progmune-runtime 3.7.68 → 3.7.69

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## [3.7.69] — 2026-10-17
+
+### 公开表面传播豁免（修冤枉第十刀）
+
+**根因**：@Public()/@SkipAuth()/@AllowAnonymous 是开发者**显式声明**
+免鉴权（正向证据，R75），但提取器只在 E2 的 skip 方向认识它们
+（「不注入鉴权标记」）——授权族规则照旧提问「缺鉴权」，公开端点
+自身（docmost 15 个 @Public 方法 17 条告警）与纯公开下游（10 条）
+全数误报。与第六刀（无请求面）同族，差在面向请求面——公开端点
+是请求面，只是免鉴权。
+
+- **提取器**：类级/方法级 @Public/@SkipAuth/@AllowAnonymous ⇒ 注入
+  `__progmune_public_surface__`（与 E2/第六刀并列；类级作用于全方法）。
+  ⚠ 注入名只收三个 NestJS 惯例装饰器，与 E2 的 AUTH_SKIP_DECORATOR
+  **不对称是故意的**：skip 方向多收（IsPublic/NoAuth/ApiExcludeEndpoint）
+  是防「公开判成有鉴权」，注入方向少收是防「受限判成公开」——两个
+  方向的错判都是假阴性；@ApiExcludeEndpoint 是 Swagger 文档语义，
+  绝不注入
+- **规则侧（Part A，第六刀同架构）**：授权族四条（Access/Mutation/
+  Ownership/Resource Ownership）safeguard 接受标记——公开端点自身的
+  告警直接消除（标记本身就是证据，与 no_request_surface 并列）
+- **传播（Part B）**：computePublicSurfacePropagatedSet——F 的每个
+  直接调用方 ∈ {公开面} ∪ {已守卫} ∪ {作业面} ⇒ 豁免；R1 调用方非空
+  / R2 边全解析 / R3 并集外照报 / R4 默认 1 轮 / R5 返回只含新增成员。
+  引擎侧 suppressed 带 `suppressedByPublicSurfacePropagation` 标记（R9），
+  `PROGMUNE_PUBLIC_SURFACE_TOGGLE=off` 逃生门；并集含守卫∪作业 ⇒ 是
+  第九刀超集，消费顺序 guard→job→mixed→public 保证不重复挂标记
+- **三向 A/B（docmost，各 fresh IR）**：①control（传播关）vs 3.7.68
+  基线 = **精确 −17 条 Part A**（全落 12 个 @Public 方法，新增 0，
+  suppressed 156=156 不变）；②pre vs control = **精确 −10 条 Part B**
+  （全带 public 标记，suppressed 156→166）；③主路径 violations
+  11=11 / score 84=84 三臂一致。告警流累计 992→…→685→669→**642**
+- **FN 风险逐条复核**：10 条传播候选全核调用方——搜索/分享/公开空间
+  服务只被 @UseGuards(JwtAuthGuard) 类级守卫路由或 @Public 路由调用
+  （search.controller.ts 类级守卫 + 方法级 @Public 并存形态），TP 0；
+  公开端点自身由装饰器显式声明
+- **回归锁定**：提取器 5 例 + 规则侧 5 例 + 传播 10 例 + 引擎产品
+  路径 2；全量 541/541（首跑 1 失败为 worker 超时环境噪音，复跑全绿）；
+  三闸门（taintpath 160 / webshape 72 / fr-007 pre5-post0 + fr-016
+  pre7-post0）；TS 盲测 119 项目 LOST 0/ADDED 0（generated 语料无
+  @Public 形状，零漂移由构造保证 R23 家族）
+
 ## [3.7.68] — 2026-10-16
 
 ### 调用方混合并集豁免（修冤枉第九刀）

package/dist/extract-ir-public-surface.test.js

@@ -0,0 +1,152 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const extract_ir_1 = require("./extract-ir");
+/**
+ * 修冤枉第十刀（2026-10-16）：公开设计端点 → 公开面标记锁定。
+ *
+ * 数据：docmost 15 个 @Public() 方法自身 17 条授权族告警全 FP——
+ * 公开是开发者显式声明（正向证据，R75），授权族「缺鉴权」提问不适用。
+ *
+ * 注入形态：类级/方法级 @Public/@SkipAuth/@AllowAnonymous（NestJS 惯例）。
+ * 反例（不注入）：@ApiExcludeEndpoint 是 Swagger 文档语义；
+ * 与 AUTH_SKIP_DECORATOR 不对称是故意的（两个方向的错判都是假阴性）。
+ */
+const MARK = "__progmune_public_surface__";
+const TSCONFIG = JSON.stringify({
+    compilerOptions: { target: "ES2020", module: "commonjs", strict: false, skipLibCheck: true, noEmit: true },
+    include: ["**/*.ts"],
+});
+function makeProject(files) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-publicsurface-"));
+    fs.writeFileSync(path.join(dir, "tsconfig.json"), TSCONFIG);
+    fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ name: "fixture", version: "0.0.0", private: true }));
+    for (const [rel, body] of Object.entries(files)) {
+        const abs = path.join(dir, rel);
+        fs.mkdirSync(path.dirname(abs), { recursive: true });
+        fs.writeFileSync(abs, body);
+    }
+    return dir;
+}
+function callsOf(dir, fnName) {
+    const fns = (0, extract_ir_1.extractIR)(dir);
+    const f = fns.find((x) => x.name === fnName);
+    return f ? (f.calls ?? []) : [];
+}
+(0, vitest_1.describe)("extractIR：公开面标记（修冤枉第十刀）", () => {
+    (0, vitest_1.it)("@Public() 类级 ⇒ 全部方法注入", () => {
+        const dir = makeProject({
+            "a.ts": `
+declare const Public: any; declare const Controller: any; declare const Get: any;
+@Public()
+@Controller("public-space")
+export class PublicSpaceController {
+  @Get("info")
+  getInfo() { return 1; }
+  getTree() { return 2; }
+}
+`,
+        });
