proofctl 0.1.11__tar.gz → 0.2.1__tar.gz

{proofctl-0.1.11 → proofctl-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.1.11
+Version: 0.2.1
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.1.11 → proofctl-0.2.1}/proofctl/checkers/dockerfile.py

@@ -9,7 +9,7 @@ from .base import DockerfileChecker
 
 # ── helpers ───────────────────────────────────────────────────────────────────
 
-_SHA_DIGEST_RE = re.compile(r"@sha256:[a-f0-9]{64}")
+_SHA_DIGEST_RE = re.compile(r"@sha(?:256:[a-f0-9]{64}|384:[a-f0-9]{96}|512:[a-f0-9]{128})")
 _HAS_TAG_RE = re.compile(r":[a-zA-Z0-9][\w.\-]*$")
 
 # DF-007: curl/wget piped to a shell
@@ -330,16 +330,26 @@ def _df008(instructions: list[tuple[int, str, str]], path: Path) -> list[Finding
         if "--checksum=sha256:" in args:
             continue
 
-        # Check the next 3 instructions for a verification RUN
-        window = instructions[idx + 1: idx + 4]
-        verified = any(
-            next_instr == "RUN" and (
+        # Walk the full continuation chain — inspect every subsequent RUN
+        # instruction (each already collapsed across `\` continuations by
+        # the parser) until we hit a non-RUN instruction. This catches
+        # `RUN wget && sha256sum -c && tar xz` chains and multi-RUN
+        # verification sequences that overflowed the old 3-instruction
+        # window.
+        verified = False
+        for _, next_instr, next_args in instructions[idx + 1:]:
+            if next_instr != "RUN":
+                break
+            if (
                 "sha256sum" in next_args
+                or "sha512sum" in next_args
                 or "shasum -a 256" in next_args
+                or "shasum -a 512" in next_args
                 or "gpg --verify" in next_args
-            )
-            for _, next_instr, next_args in window
-        )
+                or "gpg2 --verify" in next_args
+            ):
+                verified = True
+                break
         if verified:
             continue
 
@@ -359,18 +369,30 @@ def _df008(instructions: list[tuple[int, str, str]], path: Path) -> list[Finding
 
 
 def _df009(instructions: list[tuple[int, str, str]], path: Path) -> list[Finding]:
-    """PROOFCTL-DF-009 — COPY . . before dependency installation."""
+    """PROOFCTL-DF-009 — COPY . . before dependency installation.
+
+    Multi-stage context: in a Dockerfile with multiple FROM stages,
+    early/builder stages routinely COPY . to compile or vendor
+    dependencies; the cache-invalidation antipattern only matters in
+    the final (runtime) stage. Skip the rule entirely for non-final
+    stages.
+    """
     findings: list[Finding] = []
 
-    # Broad COPY destinations that indicate a full source-tree copy
-    _broad_dests = {"/app", "/src", "/code", "/workspace", "."}
+    # Determine the line range of the FINAL build stage. Anything
+    # before that range belongs to an earlier (e.g. builder) stage.
+    from_linenos = [ln for ln, instr, _ in instructions if instr == "FROM"]
+    is_multistage = len(from_linenos) > 1
+    final_stage_start = from_linenos[-1] if from_linenos else 0
 
-    # Find the first broad COPY (source is bare ".")
+    # Find the first broad COPY (source is bare ".") in the FINAL stage.
     first_broad_copy: tuple[int, str, str] | None = None
     for item in instructions:
         lineno, instr, args = item
         if instr != "COPY":
             continue
+        if is_multistage and lineno < final_stage_start:
+            continue  # earlier stage — not subject to DF-009
         tokens = args.split()
         if not tokens:
             continue
@@ -384,10 +406,14 @@ def _df009(instructions: list[tuple[int, str, str]], path: Path) -> list[Finding
 
     copy_lineno = first_broad_copy[0]
 
-    # Find the first dependency-install RUN
+    # Find the first dependency-install RUN — only consider RUNs in
+    # the final stage (otherwise we'd cross-match a builder-stage RUN
+    # with a final-stage COPY).
     for lineno, instr, args in instructions:
         if instr != "RUN":
             continue
+        if is_multistage and lineno < final_stage_start:
+            continue
         if _DEP_INSTALL_RE.search(args):
             if copy_lineno < lineno:
                 findings.append(Finding(

