progmune-runtime 3.7.23 → 3.7.25

package/CHANGELOG.md

@@ -1,10 +1,32 @@
 # Changelog
 
+## [3.7.25] — 2026-09-10
+
+### 失败语料上报链路修复（中央 hub 恢复数据流）
+
+- **诊断**：中央 hub 自 2026-05-18 起零新增（totalCount=12），npm 周下载 1000-2000 但数据全丢——两个断点：① `immune-reporter` 读废弃路径 `failure_corpus/`（语料已统一到 `.progmune_corpus/`）② 端点默认 `localhost:3000`，安装态用户到不了中央 hub
+- **修复**：数据源对齐 `.progmune_corpus/{date}/fail_*.json`（`PROGMUNE_PROJECT_DIR`/`PROGMUNE_CORPUS_DIR` 感知，损坏记录跳过）；端点默认 `https://progmune-runtime.fly.dev/report`；`PROGMUNE_HUB=off` 可关闭上报
+- **默认脱敏**：函数名 SHA-256 截 12 位（同名同哈希，模式聚合仍有效）；`PROGMUNE_FINGERPRINT_DETAIL=1` 才发送原文函数名；源码与变量值永不上传
+- **隐私口径如实披露**：README/落地页/privacy 页——「代码不上传」保持为真，「无遥测」表述改为如实披露脱敏指纹默认上报与关闭方式
+- **中央 hub 防护层上线**：字段白名单 + 类型校验（SVL-1~4、时间戳 ±窗口、序列长度上限）；请求体 512KB / 每请求 ≤500 条；实例+时间戳+模式指纹去重；每实例每 10 分钟 ≤5 次；每日 ≤10000 条；可选 `PROGMUNE_HUB_TOKEN` Bearer 认证（客户端 `PROGMUNE_HUB_TOKEN` 环境变量同步支持）
+- 回归 12 green；hub 冒烟六场景（正常/畸形/去重/超大/限流/认证）全过
+
+## [3.7.24] — 2026-09-06
+
+### 审计复检三项修复
+
+- **空规则集 fail-closed**：`evaluatePolicy` 对空规则数组直接 BLOCK（合成 `policy_config` 违规）——空数组是 truthy，原实现零规则→零违规→ALLOW；写盘门 / policy CLI / MCP 三路径同步收口，测试锁定
+- **loadEnterprisePolicyConfig 解析失败显式携带 configError**（与 loadPolicyConfig 同口径，六条 fail-open 中第 4 条全修）
+- **写盘门口径修正**（README 双语 / TIERED_POLICY / AUDIT_RESPONSE）：「写盘策略门」→「**写后回滚门——BLOCK 时文件不残留**」，明确为补偿控制而非写前拦截，写盘与回滚之间进程中断的残留为已知边界
+- **落地页 66 金标口径自解释**：「66 金标 检出 64（97%）/ 100% / 0 FP——2 条为注解依赖前置的已知漏检（基线文档单列）」，与发布门 64 一致
+- npm gitHead 溯源核对：npm gitHead = tag v3.7.23 commit，三点对齐（发布产物 ↔ tag ↔ 发布 commit）
+- 回归 29 green；check 免疫正常
+
 ## [3.7.23] — 2026-09-06
 