+        (0, vitest_1.expect)(callsOf(dir, "PublicSpaceController.getInfo")).toContain(MARK);
+        (0, vitest_1.expect)(callsOf(dir, "PublicSpaceController.getTree")).toContain(MARK);
+    });
+    (0, vitest_1.it)("@Public/@SkipAuth/@AllowAnonymous 方法级 ⇒ 仅该方法注入", () => {
+        const dir = makeProject({
+            "a.ts": `
+declare const Public: any; declare const SkipAuth: any; declare const AllowAnonymous: any;
+export class ShareController {
+  @Public()
+  getShare() {}
+  @SkipAuth()
+  getSharedPageInfo() {}
+  @AllowAnonymous()
+  transclusionLookup() {}
+  getPrivateShare() {}
+}
+`,
+        });
+        for (const fn of ["ShareController.getShare", "ShareController.getSharedPageInfo", "ShareController.transclusionLookup"]) {
+            (0, vitest_1.expect)(callsOf(dir, fn)).toContain(MARK);
+        }
+        (0, vitest_1.expect)(callsOf(dir, "ShareController.getPrivateShare")).not.toContain(MARK);
+    });
+    (0, vitest_1.it)("反例：@ApiExcludeEndpoint 是 Swagger 文档语义，不注入", () => {
+        const dir = makeProject({
+            "a.ts": `
+declare const ApiExcludeEndpoint: any;
+export class DocController {
+  @ApiExcludeEndpoint()
+  hidden() {}
+}
+`,
+        });
+        (0, vitest_1.expect)(callsOf(dir, "DocController.hidden")).not.toContain(MARK);
+    });
+    (0, vitest_1.it)("@UseGuards + @Public 并存 ⇒ public 注入、auth 不注入（显式公开优先）", () => {
+        const dir = makeProject({
+            "a.ts": `
+declare const UseGuards: any; declare const Public: any;
+declare class JwtAuthGuard {}
+export class C {
+  @UseGuards(JwtAuthGuard)
+  @Public()
+  m() { return 1; }
+}
+`,
+        });
+        const calls = callsOf(dir, "C.m");
+        (0, vitest_1.expect)(calls).toContain(MARK);
+        (0, vitest_1.expect)(calls).not.toContain("__progmune_auth_machinery__");
+    });
+    (0, vitest_1.it)("普通守卫方法 ⇒ 不注入 public、注入 auth（两条通道互不污染）", () => {
+        const dir = makeProject({
+            "a.ts": `
+declare const UseGuards: any;
+declare class JwtAuthGuard {}
+export class C {
+  @UseGuards(JwtAuthGuard)
+  m() { return 1; }
+}
+`,
+        });
+        const calls = callsOf(dir, "C.m");
+        (0, vitest_1.expect)(calls).not.toContain(MARK);
+        (0, vitest_1.expect)(calls).toContain("__progmune_auth_machinery__");
+    });
+});

package/dist/extract-ir.js

@@ -500,6 +500,45 @@ function noRequestSurfaceFromDecorators(decorators) {
     return noSurface ? [NO_REQUEST_SURFACE_MARKER] : [];
 }
 // ═══════════════════════════════════════════════════════════════
+// 修冤枉第十刀（2026-10-16）：公开设计端点 → 公开面标记
+//
+// 数据：docmost 15 个 @Public() 方法自身 17 条授权族告警 + 下游
+// 纯公开可达 10 条（knife10-public-surface-probe.ts 量化）——公开是
+// 开发者显式声明（正向证据，R75），授权族「缺鉴权」提问不适用。
+//
+// 语义与 E2（auth_machinery）相反：E2 是「有鉴权」，本标记是
+// 「鉴权问题不适用」（与第六刀 no_request_surface 同族，但面向
+// 请求面——公开端点是请求面，只是免鉴权）。
+//
+// 注入名只收三个 NestJS 惯例装饰器：Public / SkipAuth / AllowAnonymous。
+// 与 AUTH_SKIP_DECORATOR（E2 的 skip 方向）不对称是**故意的**：
+//   skip 方向多收（IsPublic/NoAuth/ApiExcludeEndpoint）是防「把公开
+//   端点判成有鉴权」的假阴性；注入方向少收是防「把受限端点判成
+//   公开」的假阴性——两个方向的错判都是假阴性，都必须保守。
+// @ApiExcludeEndpoint 是 Swagger 文档语义，绝不注入。
+// ═══════════════════════════════════════════════════════════════
+const PUBLIC_SURFACE_MARKER = "__progmune_public_surface__";
+/** 显式公开装饰器 —— 出现即注入公开面标记（NestJS 惯例） */
+const PUBLIC_SURFACE_DECORATOR = /^(?:Public|SkipAuth|AllowAnonymous)$/i;
+/**
+ * 由类/方法装饰器判定是否注入公开面标记（与 E2/第六刀同款文本匹配）。
+ * @returns [] 或 [PUBLIC_SURFACE_MARKER]
+ */
+function publicSurfaceFromDecorators(decorators) {
+    let publicSurface = false;
+    for (const d of decorators) {
+        const text = (d?.getText?.() ?? "").trim();
+        const name = /^@([A-Za-z_$][\w$]*)/.exec(text)?.[1];
+        if (!name)
+            continue;
+        if (PUBLIC_SURFACE_DECORATOR.test(name)) {