{proofctl-0.1.11 → proofctl-0.2.1}/proofctl/checkers/placeholders.py

@@ -2,8 +2,6 @@ from __future__ import annotations
 
 import ast
 import re
-import tokenize
-import io
 from pathlib import Path
 
 from ..models import Finding, Severity

{proofctl-0.1.11 → proofctl-0.2.1}/proofctl/checkers/quality.py

@@ -489,9 +489,13 @@ class _Q009Visitor(ast.NodeVisitor):
             return False
         left, right = test.left, test.comparators[0]
         # Match either side: `__name__ == "__main__"` or `"__main__" == __name__`.
-        is_dunder = lambda n: isinstance(n, ast.Name) and n.id == "__name__"
-        is_main = lambda n: isinstance(n, ast.Constant) and n.value == "__main__"
-        return (is_dunder(left) and is_main(right)) or (is_main(left) and is_dunder(right))
+        def _is_dunder(n: ast.expr) -> bool:
+            return isinstance(n, ast.Name) and n.id == "__name__"
+
+        def _is_main(n: ast.expr) -> bool:
+            return isinstance(n, ast.Constant) and n.value == "__main__"
+
+        return (_is_dunder(left) and _is_main(right)) or (_is_main(left) and _is_dunder(right))
 
     def visit_If(self, node: ast.If) -> None:
         if self._is_main_guard(node):

{proofctl-0.1.11 → proofctl-0.2.1}/proofctl/checkers/shell_checker.py

@@ -9,8 +9,12 @@ from .base import ShellFileChecker
 
 # ── patterns ──────────────────────────────────────────────────────────────────
 
-_SHEBANG_RE = re.compile(r"^#!\s*/(?:usr/(?:local/)?)?bin/(?:env\s+)?(?:bash|sh|zsh|ksh)\b")
-_BASH_SHEBANG_RE = re.compile(r"^#!\s*/(?:usr/(?:local/)?)?bin/(?:env\s+)?bash\b")
+_SHEBANG_RE = re.compile(
+    r"^#!\s*/(?:usr/(?:local/)?)?bin/(?:env\s+)?(?:bash|sh|zsh|ksh)\b(?:\s.*)?$"
+)
+_BASH_SHEBANG_RE = re.compile(
+    r"^#!\s*/(?:usr/(?:local/)?)?bin/(?:env\s+)?bash\b(?:\s.*)?$"
+)
 
 _SET_E_RE = re.compile(
     r"(?:^|\s)set\s+(?:-[a-zA-Z]*e[a-zA-Z]*|-o\s+errexit)", re.MULTILINE
@@ -21,7 +25,24 @@ _PIPE_RE = re.compile(r"[^|]\|[^|]")
 _CURL_BASH_RE = re.compile(
     r"(?:curl|wget)\s+[^\n|]+\|\s*(?:sudo\s+)?(?:bash|sh|zsh)\b", re.MULTILINE
 )
-_RM_RF_VAR_RE = re.compile(r"\brm\s+-rf\s+/\$[{]?[A-Za-z_]", re.MULTILINE)
+_RM_RF_VAR_RE = re.compile(
+    r"\brm\s+-rf\s+\"?/\$\{?(?P<var>[A-Za-z_][A-Za-z0-9_]*)\}?",
+    re.MULTILINE,
+)
+
+# Detect a guarding non-empty test of $VAR on the same line or up to
+# 5 lines above. Matches both [[ -n "$VAR" ]] and [ -n "$VAR" ] forms,
+# with optional braces around the variable name.
+def _has_guard(lines: list[str], line_idx: int, var: str) -> bool:
+    """Return True if a non-empty guard for `var` precedes line_idx."""
+    pattern = re.compile(
+        r"\[\[?\s*-n\s+\"?\$\{?" + re.escape(var) + r"\}?\"?\s*\]\]?"
+    )
+    start = max(0, line_idx - 5)
+    for i in range(start, line_idx + 1):
+        if pattern.search(lines[i]):
+            return True
+    return False
 