 ### 第三方审计修复批次 + Oracle 隔离政策 + 分资产分级策略
 
-- **治理层 fail-open 修复**（Kimi 行号级审计 P0）：risk 规则 fail-closed（不再伪造 SSL 输入，真实调用提取，无数据/模块不可用 → 显式违规）；kb_coverage 显式化；策略配置解析失败拒绝静默评估（policy CLI exit 2）；**execute 写盘策略门**（项目 opt-in `.progmune-policy.json` 后写盘即时验证，BLOCK 自动回滚——策略引擎首次获得写盘强制力）；`PROGMUNE_STRICT=false` 逃生门写入审计事件日志；决策层注释与实现对齐（乘积→加权平均）；证书时间戳贯通 PolicyContext；**潜伏 bug**：certify 的 plsbRecall 恒为 0（metadata 从未有 recall 字段，HIGH 置信度门槛永远不可达）→ 修为 verified/total
+- **治理层 fail-open 修复**（Kimi 行号级审计 P0）：risk 规则 fail-closed（不再伪造 SSL 输入，真实调用提取，无数据/模块不可用 → 显式违规）；kb_coverage 显式化；策略配置解析失败拒绝静默评估（policy CLI exit 2）；**execute 写后回滚门**（项目 opt-in `.progmune-policy.json` 后写盘随即验证，BLOCK 时文件不残留——补偿控制而非写前拦截，写盘与回滚间进程中断为已知边界；策略引擎首次获得写盘强制力）；`PROGMUNE_STRICT=false` 逃生门写入审计事件日志；决策层注释与实现对齐（乘积→加权平均）；证书时间戳贯通 PolicyContext；**潜伏 bug**：certify 的 plsbRecall 恒为 0（metadata 从未有 recall 字段，HIGH 置信度门槛永远不可达）→ 修为 verified/total
 - **跨命名空间死规则归位 + 活性守卫**（Kimi 发现 3 系统化）：全量扫描 14 条死规则——4 条归位（logout_without_invalidate/admin_action_without_check/double_commit/check_resource_ownership 挪进 pre 状态所在命名空间）、10 条 printlab 业务链为文档化例外（待跨命名空间状态引用特性）；`protocol-rules-liveness.test.ts` 使死规则永久回归可防
 - **P1 批**：SUPPRESS 等全部决策持久化审计事件日志（含 fpRate/envFactor/importance 全输入）；截断序列覆盖率显式降级上报（truncatedSequences + summary 标注）；README 双语边界声明（刻意规避不在防护目标内 / BLOCK 强制力三执行点）；FAQ 澄清 LLM 密钥为可选增强；落地页免疫叙事收敛
 - **Oracle 隔离政策**（Hunyuan 定律 5 落地，`docs/ORACLE_ISOLATION_POLICY.md`）：四类评估体系变更（规则/匹配策略/阈值/别名）必须人工确认，AI 只提案；protocols.json 全量 `status: "confirmed"` + 加载端跳过 proposed + `scripts/rule-propose.js` 提案脚手架；evaluateTrust 输出 **oracleIndependence**（confirmedRules / sameSourceAnnotations / confirmedAliases）

package/README.md

@@ -6,6 +6,10 @@
 [![MCP](https://img.shields.io/badge/MCP-Compatible-blue)](https://modelcontextprotocol.io)
 [![TS Benchmark](https://img.shields.io/badge/TS%20R98.5%25%20P100%25-22c55e)]()
 [![Python Benchmark](https://img.shields.io/badge/Python%20R100%25%20P100%25-22c55e)]()
+[![npm version](https://img.shields.io/npm/v/progmune-runtime?color=cb3837)](https://www.npmjs.com/package/progmune-runtime)
+[![npm weekly downloads](https://img.shields.io/npm/dw/progmune-runtime?color=cb3837)](https://www.npmjs.com/package/progmune-runtime)
+[![GitHub stars](https://img.shields.io/github/stars/shenlian19831109/progmune-runtime?color=gold)](https://github.com/shenlian19831109/progmune-runtime)
+[![GitHub release](https://img.shields.io/github/v/release/shenlian19831109/progmune-runtime?color=gold)](https://github.com/shenlian19831109/progmune-runtime/releases)
 
 > [中文版](https://github.com/shenlian19831109/progmune-runtime/blob/main/README.zh-CN.md) · English Version
 
