soloforge 1.1.37 → 1.1.40

package/templates/rules/shared//345/256/211/345/205/250/345/256/241/346/237/245/350/247/204/345/210/231.md

@@ -1,98 +1,132 @@
 ---
 name: security-rules
 type: review_rule
-when: '代码审查, review, 安全部署, 安全检查, 安全审计'
 scope:
   - backend
   - frontend
 products:
   - '*'
 id: ka-review-rule-安全审查规则
-asset_kind: review_rule
 lifecycle_status: active
 owner_mechanism_id: mc-generic-review
 authority: supporting
-routes:
-  - code_change
-primary_triggers:
-  - 安全审查规则
-secondary_triggers: []
-negative_triggers: []
 priority: P1
-specificity: 5
-version: 1.1.0
-last_reviewed: '2026-06-01'
+version: 1.2.0
+last_reviewed: '2026-06-04'
 stages: ["代码审查"]
+triggers: ["代码审查","review","安全部署","安全检查","安全审计"]
 ---
 
 ## SEC-01: SQL 字符串拼接导致注入风险
 pattern: /(SELECT|INSERT|UPDATE|DELETE)\b.*[\+${]/
-severity: critical
+severity: error
+check_type: deterministic
 scope: backend
 description: 禁止使用字符串拼接构造 SQL，必须使用参数化查询（PreparedStatement / MyBatis #{}）
+evidence_required:
+  - "扫描结果：含 SQL 拼接的文件路径+行号"
+  - "修复确认：参数化查询替换证据"
 
 ## SEC-02: innerHTML 赋值存在 XSS 风险
 pattern: /\.innerHTML\s*=/
-severity: critical
+severity: error
+check_type: deterministic
 scope: frontend
 description: 禁止使用 innerHTML 直接插入用户内容，必须使用 textContent 或 DOMPurify 净化
+evidence_required:
+  - "扫描结果：含 innerHTML 赋值的文件路径+行号"
+  - "修复确认：使用安全替代方案证据"
 
 ## SEC-03: eval 或 Function 构造器执行动态代码
 pattern: /\beval\s*\(|new\s+Function\s*\(/
-severity: critical
+severity: error
+check_type: deterministic
 scope: [backend, frontend]
 description: 禁止使用 eval() 和 new Function()，存在任意代码执行风险
+evidence_required:
+  - "扫描结果：含 eval/Function 的文件路径+行号"
 
 ## SEC-04: 硬编码的密码/密钥/token
 pattern: /password\s*=\s*["'][^"']+["']|secret[_-]?key\s*=\s*["'][^"']+["']|api[_-]?key\s*=\s*["'][^"']+["']/i
-severity: critical
+severity: error
+check_type: deterministic
 scope: [backend, frontend]
 description: 敏感凭证禁止硬编码在源码中，必须使用环境变量或密钥管理服务
+evidence_required:
+  - "扫描结果：含硬编码凭证的文件路径+行号"
+  - "修复确认：迁移到环境变量/密钥管理服务证据"
 
 ## SEC-05: 日志中打印敏感信息
 pattern: /log\.\w+\(.*(?:password|token|secret|身份证|idcard)/i
-severity: critical
+severity: error
+check_type: deterministic
 scope: backend
 description: 禁止在日志中输出密码、token、身份证号等敏感字段，必须脱敏处理
+evidence_required:
+  - "扫描结果：含敏感信息日志的文件路径+行号"
+  - "修复确认：脱敏处理证据"
 
 ## SEC-06: 未验证的外部重定向
 pattern: /redirect\s*\(\s*(?:req|request|ctx)\.\w+/
 severity: warning
+check_type: deterministic
 scope: backend
 description: 重定向目标必须校验白名单域名，防止开放重定向攻击
+evidence_required:
+  - "扫描结果：含未验证重定向的文件路径+行号"
 
 ## SEC-07: 路径遍历风险
 pattern: /\.\.\/|\.\.\\/
 severity: warning
+check_type: deterministic
 scope: [backend, frontend]
 description: 文件路径操作必须校验和规范化，防止通过 ../ 遍历到非授权目录
+evidence_required:
+  - "扫描结果：含路径遍历风险的文件路径+行号"
 
 ## SEC-08: 不安全的反序列化
 pattern: /ObjectInputStream|unserialize|pickle\.load/
-severity: critical
+severity: error
+check_type: deterministic
 scope: backend
 description: 禁止直接反序列化不可信数据，必须使用白名单校验或 JSON 替代方案
+evidence_required:
+  - "扫描结果：含不安全反序列化的文件路径+行号"
 