 # Placeholder variable assignments
 _PLACEHOLDER_VAR_RE = re.compile(
@@ -152,7 +173,7 @@ def _sh004_curl_bash(path: Path, source: str, lines: list[str]) -> list[Finding]
             path, lineno,
             "PROOFCTL-SH-004", "Remote code execution via curl|bash",
             Severity.ERROR,
-            f"curl/wget piped directly to bash — executes unverified remote code",
+            "curl/wget piped directly to bash — executes unverified remote code",
             hint="Download to a temp file, verify its SHA256 checksum, then execute.",
             authority="Google Shell Style Guide / CWE-78",
             docs_url="https://cwe.mitre.org/data/definitions/78.html",
@@ -161,10 +182,21 @@ def _sh004_curl_bash(path: Path, source: str, lines: list[str]) -> list[Finding]
 
 
 def _sh005_rm_rf_var(path: Path, source: str, lines: list[str]) -> list[Finding]:
-    """PROOFCTL-SH-005 — rm -rf /$VARIABLE (root wipe if var is empty)."""
+    """PROOFCTL-SH-005 — rm -rf /$VARIABLE (root wipe if var is empty).
+
+    Skip the finding when a non-empty guard for the same variable
+    appears on the same logical line or within a few lines above —
+    e.g. ``[[ -n "$VAR" ]] && rm -rf "/$VAR"`` or an enclosing
+    ``if [ -n "$VAR" ]; then rm -rf "/$VAR"; fi`` block.
+    """
     findings: list[Finding] = []
     for m in _RM_RF_VAR_RE.finditer(source):
         lineno = source[: m.start()].count("\n") + 1
+        var = m.group("var")
+        # 0-based index for `lines`
+        idx = lineno - 1
+        if 0 <= idx < len(lines) and _has_guard(lines, idx, var):
+            continue
         findings.append(_f(
             path, lineno,
             "PROOFCTL-SH-005", "Dangerous rm -rf on variable path",

{proofctl-0.1.11 → proofctl-0.2.1}/proofctl/checkers/terraform.py

@@ -304,7 +304,7 @@ class TerraformChecker(HclFileChecker):
             if b.kind != "resource":
                 continue
             inner = b.raw_lines[1:-1] if len(b.raw_lines) > 2 else []
-            content = [l for l in inner if l.strip() and not l.strip().startswith("#")]
+            content = [line for line in inner if line.strip() and not line.strip().startswith("#")]
             if not content:
                 out.append(self._f(
                     path, b.start_line,
@@ -394,7 +394,6 @@ class TerraformChecker(HclFileChecker):
     def _t004(self, path: Path, blocks: list[HclBlock], lines: list[str]) -> list[Finding]:
         """T-004 — Open ingress on sensitive ports (0.0.0.0/0)."""
         out = []
-        any_cidr = re.compile(r'(?:cidr_blocks|cidr_ranges|source_ranges)\s*=\s*\[.*"0\.0\.0\.0/0"')
         port_re = re.compile(r'(?:from_port|to_port|port)\s*=\s*(\d+)')
         all_traffic_re = re.compile(r'(?:protocol|ip_protocol)\s*=\s*"-1"|all\s*=\s*true')
 
@@ -653,9 +652,6 @@ class TerraformChecker(HclFileChecker):
     def _v001(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
         """V-001 — force_destroy / deletion_protection=false on prod-named resource."""
         out = []
-        dangerous = re.compile(
-            r'(?:force_destroy\s*=\s*true|deletion_protection\s*=\s*false)', re.IGNORECASE
-        )
         for b in blocks:
             if b.kind != "resource":
                 continue
@@ -2001,8 +1997,15 @@ class TerraformChecker(HclFileChecker):
 
     def _t015(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
         """T-015 — Output with sensitive-looking name but sensitive = true not set."""
+        # "key" is excluded when followed by measurement/metadata suffixes
+        # (e.g. max_key_age_days, key_count, key_rotation_period) — those are
+        # not sensitive values, just numeric descriptors that happen to contain
+        # the word "key".  Other terms (password, secret, token, credential)
+        # are always sensitive regardless of suffix.
         _sensitive_name_pat = re.compile(
-            r'(?:password|secret|token|key|credential)',
+            r'(?:password|secret|token|credential'
+            r'|key(?!_age|_days|_hours|_seconds|_count|_max|_min|_num'
+            r'|_threshold|_expir|_rotation|_version|_size|_length))',
             re.IGNORECASE,
         )
         out = []