@@ -119,7 +123,7 @@ Progmune is honest about what it can and cannot verify.
 - **Framework internals** — well-known framework dispatch/cache machinery (e.g. django-unicorn internals) can produce a small number of boundary false positives; they are documented per-corpus in the benchmark gold files.
 - **Known failure boundaries are documented** rather than hidden: if Progmune cannot verify a language (e.g. Go), Confidence is lowered instead of pretending 100%.
 - **Deliberate evasion is out of scope** — the annotation-driven model catches *accidental* AI protocol mistakes (missing prerequisites, wrong ordering); it does not defend against adversarial renaming/obfuscation (true of any static tool).
-- **BLOCK enforcement is the integrator's responsibility** — Progmune outputs decisions and evidence; it does not intercept at runtime. OS-level enforcement points: `trust --ci` exit code (CI gates), `policy CLI` exit code, and the opt-in write-gate (with `.progmune-policy.json`, `execute` verifies immediately after writing and rolls back on BLOCK).
+- **BLOCK enforcement is the integrator's responsibility** — Progmune outputs decisions and evidence; it does not intercept at runtime. OS-level enforcement points: `trust --ci` exit code (CI gates), `policy CLI` exit code, and the opt-in **write-then-rollback gate** (with `.progmune-policy.json`, `execute` writes then verifies immediately; on BLOCK the file does not persist. This is a compensating control, not pre-write interception: a process killed between write and rollback may leave the content behind — a known boundary).
 
 **Tiered adoption by asset class** ([TIERED_POLICY](https://github.com/shenlian19831109/progmune-runtime/blob/main/docs/TIERED_POLICY.md)): don't gate all code alike — pick a tier by "cost of failure × AI involvement", one command to install:
 

package/README.zh-CN.md

@@ -119,7 +119,7 @@ Progmune 对能验证什么、不能验证什么保持诚实。
 - **框架内部件**——知名框架的分发/缓存机制（如 django-unicorn 内部件）可能产生少量边界误报；各语料基准 gold 文件中已逐条记录。
 - **已知失败边界一律记录**而非隐藏：如果 Progmune 无法验证某语言（如 Go），置信度会降低而不是假装 100%。
 - **刻意规避不在防护目标内**——注解驱动模型拦截的是 AI 的「意外」协议错误（漏写前置步骤、顺序颠倒）；对故意改名/混淆的对抗性规避不设防（任何静态工具同理）。
-- **BLOCK 的强制力由集成方承担**——Progmune 输出判定与证据，不运行时拦截。OS 级强制执行点：`trust --ci` 退出码（CI 门禁）、`policy CLI` 退出码、以及 opt-in 的写盘策略门（项目配置 `.progmune-policy.json` 后，execute 写盘即时验证，BLOCK 自动回滚）。
+- **BLOCK 的强制力由集成方承担**——Progmune 输出判定与证据，不运行时拦截。OS 级强制执行点：`trust --ci` 退出码（CI 门禁）、`policy CLI` 退出码、以及 opt-in 的**写后回滚门**（项目配置 `.progmune-policy.json` 后，execute 写盘随即验证，BLOCK 时文件不残留。注意这是补偿控制而非写前拦截：写盘与回滚之间若进程被中断，违规内容可能短暂/持续残留——已知边界）。
 
 **分资产分级接入**（[TIERED_POLICY](https://github.com/shenlian19831109/progmune-runtime/blob/main/docs/TIERED_POLICY.md)）：不要给所有代码同一套门禁——按「出错代价 × AI 参与度」选档，一条命令落地：
 

