slopbrick 0.34.9 → 0.35.0

package/dist/engine/worker.cjs

@@ -37185,6 +37185,61 @@ var javaSqlStringConcatRule = createRule({
   }
 });
 
+// src/rules/java/suspicious-implementation.ts
+var STRONG_VERB_REGEX = /(?:validate|validates|validated|verifies?|verify|check|checks?|checked|ensures?|ensure|ensured|verifies|verified|sanitize|sanitizes|sanitized|escape|escapes|escaped|authenticate|authenticates|authenticated|authorize|authorizes|authorized|audit|audits|audited|inspect|inspects|inspected|filter|filters?|filtered|normalize|normalizes|normalized|encrypt|encrypts|encrypted|decrypt|decrypts|decrypted|hash|hashes|hashed|sign|signs?|signed|compress|compresses|compressed|decompress|decompresses|decompressed|parse|parses|parsed|format|formats?|formatted)(?=[A-Z]|[^a-zA-Z]|$)/i;
+var METHOD_DECL_REGEX = /(?:public|private|protected)\s+(?:static\s+)?[\w<>,\s\[\]]+?\s+(\w+)\s*\([^)]*\)\s*\{([^{}]*)\}/g;
+var EMPTY_BODY_REGEX = /^\s*$/;
+var RETURN_CONSTANT_REGEX = /^\s*return\s+(?:null|true|false|0|1|0L|0\.0|"")\s*;\s*$/;
+var RETURN_INPUT_REGEX = /^\s*return\s+(\w+)\s*;\s*$/;
+var JUST_THROW_REGEX = /^\s*throw\s+new\s+(?:UnsupportedOperationException|UnsupportedOperationException\([^)]*\)|RuntimeException\([^)]*\)|IllegalStateException\([^)]*\))\s*;\s*$/;
+var javaSuspiciousImplementationRule = createRule({
+  id: "java/suspicious-implementation",
+  category: "security",
+  severity: "high",
+  aiSpecific: false,
+  description: "function name suggests validation/encryption/auth but body is empty or trivially wrong \u2014 content mismatch",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.java$/i.test(facts.filePath)) return issues;
+    if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+    let m;
+    METHOD_DECL_REGEX.lastIndex = 0;
+    while ((m = METHOD_DECL_REGEX.exec(source)) !== null) {
+      const methodName = m[1];
+      const body = m[2];
+      if (!STRONG_VERB_REGEX.test(methodName)) continue;
+      let reason = null;
+      if (EMPTY_BODY_REGEX.test(body)) {
+        reason = "empty body";
+      } else if (RETURN_CONSTANT_REGEX.test(body)) {
+        reason = "returns a constant (null/true/false/0/1)";
+      } else if (RETURN_INPUT_REGEX.test(body)) {
+        reason = "returns the input unchanged (pass-through stub)";
+      } else if (JUST_THROW_REGEX.test(body)) {
+        reason = "throws UnsupportedOperationException \u2014 not implemented";
+      }
+      if (!reason) continue;
+      const line = source.slice(0, m.index).split("\n").length;
+      issues.push({
+        ruleId: "java/suspicious-implementation",
+        category: "security",
+        severity: "high",
+        aiSpecific: false,
+        message: `function ${methodName} (${reason}) \u2014 content-based mismatch`,
+        line,
+        column: 1,
+        advice: `The function name "${methodName}" suggests a real validation/encryption/auth/filter operation, but the body is ${reason}. This is a content mismatch \u2014 the code's claimed behavior doesn't match its actual behavior. Real production code that ships this is a silent security failure (OWASP A04:2021 \u2014 Insecure Design). The fix is to either implement the operation or rename the function to reflect what it actually does. Reference: java/suspicious-implementation v0.35.0 (CoCoNUTS-inspired content-based detection).`
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/java/system-out-println.ts
 var SYSTEM_OUT_REGEX = /\bSystem\.out\.println\s*\(/g;
 var REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging)/;
@@ -40568,7 +40623,7 @@ var swiftFatalErrorThrownRule = createRule({
 