{proofctl-0.1.11 → proofctl-0.2.1}/proofctl/checkers/yaml_checker.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 
 import re
 from pathlib import Path
-from typing import Any, Iterator
+from typing import Iterator
 
 import yaml
 
@@ -1400,67 +1400,76 @@ class _YamlCheckerImpl(YamlFileChecker):
     def check(self, path: Path, source: str) -> list[Finding]:
         findings: list[Finding] = []
 
-        # ── duplicate key detection ───────────────────────────────────────────
-        loader = _DupKeyLoader(source)
-        loader._dup_findings = []  # type: ignore[attr-defined]
+        # ── duplicate key detection (multi-doc aware) ─────────────────────────
+        # Use a fresh loader per document so _dup_findings does not leak
+        # from doc N into doc N+1 in a `---` separated stream.
+        all_dup_findings: list[tuple[str, int]] = []
         try:
-            loader.get_single_data()
+            loader = _DupKeyLoader(source)
+            loader._dup_findings = []  # type: ignore[attr-defined]
+            try:
+                while loader.check_data():
+                    loader.get_data()
+                    all_dup_findings.extend(loader._dup_findings)  # type: ignore[attr-defined]
+                    # Reset between documents — findings already harvested.
+                    loader._dup_findings = []  # type: ignore[attr-defined]
+            finally:
+                loader.dispose()
         except yaml.YAMLError:
             pass
-        finally:
-            loader.dispose()
-        findings.extend(_yaml002_findings(loader._dup_findings, path))  # type: ignore[attr-defined]
+        findings.extend(_yaml002_findings(all_dup_findings, path))
 
-        # ── node-based checks ─────────────────────────────────────────────────
+        # ── node-based checks (multi-doc aware) ───────────────────────────────
         try:
-            root = yaml.compose(source, Loader=yaml.SafeLoader)
+            roots = list(yaml.compose_all(source, Loader=yaml.SafeLoader))
         except yaml.YAMLError:
             return findings  # unparseable — dup findings are still valid
 
-        if root is None:
-            return findings
+        for root in roots:
+            if root is None:
+                continue
 