package/dist/immune-reporter.js

@@ -33,6 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildHeaders = buildHeaders;
+exports.resolveEndpoint = resolveEndpoint;
+exports.maskFunctionName = maskFunctionName;
 exports.extractFingerprints = extractFingerprints;
 exports.reportFingerprints = reportFingerprints;
 exports.previewFingerprints = previewFingerprints;
@@ -41,8 +44,34 @@ const path = __importStar(require("path"));
 const https = __importStar(require("https"));
 const http = __importStar(require("http"));
 const crypto = __importStar(require("crypto"));
-const REPORT_ENDPOINT = process.env.PROGMUNE_HUB || "http://localhost:3000/report";
-const CURSOR_FILE = path.resolve(__dirname, "../.progmune_memory/report_cursor.json");
+// ── 数据源（与 failure-corpus.ts 统一路径，项目级、可写） ──
+const PROJECT_DIR = process.env.PROGMUNE_PROJECT_DIR || process.cwd();
+const CORPUS_DIR = process.env.PROGMUNE_CORPUS_DIR || path.resolve(PROJECT_DIR, ".progmune_corpus");
+const CURSOR_FILE = path.join(CORPUS_DIR, ".report_cursor.json");
+// ── 端点与开关 ──
+const HUB_ENV = process.env.PROGMUNE_HUB;
+const HUB_TOKEN = process.env.PROGMUNE_HUB_TOKEN;
+const DETAIL_ENABLED = process.env.PROGMUNE_FINGERPRINT_DETAIL === "1";
+const OFF_PATTERN = /^(off|0|false|no|disabled)$/i;
+/** 上报请求头：hub 设了 PROGMUNE_HUB_TOKEN 时需带 Bearer 认证。 */
+function buildHeaders(token = HUB_TOKEN) {
+    const headers = { "Content-Type": "application/json" };
+    if (token)
+        headers["Authorization"] = `Bearer ${token}`;
+    return headers;
+}
+/** 解析上报端点：显式关闭 → null；未设 → 中央 hub；其他 → 自定义 URL。 */
+function resolveEndpoint(env = HUB_ENV) {
+    if (env && OFF_PATTERN.test(env))
+        return null;
+    return env || "https://progmune-runtime.fly.dev/report";
+}
+/** 脱敏：默认哈希函数名；DETAIL 开关打开时保留原文。 */
+function maskFunctionName(name, detail = DETAIL_ENABLED) {
+    if (detail)
+        return name;
+    return "fn:" + crypto.createHash("sha256").update(name).digest("hex").substring(0, 12);
+}
 function getInstanceId() {
     const host = require("os").hostname();
     const cwd = process.cwd();
@@ -62,8 +91,8 @@ function saveReportCursor(timestamp, count) {
         fs.mkdirSync(dir, { recursive: true });
     fs.writeFileSync(CURSOR_FILE, JSON.stringify({ lastTimestamp: timestamp, reportedCount: count, updatedAt: new Date().toISOString() }, null, 2));
 }
-function extractFingerprints(cursor) {
-    const corpusDir = path.resolve(__dirname, "../failure_corpus");
+/** 收集语料目录中的新失败指纹（含脱敏处理）。corpusDir 参数便于测试注入。 */
+function extractFingerprints(cursor, corpusDir = CORPUS_DIR) {
     if (!fs.existsSync(corpusDir))
         return [];
     const fingerprints = [];
@@ -73,16 +102,22 @@ function extractFingerprints(cursor) {
         if (!fs.statSync(datePath).isDirectory())
             continue;
         for (const file of fs.readdirSync(datePath).sort()) {
-            if (!file.endsWith(".json"))
+            if (!file.endsWith(".json") || !file.startsWith("fail_"))
                 continue;
             const filePath = path.join(datePath, file);
-            const record = JSON.parse(fs.readFileSync(filePath, "utf-8"));
-            // 如果游标存在且该记录时间戳 <= 游标，跳过
-            if (cursor && cursor.lastTimestamp && record.timestamp <= cursor.lastTimestamp)
+            let record;
+            try {
+                record = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+            }
+            catch {
+                continue; /* 损坏记录跳过，best-effort */
+            }
+            // 游标存在且该记录时间戳 <= 游标，跳过
+            if (cursor && cursor.lastTimestamp && (record.timestamp || "") <= cursor.lastTimestamp)
                 continue;
             const funcSeq = (record.actionSequence || [])
                 .filter((a) => a.kind === "call")
-                .map((a) => a.function);
+                .map((a) => maskFunctionName(String(a.function)));
             fingerprints.push({
                 instance_id: instanceId,
                 timestamp: record.timestamp,
@@ -99,6 +134,10 @@ function extractFingerprints(cursor) {
 }
 /** @requires CORPUS @produces FINGERPRINT_REPORT */
 async function reportFingerprints() {
+    const endpoint = resolveEndpoint();
+    if (endpoint === null) {
+        return { success: true, message: "上报已禁用（PROGMUNE_HUB=off），跳过" };
+    }
     const cursor = getReportCursor();
     const fingerprints = extractFingerprints(cursor);
     if (fingerprints.length === 0) {
@@ -109,11 +148,11 @@ async function reportFingerprints() {
     const maxTimestamp = fingerprints[fingerprints.length - 1].timestamp;
     const payload = JSON.stringify({ fingerprints });
     return new Promise((resolve) => {
-        const url = new URL(REPORT_ENDPOINT);
+        const url = new URL(endpoint);
         const transport = url.protocol === "https:" ? https : http;
-        const req = transport.request(REPORT_ENDPOINT, {
+        const req = transport.request(endpoint, {
             method: "POST",
-            headers: { "Content-Type": "application/json" },
+            headers: buildHeaders(),
         }, (res) => {
             let data = "";
             res.on("data", (chunk) => data += chunk);
@@ -128,6 +167,7 @@ async function reportFingerprints() {
                 }
             });
         });
+        req.setTimeout(8000, () => req.destroy(new Error("上报超时")));
         req.on("error", (e) => resolve({ success: false, message: `网络错误: ${e.message}` }));
         req.write(payload);
         req.end();

