slopbrick 0.34.10 → 0.35.0

package/dist/engine/worker.cjs

@@ -37185,6 +37185,61 @@ var javaSqlStringConcatRule = createRule({
   }
 });
 
+// src/rules/java/suspicious-implementation.ts
+var STRONG_VERB_REGEX = /(?:validate|validates|validated|verifies?|verify|check|checks?|checked|ensures?|ensure|ensured|verifies|verified|sanitize|sanitizes|sanitized|escape|escapes|escaped|authenticate|authenticates|authenticated|authorize|authorizes|authorized|audit|audits|audited|inspect|inspects|inspected|filter|filters?|filtered|normalize|normalizes|normalized|encrypt|encrypts|encrypted|decrypt|decrypts|decrypted|hash|hashes|hashed|sign|signs?|signed|compress|compresses|compressed|decompress|decompresses|decompressed|parse|parses|parsed|format|formats?|formatted)(?=[A-Z]|[^a-zA-Z]|$)/i;
+var METHOD_DECL_REGEX = /(?:public|private|protected)\s+(?:static\s+)?[\w<>,\s\[\]]+?\s+(\w+)\s*\([^)]*\)\s*\{([^{}]*)\}/g;
+var EMPTY_BODY_REGEX = /^\s*$/;
+var RETURN_CONSTANT_REGEX = /^\s*return\s+(?:null|true|false|0|1|0L|0\.0|"")\s*;\s*$/;
+var RETURN_INPUT_REGEX = /^\s*return\s+(\w+)\s*;\s*$/;
+var JUST_THROW_REGEX = /^\s*throw\s+new\s+(?:UnsupportedOperationException|UnsupportedOperationException\([^)]*\)|RuntimeException\([^)]*\)|IllegalStateException\([^)]*\))\s*;\s*$/;
+var javaSuspiciousImplementationRule = createRule({
+  id: "java/suspicious-implementation",
+  category: "security",
+  severity: "high",
+  aiSpecific: false,
+  description: "function name suggests validation/encryption/auth but body is empty or trivially wrong \u2014 content mismatch",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.java$/i.test(facts.filePath)) return issues;
+    if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+    let m;
+    METHOD_DECL_REGEX.lastIndex = 0;
+    while ((m = METHOD_DECL_REGEX.exec(source)) !== null) {
+      const methodName = m[1];
+      const body = m[2];
+      if (!STRONG_VERB_REGEX.test(methodName)) continue;
+      let reason = null;
+      if (EMPTY_BODY_REGEX.test(body)) {
+        reason = "empty body";
+      } else if (RETURN_CONSTANT_REGEX.test(body)) {
+        reason = "returns a constant (null/true/false/0/1)";
+      } else if (RETURN_INPUT_REGEX.test(body)) {
+        reason = "returns the input unchanged (pass-through stub)";
+      } else if (JUST_THROW_REGEX.test(body)) {
+        reason = "throws UnsupportedOperationException \u2014 not implemented";
+      }
+      if (!reason) continue;
+      const line = source.slice(0, m.index).split("\n").length;
+      issues.push({
+        ruleId: "java/suspicious-implementation",
+        category: "security",
+        severity: "high",
+        aiSpecific: false,
+        message: `function ${methodName} (${reason}) \u2014 content-based mismatch`,
+        line,
+        column: 1,
+        advice: `The function name "${methodName}" suggests a real validation/encryption/auth/filter operation, but the body is ${reason}. This is a content mismatch \u2014 the code's claimed behavior doesn't match its actual behavior. Real production code that ships this is a silent security failure (OWASP A04:2021 \u2014 Insecure Design). The fix is to either implement the operation or rename the function to reflect what it actually does. Reference: java/suspicious-implementation v0.35.0 (CoCoNUTS-inspired content-based detection).`
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/java/system-out-println.ts
 var SYSTEM_OUT_REGEX = /\bSystem\.out\.println\s*\(/g;
 var REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging)/;
@@ -43321,6 +43376,7 @@ var builtinRules = [
   javaCommandInjectionRule,
   javaHardcodedCredentialRule,
   javaSqlStringConcatRule,
+  javaSuspiciousImplementationRule,
   javaSystemOutPrintlnRule,
   javaThreadSleepInLoopRule,
   kotlinCoroutineGlobalScopeRule,
@@ -45710,6 +45766,22 @@ var signal_strength_default = {
     _v9Precision: 0,
     defaultOff: true
   },
+  "java/suspicious-implementation": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "OK",
+    _calibrationNote: "v0.35.0: NEW RULE \u2014 content-based detection (CoCoNUTS-inspired). Detects function names that claim a strong operation (validate, encrypt, hash, sanitize, check, verify, authenticate, etc.) but whose body is trivially empty, returns a constant, or returns the input unchanged. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (i.e. ON by default) and verdict=OK. The CoCoNUTS paper (2025) showed that style-based AI-detectors fail under paraphrasing; this rule looks at semantic content (function body behavior) rather than surface features. v9 calibration is pending \u2014 the rule was added at the end of the v0.34.X refinement series and has not been measured against the v9 corpus yet. The expected impact: low recall (most production code doesn't have these stubs) but high precision (when it fires, it's a real bug). The full v9 calibration is the next step for v0.35.0.x patches.",
+    aiSpecific: false,
+    _v9Verdict: "OK",
+    _v9Lift: 0,
+    _v9Recall: 0,
+    _v9FpRate: 0,
+    _v9Precision: 0,
+    defaultOff: false
+  },
   "swift/force-unwrap": {
     recall: 0.10211,
     fpRate: 0.21462,