 ## SEC-09: SSRF 服务端请求伪造
 pattern: /(?:HttpClient|RestTemplate|WebClient|OkHttp|URLConnection)\s*\(\s*(?:req|request|ctx|param)\./
-severity: critical
+severity: error
+check_type: deterministic
 scope: backend
 description: 外部 URL 请求禁止直接使用用户输入，必须校验 IP/域名白名单，防止 SSRF 攻击
+evidence_required:
+  - "扫描结果：含 SSRF 风险的文件路径+行号"
+  - "修复确认：白名单校验证据"
 
 ## SEC-10: CORS 配置过于宽松
 pattern: /allowedOrigins\s*\(\s*"\*"\s*\)|Access-Control-Allow-Origin.*\*/
 severity: warning
+check_type: deterministic
 scope: backend
 description: CORS 配置禁止使用通配符 *，必须指定具体域名白名单
+evidence_required:
+  - "扫描结果：含宽松 CORS 配置的文件路径+行号"
 
 ## SEC-11: 未启用 HTTPS 的 Cookie
 pattern: /cookie.*(?:secure\s*:\s*false|httpOnly\s*:\s*false)/i
 severity: warning
+check_type: deterministic
 scope: [backend, frontend]
 description: 敏感 Cookie 必须设置 Secure 和 HttpOnly 标志
+evidence_required:
+  - "扫描结果：含不安全 Cookie 配置的文件路径+行号"
 
 ## SEC-12: JWT 未校验签名算法
 pattern: /JWT|jwt.*verify|jwt.*decode/
-severity: critical
+severity: error
+check_type: deterministic
 scope: backend
 description: JWT 必须显式指定签名算法（如 HS256/RS256），禁止接受 none 算法
+evidence_required:
+  - "扫描结果：含 JWT 操作的文件路径+行号"
+  - "修复确认：显式指定签名算法证据"

package/templates/rules/shared//345/271/266/345/217/221/345/256/241/346/237/245/350/247/204/345/210/231.md

@@ -1,85 +1,112 @@
 ---
 name: concurrency-rules
 type: review_rule
-when: '代码审查, review, 并发检查, 线程安全检查, 锁检查'
 scope:
   - backend
 products:
   - '*'
 id: ka-review-rule-并发审查规则
-asset_kind: review_rule
 lifecycle_status: active
 owner_mechanism_id: mc-generic-review
 authority: supporting
-routes:
-  - code_change
-primary_triggers:
-  - 并发审查规则
-secondary_triggers: []
-negative_triggers: []
 priority: P1
-specificity: 5
-version: 1.1.0
-last_reviewed: '2026-06-01'
+version: 1.2.0
+last_reviewed: '2026-06-04'
 stages: ["代码审查"]
+triggers: ["代码审查","review","并发检查","线程安全检查","锁检查"]
 ---
 
 ## CON-01: 共享可变状态无并发保护
 pattern: "synchronized|ReentrantLock|AtomicInteger|volatile"
-severity: critical
+severity: error
+check_type: deterministic
 scope: backend
 description: 涉及金额、库存、计数器的操作必须显式声明并发控制策略。若未使用任何并发控制原语，标记为需人工确认
+evidence_required:
+  - "扫描结果：含共享可变状态的文件路径+行号"
+  - "并发控制策略声明"
 
 ## CON-02: 分布式环境使用 JVM 级锁
 pattern: "synchronized\\s*\\(|ReentrantLock"
 severity: warning
+check_type: deterministic
 scope: backend
 description: 多实例部署场景下 synchronized/ReentrantLock 无法跨 JVM，必须使用分布式锁（Redis/Redisson）
+evidence_required:
+  - "扫描结果：含 JVM 级锁的文件路径+行号"
+  - "部署架构确认（单实例/多实例）"
 
 ## CON-03: 先查后改未用原子操作
 pattern: "SELECT.*stock|SELECT.*count|SELECT.*amount.*WHERE"
 severity: warning
+check_type: deterministic
 scope: backend
 description: 库存/余额/计数器等场景禁止先 SELECT 再 UPDATE，必须使用原子操作（UPDATE SET x = x - 1 WHERE x >= 1）
+evidence_required:
+  - "扫描结果：含先查后改模式的文件路径+行号"
 