package/dist/immune-reporter.test.js

@@ -0,0 +1,149 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const immune_reporter_1 = require("./immune-reporter");
+/**
+ * Immune Reporter 测试——2026-09 修复轮：
+ * 默认脱敏、PROGMUNE_HUB=off 开关、语料路径对齐 .progmune_corpus。
+ * 涉及文件系统的用例使用临时目录注入（corpusDir 参数），不触碰真实语料。
+ */
+let tmpDir;
+(0, vitest_1.beforeEach)(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "progmune-reporter-"));
+});
+(0, vitest_1.afterEach)(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+});
+(0, vitest_1.describe)("resolveEndpoint", () => {
+    (0, vitest_1.it)("未设置 PROGMUNE_HUB 时默认指向中央 hub", () => {
+        (0, vitest_1.expect)((0, immune_reporter_1.resolveEndpoint)(undefined)).toBe("https://progmune-runtime.fly.dev/report");
+    });
+    (0, vitest_1.it)("PROGMUNE_HUB=off 及其变体（0/false/no/disabled）关闭上报", () => {
+        for (const v of ["off", "0", "false", "no", "disabled", "OFF"]) {
+            (0, vitest_1.expect)((0, immune_reporter_1.resolveEndpoint)(v)).toBeNull();
+        }
+    });
+    (0, vitest_1.it)("自定义 URL 原样生效", () => {
+        (0, vitest_1.expect)((0, immune_reporter_1.resolveEndpoint)("http://localhost:9999/report")).toBe("http://localhost:9999/report");
+    });
+});
+(0, vitest_1.describe)("maskFunctionName", () => {
+    (0, vitest_1.it)("默认脱敏：同名函数产生相同哈希（模式聚合保持有效）", () => {
+        const a = (0, immune_reporter_1.maskFunctionName)("generate_jwt", false);
+        const b = (0, immune_reporter_1.maskFunctionName)("generate_jwt", false);
+        (0, vitest_1.expect)(a).toBe(b);
+        (0, vitest_1.expect)(a).toMatch(/^fn:[0-9a-f]{12}$/);
+        (0, vitest_1.expect)(a).not.toContain("generate_jwt");
+    });
+    (0, vitest_1.it)("不同函数名产生不同哈希", () => {
+        (0, vitest_1.expect)((0, immune_reporter_1.maskFunctionName)("generate_jwt", false)).not.toBe((0, immune_reporter_1.maskFunctionName)("create_session", false));
+    });
+    (0, vitest_1.it)("PROGMUNE_FINGERPRINT_DETAIL=1 时保留原文", () => {
+        (0, vitest_1.expect)((0, immune_reporter_1.maskFunctionName)("generate_jwt", true)).toBe("generate_jwt");
+    });
+});
+(0, vitest_1.describe)("buildHeaders", () => {
+    (0, vitest_1.it)("无 token 时只带 Content-Type", () => {
+        (0, vitest_1.expect)((0, immune_reporter_1.buildHeaders)(undefined)).toEqual({ "Content-Type": "application/json" });
+    });
+    (0, vitest_1.it)("设置 PROGMUNE_HUB_TOKEN 时带 Bearer 认证头", () => {
+        const h = (0, immune_reporter_1.buildHeaders)("secret-token");
+        (0, vitest_1.expect)(h["Authorization"]).toBe("Bearer secret-token");
+        (0, vitest_1.expect)(h["Content-Type"]).toBe("application/json");
+    });
+});
+(0, vitest_1.describe)("extractFingerprints", () => {