package/dist/engine/worker.js

@@ -37156,6 +37156,61 @@ var javaSqlStringConcatRule = createRule({
   }
 });
 
+// src/rules/java/suspicious-implementation.ts
+var STRONG_VERB_REGEX = /(?:validate|validates|validated|verifies?|verify|check|checks?|checked|ensures?|ensure|ensured|verifies|verified|sanitize|sanitizes|sanitized|escape|escapes|escaped|authenticate|authenticates|authenticated|authorize|authorizes|authorized|audit|audits|audited|inspect|inspects|inspected|filter|filters?|filtered|normalize|normalizes|normalized|encrypt|encrypts|encrypted|decrypt|decrypts|decrypted|hash|hashes|hashed|sign|signs?|signed|compress|compresses|compressed|decompress|decompresses|decompressed|parse|parses|parsed|format|formats?|formatted)(?=[A-Z]|[^a-zA-Z]|$)/i;
+var METHOD_DECL_REGEX = /(?:public|private|protected)\s+(?:static\s+)?[\w<>,\s\[\]]+?\s+(\w+)\s*\([^)]*\)\s*\{([^{}]*)\}/g;
+var EMPTY_BODY_REGEX = /^\s*$/;
+var RETURN_CONSTANT_REGEX = /^\s*return\s+(?:null|true|false|0|1|0L|0\.0|"")\s*;\s*$/;
+var RETURN_INPUT_REGEX = /^\s*return\s+(\w+)\s*;\s*$/;
+var JUST_THROW_REGEX = /^\s*throw\s+new\s+(?:UnsupportedOperationException|UnsupportedOperationException\([^)]*\)|RuntimeException\([^)]*\)|IllegalStateException\([^)]*\))\s*;\s*$/;
+var javaSuspiciousImplementationRule = createRule({
+  id: "java/suspicious-implementation",
+  category: "security",
+  severity: "high",
+  aiSpecific: false,
+  description: "function name suggests validation/encryption/auth but body is empty or trivially wrong \u2014 content mismatch",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.java$/i.test(facts.filePath)) return issues;
+    if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+    let m;
+    METHOD_DECL_REGEX.lastIndex = 0;
+    while ((m = METHOD_DECL_REGEX.exec(source)) !== null) {
+      const methodName = m[1];
+      const body = m[2];
+      if (!STRONG_VERB_REGEX.test(methodName)) continue;
+      let reason = null;
+      if (EMPTY_BODY_REGEX.test(body)) {
+        reason = "empty body";
+      } else if (RETURN_CONSTANT_REGEX.test(body)) {
+        reason = "returns a constant (null/true/false/0/1)";
+      } else if (RETURN_INPUT_REGEX.test(body)) {
+        reason = "returns the input unchanged (pass-through stub)";
+      } else if (JUST_THROW_REGEX.test(body)) {
+        reason = "throws UnsupportedOperationException \u2014 not implemented";
+      }
+      if (!reason) continue;
+      const line = source.slice(0, m.index).split("\n").length;
+      issues.push({
+        ruleId: "java/suspicious-implementation",
+        category: "security",
+        severity: "high",
+        aiSpecific: false,
+        message: `function ${methodName} (${reason}) \u2014 content-based mismatch`,
+        line,
+        column: 1,
+        advice: `The function name "${methodName}" suggests a real validation/encryption/auth/filter operation, but the body is ${reason}. This is a content mismatch \u2014 the code's claimed behavior doesn't match its actual behavior. Real production code that ships this is a silent security failure (OWASP A04:2021 \u2014 Insecure Design). The fix is to either implement the operation or rename the function to reflect what it actually does. Reference: java/suspicious-implementation v0.35.0 (CoCoNUTS-inspired content-based detection).`
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/java/system-out-println.ts
 var SYSTEM_OUT_REGEX = /\bSystem\.out\.println\s*\(/g;
 var REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging)/;
@@ -43292,6 +43347,7 @@ var builtinRules = [
   javaCommandInjectionRule,
   javaHardcodedCredentialRule,
   javaSqlStringConcatRule,
+  javaSuspiciousImplementationRule,
   javaSystemOutPrintlnRule,
   javaThreadSleepInLoopRule,
   kotlinCoroutineGlobalScopeRule,
@@ -45681,6 +45737,22 @@ var signal_strength_default = {
     _v9Precision: 0,
     defaultOff: true
   },
+  "java/suspicious-implementation": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "OK",
+    _calibrationNote: "v0.35.0: NEW RULE \u2014 content-based detection (CoCoNUTS-inspired). Detects function names that claim a strong operation (validate, encrypt, hash, sanitize, check, verify, authenticate, etc.) but whose body is trivially empty, returns a constant, or returns the input unchanged. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (i.e. ON by default) and verdict=OK. The CoCoNUTS paper (2025) showed that style-based AI-detectors fail under paraphrasing; this rule looks at semantic content (function body behavior) rather than surface features. v9 calibration is pending \u2014 the rule was added at the end of the v0.34.X refinement series and has not been measured against the v9 corpus yet. The expected impact: low recall (most production code doesn't have these stubs) but high precision (when it fires, it's a real bug). The full v9 calibration is the next step for v0.35.0.x patches.",
+    aiSpecific: false,
+    _v9Verdict: "OK",
+    _v9Lift: 0,
+    _v9Recall: 0,
+    _v9FpRate: 0,
+    _v9Precision: 0,
+    defaultOff: false
+  },
   "swift/force-unwrap": {
     recall: 0.10211,
     fpRate: 0.21462,