 // src/rules/swift/force-unwrap.ts
 var AS_FORCE_REGEX = /\bas!\s+/g;
-var ACCESS_FORCE_REGEX = /(?:\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
+var ACCESS_FORCE_REGEX = /(?<![=!])(\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
 var TRY_FORCE_REGEX = /\btry!\s+/g;
 var swiftForceUnwrapRule = createRule({
   id: "swift/force-unwrap",
@@ -40595,7 +40650,7 @@ var swiftForceUnwrapRule = createRule({
         message: `force-unwrap (${label}) at line ${line} \u2014 crashes if the value is nil`,
         line,
         column: 1,
-        advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.24.'
+        advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.34.10 (refined: exclude `!` in `!==`/`!=` operators via negative lookbehind).'
       });
     };
     let m;
@@ -40604,7 +40659,10 @@ var swiftForceUnwrapRule = createRule({
     TRY_FORCE_REGEX.lastIndex = 0;
     while ((m = TRY_FORCE_REGEX.exec(source)) !== null) emit(m.index, "try!");
     ACCESS_FORCE_REGEX.lastIndex = 0;
-    while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) emit(m.index, "!.");
+    while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) {
+      const bangOffset = m.index + (m[1]?.length ?? 1);
+      emit(bangOffset, "!.");
+    }
     return issues;
   }
 });
@@ -43318,6 +43376,7 @@ var builtinRules = [
   javaCommandInjectionRule,
   javaHardcodedCredentialRule,
   javaSqlStringConcatRule,
+  javaSuspiciousImplementationRule,
   javaSystemOutPrintlnRule,
   javaThreadSleepInLoopRule,
   kotlinCoroutineGlobalScopeRule,
@@ -45707,6 +45766,22 @@ var signal_strength_default = {
     _v9Precision: 0,
     defaultOff: true
   },
+  "java/suspicious-implementation": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "OK",
+    _calibrationNote: "v0.35.0: NEW RULE \u2014 content-based detection (CoCoNUTS-inspired). Detects function names that claim a strong operation (validate, encrypt, hash, sanitize, check, verify, authenticate, etc.) but whose body is trivially empty, returns a constant, or returns the input unchanged. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (i.e. ON by default) and verdict=OK. The CoCoNUTS paper (2025) showed that style-based AI-detectors fail under paraphrasing; this rule looks at semantic content (function body behavior) rather than surface features. v9 calibration is pending \u2014 the rule was added at the end of the v0.34.X refinement series and has not been measured against the v9 corpus yet. The expected impact: low recall (most production code doesn't have these stubs) but high precision (when it fires, it's a real bug). The full v9 calibration is the next step for v0.35.0.x patches.",
+    aiSpecific: false,
+    _v9Verdict: "OK",
+    _v9Lift: 0,
+    _v9Recall: 0,
+    _v9FpRate: 0,
+    _v9Precision: 0,
+    defaultOff: false
+  },
   "swift/force-unwrap": {
     recall: 0.10211,
     fpRate: 0.21462,
@@ -45714,7 +45789,7 @@ var signal_strength_default = {
     precision: 0.1721,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.32: v9 Swift calibration (1300 neg, 568 pos). Per-file unique measurement: 58 TP files, 279 FP files, ratio=0.48. Era-confounded: pre-2022 Swift used ! freely (the only way to unwrap); modern Swift uses guard let / if let / try?. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
+    _calibrationNote: "v0.34.10: REFINED \u2014 the access-force regex now uses a negative lookbehind to exclude `!` in `!=` and `!==` comparison operators. Per-file unique v9 Swift calibration (1300 neg, 568 pos): 58 TP files, 279 FP files, ratio=0.48 (DORMANT). The previous regex incorrectly fired on `!` in `a != b` and `a !== b` patterns, which are common in control flow. The refinement is expected to push precision from 17.2% to 25%+ by removing these false positives. Era-confounded: pre-2022 Swift used `!` freely (the only way to unwrap); modern Swift uses `guard let` / `if let` / `try?`. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,

package/dist/engine/worker.js

@@ -37156,6 +37156,61 @@ var javaSqlStringConcatRule = createRule({
   }
 });
 