+            publicSurface = true;
+            break;
+        }
+    }
+    return publicSurface ? [PUBLIC_SURFACE_MARKER] : [];
+}
+// ═══════════════════════════════════════════════════════════════
 // E3（2026-09-22）：TS 侧「入参已按 schema 校验」语义标记
 //
 // 判据（先抄准再写 expect，R22）：
@@ -3303,6 +3342,15 @@ function _extractSingleProject(absRoot, tsconfigPath) {
                     if (!mCalls.includes(mk))
                         mCalls.push(mk);
                 }
+                // 修冤枉第十刀：@Public()/@SkipAuth()/@AllowAnonymous → 公开面标记
+                // （与 E2/第六刀并列；类级公开装饰器作用于全部方法）
+                for (const mk of publicSurfaceFromDecorators([
+                    ...(cls.getDecorators?.() ?? []),
+                    ...(m.getDecorators?.() ?? []),
+                ])) {
+                    if (!mCalls.includes(mk))
+                        mCalls.push(mk);
+                }
                 funcs.push({
                     name: `${cn}.${mn}`,
                     params: mParams.map((p) => ({ name: p.getName(), type: getParamType(p), typeDetail: getParamTypeDetail(p) })),

package/dist/protocol-detector-public-surface-rule.test.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const protocol_detector_1 = require("./protocol-detector");
+/**
+ * 修冤枉第十刀（2026-10-16）：公开面标记的规则侧接受位锁定。
+ *
+ * 语义：@Public()/@SkipAuth()/@AllowAnonymous 是开发者显式声明免鉴权
+ * （正向证据，R75）——授权族四条的「缺鉴权/缺属主校验」提问在公开
+ * 端点上不适用。只抑制 authorization 类；其他族规则不受标记影响。
+ */
+const M = "__progmune_public_surface__";
+const has = (vs, rule) => vs.some((v) => v.rule === rule);
+(0, vitest_1.describe)("public_surface 标记：授权族四条接受、其他族不受影响", () => {
+    const calls = ["getShareTree", M];
+    (0, vitest_1.it)("Unauthenticated Access 被抑制", () => {
+        const bare = (0, protocol_detector_1.detectSafeguardViolations)(["getShareTree"], "ShareController.getShare", "typescript", ["shareId"], true);
+        (0, vitest_1.expect)(has(bare, "Authorization (Unauthenticated Access)")).toBe(true);
+        const withMark = (0, protocol_detector_1.detectSafeguardViolations)(calls, "ShareController.getShare", "typescript", ["shareId"], true);
+        (0, vitest_1.expect)(has(withMark, "Authorization (Unauthenticated Access)")).toBe(false);
+    });
+    (0, vitest_1.it)("Unauthenticated Mutation 被抑制", () => {
+        // updateInvite 直接命中 Mutation 触发词；真实语料里的 acceptInvite
+        // 告警靠函数体内调用上下文触发，隔离夹具用直接形态
+        const bare = (0, protocol_detector_1.detectSafeguardViolations)(["updateInvite"], "WorkspaceController.updateInvite", "typescript", ["token"], true);
+        (0, vitest_1.expect)(has(bare, "Authorization (Unauthenticated Mutation)")).toBe(true);
+        const withMark = (0, protocol_detector_1.detectSafeguardViolations)(["updateInvite", M], "WorkspaceController.updateInvite", "typescript", ["token"], true);
+        (0, vitest_1.expect)(has(withMark, "Authorization (Unauthenticated Mutation)")).toBe(false);
+    });
+    (0, vitest_1.it)("Ownership Check 被抑制（公开端点的属主校验提问不适用）", () => {
+        // sharePage 直接命中 Ownership 触发词（share+Page）；真实语料里的
+        // getSharedPageInfo 类告警靠同文件级调用上下文触发，隔离夹具用直接形态
+        const bare = (0, protocol_detector_1.detectSafeguardViolations)(["sharePage"], "ShareController.sharePage", "typescript", ["shareId"], true);
+        (0, vitest_1.expect)(has(bare, "Authorization (Ownership Check)")).toBe(true);
+        const withMark = (0, protocol_detector_1.detectSafeguardViolations)(["sharePage", M], "ShareController.sharePage", "typescript", ["shareId"], true);
+        (0, vitest_1.expect)(has(withMark, "Authorization (Ownership Check)")).toBe(false);
+    });
+    (0, vitest_1.it)("Resource Ownership 被抑制", () => {
+        const bare = (0, protocol_detector_1.detectSafeguardViolations)(["toggleShare"], "ShareController.toggleShare", "typescript", ["id"], true);