package/dist/index.cjs

@@ -36,7 +36,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.34.10";
+    VERSION = "0.35.0";
   }
 });
 
@@ -30850,6 +30850,68 @@ var init_sql_string_concat = __esm({
   }
 });
 
+// src/rules/java/suspicious-implementation.ts
+var STRONG_VERB_REGEX, METHOD_DECL_REGEX, EMPTY_BODY_REGEX, RETURN_CONSTANT_REGEX, RETURN_INPUT_REGEX, JUST_THROW_REGEX, javaSuspiciousImplementationRule;
+var init_suspicious_implementation = __esm({
+  "src/rules/java/suspicious-implementation.ts"() {
+    "use strict";
+    init_rule();
+    STRONG_VERB_REGEX = /(?:validate|validates|validated|verifies?|verify|check|checks?|checked|ensures?|ensure|ensured|verifies|verified|sanitize|sanitizes|sanitized|escape|escapes|escaped|authenticate|authenticates|authenticated|authorize|authorizes|authorized|audit|audits|audited|inspect|inspects|inspected|filter|filters?|filtered|normalize|normalizes|normalized|encrypt|encrypts|encrypted|decrypt|decrypts|decrypted|hash|hashes|hashed|sign|signs?|signed|compress|compresses|compressed|decompress|decompresses|decompressed|parse|parses|parsed|format|formats?|formatted)(?=[A-Z]|[^a-zA-Z]|$)/i;
+    METHOD_DECL_REGEX = /(?:public|private|protected)\s+(?:static\s+)?[\w<>,\s\[\]]+?\s+(\w+)\s*\([^)]*\)\s*\{([^{}]*)\}/g;
+    EMPTY_BODY_REGEX = /^\s*$/;
+    RETURN_CONSTANT_REGEX = /^\s*return\s+(?:null|true|false|0|1|0L|0\.0|"")\s*;\s*$/;
+    RETURN_INPUT_REGEX = /^\s*return\s+(\w+)\s*;\s*$/;
+    JUST_THROW_REGEX = /^\s*throw\s+new\s+(?:UnsupportedOperationException|UnsupportedOperationException\([^)]*\)|RuntimeException\([^)]*\)|IllegalStateException\([^)]*\))\s*;\s*$/;
+    javaSuspiciousImplementationRule = createRule({
+      id: "java/suspicious-implementation",
+      category: "security",
+      severity: "high",
+      aiSpecific: false,
+      description: "function name suggests validation/encryption/auth but body is empty or trivially wrong \u2014 content mismatch",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.java$/i.test(facts.filePath)) return issues;
+        if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+        let m;
+        METHOD_DECL_REGEX.lastIndex = 0;
+        while ((m = METHOD_DECL_REGEX.exec(source)) !== null) {
+          const methodName = m[1];
+          const body = m[2];
+          if (!STRONG_VERB_REGEX.test(methodName)) continue;
+          let reason = null;
+          if (EMPTY_BODY_REGEX.test(body)) {
+            reason = "empty body";
+          } else if (RETURN_CONSTANT_REGEX.test(body)) {
+            reason = "returns a constant (null/true/false/0/1)";
+          } else if (RETURN_INPUT_REGEX.test(body)) {
+            reason = "returns the input unchanged (pass-through stub)";
+          } else if (JUST_THROW_REGEX.test(body)) {
+            reason = "throws UnsupportedOperationException \u2014 not implemented";
+          }
+          if (!reason) continue;
+          const line = source.slice(0, m.index).split("\n").length;
+          issues.push({
+            ruleId: "java/suspicious-implementation",
+            category: "security",
+            severity: "high",
+            aiSpecific: false,
+            message: `function ${methodName} (${reason}) \u2014 content-based mismatch`,
+            line,
+            column: 1,
+            advice: `The function name "${methodName}" suggests a real validation/encryption/auth/filter operation, but the body is ${reason}. This is a content mismatch \u2014 the code's claimed behavior doesn't match its actual behavior. Real production code that ships this is a silent security failure (OWASP A04:2021 \u2014 Insecure Design). The fix is to either implement the operation or rename the function to reflect what it actually does. Reference: java/suspicious-implementation v0.35.0 (CoCoNUTS-inspired content-based detection).`