+// src/rules/java/suspicious-implementation.ts
+var STRONG_VERB_REGEX = /(?:validate|validates|validated|verifies?|verify|check|checks?|checked|ensures?|ensure|ensured|verifies|verified|sanitize|sanitizes|sanitized|escape|escapes|escaped|authenticate|authenticates|authenticated|authorize|authorizes|authorized|audit|audits|audited|inspect|inspects|inspected|filter|filters?|filtered|normalize|normalizes|normalized|encrypt|encrypts|encrypted|decrypt|decrypts|decrypted|hash|hashes|hashed|sign|signs?|signed|compress|compresses|compressed|decompress|decompresses|decompressed|parse|parses|parsed|format|formats?|formatted)(?=[A-Z]|[^a-zA-Z]|$)/i;
+var METHOD_DECL_REGEX = /(?:public|private|protected)\s+(?:static\s+)?[\w<>,\s\[\]]+?\s+(\w+)\s*\([^)]*\)\s*\{([^{}]*)\}/g;
+var EMPTY_BODY_REGEX = /^\s*$/;
+var RETURN_CONSTANT_REGEX = /^\s*return\s+(?:null|true|false|0|1|0L|0\.0|"")\s*;\s*$/;
+var RETURN_INPUT_REGEX = /^\s*return\s+(\w+)\s*;\s*$/;
+var JUST_THROW_REGEX = /^\s*throw\s+new\s+(?:UnsupportedOperationException|UnsupportedOperationException\([^)]*\)|RuntimeException\([^)]*\)|IllegalStateException\([^)]*\))\s*;\s*$/;
+var javaSuspiciousImplementationRule = createRule({
+  id: "java/suspicious-implementation",
+  category: "security",
+  severity: "high",
+  aiSpecific: false,
+  description: "function name suggests validation/encryption/auth but body is empty or trivially wrong \u2014 content mismatch",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.java$/i.test(facts.filePath)) return issues;
+    if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+    let m;
+    METHOD_DECL_REGEX.lastIndex = 0;
+    while ((m = METHOD_DECL_REGEX.exec(source)) !== null) {
+      const methodName = m[1];
+      const body = m[2];
+      if (!STRONG_VERB_REGEX.test(methodName)) continue;
+      let reason = null;
+      if (EMPTY_BODY_REGEX.test(body)) {
+        reason = "empty body";
+      } else if (RETURN_CONSTANT_REGEX.test(body)) {
+        reason = "returns a constant (null/true/false/0/1)";
+      } else if (RETURN_INPUT_REGEX.test(body)) {
+        reason = "returns the input unchanged (pass-through stub)";
+      } else if (JUST_THROW_REGEX.test(body)) {
+        reason = "throws UnsupportedOperationException \u2014 not implemented";
+      }
+      if (!reason) continue;
+      const line = source.slice(0, m.index).split("\n").length;
+      issues.push({
+        ruleId: "java/suspicious-implementation",
+        category: "security",
+        severity: "high",
+        aiSpecific: false,
+        message: `function ${methodName} (${reason}) \u2014 content-based mismatch`,
+        line,
+        column: 1,
+        advice: `The function name "${methodName}" suggests a real validation/encryption/auth/filter operation, but the body is ${reason}. This is a content mismatch \u2014 the code's claimed behavior doesn't match its actual behavior. Real production code that ships this is a silent security failure (OWASP A04:2021 \u2014 Insecure Design). The fix is to either implement the operation or rename the function to reflect what it actually does. Reference: java/suspicious-implementation v0.35.0 (CoCoNUTS-inspired content-based detection).`
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/java/system-out-println.ts
 var SYSTEM_OUT_REGEX = /\bSystem\.out\.println\s*\(/g;
 var REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging)/;
@@ -40539,7 +40594,7 @@ var swiftFatalErrorThrownRule = createRule({
 