 ## CON-04: @Transactional 同类内部调用
 pattern: "this\\.|@Transactional"
 severity: warning
+check_type: deterministic
 scope: backend
 description: @Transactional 方法被同类内部 this.xxx() 调用时 AOP 代理失效，事务不生效
+evidence_required:
+  - "扫描结果：含 this 调用事务方法的文件路径+行号"
 
 ## CON-05: 事务内执行外部调用
 pattern: "RestTemplate|FeignClient|HttpClient|WebClient"
 severity: info
+check_type: deterministic
 scope: backend
 description: 事务方法中执行外部 HTTP 调用会延长事务持有时间，建议移到事务外或使用 REQUIRES_NEW 隔离
+evidence_required:
+  - "扫描结果：事务内外部调用的文件路径+行号"
 
 ## CON-06: SimpleDateFormat 非线程安全
 pattern: "SimpleDateFormat"
 severity: warning
+check_type: deterministic
 scope: backend
 description: SimpleDateFormat 非线程安全，多线程共享会导致日期解析错误，使用 DateTimeFormatter 或 ThreadLocal
+evidence_required:
+  - "扫描结果：含 SimpleDateFormat 的文件路径+行号"
 
 ## CON-07: ThreadLocal 未清理导致内存泄漏
 pattern: /ThreadLocal\s*<|new\s+ThreadLocal/
 severity: warning
+check_type: deterministic
 scope: backend
 description: ThreadLocal 必须在请求结束时 remove()，否则线程池复用会导致内存泄漏和数据串线
+evidence_required:
+  - "扫描结果：含 ThreadLocal 的文件路径+行号"
+  - "remove() 调用确认"
 
 ## CON-08: 非线程安全的集合用作类成员变量
 pattern: /private\s+(?:static\s+)?(?:final\s+)?(?:HashMap|ArrayList|LinkedList|HashSet)\s*</
 severity: warning
+check_type: deterministic
 scope: backend
 description: 类级别的共享集合必须使用 ConcurrentHashMap/CopyOnWriteArrayList 等线程安全实现
+evidence_required:
+  - "扫描结果：含非线程安全集合的文件路径+行号"
 
 ## CON-09: CompletableFuture 未处理异常
 pattern: /CompletableFuture.*(?:thenApply|thenAccept|thenCompose)\s*\(/
 severity: warning
+check_type: deterministic
 scope: backend
 description: CompletableFuture 链必须以 exceptionally() 或 handle() 结尾，防止异常被静默吞掉
+evidence_required:
+  - "扫描结果：含 CompletableFuture 的文件路径+行号"
+  - "异常处理链确认"
 
 ## CON-10: 线程池未正确配置拒绝策略
 pattern: /new\s+ThreadPoolExecutor\s*\(/
 severity: warning
+check_type: deterministic
 scope: backend
 description: 线程池必须显式配置拒绝策略（CallerRunsPolicy/自定义），禁止使用默认 AbortPolicy
+evidence_required:
+  - "扫描结果：含线程池创建的文件路径+行号"
+  - "拒绝策略配置确认"

package/templates/rules/shared//346/200/247/350/203/275/345/256/241/346/237/245/350/247/204/345/210/231.md

@@ -1,80 +1,100 @@
 ---
 name: performance-rules
 type: review_rule
-when: '代码审查, review, 性能检查, 性能优化'
 scope:
   - backend
   - frontend
 products:
   - '*'
 id: ka-review-rule-性能审查规则
-asset_kind: review_rule
 lifecycle_status: active
 owner_mechanism_id: mc-generic-review
 authority: supporting
-routes:
-  - code_change
-primary_triggers:
-  - 性能审查规则
-secondary_triggers: []
-negative_triggers: []
 priority: P1
-specificity: 5
-version: 1.1.0
-last_reviewed: '2026-06-01'
+version: 1.2.0
+last_reviewed: '2026-06-04'
 stages: ["代码审查"]
+triggers: ["代码审查","review","性能检查","性能优化"]
 ---
 
 ## PER-01: 循环内逐条数据库调用（N+1 问题）
 pattern: /(?:for|while)\s*\(.*\)[\s\S]*?\.(?:save|insert|update|delete|query|select|findBy)\s*\(/
-severity: critical
+severity: error
+check_type: deterministic
 scope: backend
 description: 循环内禁止逐条数据库操作，必须使用批量 SQL 或 IN 查询
+evidence_required:
+  - "扫描结果：含循环内数据库调用的文件路径+行号"
+  - "修复确认：批量操作替换证据"
 