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/java/system-out-println.ts
 var SYSTEM_OUT_REGEX, REAL_LOGGING_IMPORT_REGEX, javaSystemOutPrintlnRule;
 var init_system_out_println = __esm({
@@ -46964,6 +47026,7 @@ var init_builtins = __esm({
     init_command_injection();
     init_hardcoded_credential();
     init_sql_string_concat();
+    init_suspicious_implementation();
     init_system_out_println();
     init_thread_sleep_in_loop();
     init_coroutine_global_scope();
@@ -47103,6 +47166,7 @@ var init_builtins = __esm({
       javaCommandInjectionRule,
       javaHardcodedCredentialRule,
       javaSqlStringConcatRule,
+      javaSuspiciousImplementationRule,
       javaSystemOutPrintlnRule,
       javaThreadSleepInLoopRule,
       kotlinCoroutineGlobalScopeRule,
@@ -51797,6 +51861,22 @@ var init_signal_strength = __esm({
         _v9Precision: 0,
         defaultOff: true
       },
+      "java/suspicious-implementation": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 0,
+        precision: 0,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "OK",
+        _calibrationNote: "v0.35.0: NEW RULE \u2014 content-based detection (CoCoNUTS-inspired). Detects function names that claim a strong operation (validate, encrypt, hash, sanitize, check, verify, authenticate, etc.) but whose body is trivially empty, returns a constant, or returns the input unchanged. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (i.e. ON by default) and verdict=OK. The CoCoNUTS paper (2025) showed that style-based AI-detectors fail under paraphrasing; this rule looks at semantic content (function body behavior) rather than surface features. v9 calibration is pending \u2014 the rule was added at the end of the v0.34.X refinement series and has not been measured against the v9 corpus yet. The expected impact: low recall (most production code doesn't have these stubs) but high precision (when it fires, it's a real bug). The full v9 calibration is the next step for v0.35.0.x patches.",
+        aiSpecific: false,
+        _v9Verdict: "OK",
+        _v9Lift: 0,
+        _v9Recall: 0,
+        _v9FpRate: 0,
+        _v9Precision: 0,
+        defaultOff: false
+      },
       "swift/force-unwrap": {
         recall: 0.10211,
         fpRate: 0.21462,
@@ -60063,6 +60143,8 @@ var RULE_HINTS = {
   "java/thread-sleep-in-loop": "Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the polling anti-pattern \u2014 ties up Tomcat/Jetty/Netty threads. (v0.30.0 \u2014 DORMANT, era-confounded ratio 0.97.)",
   "java/system-out-println": "The file imports a real logger (SLF4J/Log4j2/java.util.logging) but uses System.out.println. Use the declared log object instead. (v0.31.0 \u2014 OK; ratio 1.73, refined from v0.30.)",
   "java/command-injection": "Use ProcessBuilder with a List<String> of args (no shell parsing) and validate each arg. Runtime.exec() with concat is the canonical command-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT.)",
+  // v0.35.0 — content-based detection (CoCoNUTS-inspired)
+  "java/suspicious-implementation": "Function name claims validate/encrypt/hash/sanitize but body is empty, returns null/true, or returns the input. This is a content mismatch \u2014 the function's claimed behavior doesn't match its actual behavior. OWASP A04:2021.",
   // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
   "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",
   "swift/print-debug": "Replace with `Logger(subsystem:..., category:...).info(...)` (os.log). `print` writes to stdout with no level and no redaction. (v0.24.0 \u2014 DORMANT.)",