 // src/rules/swift/force-unwrap.ts
 var AS_FORCE_REGEX = /\bas!\s+/g;
-var ACCESS_FORCE_REGEX = /(?:\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
+var ACCESS_FORCE_REGEX = /(?<![=!])(\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
 var TRY_FORCE_REGEX = /\btry!\s+/g;
 var swiftForceUnwrapRule = createRule({
   id: "swift/force-unwrap",
@@ -40566,7 +40621,7 @@ var swiftForceUnwrapRule = createRule({
         message: `force-unwrap (${label}) at line ${line} \u2014 crashes if the value is nil`,
         line,
         column: 1,
-        advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.24.'
+        advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.34.10 (refined: exclude `!` in `!==`/`!=` operators via negative lookbehind).'
       });
     };
     let m;
@@ -40575,7 +40630,10 @@ var swiftForceUnwrapRule = createRule({
     TRY_FORCE_REGEX.lastIndex = 0;
     while ((m = TRY_FORCE_REGEX.exec(source)) !== null) emit(m.index, "try!");
     ACCESS_FORCE_REGEX.lastIndex = 0;
-    while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) emit(m.index, "!.");
+    while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) {
+      const bangOffset = m.index + (m[1]?.length ?? 1);
+      emit(bangOffset, "!.");
+    }
     return issues;
   }
 });
@@ -43289,6 +43347,7 @@ var builtinRules = [
   javaCommandInjectionRule,
   javaHardcodedCredentialRule,
   javaSqlStringConcatRule,
+  javaSuspiciousImplementationRule,
   javaSystemOutPrintlnRule,
   javaThreadSleepInLoopRule,
   kotlinCoroutineGlobalScopeRule,
@@ -45678,6 +45737,22 @@ var signal_strength_default = {
     _v9Precision: 0,
     defaultOff: true
   },
+  "java/suspicious-implementation": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "OK",
+    _calibrationNote: "v0.35.0: NEW RULE \u2014 content-based detection (CoCoNUTS-inspired). Detects function names that claim a strong operation (validate, encrypt, hash, sanitize, check, verify, authenticate, etc.) but whose body is trivially empty, returns a constant, or returns the input unchanged. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (i.e. ON by default) and verdict=OK. The CoCoNUTS paper (2025) showed that style-based AI-detectors fail under paraphrasing; this rule looks at semantic content (function body behavior) rather than surface features. v9 calibration is pending \u2014 the rule was added at the end of the v0.34.X refinement series and has not been measured against the v9 corpus yet. The expected impact: low recall (most production code doesn't have these stubs) but high precision (when it fires, it's a real bug). The full v9 calibration is the next step for v0.35.0.x patches.",
+    aiSpecific: false,
+    _v9Verdict: "OK",
+    _v9Lift: 0,
+    _v9Recall: 0,
+    _v9FpRate: 0,
+    _v9Precision: 0,
+    defaultOff: false
+  },
   "swift/force-unwrap": {
     recall: 0.10211,
     fpRate: 0.21462,
@@ -45685,7 +45760,7 @@ var signal_strength_default = {
     precision: 0.1721,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.32: v9 Swift calibration (1300 neg, 568 pos). Per-file unique measurement: 58 TP files, 279 FP files, ratio=0.48. Era-confounded: pre-2022 Swift used ! freely (the only way to unwrap); modern Swift uses guard let / if let / try?. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
+    _calibrationNote: "v0.34.10: REFINED \u2014 the access-force regex now uses a negative lookbehind to exclude `!` in `!=` and `!==` comparison operators. Per-file unique v9 Swift calibration (1300 neg, 568 pos): 58 TP files, 279 FP files, ratio=0.48 (DORMANT). The previous regex incorrectly fired on `!` in `a != b` and `a !== b` patterns, which are common in control flow. The refinement is expected to push precision from 17.2% to 25%+ by removing these false positives. Era-confounded: pre-2022 Swift used `!` freely (the only way to unwrap); modern Swift uses `guard let` / `if let` / `try?`. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,

package/dist/index.cjs

@@ -36,7 +36,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.34.9";
+    VERSION = "0.35.0";
   }
 });
 
@@ -30850,6 +30850,68 @@ var init_sql_string_concat = __esm({
   }
 });
 