 ## PER-02: SELECT * 查询未指定字段
 pattern: /SELECT\s+\*\s+FROM/i
 severity: info
+check_type: deterministic
 scope: backend
 description: 查询应明确指定所需字段，避免传输不必要的数据
+evidence_required:
+  - "扫描结果：含 SELECT * 的文件路径+行号"
 
 ## PER-03: 未使用分页的大列表查询
 pattern: /findAll\s*\(\s*\)|\.toList\(\)\s*;|find\s*\(\s*\{\s*\}\s*\)/
 severity: warning
+check_type: deterministic
 scope: backend
 description: 列表查询必须分页，禁止一次加载全量数据
+evidence_required:
+  - "扫描结果：含未分页查询的文件路径+行号"
 
 ## PER-04: 大循环内创建对象或字符串拼接
 pattern: /(?:for|while)\s*\(.*\)[\s\S]*?new\s+(?:ArrayList|HashMap|StringBuilder)/
 severity: info
+check_type: deterministic
 scope: backend
 description: 大循环内避免重复创建对象，应提前初始化或使用对象池
+evidence_required:
+  - "扫描结果：含循环内创建对象的文件路径+行号"
 
 ## PER-05: 前端组件不必要的重渲染
 pattern: /onClick=\{\(\).*=>|style=\{\{/
 severity: info
+check_type: deterministic
 scope: frontend
 description: 内联函数和对象作为 props 会导致子组件不必要的重渲染，应使用 useCallback/useMemo
+evidence_required:
+  - "扫描结果：含内联函数/对象的文件路径+行号"
 
 ## PER-06: 未使用 useMemo/useCallback 的高开销计算
 pattern: /(?:\.sort|\.filter|\.map|\.reduce)\s*\(.*=>.*(?:\.sort|\.filter|\.map)/
 severity: info
+check_type: deterministic
 scope: frontend
 description: 链式数组操作或高开销计算应使用 useMemo 缓存结果，避免每次渲染重复计算
+evidence_required:
+  - "扫描结果：含未缓存计算的文件路径+行号"
 
 ## PER-07: 未使用连接池的数据库连接
 pattern: /DriverManager\.getConnection/
 severity: warning
+check_type: deterministic
 scope: backend
 description: 禁止使用 DriverManager 直接创建连接，必须使用连接池（HikariCP/Druid）
+evidence_required:
+  - "扫描结果：含 DriverManager 调用的文件路径+行号"
 
 ## PER-08: 大事务包含非必要操作
 pattern: /@Transactional[\s\S]*?(?:log\.|email|send|notify|http)/
 severity: warning
+check_type: deterministic
 scope: backend
 description: @Transactional 方法内禁止包含发送邮件、HTTP 调用、MQ 发送等非必要操作，避免长事务
+evidence_required:
+  - "扫描结果：含大事务非必要操作的文件路径+行号"
 
 ## PER-09: 前端图片未压缩或懒加载
 pattern: /<img\s+src=/
 severity: info
+check_type: deterministic
 scope: frontend
 description: 图片资源必须使用压缩/懒加载/响应式加载，禁止原始大图直接展示
+evidence_required:
+  - "扫描结果：含未优化图片的文件路径+行号"

package/templates/rules/shared//346/216/245/345/217/243/345/245/221/347/272/246/345/256/241/346/237/245/350/247/204/345/210/231.md

@@ -1,85 +1,112 @@
 ---
 name: api-contract-rules
 type: review_rule
-when: '代码审查, review, 接口契约检查, API规范检查'
 scope:
   - backend
 products:
   - '*'
 id: ka-review-rule-接口契约审查规则
-asset_kind: review_rule
 lifecycle_status: active
 owner_mechanism_id: mc-generic-review
 authority: supporting
-routes:
-  - code_change
-primary_triggers:
-  - 接口契约审查规则
-secondary_triggers: []
-negative_triggers: []
 priority: P1
-specificity: 5
-version: 1.1.0
-last_reviewed: '2026-06-01'
+version: 1.2.0
+last_reviewed: '2026-06-04'
 stages: ["代码审查"]
+triggers: ["代码审查","review","接口契约检查","API规范检查"]
 ---
 
 ## API-01: Controller 返回 Entity 而非 DTO
 pattern: "ResponseEntity<Entity>|ResponseEntity<\\s*$"
 severity: warning
+check_type: deterministic
 scope: backend
 description: 禁止直接返回数据库 Entity，必须通过 DTO/VO 转换，防止敏感字段泄漏和结构耦合
+evidence_required:
+  - "扫描结果：含直接返回 Entity 的 Controller 文件路径+行号"
+  - "修复确认：DTO/VO 转换替换证据"
 