package/dist/index.js

@@ -19,7 +19,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.34.10";
+    VERSION = "0.35.0";
   }
 });
 
@@ -30831,6 +30831,68 @@ var init_sql_string_concat = __esm({
   }
 });
 
+// src/rules/java/suspicious-implementation.ts
+var STRONG_VERB_REGEX, METHOD_DECL_REGEX, EMPTY_BODY_REGEX, RETURN_CONSTANT_REGEX, RETURN_INPUT_REGEX, JUST_THROW_REGEX, javaSuspiciousImplementationRule;
+var init_suspicious_implementation = __esm({
+  "src/rules/java/suspicious-implementation.ts"() {
+    "use strict";
+    init_rule();
+    STRONG_VERB_REGEX = /(?:validate|validates|validated|verifies?|verify|check|checks?|checked|ensures?|ensure|ensured|verifies|verified|sanitize|sanitizes|sanitized|escape|escapes|escaped|authenticate|authenticates|authenticated|authorize|authorizes|authorized|audit|audits|audited|inspect|inspects|inspected|filter|filters?|filtered|normalize|normalizes|normalized|encrypt|encrypts|encrypted|decrypt|decrypts|decrypted|hash|hashes|hashed|sign|signs?|signed|compress|compresses|compressed|decompress|decompresses|decompressed|parse|parses|parsed|format|formats?|formatted)(?=[A-Z]|[^a-zA-Z]|$)/i;
+    METHOD_DECL_REGEX = /(?:public|private|protected)\s+(?:static\s+)?[\w<>,\s\[\]]+?\s+(\w+)\s*\([^)]*\)\s*\{([^{}]*)\}/g;
+    EMPTY_BODY_REGEX = /^\s*$/;
+    RETURN_CONSTANT_REGEX = /^\s*return\s+(?:null|true|false|0|1|0L|0\.0|"")\s*;\s*$/;
+    RETURN_INPUT_REGEX = /^\s*return\s+(\w+)\s*;\s*$/;
+    JUST_THROW_REGEX = /^\s*throw\s+new\s+(?:UnsupportedOperationException|UnsupportedOperationException\([^)]*\)|RuntimeException\([^)]*\)|IllegalStateException\([^)]*\))\s*;\s*$/;
+    javaSuspiciousImplementationRule = createRule({
+      id: "java/suspicious-implementation",
+      category: "security",
+      severity: "high",
+      aiSpecific: false,
+      description: "function name suggests validation/encryption/auth but body is empty or trivially wrong \u2014 content mismatch",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.java$/i.test(facts.filePath)) return issues;
+        if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+        let m;
+        METHOD_DECL_REGEX.lastIndex = 0;
+        while ((m = METHOD_DECL_REGEX.exec(source)) !== null) {
+          const methodName = m[1];
+          const body = m[2];
+          if (!STRONG_VERB_REGEX.test(methodName)) continue;
+          let reason = null;
+          if (EMPTY_BODY_REGEX.test(body)) {
+            reason = "empty body";
+          } else if (RETURN_CONSTANT_REGEX.test(body)) {
+            reason = "returns a constant (null/true/false/0/1)";
+          } else if (RETURN_INPUT_REGEX.test(body)) {
+            reason = "returns the input unchanged (pass-through stub)";
+          } else if (JUST_THROW_REGEX.test(body)) {
+            reason = "throws UnsupportedOperationException \u2014 not implemented";
+          }
+          if (!reason) continue;
+          const line = source.slice(0, m.index).split("\n").length;
+          issues.push({
+            ruleId: "java/suspicious-implementation",
+            category: "security",
+            severity: "high",
+            aiSpecific: false,
+            message: `function ${methodName} (${reason}) \u2014 content-based mismatch`,
+            line,
+            column: 1,
+            advice: `The function name "${methodName}" suggests a real validation/encryption/auth/filter operation, but the body is ${reason}. This is a content mismatch \u2014 the code's claimed behavior doesn't match its actual behavior. Real production code that ships this is a silent security failure (OWASP A04:2021 \u2014 Insecure Design). The fix is to either implement the operation or rename the function to reflect what it actually does. Reference: java/suspicious-implementation v0.35.0 (CoCoNUTS-inspired content-based detection).`
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/java/system-out-println.ts