+// src/rules/java/suspicious-implementation.ts
+var STRONG_VERB_REGEX, METHOD_DECL_REGEX, EMPTY_BODY_REGEX, RETURN_CONSTANT_REGEX, RETURN_INPUT_REGEX, JUST_THROW_REGEX, javaSuspiciousImplementationRule;
+var init_suspicious_implementation = __esm({
+  "src/rules/java/suspicious-implementation.ts"() {
+    "use strict";
+    init_rule();
+    STRONG_VERB_REGEX = /(?:validate|validates|validated|verifies?|verify|check|checks?|checked|ensures?|ensure|ensured|verifies|verified|sanitize|sanitizes|sanitized|escape|escapes|escaped|authenticate|authenticates|authenticated|authorize|authorizes|authorized|audit|audits|audited|inspect|inspects|inspected|filter|filters?|filtered|normalize|normalizes|normalized|encrypt|encrypts|encrypted|decrypt|decrypts|decrypted|hash|hashes|hashed|sign|signs?|signed|compress|compresses|compressed|decompress|decompresses|decompressed|parse|parses|parsed|format|formats?|formatted)(?=[A-Z]|[^a-zA-Z]|$)/i;
+    METHOD_DECL_REGEX = /(?:public|private|protected)\s+(?:static\s+)?[\w<>,\s\[\]]+?\s+(\w+)\s*\([^)]*\)\s*\{([^{}]*)\}/g;
+    EMPTY_BODY_REGEX = /^\s*$/;
+    RETURN_CONSTANT_REGEX = /^\s*return\s+(?:null|true|false|0|1|0L|0\.0|"")\s*;\s*$/;
+    RETURN_INPUT_REGEX = /^\s*return\s+(\w+)\s*;\s*$/;
+    JUST_THROW_REGEX = /^\s*throw\s+new\s+(?:UnsupportedOperationException|UnsupportedOperationException\([^)]*\)|RuntimeException\([^)]*\)|IllegalStateException\([^)]*\))\s*;\s*$/;
+    javaSuspiciousImplementationRule = createRule({
+      id: "java/suspicious-implementation",
+      category: "security",
+      severity: "high",
+      aiSpecific: false,
+      description: "function name suggests validation/encryption/auth but body is empty or trivially wrong \u2014 content mismatch",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.java$/i.test(facts.filePath)) return issues;
+        if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+        let m;
+        METHOD_DECL_REGEX.lastIndex = 0;
+        while ((m = METHOD_DECL_REGEX.exec(source)) !== null) {
+          const methodName = m[1];
+          const body = m[2];
+          if (!STRONG_VERB_REGEX.test(methodName)) continue;
+          let reason = null;
+          if (EMPTY_BODY_REGEX.test(body)) {
+            reason = "empty body";
+          } else if (RETURN_CONSTANT_REGEX.test(body)) {
+            reason = "returns a constant (null/true/false/0/1)";
+          } else if (RETURN_INPUT_REGEX.test(body)) {
+            reason = "returns the input unchanged (pass-through stub)";
+          } else if (JUST_THROW_REGEX.test(body)) {
+            reason = "throws UnsupportedOperationException \u2014 not implemented";
+          }
+          if (!reason) continue;
+          const line = source.slice(0, m.index).split("\n").length;
+          issues.push({
+            ruleId: "java/suspicious-implementation",
+            category: "security",
+            severity: "high",
+            aiSpecific: false,
+            message: `function ${methodName} (${reason}) \u2014 content-based mismatch`,
+            line,
+            column: 1,
+            advice: `The function name "${methodName}" suggests a real validation/encryption/auth/filter operation, but the body is ${reason}. This is a content mismatch \u2014 the code's claimed behavior doesn't match its actual behavior. Real production code that ships this is a silent security failure (OWASP A04:2021 \u2014 Insecure Design). The fix is to either implement the operation or rename the function to reflect what it actually does. Reference: java/suspicious-implementation v0.35.0 (CoCoNUTS-inspired content-based detection).`
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/java/system-out-println.ts
 var SYSTEM_OUT_REGEX, REAL_LOGGING_IMPORT_REGEX, javaSystemOutPrintlnRule;
 var init_system_out_println = __esm({
@@ -41102,7 +41164,7 @@ var init_force_unwrap2 = __esm({
     "use strict";
     init_rule();
     AS_FORCE_REGEX = /\bas!\s+/g;
-    ACCESS_FORCE_REGEX = /(?:\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
+    ACCESS_FORCE_REGEX = /(?<![=!])(\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
     TRY_FORCE_REGEX = /\btry!\s+/g;
     swiftForceUnwrapRule = createRule({
       id: "swift/force-unwrap",
@@ -41129,7 +41191,7 @@ var init_force_unwrap2 = __esm({
             message: `force-unwrap (${label}) at line ${line} \u2014 crashes if the value is nil`,
             line,
             column: 1,
-            advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.24.'
+            advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.34.10 (refined: exclude `!` in `!==`/`!=` operators via negative lookbehind).'
           });
         };
         let m;
@@ -41138,7 +41200,10 @@ var init_force_unwrap2 = __esm({
         TRY_FORCE_REGEX.lastIndex = 0;
         while ((m = TRY_FORCE_REGEX.exec(source)) !== null) emit(m.index, "try!");