+        (0, vitest_1.expect)(has(bare, "Authorization (Resource Ownership)")).toBe(true);
+        const withMark = (0, protocol_detector_1.detectSafeguardViolations)(["toggleShare", M], "ShareController.toggleShare", "typescript", ["id"], true);
+        (0, vitest_1.expect)(has(withMark, "Authorization (Resource Ownership)")).toBe(false);
+    });
+    (0, vitest_1.it)("非授权族规则不受标记影响（渲染 sink 照报）", () => {
+        const vs = (0, protocol_detector_1.detectSafeguardViolations)(["render", M], "PublicController.renderTemplate", "typescript");
+        (0, vitest_1.expect)(has(vs, "No Input Sanitization")).toBe(true);
+    });
+});

package/dist/protocol-detector-public-surface.test.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const protocol_detector_1 = require("./protocol-detector");
+/**
+ * 公开表面传播豁免（修冤枉第十刀，2026-10-16）单元测试。
+ *
+ * 判据（见 computePublicSurfacePropagatedSet 注释）：
+ *   函数 F 的每个直接调用方都 ∈ {公开面} ∪ {已守卫传播集} ∪
+ *   {作业面传播集} ⇒ F 无未鉴权请求面（公开=开发者显式声明，
+ *   已守卫=过了鉴权，作业=无请求面）。
+ * R1-R5：调用方非空 / 边全解析 / 全部落在并集内 / 快照轮次默认 1 /
+ * 返回集合只含并集新增成员。
+ * 直接公开标记函数自身的告警由规则侧 safeguard 接受标记消除（R1 注）。
+ */
+const MG = "__progmune_auth_machinery__";
+const MJ = "__progmune_no_request_surface__";
+/** 便捷：guard/job/公开集 + 公开传播集一并算 */
+function sets(fns, publicFns, opts) {
+    const guard = (0, protocol_detector_1.computeGuardPropagatedSet)(fns);
+    const job = (0, protocol_detector_1.computeJobSurfacePropagatedSet)(fns);
+    const pub = new Set(publicFns);
+    const propagated = (0, protocol_detector_1.computePublicSurfacePropagatedSet)(fns, pub, guard, job, opts);
+    return { guard, job, pub, propagated };
+}
+(0, vitest_1.describe)("computePublicSurfacePropagatedSet（公开表面传播，第十刀）", () => {
+    (0, vitest_1.it)("只被公开端点调用 ⇒ 豁免", () => {
+        const fns = [
+            { name: "ShareController.getShare", file: "c/share.controller.ts", calls: ["getShareTree"] },
+            { name: "ShareService.getShareTree", file: "s/share.service.ts", calls: [] },
+        ];
+        const { propagated } = sets(fns, ["ShareController.getShare"]);
+        (0, vitest_1.expect)(propagated.has("ShareService.getShareTree")).toBe(true);
+    });
+    (0, vitest_1.it)("混合调用方（公开 + 已守卫）⇒ 豁免（第九刀够不着的形态）", () => {
+        const fns = [
+            { name: "GuardedController.create", file: "c/page.controller.ts", calls: [MG, "searchPage"] },
+            { name: "SearchController.searchShare", file: "c/search.controller.ts", calls: ["searchPage"] },
+            { name: "SearchService.searchPage", file: "s/search.service.ts", calls: [] },
+        ];
+        const { guard, propagated } = sets(fns, ["SearchController.searchShare"]);
+        (0, vitest_1.expect)(guard.has("SearchService.searchPage")).toBe(false); // 非全守卫 ⇒ 第五刀不豁免
+        (0, vitest_1.expect)(propagated.has("SearchService.searchPage")).toBe(true); // 公开∪守卫 并集 ⇒ 豁免
+    });
+    (0, vitest_1.it)("混合调用方（公开 + 作业）⇒ 豁免", () => {
+        const fns = [
+            { name: "ShareController.getShare", file: "c.ts", calls: ["getShareTree"] },
+            { name: "DigestJob.run", file: "q.ts", calls: [MJ, "getShareTree"] },
+            { name: "ShareService.getShareTree", file: "s.ts", calls: [] },
+        ];
+        const { propagated } = sets(fns, ["ShareController.getShare"]);
+        (0, vitest_1.expect)(propagated.has("ShareService.getShareTree")).toBe(true);
+    });
+    (0, vitest_1.it)("任一调用方在并集外（未守卫的非公开调用方）⇒ 不豁免（fail-safe）", () => {
+        const fns = [
+            { name: "ShareController.getShare", file: "c.ts", calls: ["getShareTree"] },
+            { name: "InternalController.export", file: "c2.ts", calls: ["getShareTree"] }, // 无守卫无公开标记
+            { name: "ShareService.getShareTree", file: "s.ts", calls: [] },