-        findings.extend(_yaml001(root, path))
-
-        if _is_k8s(root):
-            assert isinstance(root, yaml.MappingNode)
-            findings.extend(_yaml003_k8s(root, path))
-            findings.extend(_yaml004_k8s(root, path))
-            findings.extend(_yaml005_k8s(root, path))
-            findings.extend(_yaml006_image_latest(root, path, "PROOFCTL-YAML-006"))
-            findings.extend(_yaml009_k8s(root, path))
-            findings.extend(_yaml010_k8s(root, path))
-            findings.extend(_yaml011_k8s(root, path))
-            findings.extend(_yaml012_k8s(root, path))
-            findings.extend(_yaml013_k8s(root, path))
-            findings.extend(_yaml014_k8s(root, path))
-            findings.extend(_yaml015_k8s(root, path))
-            findings.extend(_yaml016_017_k8s(root, path))
-            findings.extend(_yaml018_k8s(root, path))
-            findings.extend(_yaml020_k8s(root, path))
-            findings.extend(_yaml021_k8s(root, path))
-            # AI-slop: removed apiVersions, PSP, explicit root, deprecated annotations
-            findings.extend(_yaml_ai001_k8s_removed_api(root, path))
-            findings.extend(_yaml_ai002_pod_security_policy(root, path))
-            findings.extend(_yaml_ai003_run_as_user_root(root, path))
-            findings.extend(_yaml_ai006_ingress_class_annotation(root, path))
-
-        elif _is_compose(root):
-            findings.extend(_yaml006_image_latest(root, path, "PROOFCTL-YAML-006"))
-            findings.extend(_yaml008_compose_privileged(root, path))
-
-        if _is_gha(path) or _is_gha_content(root):
-            findings.extend(_yaml007_gha(root, path))
-            if isinstance(root, yaml.MappingNode):
-                findings.extend(_yaml_gha001(root, path))
-                findings.extend(_yaml_gha002(root, path))
-                findings.extend(_yaml_gha003(root, path))
-                findings.extend(_yaml_gha004(root, path))
-                findings.extend(_yaml_gha005(root, path))
-                findings.extend(_yaml_gha006(root, path))
-                # AI-slop: deprecated workflow commands, stale action versions
-                findings.extend(_yaml_ai004_gha_deprecated_commands(root, path))
-                findings.extend(_yaml_ai005_old_action_versions(root, path))
+            findings.extend(_yaml001(root, path))
+
+            if _is_k8s(root):
+                assert isinstance(root, yaml.MappingNode)
+                findings.extend(_yaml003_k8s(root, path))
+                findings.extend(_yaml004_k8s(root, path))
+                findings.extend(_yaml005_k8s(root, path))
+                findings.extend(_yaml006_image_latest(root, path, "PROOFCTL-YAML-006"))
+                findings.extend(_yaml009_k8s(root, path))
+                findings.extend(_yaml010_k8s(root, path))
+                findings.extend(_yaml011_k8s(root, path))
+                findings.extend(_yaml012_k8s(root, path))
+                findings.extend(_yaml013_k8s(root, path))
+                findings.extend(_yaml014_k8s(root, path))
+                findings.extend(_yaml015_k8s(root, path))
+                findings.extend(_yaml016_017_k8s(root, path))
+                findings.extend(_yaml018_k8s(root, path))
+                findings.extend(_yaml020_k8s(root, path))
+                findings.extend(_yaml021_k8s(root, path))
+                # AI-slop: removed apiVersions, PSP, explicit root, deprecated annotations
+                findings.extend(_yaml_ai001_k8s_removed_api(root, path))
+                findings.extend(_yaml_ai002_pod_security_policy(root, path))
+                findings.extend(_yaml_ai003_run_as_user_root(root, path))
+                findings.extend(_yaml_ai006_ingress_class_annotation(root, path))
+
+            elif _is_compose(root):
+                findings.extend(_yaml006_image_latest(root, path, "PROOFCTL-YAML-006"))
+                findings.extend(_yaml008_compose_privileged(root, path))
+
+            if _is_gha(path) or _is_gha_content(root):
+                findings.extend(_yaml007_gha(root, path))
+                if isinstance(root, yaml.MappingNode):
+                    findings.extend(_yaml_gha001(root, path))
+                    findings.extend(_yaml_gha002(root, path))
+                    findings.extend(_yaml_gha003(root, path))
+                    findings.extend(_yaml_gha004(root, path))
+                    findings.extend(_yaml_gha005(root, path))
+                    findings.extend(_yaml_gha006(root, path))
+                    # AI-slop: deprecated workflow commands, stale action versions
+                    findings.extend(_yaml_ai004_gha_deprecated_commands(root, path))
+                    findings.extend(_yaml_ai005_old_action_versions(root, path))
 
         return findings
 

{proofctl-0.1.11 → proofctl-0.2.1}/proofctl/cli.py

@@ -1,8 +1,9 @@
 from __future__ import annotations
 
+import sys
 from enum import Enum
 from pathlib import Path
-from typing import List, Optional
+from typing import Optional
 
 import typer
 
@@ -10,6 +11,29 @@ from .config import load_config
 from .engine import run_check
 from .registry import RULES, families_help_string, is_hidden_family
 
+
+def _ensure_utf8_io() -> None:
+    """Force stdout/stderr to UTF-8.
+
+    Rich-rendered tables embed box-drawing characters (─ │ ╭),
+    arrows (→), and emoji (📖 ✓) that can't be encoded under
+    Windows' default cp1252 locale — proofctl crashes mid-render with
+    UnicodeEncodeError. Reconfiguring at startup makes output portable
+    regardless of host locale; `errors="replace"` is a defensive fallback
+    so a misconfigured stream never aborts the run.
+    """
+    for stream_name in ("stdout", "stderr"):
+        stream = getattr(sys, stream_name, None)
+        if stream is None or not hasattr(stream, "reconfigure"):
+            continue
+        try:
+            stream.reconfigure(encoding="utf-8", errors="replace")
+        except (OSError, ValueError):
+            pass
+
+
+_ensure_utf8_io()
+
 app = typer.Typer(
     name="proofctl",
     help="Detects AI-generated slop: hallucinated imports, phantom methods, placeholder code, cross-language leakage, and variant file debris.",

