proofctl 0.4.1__tar.gz → 0.4.3__tar.gz

{proofctl-0.4.1 → proofctl-0.4.3}/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Kolawolu Odunola
+Copyright (c) 2025-2026 Kolawolu Odunola
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

proofctl-0.4.3/MANIFEST.in

@@ -0,0 +1,19 @@
+graft proofctl
+include README.md
+include LICENSE
+include pyproject.toml
+
+# Internal-only — never ship to PyPI
+prune tests
+prune doc
+prune docs
+prune examples
+prune build
+prune dist
+prune .github
+exclude AUDIT_AND_ROADMAP.md
+exclude AUDIT_VERIFICATION_v0.1.11.md
+
+global-exclude __pycache__
+global-exclude *.py[cod]
+global-exclude .DS_Store

{proofctl-0.4.1 → proofctl-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.4.1
+Version: 0.4.3
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT
@@ -28,7 +28,7 @@ Dynamic: license-file
 
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **264 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -165,7 +165,7 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-264 rules across 14 families. Run `proofctl rules` after install to enumerate.
+267 rules across 14 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
@@ -173,9 +173,9 @@ git commit -m "chore: add proofctl baseline"
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
 | Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 26 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 28 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 50 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress |
+| Terraform — GCP (`TF-G`) | 51 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress, compute access scopes |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
 | Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |

{proofctl-0.4.1 → proofctl-0.4.3}/README.md

@@ -1,6 +1,6 @@
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **264 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -137,7 +137,7 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-264 rules across 14 families. Run `proofctl rules` after install to enumerate.
+267 rules across 14 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
@@ -145,9 +145,9 @@ git commit -m "chore: add proofctl baseline"
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
 | Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 26 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 28 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 50 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress |
+| Terraform — GCP (`TF-G`) | 51 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress, compute access scopes |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
 | Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |

{proofctl-0.4.1 → proofctl-0.4.3}/proofctl/checkers/terraform.py

@@ -294,6 +294,7 @@ class TerraformChecker(HclFileChecker):
         out += self._g044(path, blocks)
         out += self._g045(path, blocks)
         out += self._g046(path, blocks)
+        out += self._g047(path, blocks)
 
         # Group AZ — Azure
         out += self._az001(path, blocks)
@@ -327,6 +328,8 @@ class TerraformChecker(HclFileChecker):
         out += self._ai009(path, lines)
         out += self._ai010(path, lines)
         out += self._ai011(path, lines)
+        out += self._ai012(path, blocks)
+        out += self._ai013(path, blocks)
 
         return out
 
@@ -2935,6 +2938,36 @@ class TerraformChecker(HclFileChecker):
                     break
         return out
 
+    def _g047(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
+        """G-047 — Compute instance with `cloud-platform` access scope.
+
+        Access scopes are a coarse, IAM-bypassing layer on top of service-account
+        permissions. `cloud-platform` grants the metadata server permission to
+        mint tokens for every GCP API — so any role the SA ever acquires becomes
+        immediately usable from the VM. Best practice: rely on IAM only, and
+        narrow the scope to `cloud-platform.read-only` or use the default
+        scopes set with explicit IAM roles.
+        """
+        out = []
+        for b in blocks:
+            if b.kind != "resource" or b.label1 != "google_compute_instance":
+                continue
+            for sa in b.nested("service_account"):
+                # Match "cloud-platform" exactly inside the scopes list — not
+                # cloud-platform.read-only or other narrower scopes.
+                if sa.contains(r'"cloud-platform"'):
+                    out.append(self._f(
+                        path, sa.attr_line("scopes") or sa.start_line,
+                        "PROOFCTL-TF-G047", "Compute instance with cloud-platform scope",
+                        Severity.WARNING,
+                        f'google_compute_instance "{b.label2}" has access scope "cloud-platform" — broadest possible API access',
+                        hint='Use narrower scopes (e.g. "cloud-platform.read-only") or omit and rely on IAM bindings on the service account.',
+                        authority="GCP Compute Engine — Access scopes vs IAM",
+                        docs_url="https://cloud.google.com/compute/docs/access/service-accounts#scopes_best_practice",
+                    ))
+                    break
+        return out
+
     # ════════════════════════════════════════════════════════════════════════
     # Group AZ — Azure data-exfiltration rules (extended)
     # ════════════════════════════════════════════════════════════════════════
@@ -3328,6 +3361,152 @@ class TerraformChecker(HclFileChecker):
             ))
         return out
 