+    function writeRecord(date, id, record) {
+        const dir = path.join(tmpDir, date);
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(path.join(dir, `fail_${id}.json`), JSON.stringify(record));
+    }
+    (0, vitest_1.it)("从 .progmune_corpus 路径读取并默认脱敏函数名", () => {
+        writeRecord("2026-09-09", "1", {
+            timestamp: "2026-09-09T10:00:00.000Z",
+            violatedSVL: "SVL-4",
+            constraintType: "protocol",
+            actionSequence: [{ kind: "call", function: "generate_jwt" }],
+            ssgState: ["UNAUTHENTICATED"],
+        });
+        const fps = (0, immune_reporter_1.extractFingerprints)({ lastTimestamp: null }, tmpDir);
+        (0, vitest_1.expect)(fps.length).toBe(1);
+        (0, vitest_1.expect)(fps[0].functionSequence[0]).toMatch(/^fn:[0-9a-f]{12}$/);
+        (0, vitest_1.expect)(fps[0].preState).toEqual([["UNAUTHENTICATED"]]);
+    });
+    (0, vitest_1.it)("游标之后的新记录才会上报，旧记录跳过", () => {
+        writeRecord("2026-09-01", "old", {
+            timestamp: "2026-09-01T10:00:00.000Z",
+            violatedSVL: "SVL-4",
+            constraintType: "protocol",
+            actionSequence: [],
+        });
+        writeRecord("2026-09-09", "new", {
+            timestamp: "2026-09-09T10:00:00.000Z",
+            violatedSVL: "SVL-4",
+            constraintType: "protocol",
+            actionSequence: [],
+        });
+        const fps = (0, immune_reporter_1.extractFingerprints)({ lastTimestamp: "2026-09-05T00:00:00.000Z" }, tmpDir);
+        (0, vitest_1.expect)(fps.length).toBe(1);
+        (0, vitest_1.expect)(fps[0].timestamp).toBe("2026-09-09T10:00:00.000Z");
+    });
+    (0, vitest_1.it)("非 fail_ 前缀文件与损坏 JSON 跳过，不中断", () => {
+        writeRecord("2026-09-09", "ok", {
+            timestamp: "2026-09-09T10:00:00.000Z",
+            violatedSVL: "SVL-4",
+            constraintType: "protocol",
+            actionSequence: [],
+        });
+        fs.writeFileSync(path.join(tmpDir, "2026-09-09", "trajectory_x.json"), "{}");
+        fs.writeFileSync(path.join(tmpDir, "2026-09-09", "fail_broken.json"), "{corrupted");
+        const fps = (0, immune_reporter_1.extractFingerprints)({ lastTimestamp: null }, tmpDir);
+        (0, vitest_1.expect)(fps.length).toBe(1);
+    });
+    (0, vitest_1.it)("无调用序列时 functionSequence 为空数组而非报错", () => {
+        writeRecord("2026-09-09", "empty", {
+            timestamp: "2026-09-09T10:00:00.000Z",
+            violatedSVL: "SVL-2",
+            constraintType: "types",
+        });
+        const fps = (0, immune_reporter_1.extractFingerprints)({ lastTimestamp: null }, tmpDir);
+        (0, vitest_1.expect)(fps.length).toBe(1);
+        (0, vitest_1.expect)(fps[0].functionSequence).toEqual([]);
+    });
+});