 var SYSTEM_OUT_REGEX, REAL_LOGGING_IMPORT_REGEX, javaSystemOutPrintlnRule;
 var init_system_out_println = __esm({
@@ -46945,6 +47007,7 @@ var init_builtins = __esm({
     init_command_injection();
     init_hardcoded_credential();
     init_sql_string_concat();
+    init_suspicious_implementation();
     init_system_out_println();
     init_thread_sleep_in_loop();
     init_coroutine_global_scope();
@@ -47084,6 +47147,7 @@ var init_builtins = __esm({
       javaCommandInjectionRule,
       javaHardcodedCredentialRule,
       javaSqlStringConcatRule,
+      javaSuspiciousImplementationRule,
       javaSystemOutPrintlnRule,
       javaThreadSleepInLoopRule,
       kotlinCoroutineGlobalScopeRule,
@@ -51775,6 +51839,22 @@ var init_signal_strength = __esm({
         _v9Precision: 0,
         defaultOff: true
       },
+      "java/suspicious-implementation": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 0,
+        precision: 0,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "OK",
+        _calibrationNote: "v0.35.0: NEW RULE \u2014 content-based detection (CoCoNUTS-inspired). Detects function names that claim a strong operation (validate, encrypt, hash, sanitize, check, verify, authenticate, etc.) but whose body is trivially empty, returns a constant, or returns the input unchanged. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (i.e. ON by default) and verdict=OK. The CoCoNUTS paper (2025) showed that style-based AI-detectors fail under paraphrasing; this rule looks at semantic content (function body behavior) rather than surface features. v9 calibration is pending \u2014 the rule was added at the end of the v0.34.X refinement series and has not been measured against the v9 corpus yet. The expected impact: low recall (most production code doesn't have these stubs) but high precision (when it fires, it's a real bug). The full v9 calibration is the next step for v0.35.0.x patches.",
+        aiSpecific: false,
+        _v9Verdict: "OK",
+        _v9Lift: 0,
+        _v9Recall: 0,
+        _v9FpRate: 0,
+        _v9Precision: 0,
+        defaultOff: false
+      },
       "swift/force-unwrap": {
         recall: 0.10211,
         fpRate: 0.21462,
@@ -59962,6 +60042,8 @@ var RULE_HINTS = {
   "java/thread-sleep-in-loop": "Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the polling anti-pattern \u2014 ties up Tomcat/Jetty/Netty threads. (v0.30.0 \u2014 DORMANT, era-confounded ratio 0.97.)",
   "java/system-out-println": "The file imports a real logger (SLF4J/Log4j2/java.util.logging) but uses System.out.println. Use the declared log object instead. (v0.31.0 \u2014 OK; ratio 1.73, refined from v0.30.)",
   "java/command-injection": "Use ProcessBuilder with a List<String> of args (no shell parsing) and validate each arg. Runtime.exec() with concat is the canonical command-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT.)",
+  // v0.35.0 — content-based detection (CoCoNUTS-inspired)
+  "java/suspicious-implementation": "Function name claims validate/encrypt/hash/sanitize but body is empty, returns null/true, or returns the input. This is a content mismatch \u2014 the function's claimed behavior doesn't match its actual behavior. OWASP A04:2021.",
   // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
   "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",
   "swift/print-debug": "Replace with `Logger(subsystem:..., category:...).info(...)` (os.log). `print` writes to stdout with no level and no redaction. (v0.24.0 \u2014 DORMANT.)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slopbrick",
-  "version": "0.34.10",
+  "version": "0.35.0",
   "description": "Discovered, modeled, and governed repository structure. SlopBrick scans source code, classifies it against 95+ rules in 15 categories, computes 4 scores (aiSlopScore: lower=cleaner, engineeringHygiene, security, repositoryHealth composite), and persists the structure for AI agents and CI.",
   "type": "module",
   "bin": {