{proofctl-0.1.11 → proofctl-0.2.1}/proofctl/config.py

@@ -9,16 +9,72 @@ import yaml
 from .models import Severity
 
 _DEFAULT_EXCLUDES: list[str] = [
+    # ── Python project environments ───────────────────────────────────────────
     "**/.venv/**",
     "**/venv/**",
-    "**/node_modules/**",
-    "**/.git/**",
     "**/__pycache__/**",
     "**/*.egg-info/**",
     "**/dist/**",
     "**/build/**",
-    "**/.terragrunt-cache/**",
+    # ── Universal VCS / package managers ─────────────────────────────────────
+    "**/.git/**",
+    "**/node_modules/**",
+    # ── Terraform / Terragrunt caches ─────────────────────────────────────────
     "**/.terraform/**",
+    "**/.terragrunt-cache/**",
+    # Terraform/OpenTofu state and plan artifacts — never hand-authored;
+    # may contain sensitive resource outputs and secrets.
+    "**/*.tfstate",
+    "**/*.tfstate.backup",
+    "**/*.tfplan",
+    # ── Flux CD ───────────────────────────────────────────────────────────────
+    # Both files are auto-generated by `flux bootstrap` and contain the comment
+    # "# This manifest was generated by flux. DO NOT EDIT."
+    # gotk-components.yaml carries wildcard RBAC + cluster-admin bindings that
+    # are intentional Flux design; gotk-sync.yaml wires the GitRepository/
+    # Kustomization that reconciles flux-system itself.  Neither is user policy.
+    "**/flux-system/gotk-components.yaml",
+    "**/flux-system/gotk-sync.yaml",
+    # ── ArgoCD Autopilot ──────────────────────────────────────────────────────
+    # Files generated by `argocd-autopilot repo bootstrap`. The kustomization
+    # references upstream install.yaml which carries a cluster-admin binding for
+    # argocd-application-controller — intentional, not a misconfiguration.
+    "**/bootstrap/argo-cd/kustomization.yaml",
+    "**/bootstrap/argo-cd.yaml",
+    "**/bootstrap/cluster-resources/in-cluster/**",
+    # ── AWS CDK / CDK for Terraform ───────────────────────────────────────────
+    # cdk.out/ is synthesized CloudFormation JSON from `cdk synth`.
+    # .gen/ and cdktf.out/ are CDKTF provider bindings and synth output.
+    "**/cdk.out/**",
+    "**/.gen/**",
+    "**/cdktf.out/**",
+    # ── Helm ─────────────────────────────────────────────────────────────────
+    # Chart tarballs downloaded by `helm dep update` into charts/ subdirectories.
+    "**/charts/*.tgz",
+    # ── Pulumi ───────────────────────────────────────────────────────────────
+    # Local backend state written by `pulumi up` when using file:// backend.
+    "**/.pulumi/**",
+    # ── Other IaC tool caches ─────────────────────────────────────────────────
+    "**/packer_cache/**",     # Packer: ISO/VM template cache (default ./packer_cache/)
+    "**/.vagrant/**",         # Vagrant: machine state, private keys, VM references
+    "**/.crossplane/**",      # Crossplane CLI: provider OCI layer / CRD schema cache
+    # ── Ansible Galaxy ────────────────────────────────────────────────────────
+    # Collections installed via `ansible-galaxy collection install`.
+    "**/collections/ansible_collections/**",
+    # ── Go vendor ─────────────────────────────────────────────────────────────
+    # Third-party module source vendored by `go mod vendor`. Contains .go files
+    # that can trigger false-positives in import / quality rules.
+    "**/vendor/**",
+    # ── Python tool caches ────────────────────────────────────────────────────
+    # These directories contain .py files and can surface false-positives if
+    # scanned (e.g. generated test helpers, mypy stubs, hypothesis examples).
+    "**/.tox/**",
+    "**/.nox/**",
+    "**/.pytest_cache/**",
+    "**/.mypy_cache/**",
+    "**/.ruff_cache/**",
+    "**/.hypothesis/**",
+    "**/htmlcov/**",
 ]
 