package/dist/policy/engine.js

@@ -135,6 +135,28 @@ function extractCallsBestEffort(file) {
 function evaluatePolicy(ctx, rules) {
     const activeRules = rules || types_1.DEFAULT_POLICY;
     const violations = [];
+    // fail-closed（审计复检 2026-09-06）：空数组是 truthy，原实现会
+    // 零规则 → 零违规 → ALLOW——空规则集必须拒绝而非放行
+    if (activeRules.length === 0) {
+        return {
+            passed: false,
+            verdict: "BLOCK",
+            rules: 0,
+            passed_rules: 0,
+            failed_rules: 1,
+            violations: [{
+                    rule: {
+                        type: "policy_config",
+                        severity: "block",
+                        description: "Empty policy ruleset is rejected (fail-closed)",
+                    },
+                    actual: "0 active rules",
+                    expected: ">= 1 active rule",
+                    detail: "empty ruleset passes nothing — refusing to ALLOW (fail-closed)",
+                }],
+            summary: "BLOCK: empty policy ruleset",
+        };
+    }
     for (const rule of activeRules) {
         switch (rule.type) {
             // ── Confidence ──
@@ -391,7 +413,13 @@ function loadEnterprisePolicyConfig(projectPath, configPath) {
         };
     }
     catch (e) {
-        console.error(`⚠️  Failed to load enterprise policy config: ${e.message}. Using defaults.`);
-        return emptyResult;
+        console.error(`⚠️  Failed to load enterprise policy config: ${e.message}.`);
+        // fail-closed 信号（审计复检 2026-09-06）：与 loadPolicyConfig 同口径——
+        // 显式携带 configError，调用方拒绝静默评估
+        return {
+            ...emptyResult,
+            source: "built-in defaults (enterprise config error)",
+            configError: `Failed to parse ${cfgFile}: ${e.message}`,
+        };
     }
 }

package/dist/policy/engine.test.js

@@ -97,6 +97,14 @@ function baseCtx(file) {
         (0, vitest_1.expect)(res.configError).toBeDefined();
         (0, vitest_1.expect)(res.configError).toContain("Failed to parse");
     });
+    (0, vitest_1.it)("空规则集 fail-closed：[] 是 truthy 但必须拒绝（BLOCK，非 ALLOW）", () => {
+        const f = path.join(dir, "empty.ts");
+        fs.writeFileSync(f, "");
+        const result = (0, engine_1.evaluatePolicy)(baseCtx(f), []);
+        (0, vitest_1.expect)(result.passed).toBe(false);
+        (0, vitest_1.expect)(result.verdict).toBe("BLOCK");
+        (0, vitest_1.expect)(result.violations.some((v) => v.rule.type === "policy_config")).toBe(true);
+    });
 });
 (0, vitest_1.describe)("execute 写盘策略门（opt-in）", () => {
     const MARKED = `// @progmune-generated session=s1 timestamp=2026-09-06T00:00:00.000Z

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.23";
+exports.RUNTIME_VERSION = "3.7.25";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.23",
+  "version": "3.7.25",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",