+        ];
+        const { propagated } = sets(fns, ["ShareController.getShare"]);
+        (0, vitest_1.expect)(propagated.has("ShareService.getShareTree")).toBe(false);
+    });
+    (0, vitest_1.it)("无调用方（入口/未连通）⇒ 不豁免（R1）", () => {
+        const fns = [{ name: "orphanEntry", file: "m.ts", calls: [] }];
+        const { propagated } = sets(fns, ["orphanEntry"]);
+        (0, vitest_1.expect)(propagated.has("orphanEntry")).toBe(false);
+    });
+    (0, vitest_1.it)("歧义调用边 ⇒ 不豁免（R2 fail-safe）", () => {
+        const fns = [
+            { name: "PublicController.get", file: "c/ctrl.ts", calls: ["load"] },
+            { name: "XxxService.load", file: "x/x.service.ts", calls: [] },
+            { name: "YyyService.load", file: "y/y.service.ts", calls: [] },
+        ];
+        const { propagated } = sets(fns, ["PublicController.get"]);
+        (0, vitest_1.expect)(propagated.has("XxxService.load")).toBe(false);
+        (0, vitest_1.expect)(propagated.has("YyyService.load")).toBe(false);
+    });
+    (0, vitest_1.it)("默认 1 轮：公开下游的下游不豁免（传递闭包未开）", () => {
+        const fns = [
+            { name: "ShareController.getShare", file: "c.ts", calls: ["getShareTree"] },
+            { name: "ShareService.getShareTree", file: "s.ts", calls: ["loadPageData"] },
+            { name: "loadPageData", file: "s.ts", calls: [] },
+        ];
+        const { propagated } = sets(fns, ["ShareController.getShare"]);
+        (0, vitest_1.expect)(propagated.has("ShareService.getShareTree")).toBe(true);
+        (0, vitest_1.expect)(propagated.has("loadPageData")).toBe(false);
+    });
+    (0, vitest_1.it)("maxRounds=2 ⇒ 传递两跳成立（快照轮次语义）", () => {
+        const fns = [
+            { name: "ShareController.getShare", file: "c.ts", calls: ["getShareTree"] },
+            { name: "ShareService.getShareTree", file: "s.ts", calls: ["loadPageData"] },
+            { name: "loadPageData", file: "s.ts", calls: [] },
+        ];
+        const { propagated } = sets(fns, ["ShareController.getShare"], { maxRounds: 2 });
+        (0, vitest_1.expect)(propagated.has("ShareService.getShareTree")).toBe(true);
+        (0, vitest_1.expect)(propagated.has("loadPageData")).toBe(true);
+    });
+    (0, vitest_1.it)("返回集合只含并集新增成员（R5：公开种子/守卫/作业成员不重复进）", () => {
+        const fns = [
+            { name: "PublicController.show", file: "c.ts", calls: ["target"] },
+            { name: "GuardedController.create", file: "c.ts", calls: [MG, "service"] },
+            { name: "Job.run", file: "q.ts", calls: [MJ, "jobOnly"] },
+            { name: "service", file: "s.ts", calls: ["target"] },
+            { name: "jobOnly", file: "s.ts", calls: ["target"] },
+            { name: "target", file: "s.ts", calls: [] },
+        ];
+        const { propagated } = sets(fns, ["PublicController.show"]);
+        // 公开种子自身、守卫/作业成员都不重复进 propagated
+        (0, vitest_1.expect)(propagated.has("PublicController.show")).toBe(false);
+        (0, vitest_1.expect)(propagated.has("Job.run")).toBe(false);
+        (0, vitest_1.expect)(propagated.has("service")).toBe(false); // 守卫传播成员（调用方全守卫）
+        (0, vitest_1.expect)(propagated.has("jobOnly")).toBe(false); // 作业面成员
+        (0, vitest_1.expect)(propagated.has("target")).toBe(true); // 调用方 {public[pub], service[g], jobOnly[j]} ⊆ 并集
+    });
+    (0, vitest_1.it)("自调不提供豁免证据", () => {
+        const fns = [{ name: "ShareService.getShareTree", file: "s.ts", calls: ["getShareTree"] }];
+        const { propagated } = sets(fns, []);
+        (0, vitest_1.expect)(propagated.has("ShareService.getShareTree")).toBe(false);
+    });
+});

package/dist/protocol-detector.js

@@ -18,6 +18,7 @@ exports.computeResolvedCallerMap = computeResolvedCallerMap;
 exports.computeGuardPropagatedSet = computeGuardPropagatedSet;