         ACCESS_FORCE_REGEX.lastIndex = 0;
-        while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) emit(m.index, "!.");
+        while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) {
+          const bangOffset = m.index + (m[1]?.length ?? 1);
+          emit(bangOffset, "!.");
+        }
         return issues;
       }
     });
@@ -46961,6 +47026,7 @@ var init_builtins = __esm({
     init_command_injection();
     init_hardcoded_credential();
     init_sql_string_concat();
+    init_suspicious_implementation();
     init_system_out_println();
     init_thread_sleep_in_loop();
     init_coroutine_global_scope();
@@ -47100,6 +47166,7 @@ var init_builtins = __esm({
       javaCommandInjectionRule,
       javaHardcodedCredentialRule,
       javaSqlStringConcatRule,
+      javaSuspiciousImplementationRule,
       javaSystemOutPrintlnRule,
       javaThreadSleepInLoopRule,
       kotlinCoroutineGlobalScopeRule,
@@ -51794,6 +51861,22 @@ var init_signal_strength = __esm({
         _v9Precision: 0,
         defaultOff: true
       },
+      "java/suspicious-implementation": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 0,
+        precision: 0,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "OK",
+        _calibrationNote: "v0.35.0: NEW RULE \u2014 content-based detection (CoCoNUTS-inspired). Detects function names that claim a strong operation (validate, encrypt, hash, sanitize, check, verify, authenticate, etc.) but whose body is trivially empty, returns a constant, or returns the input unchanged. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (i.e. ON by default) and verdict=OK. The CoCoNUTS paper (2025) showed that style-based AI-detectors fail under paraphrasing; this rule looks at semantic content (function body behavior) rather than surface features. v9 calibration is pending \u2014 the rule was added at the end of the v0.34.X refinement series and has not been measured against the v9 corpus yet. The expected impact: low recall (most production code doesn't have these stubs) but high precision (when it fires, it's a real bug). The full v9 calibration is the next step for v0.35.0.x patches.",
+        aiSpecific: false,
+        _v9Verdict: "OK",
+        _v9Lift: 0,
+        _v9Recall: 0,
+        _v9FpRate: 0,
+        _v9Precision: 0,
+        defaultOff: false
+      },
       "swift/force-unwrap": {
         recall: 0.10211,
         fpRate: 0.21462,
@@ -51801,7 +51884,7 @@ var init_signal_strength = __esm({
         precision: 0.1721,
         lastCalibratedAt: "2026-07-03T00:00:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.32: v9 Swift calibration (1300 neg, 568 pos). Per-file unique measurement: 58 TP files, 279 FP files, ratio=0.48. Era-confounded: pre-2022 Swift used ! freely (the only way to unwrap); modern Swift uses guard let / if let / try?. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
+        _calibrationNote: "v0.34.10: REFINED \u2014 the access-force regex now uses a negative lookbehind to exclude `!` in `!=` and `!==` comparison operators. Per-file unique v9 Swift calibration (1300 neg, 568 pos): 58 TP files, 279 FP files, ratio=0.48 (DORMANT). The previous regex incorrectly fired on `!` in `a != b` and `a !== b` patterns, which are common in control flow. The refinement is expected to push precision from 17.2% to 25%+ by removing these false positives. Era-confounded: pre-2022 Swift used `!` freely (the only way to unwrap); modern Swift uses `guard let` / `if let` / `try?`. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,
@@ -60060,6 +60143,8 @@ var RULE_HINTS = {
   "java/thread-sleep-in-loop": "Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the polling anti-pattern \u2014 ties up Tomcat/Jetty/Netty threads. (v0.30.0 \u2014 DORMANT, era-confounded ratio 0.97.)",
   "java/system-out-println": "The file imports a real logger (SLF4J/Log4j2/java.util.logging) but uses System.out.println. Use the declared log object instead. (v0.31.0 \u2014 OK; ratio 1.73, refined from v0.30.)",
   "java/command-injection": "Use ProcessBuilder with a List<String> of args (no shell parsing) and validate each arg. Runtime.exec() with concat is the canonical command-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT.)",
+  // v0.35.0 — content-based detection (CoCoNUTS-inspired)
+  "java/suspicious-implementation": "Function name claims validate/encrypt/hash/sanitize but body is empty, returns null/true, or returns the input. This is a content mismatch \u2014 the function's claimed behavior doesn't match its actual behavior. OWASP A04:2021.",
   // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
   "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",
   "swift/print-debug": "Replace with `Logger(subsystem:..., category:...).info(...)` (os.log). `print` writes to stdout with no level and no redaction. (v0.24.0 \u2014 DORMANT.)",