 ## API-02: 缺少 @Transactional 的写操作
 pattern: "@(PostMapping|PutMapping|DeleteMapping|PatchMapping)"
 severity: warning
+check_type: deterministic
 scope: backend
 description: 写操作 Service 方法必须标注 @Transactional(rollbackFor = Exception.class)
+evidence_required:
+  - "扫描结果：含写操作但缺少 @Transactional 的方法文件路径+行号"
+  - "修复确认：事务注解添加证据"
 
 ## API-03: 接口缺少权限注解
 pattern: "@(PostMapping|PutMapping|DeleteMapping)"
-severity: critical
+severity: error
+check_type: deterministic
 scope: backend
 description: 写接口必须有 @PreAuthorize 或 @Secured 注解，禁止裸露写操作
+evidence_required:
+  - "扫描结果：含裸露写操作（无权限注解）的接口文件路径+行号"
+  - "修复确认：权限注解添加证据"
 
 ## API-04: 硬编码分页参数
 pattern: "LIMIT\\s+\\d+|pageSize\\s*=\\s*\\d{4,}"
 severity: warning
+check_type: deterministic
 scope: backend
 description: 分页参数禁止硬编码大数字，pageSize 上限不超过 100
+evidence_required:
+  - "扫描结果：含硬编码分页参数的文件路径+行号"
+  - "修复确认：参数化替换证据"
 
 ## API-05: 缺少参数校验注解
 pattern: "@RequestBody\\s+\\w+\\s+\\w+"
 severity: info
+check_type: deterministic
 scope: backend
-description: @RequestBody 参数应搭配 @Valid 或 @Validated 注解触发校验
+description: "@RequestBody 参数应搭配 @Valid 或 @Validated 注解触发校验"
+evidence_required:
+  - "扫描结果：含未校验 @RequestBody 参数的接口文件路径+行号"
 
 ## API-06: 接口路径不符合 RESTful 规范
 pattern: "@(Get|Post|Put|Delete)Mapping.*(/get|/query|/add|/update|/delete|/list)"
 severity: info
+check_type: deterministic
 scope: backend
 description: 接口路径应使用资源名词 + HTTP 方法语义，避免 /getUser、/deleteOrder 等动词路径
+evidence_required:
+  - "扫描结果：含非 RESTful 路径的接口文件路径+行号"
 
 ## API-07: 接口缺少统一响应包装
 pattern: /ResponseEntity<\s*(?!ApiResult|Result|R<)/
 severity: warning
+check_type: deterministic
 scope: backend
 description: 接口返回值必须使用统一响应包装（如 Result<T>），禁止直接返回裸数据或 ResponseEntity
+evidence_required:
+  - "扫描结果：含未包装响应的接口文件路径+行号"
+  - "修复确认：统一响应包装替换证据"
 
 ## API-08: 分页接口返回非标准结构
 pattern: /Page(?:Info|able)|PageRequest/
 severity: info
+check_type: deterministic
 scope: backend
 description: 分页接口必须返回标准结构（total、list、pageNum、pageSize），禁止自定义分页格式
+evidence_required:
+  - "扫描结果：含非标准分页结构的接口文件路径+行号"
 
 ## API-09: 缺少接口版本号
 pattern: /@(?:Get|Post|Put|Delete)Mapping\s*\(\s*"\/(?!v\d)/
 severity: info
+check_type: deterministic
 scope: backend
 description: API 路径应包含版本号前缀（如 /api/v1/），便于后续接口演进和兼容
+evidence_required:
+  - "扫描结果：含无版本号路径的接口文件路径+行号"
 
 ## API-10: 接口缺少 Swagger/OpenAPI 文档注解
 pattern: /@(?:Get|Post|Put|Delete)Mapping\s*\(/
 severity: info
+check_type: deterministic
 scope: backend
 description: 接口必须添加 @Operation/@Api 注解，保证 API 文档自动生成
+evidence_required:
+  - "扫描结果：含缺少文档注解的接口文件路径+行号"

package/templates/rules/shared//346/236/266/346/236/204/345/256/241/346/237/245/350/247/204/345/210/231.md