 exports.computeJobSurfacePropagatedSet = computeJobSurfacePropagatedSet;
 exports.computeMixedSurfacePropagatedSet = computeMixedSurfacePropagatedSet;
+exports.computePublicSurfacePropagatedSet = computePublicSurfacePropagatedSet;
 exports.detectSafeguardViolationsV7 = detectSafeguardViolationsV7;
 exports.detectProtocolViolations = detectProtocolViolations;
 exports.validateProtocolState = validateProtocolState;
@@ -390,7 +391,7 @@ const SAFEGUARD_RULES = [
             { pattern: /\b(hasPermission|checkPermission|checkAccess|isAuthorized|checkRole|requireRole|adminCheck|isAdmin|canModify|canDelete|canEdit)\b/i, label: "authz_check" },
             // 修冤枉第六刀：队列/定时/事件处理器不面向请求面——鉴权发生在入队侧，
             // 「改资源没查属主」的提问在处理器层不适用（docmost 补标注 FP 类）
-            { pattern: /\b(__progmune_no_request_surface__)\b/, label: "no_request_surface" },
+            { pattern: /\b(__progmune_no_request_surface__|__progmune_public_surface__)\b/, label: "no_request_surface" },
             { pattern: /\b(__progmune_ownership_checked__)\b/, label: "inline_ownership_check" },
             // §46 ②：资源属主被**赋值为当前主体**（`{ userId: user.id }` / `where:{userId: user.id}`）。
             // 这类函数的被操作对象就是（或已被限定在）主体自己，谈不上「改别人的东西」。
@@ -434,7 +435,7 @@ const SAFEGUARD_RULES = [
         paramTypeSafeguards: [SESSION_BEARING_TYPE_RE],
         trigger: /\b(list|download|view|fetch)(?:[A-Z]\w*|_\w+)|get(?:[A-Z]\w+|_\w+)/i,
         safeguards: [
-            { pattern: /\b(getUser|validateToken|verifyToken|verifySession|validateSession|getSessionUser|getSession\b|getCurrentUser|token\w*(Check|Verify|Valid)|session\w*(Check|Verify|Valid)|auth\w*(Check|Verify|Valid|Guard|Middleware|Required)|requireAuth|withAuth|authenticate\w*(User|Request|Token)?|checkAuth|isAuth|hasAuth|checkAccess|hasAccess|get_user|get_session_user|get_current_user|validate_session|verify_token|require_auth|with_auth|check_auth|auth_required|authenticate_user|authenticate_request|authenticate_token|token_check|token_verify|token_valid|session_check|session_verify|session_valid|auth_check|auth_guard|auth_middleware|get_current_user_authorizer|current_user_authorizer|login_required|permission_required|user_passes_test|check_authorization|check_permission|jwt\.decode|decode_token|__progmune_auth_checked__|__progmune_credential_check__|__progmune_drf_permissions__|__progmune_auth_machinery__|__progmune_no_request_surface__)\b/i, label: "auth_check" },
+            { pattern: /\b(getUser|validateToken|verifyToken|verifySession|validateSession|getSessionUser|getSession\b|getCurrentUser|token\w*(Check|Verify|Valid)|session\w*(Check|Verify|Valid)|auth\w*(Check|Verify|Valid|Guard|Middleware|Required)|requireAuth|withAuth|authenticate\w*(User|Request|Token)?|checkAuth|isAuth|hasAuth|checkAccess|hasAccess|get_user|get_session_user|get_current_user|validate_session|verify_token|require_auth|with_auth|check_auth|auth_required|authenticate_user|authenticate_request|authenticate_token|token_check|token_verify|token_valid|session_check|session_verify|session_valid|auth_check|auth_guard|auth_middleware|get_current_user_authorizer|current_user_authorizer|login_required|permission_required|user_passes_test|check_authorization|check_permission|jwt\.decode|decode_token|__progmune_auth_checked__|__progmune_credential_check__|__progmune_drf_permissions__|__progmune_auth_machinery__|__progmune_no_request_surface__|__progmune_public_surface__)\b/i, label: "auth_check" },
             // §40 C1：裸 can —— verdaccio 的 can('publish') 中间件就是这里的授权判定
             { pattern: exports.AUTHZ_BARE_CAN_RE, label: "bare_can", callsOnly: true },
         ],
@@ -473,7 +474,7 @@ const SAFEGUARD_RULES = [
         // (listPosts/getPost/deletePost fire via identifier-parsed words).