package/dist/index.js

@@ -19,7 +19,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.34.9";
+    VERSION = "0.35.0";
   }
 });
 
@@ -30831,6 +30831,68 @@ var init_sql_string_concat = __esm({
   }
 });
 
+// src/rules/java/suspicious-implementation.ts
+var STRONG_VERB_REGEX, METHOD_DECL_REGEX, EMPTY_BODY_REGEX, RETURN_CONSTANT_REGEX, RETURN_INPUT_REGEX, JUST_THROW_REGEX, javaSuspiciousImplementationRule;
+var init_suspicious_implementation = __esm({
+  "src/rules/java/suspicious-implementation.ts"() {
+    "use strict";
+    init_rule();
+    STRONG_VERB_REGEX = /(?:validate|validates|validated|verifies?|verify|check|checks?|checked|ensures?|ensure|ensured|verifies|verified|sanitize|sanitizes|sanitized|escape|escapes|escaped|authenticate|authenticates|authenticated|authorize|authorizes|authorized|audit|audits|audited|inspect|inspects|inspected|filter|filters?|filtered|normalize|normalizes|normalized|encrypt|encrypts|encrypted|decrypt|decrypts|decrypted|hash|hashes|hashed|sign|signs?|signed|compress|compresses|compressed|decompress|decompresses|decompressed|parse|parses|parsed|format|formats?|formatted)(?=[A-Z]|[^a-zA-Z]|$)/i;
+    METHOD_DECL_REGEX = /(?:public|private|protected)\s+(?:static\s+)?[\w<>,\s\[\]]+?\s+(\w+)\s*\([^)]*\)\s*\{([^{}]*)\}/g;
+    EMPTY_BODY_REGEX = /^\s*$/;
+    RETURN_CONSTANT_REGEX = /^\s*return\s+(?:null|true|false|0|1|0L|0\.0|"")\s*;\s*$/;
+    RETURN_INPUT_REGEX = /^\s*return\s+(\w+)\s*;\s*$/;
+    JUST_THROW_REGEX = /^\s*throw\s+new\s+(?:UnsupportedOperationException|UnsupportedOperationException\([^)]*\)|RuntimeException\([^)]*\)|IllegalStateException\([^)]*\))\s*;\s*$/;
+    javaSuspiciousImplementationRule = createRule({
+      id: "java/suspicious-implementation",
+      category: "security",
+      severity: "high",
+      aiSpecific: false,
+      description: "function name suggests validation/encryption/auth but body is empty or trivially wrong \u2014 content mismatch",
+      create(_context) {
+        return {};
+      },
+      analyze(_context, facts) {
+        const issues = [];
+        const source = facts.v2?._source;
+        if (!source) return issues;
+        if (!/\.java$/i.test(facts.filePath)) return issues;
+        if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+        let m;
+        METHOD_DECL_REGEX.lastIndex = 0;
+        while ((m = METHOD_DECL_REGEX.exec(source)) !== null) {
+          const methodName = m[1];
+          const body = m[2];
+          if (!STRONG_VERB_REGEX.test(methodName)) continue;
+          let reason = null;
+          if (EMPTY_BODY_REGEX.test(body)) {
+            reason = "empty body";
+          } else if (RETURN_CONSTANT_REGEX.test(body)) {
+            reason = "returns a constant (null/true/false/0/1)";
+          } else if (RETURN_INPUT_REGEX.test(body)) {
+            reason = "returns the input unchanged (pass-through stub)";
+          } else if (JUST_THROW_REGEX.test(body)) {
+            reason = "throws UnsupportedOperationException \u2014 not implemented";
+          }
+          if (!reason) continue;
+          const line = source.slice(0, m.index).split("\n").length;
+          issues.push({
+            ruleId: "java/suspicious-implementation",
+            category: "security",
+            severity: "high",
+            aiSpecific: false,
+            message: `function ${methodName} (${reason}) \u2014 content-based mismatch`,
+            line,
+            column: 1,
+            advice: `The function name "${methodName}" suggests a real validation/encryption/auth/filter operation, but the body is ${reason}. This is a content mismatch \u2014 the code's claimed behavior doesn't match its actual behavior. Real production code that ships this is a silent security failure (OWASP A04:2021 \u2014 Insecure Design). The fix is to either implement the operation or rename the function to reflect what it actually does. Reference: java/suspicious-implementation v0.35.0 (CoCoNUTS-inspired content-based detection).`
+          });
+        }
+        return issues;
+      }
+    });
+  }
+});
+
 // src/rules/java/system-out-println.ts
 var SYSTEM_OUT_REGEX, REAL_LOGGING_IMPORT_REGEX, javaSystemOutPrintlnRule;
 var init_system_out_println = __esm({
@@ -41083,7 +41145,7 @@ var init_force_unwrap2 = __esm({
     "use strict";
     init_rule();
     AS_FORCE_REGEX = /\bas!\s+/g;
-    ACCESS_FORCE_REGEX = /(?:\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
+    ACCESS_FORCE_REGEX = /(?<![=!])(\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
     TRY_FORCE_REGEX = /\btry!\s+/g;
     swiftForceUnwrapRule = createRule({
       id: "swift/force-unwrap",
@@ -41110,7 +41172,7 @@ var init_force_unwrap2 = __esm({
             message: `force-unwrap (${label}) at line ${line} \u2014 crashes if the value is nil`,
             line,
             column: 1,
-            advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.24.'
+            advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.34.10 (refined: exclude `!` in `!==`/`!=` operators via negative lookbehind).'
           });
         };
         let m;
@@ -41119,7 +41181,10 @@ var init_force_unwrap2 = __esm({
         TRY_FORCE_REGEX.lastIndex = 0;
         while ((m = TRY_FORCE_REGEX.exec(source)) !== null) emit(m.index, "try!");
         ACCESS_FORCE_REGEX.lastIndex = 0;
