径——
+        // 显式携带 configError，调用方拒绝静默评估
+        return {
+            ...emptyResult,
+            source: "built-in defaults (enterprise config error)",
+            configError: `Failed to parse ${cfgFile}: ${e.message}`,
+        };
     }
 }