         trigger: /\b(add|create|update|set|publish|insert|submit)(?:[A-Z]\w*|_\w+)|(?:[A-Z]\w*|_\w+)(Add|Create|Update|Set|Publish|Insert|Submit)\b/i,
         safeguards: [
-            { pattern: /\b(getUser|validateToken|verifyToken|verifySession|validateSession|getSessionUser|getSession\b|getCurrentUser|token\w*(Check|Verify|Valid)|session\w*(Check|Verify|Valid)|auth\w*(Check|Verify|Valid|Guard|Middleware|Required)|requireAuth|withAuth|authenticate\w*(User|Request|Token)?|checkAuth|isAuth|hasAuth|checkAccess|hasAccess|get_user|get_session_user|get_current_user|validate_session|verify_token|require_auth|with_auth|check_auth|auth_required|authenticate_user|authenticate_request|authenticate_token|token_check|token_verify|token_valid|session_check|session_verify|session_valid|auth_check|auth_guard|auth_middleware|get_current_user_authorizer|current_user_authorizer|login_required|permission_required|user_passes_test|check_authorization|check_permission|__progmune_auth_checked__|__progmune_credential_check__|__progmune_drf_permissions__|__progmune_auth_machinery__|__progmune_no_request_surface__)\b/i, label: "auth_check" },
+            { pattern: /\b(getUser|validateToken|verifyToken|verifySession|validateSession|getSessionUser|getSession\b|getCurrentUser|token\w*(Check|Verify|Valid)|session\w*(Check|Verify|Valid)|auth\w*(Check|Verify|Valid|Guard|Middleware|Required)|requireAuth|withAuth|authenticate\w*(User|Request|Token)?|checkAuth|isAuth|hasAuth|checkAccess|hasAccess|get_user|get_session_user|get_current_user|validate_session|verify_token|require_auth|with_auth|check_auth|auth_required|authenticate_user|authenticate_request|authenticate_token|token_check|token_verify|token_valid|session_check|session_verify|session_valid|auth_check|auth_guard|auth_middleware|get_current_user_authorizer|current_user_authorizer|login_required|permission_required|user_passes_test|check_authorization|check_permission|__progmune_auth_checked__|__progmune_credential_check__|__progmune_drf_permissions__|__progmune_auth_machinery__|__progmune_no_request_surface__|__progmune_public_surface__)\b/i, label: "auth_check" },
             // §40 C1：裸 can —— 同上
             { pattern: exports.AUTHZ_BARE_CAN_RE, label: "bare_can", callsOnly: true },
             // §46 ①：凭签发入口豁免 —— 独立 safeguard，**不并入 auth_check**。
@@ -643,7 +644,7 @@ const SAFEGUARD_RULES = [
             { pattern: /\b(ownerId\s*[!=]==?|authorId\s*[!=]==?|userId\s*[!=]==?|createdBy|\.owner\s*[!=]==?)/i, label: "ownership_comparison" },
             { pattern: /\b(__progmune_ownership_checked__)\b/, label: "inline_ownership_check" },
             // 修冤枉第六刀：同上（无请求面 ⇒ 属主校验提问不适用）
-            { pattern: /\b(__progmune_no_request_surface__)\b/, label: "no_request_surface" },
+            { pattern: /\b(__progmune_no_request_surface__|__progmune_public_surface__)\b/, label: "no_request_surface" },
             // §38：同 Ownership Check，组合式谓语一并接上（这条规则更严，更需要）
             { pattern: exports.AUTHZ_PREDICATE_RE, label: "casl_predicate" },
             { pattern: exports.AUTHZ_CAN_HELPER_RE, label: "can_helper" },
@@ -1885,6 +1886,53 @@ function computeMixedSurfacePropagatedSet(funcs, guardSet, jobSet, opts) {
     }
     return mixed;
 }
+/**
+ * 修冤枉第十刀（2026-10-16）：公开表面传播豁免——
+ * 「函数的每个直接调用方都 ∈ {公开面传播集} ∪ {已守卫传播集} ∪
+ * {作业面传播集}」。
+ *
+ * 第九刀覆盖「守卫∪作业」混合；公开端点（@Public()/@SkipAuth()/
+ * @AllowAnonymous 显式免鉴权装饰器）是第三条正当路径——公开是开发者
+ * **显式声明**（正向证据，R75）：经由公开端点可达的函数，授权族提问
+ * 「缺鉴权」不适用（公开≠意外缺守卫；未公开却缺守卫照报）。
+ *
+ * 保守规则（与第五/九刀共享边解析，见 computeResolvedCallerMap R4）：
+ *   R1 调用方集合非空——入口函数无项目调用方，永不豁免（公开入口
+ *      自身的告警由规则侧 safeguard 接受标记直接消除，与第六刀同架构）
+ *   R2 每条调用边都必须可解析（resolved=true），歧义 fail-safe
+ *   R3 调用方必须 ∈ publicSet ∪ guardSet ∪ jobSet；任一在并集外 → 照报
+ *   R4 快照轮次语义；默认 1 轮
+ *   R5 返回集合只含并集【新增】成员
+ *
+ * 注意：并集含守卫∪作业 ⇒ 本集合是第九刀的超集；engine 消费顺序
+ * guard→job→mixed→public（未豁免才挂 public 标记）保证第九刀告警
+ * 不重复挂标记。
+ */
+function computePublicSurfacePropagatedSet(funcs, publicSet, guardSet, jobSet, opts) {
+    const maxRounds = opts?.maxRounds ?? 1;
+    const calleeToCallers = computeResolvedCallerMap(funcs);