-        while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) emit(m.index, "!.");
+        while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) {
+          const bangOffset = m.index + (m[1]?.length ?? 1);
+          emit(bangOffset, "!.");
+        }
         return issues;
       }
     });
@@ -46942,6 +47007,7 @@ var init_builtins = __esm({
     init_command_injection();
     init_hardcoded_credential();
     init_sql_string_concat();
+    init_suspicious_implementation();
     init_system_out_println();
     init_thread_sleep_in_loop();
     init_coroutine_global_scope();
@@ -47081,6 +47147,7 @@ var init_builtins = __esm({
       javaCommandInjectionRule,
       javaHardcodedCredentialRule,
       javaSqlStringConcatRule,
+      javaSuspiciousImplementationRule,
       javaSystemOutPrintlnRule,
       javaThreadSleepInLoopRule,
       kotlinCoroutineGlobalScopeRule,
@@ -51772,6 +51839,22 @@ var init_signal_strength = __esm({
         _v9Precision: 0,
         defaultOff: true
       },
+      "java/suspicious-implementation": {
+        recall: 0,
+        fpRate: 0,
+        ratio: 0,
+        precision: 0,
+        lastCalibratedAt: "2026-07-03T00:00:00Z",
+        verdict: "OK",
+        _calibrationNote: "v0.35.0: NEW RULE \u2014 content-based detection (CoCoNUTS-inspired). Detects function names that claim a strong operation (validate, encrypt, hash, sanitize, check, verify, authenticate, etc.) but whose body is trivially empty, returns a constant, or returns the input unchanged. The rule is a real engineering defect detector (not AI fingerprint), so it is defaultOff=false (i.e. ON by default) and verdict=OK. The CoCoNUTS paper (2025) showed that style-based AI-detectors fail under paraphrasing; this rule looks at semantic content (function body behavior) rather than surface features. v9 calibration is pending \u2014 the rule was added at the end of the v0.34.X refinement series and has not been measured against the v9 corpus yet. The expected impact: low recall (most production code doesn't have these stubs) but high precision (when it fires, it's a real bug). The full v9 calibration is the next step for v0.35.0.x patches.",
+        aiSpecific: false,
+        _v9Verdict: "OK",
+        _v9Lift: 0,
+        _v9Recall: 0,
+        _v9FpRate: 0,
+        _v9Precision: 0,
+        defaultOff: false
+      },
       "swift/force-unwrap": {
         recall: 0.10211,
         fpRate: 0.21462,
@@ -51779,7 +51862,7 @@ var init_signal_strength = __esm({
         precision: 0.1721,
         lastCalibratedAt: "2026-07-03T00:00:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.32: v9 Swift calibration (1300 neg, 568 pos). Per-file unique measurement: 58 TP files, 279 FP files, ratio=0.48. Era-confounded: pre-2022 Swift used ! freely (the only way to unwrap); modern Swift uses guard let / if let / try?. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
+        _calibrationNote: "v0.34.10: REFINED \u2014 the access-force regex now uses a negative lookbehind to exclude `!` in `!=` and `!==` comparison operators. Per-file unique v9 Swift calibration (1300 neg, 568 pos): 58 TP files, 279 FP files, ratio=0.48 (DORMANT). The previous regex incorrectly fired on `!` in `a != b` and `a !== b` patterns, which are common in control flow. The refinement is expected to push precision from 17.2% to 25%+ by removing these false positives. Era-confounded: pre-2022 Swift used `!` freely (the only way to unwrap); modern Swift uses `guard let` / `if let` / `try?`. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,
@@ -59959,6 +60042,8 @@ var RULE_HINTS = {
   "java/thread-sleep-in-loop": "Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the polling anti-pattern \u2014 ties up Tomcat/Jetty/Netty threads. (v0.30.0 \u2014 DORMANT, era-confounded ratio 0.97.)",
   "java/system-out-println": "The file imports a real logger (SLF4J/Log4j2/java.util.logging) but uses System.out.println. Use the declared log object instead. (v0.31.0 \u2014 OK; ratio 1.73, refined from v0.30.)",
   "java/command-injection": "Use ProcessBuilder with a List<String> of args (no shell parsing) and validate each arg. Runtime.exec() with concat is the canonical command-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT.)",
+  // v0.35.0 — content-based detection (CoCoNUTS-inspired)
+  "java/suspicious-implementation": "Function name claims validate/encrypt/hash/sanitize but body is empty, returns null/true, or returns the input. This is a content mismatch \u2014 the function's claimed behavior doesn't match its actual behavior. OWASP A04:2021.",
   // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
   "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",
   "swift/print-debug": "Replace with `Logger(subsystem:..., category:...).info(...)` (os.log). `print` writes to stdout with no level and no redaction. (v0.24.0 \u2014 DORMANT.)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slopbrick",
-  "version": "0.34.9",
+  "version": "0.35.0",
   "description": "Discovered, modeled, and governed repository structure. SlopBrick scans source code, classifies it against 95+ rules in 15 categories, computes 4 scores (aiSlopScore: lower=cleaner, engineeringHygiene, security, repositoryHealth composite), and persists the structure for AI agents and CI.",
   "type": "module",
   "bin": {