@@ -1,81 +1,99 @@
 ---
 name: architecture-rules
 type: review_rule
-when: '代码审查, review, 架构检查, 设计审查'
 scope:
   - backend
   - frontend
 products:
   - '*'
 id: ka-review-rule-架构审查规则
-asset_kind: review_rule
 lifecycle_status: active
 owner_mechanism_id: mc-generic-review
 authority: supporting
-routes:
-  - code_change
-primary_triggers:
-  - 架构审查规则
-secondary_triggers: []
-negative_triggers: []
 priority: P1
-specificity: 5
-version: 1.1.0
-last_reviewed: '2026-06-01'
+version: 1.2.0
+last_reviewed: '2026-06-04'
 stages: ["代码审查"]
+triggers: ["代码审查","review","架构检查","设计审查"]
 ---
 
 ## ARC-01: Controller 包含业务逻辑
 pattern: /@(?:RestController|Controller)[\s\S]*?public\s+\w+\s+\w+\s*\([^)]*\)\s*\{[\s\S]*?(?:if\s*\(.*[><=!]|for\s*\(|while\s*\().*(?:calculate|compute|validate)/
 severity: warning
+check_type: deterministic
 scope: backend
 description: Controller 层禁止包含业务逻辑（if/else 分支、计算、校验），必须下沉到 Service 层
+evidence_required:
+  - "扫描结果：含业务逻辑的 Controller 文件路径+行号"
 
 ## ARC-02: Entity 直接暴露给外部
 pattern: /(?:ResponseEntity|ResponseBody).*<.*Entity>/
 severity: warning
+check_type: deterministic
 scope: backend
 description: Controller 返回类型禁止使用 Entity，必须通过 DTO/VO 转换，防止结构耦合和敏感字段泄漏
+evidence_required:
+  - "扫描结果：直接暴露 Entity 的文件路径+行号"
 
 ## ARC-03: 缺少 @Transactional 注解的写操作
 pattern: /public\s+\w+\s+(?:save|create|update|delete|insert|remove)\w*\s*\(/
-severity: critical
+severity: error
+check_type: deterministic
 scope: backend
 description: 写操作 Service 方法必须标注 @Transactional(rollbackFor = Exception.class)
+evidence_required:
+  - "扫描结果：缺少 @Transactional 的写操作文件路径+行号"
 
 ## ARC-04: 未使用依赖注入直接 new 服务对象
 pattern: /new\s+\w*(?:Service|Repository|Mapper|Dao|Manager)\s*\(/
 severity: warning
+check_type: deterministic
 scope: backend
 description: 禁止手动 new Service/Repository 实例，必须通过构造器注入或 @Autowired
+evidence_required:
+  - "扫描结果：含 new 服务对象的文件路径+行号"
 
 ## ARC-05: 前端组件文件超过 300 行应拆分
 pattern: //
 severity: info
+check_type: deterministic
 scope: frontend
-check: lines
 description: 单个组件文件超过 300 行时应拆分为子组件，保持单一职责
+evidence_required:
+  - "文件行数统计"
 
 ## ARC-06: API 调用未封装到 service 层
 pattern: /(?:fetch|axios)\s*\.\s*(?:get|post|put|delete)\s*\(/
 severity: warning
+check_type: deterministic
 scope: frontend
 description: HTTP 调用禁止直接写在组件中，必须封装到独立的 service/API 层
+evidence_required:
+  - "扫描结果：含组件内 HTTP 调用的文件路径+行号"
 
 ## ARC-07: 循环依赖导致启动失败
 pattern: /@Autowired.*@Lazy|@Lazy\s+@Autowired/
 severity: warning
+check_type: deterministic
 scope: backend
 description: 使用 @Lazy 解决循环依赖是临时方案，应重构消除循环依赖
+evidence_required:
+  - "扫描结果：含 @Lazy 循环依赖的文件路径+行号"
 
 ## ARC-08: Service 层直接操作 HttpServletRequest/Response
 pattern: /(?:HttpServletRequest|HttpServletResponse)\s/
 severity: warning
+check_type: deterministic
 scope: backend
 description: Service 层禁止依赖 Servlet API，应通过参数 DTO 传递数据
+evidence_required:
+  - "扫描结果：Service 层引用 Servlet API 的文件路径+行号"
 
 ## ARC-09: 未配置全局异常处理器
 pattern: /@(?:RestControllerAdvice|ControllerAdvice)/
 severity: info
+check_type: deterministic
 scope: backend
 description: 项目必须有全局异常处理器（@RestControllerAdvice），统一错误响应格式
+evidence_required:
+  - "全局异常处理器存在确认"