+    const base = new Set([...publicSet, ...guardSet, ...jobSet]);
+    const added = new Set(); // R5：只记本轮新增
+    for (let round = 0; round < maxRounds; round++) {
+        const toAdd = [];
+        for (const f of funcs) {
+            if (base.has(f.name))
+                continue;
+            const callers = calleeToCallers.get(f.name) || [];
+            if (callers.length === 0)
+                continue; // R1：无调用方（入口/未连通）→ 不豁免
+            if (callers.every((c) => c.resolved && base.has(c.caller)))
+                toAdd.push(f.name);
+        }
+        if (toAdd.length === 0)
+            break;
+        for (const n of toAdd) {
+            base.add(n);
+            added.add(n);
+        }
+    }
+    return added;
+}
 /**
  * v7: Build safeguard context — own → same-file → caller chain.
  *

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.68";
+exports.RUNTIME_VERSION = "3.7.69";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -1520,6 +1520,21 @@ async function collectProtocolViolations(ctx, callGraph) {
                 const mixedSurfacePropagated = process.env.PROGMUNE_MIXED_SURFACE_TOGGLE === "off"
                     ? new Set()
                     : (0, protocol_detector_1.computeMixedSurfacePropagatedSet)(functions, guardPropagated, jobSurfacePropagated);
+                // 修冤枉第十刀（2026-10-16）：公开表面传播豁免——「每个直接
+                // 调用方都 ∈ {公开面} ∪ {已守卫} ∪ {作业面}」⇒ 无未鉴权请求面
+                // （公开=开发者显式声明，见 computePublicSurfacePropagatedSet
+                // R1-R5）。直接公开标记函数的告警由规则侧 safeguard 接受标记
+                // 消除（与第六刀同架构）；本传播只覆盖下游。并集含守卫∪作业
+                // ⇒ 是第九刀超集——消费顺序 guard→job→mixed→public，已豁免
+                // 的告警不重复挂 public 标记。
+                const publicMarked = new Set();
+                for (const f of functions) {
+                    if ((f.calls || []).includes("__progmune_public_surface__"))
+                        publicMarked.add(f.name);
+                }
+                const publicSurfacePropagated = process.env.PROGMUNE_PUBLIC_SURFACE_TOGGLE === "off"
+                    ? new Set()
+                    : (0, protocol_detector_1.computePublicSurfacePropagatedSet)(functions, publicMarked, guardPropagated, jobSurfacePropagated);
                 for (const f of functions) {
                     const fCalls = f.calls || [];
                     let svs;
@@ -1534,9 +1549,11 @@ async function collectProtocolViolations(ctx, callGraph) {
                     const params = (f.params || []).map((p) => ({ n: p.name, t: p.type || "" }));
                     const directlyMarked = fCalls.includes("__progmune_auth_machinery__");
                     const directlyJobMarked = fCalls.includes("__progmune_no_request_surface__");
+                    const directlyPublicMarked = fCalls.includes("__progmune_public_surface__");
                     const guardExempt = !directlyMarked && guardPropagated.has(f.name);
                     const jobExempt = !directlyJobMarked && jobSurfacePropagated.has(f.name);
                     const mixedExempt = !directlyMarked && !directlyJobMarked && mixedSurfacePropagated.has(f.name);
+                    const publicExempt = !directlyPublicMarked && publicSurfacePropagated.has(f.name);
                     for (const v of svs) {
                         const alert = {
                             rule: v.rule,
@@ -1560,6 +1577,10 @@ async function collectProtocolViolations(ctx, callGraph) {
                                 alert.suppressedByMixedSurfacePropagation = true;
                                 suppressed = true;
                             }
+                            if (!suppressed && publicExempt) {
+                                alert.suppressedByPublicSurfacePropagation = true;
+                                suppressed = true;
+                            }
                             if (suppressed) {
                                 safeguardAlertsSuppressed.push(alert);
                                 continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.68",
+  "version": "3.7.69",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",