 # Top-level config keys recognised by `.proofctl.yaml`. Anything else triggers

{proofctl-0.1.11 → proofctl-0.2.1}/proofctl/engine.py

@@ -17,7 +17,6 @@ import ast
 import dataclasses
 import re
 import subprocess
-import traceback
 from pathlib import Path
 from typing import Iterable
 
@@ -412,7 +411,24 @@ def run_check(
         floor = Severity.from_str(min_severity)
         findings = [f for f in findings if f.severity >= floor]
 
-    return sorted(findings, key=lambda x: (-x.severity, x.file, x.line or 0))
+    sorted_findings = sorted(findings, key=lambda x: (-x.severity, x.file, x.line or 0))
+
+    # ── 8. Module-level rule deduplication. ───────────────────────────────────
+    # Rules like T014 (missing required_version) represent a per-module property,
+    # not a per-file one.  A module with 10 .tf files should produce one finding,
+    # not ten.  After sorting we keep the first occurrence per (dir, rule_id) so
+    # the preserved finding is always the alphabetically-first file in the module.
+    _MODULE_LEVEL_RULES: frozenset[str] = frozenset({"PROOFCTL-TF-T014"})
+    seen_module_dirs: set[tuple[str, str]] = set()
+    result: list[Finding] = []
+    for f in sorted_findings:
+        if f.rule_id in _MODULE_LEVEL_RULES:
+            dir_key = (str(Path(f.file).parent), f.rule_id)
+            if dir_key in seen_module_dirs:
+                continue
+            seen_module_dirs.add(dir_key)
+        result.append(f)
+    return result
 
 
 def _normalise(f: Finding, root: Path, config: ProofctlConfig) -> Finding | None:

{proofctl-0.1.11 → proofctl-0.2.1}/proofctl/models.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from dataclasses import dataclass, field
+from dataclasses import dataclass
 from enum import IntEnum
 
 

{proofctl-0.1.11 → proofctl-0.2.1}/proofctl/reporters/html_reporter.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import html
-import json
 from collections import Counter
 from datetime import datetime, timezone
 
@@ -160,6 +159,7 @@ class HtmlReporter:
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="proofctl:schema_version" content="1">
 <title>proofctl report</title>
 <style>{_CSS}</style>
 </head>

proofctl-0.2.1/proofctl/reporters/json_reporter.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+import json
+from collections import Counter
+
+from ..models import Finding, Severity
+
+# Bumped in lockstep with documented JSON schema changes. Consumers can branch
+# on this field. Start at 1 since this is the first formally-stable schema.
+SCHEMA_VERSION = 1
+
+# Stable field order for each finding object. Matches the order documented in
+# the README and used by external tooling.
+_FINDING_FIELDS = (
+    "file",
+    "line",
+    "col",
+    "rule_id",
+    "rule_name",
+    "severity",
+    "message",
+    "hint",
+    "authority",
+    "docs_url",
+    "fixable",
+)
+
+
+class JsonReporter:
+    def render(self, findings: list[Finding]) -> str:
+        counts = Counter(f.severity for f in findings)
+
+        # Stable summary order: total, ERROR, WARNING, INFO (matches README).
+        summary = {
+            "total": len(findings),
+            "ERROR": counts[Severity.ERROR],
+            "WARNING": counts[Severity.WARNING],
+            "INFO": counts[Severity.INFO],
+        }
+
+        serialisable = []
+        for f in findings:
+            d = {
+                "file": f.file,
+                "line": f.line,
+                "col": f.col,
+                "rule_id": f.rule_id,
+                "rule_name": f.rule_name,
+                "severity": f.severity.label(),
+                "message": f.message,
+                "hint": f.hint,
+                "authority": f.authority,
+                "docs_url": f.docs_url,
+                "fixable": f.fixable,
+            }
+            serialisable.append(d)
+
+        payload = {
+            "schema_version": SCHEMA_VERSION,
+            "summary": summary,
+            "findings": serialisable,
+        }
+        return json.dumps(payload, indent=2)