+    # GCE boot disk that references an image *family* rather than a specific
+    # image is the GCP equivalent of `:latest` — Google promotes new images
+    # into a family on its own schedule. Any apply that triggers VM rebuild
+    # picks up whatever's current that day. Sneaky drift / surprise OS upgrade
+    # vector that AI tools default to because the canonical examples use it.
+    _IMAGE_FAMILY_RE = re.compile(
+        r'image\s*=\s*"[^"]*?/images/family/[^"]+"',
+    )
+
+    def _ai012(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
+        """AI-012 — GCE boot disk references an image *family* (mutable)."""
+        out = []
+        for b in blocks:
+            if b.kind != "resource" or b.label1 != "google_compute_instance":
+                continue
+            for bd in b.nested("boot_disk"):
+                # `image` can live either directly on boot_disk or inside
+                # the nested initialize_params block.
+                targets = [bd] + bd.nested("initialize_params")
+                for t in targets:
+                    line = t.any_line_matches(self._IMAGE_FAMILY_RE.pattern)
+                    if line is not None:
+                        out.append(self._f(
+                            path, line,
+                            "PROOFCTL-TF-AI-012",
+                            "GCE boot disk uses image family (mutable)",
+                            Severity.WARNING,
+                            f'google_compute_instance "{b.label2}" references an image family — Google promotes new images into the family at any time',
+                            hint="Pin to a specific image name (e.g. ubuntu-2404-amd64-20251101) or set lifecycle { ignore_changes = [boot_disk[0].initialize_params[0].image] } to opt out of rebuilds.",
+                            authority="GCP Compute Engine — Image families",
+                            docs_url="https://cloud.google.com/compute/docs/images/image-families-best-practices",
+                        ))
+                        break  # one finding per boot_disk is enough
+        return out
+
+    # Variables likely to hold credential material — used by AI-013 to decide
+    # which `var.X` references are dangerous to embed in compute metadata.
+    # Aligns with the SECRET-007 name set so engineers don't have to learn
+    # two parallel taxonomies.
+    _SENSITIVE_VAR_NAME_RE = re.compile(
+        r"\bvar\.((?:[a-zA-Z0-9_]*_)?"
+        r"(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|"
+        r"private[_-]?key|client[_-]?secret|encryption[_-]?key|auth[_-]?token|"
+        r"bearer[_-]?token|jwt|credential|tunnel[_-]?token)"
+        r"[a-zA-Z0-9_]*)\b",
+        re.IGNORECASE,
+    )
+
+    @staticmethod
+    def _line_range_of_attr(
+        block: HclBlock, attr_name: str
+    ) -> tuple[int, int] | None:
+        """Find (start_idx, end_idx) into block.raw_lines that span the attribute
+        ``attr_name = <value>`` including any continuation lines opened by
+        parentheses or brackets.
+
+        Returns indices relative to ``block.raw_lines`` (0-based), inclusive of
+        the closing bracket / paren line. Returns None if the attribute is not
+        present.
+        """
+        head = re.compile(rf"^\s*{re.escape(attr_name)}\s*=\s*(.*)$")
+        for i, line in enumerate(block.raw_lines):
+            m = head.match(line)
+            if not m:
+                continue
+            rest = m.group(1)
+            depth = rest.count("(") + rest.count("[") + rest.count("{")
+            depth -= rest.count(")") + rest.count("]") + rest.count("}")
+            if depth <= 0:
+                return (i, i)
+            j = i + 1
+            while j < len(block.raw_lines) and depth > 0:
+                ln = block.raw_lines[j]
+                depth += ln.count("(") + ln.count("[") + ln.count("{")
+                depth -= ln.count(")") + ln.count("]") + ln.count("}")
+                j += 1
+            return (i, j - 1)
+        return None
+
+    def _ai013(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
+        """AI-013 — Sensitive variable interpolated into compute metadata.
+
+        Pattern: `var.<secret-shaped-name>` appears inside ``metadata_startup_script``
+        or any nested ``metadata { ... }`` block on a ``google_compute_instance``
+        resource.
+
+        Risk: anything that ends up in VM metadata is readable by any caller
+        with ``compute.instances.get`` and is written to plan / state. The
+        Cloudflare-tunnel-in-startup-script pattern is the canonical AI-slop
+        instance.
+        """
+        out = []
+        seen: set[tuple[Path, int]] = set()
+
+        def _emit(b: HclBlock, line: int, var_name: str, surface: str) -> None:
+            key = (path, line)
+            if key in seen:
+                return
+            seen.add(key)
+            out.append(self._f(
+                path, line,
+                "PROOFCTL-TF-AI-013",
+                "Sensitive variable in compute metadata",
+                Severity.ERROR,
+                f'google_compute_instance "{b.label2}" passes var.{var_name} into {surface} — secret will be readable from VM metadata and visible in plan/state',
+                hint=(
+                    "Mount the secret from Secret Manager inside the VM at runtime "
+                    "(google_secret_manager_secret_iam_member + a startup script that "
+                    "calls `gcloud secrets versions access`). Do not bake the value into metadata."
+                ),
+                authority="CIS GCP Benchmark 4.6 / OWASP A02 Cryptographic Failures",
+                docs_url="https://cloud.google.com/compute/docs/metadata/overview#metadata_security_considerations",
+            ))
+
+        for b in blocks:
+            if b.kind != "resource" or b.label1 != "google_compute_instance":
+                continue
+            # 1. Scan metadata_startup_script line range.
+            rng = self._line_range_of_attr(b, "metadata_startup_script")
+            if rng is not None:
+                lo, hi = rng
+                for offset in range(lo, hi + 1):
+                    line_text = b.raw_lines[offset]
+                    m = self._SENSITIVE_VAR_NAME_RE.search(line_text)
+                    if m:
+                        _emit(b, b.start_line + offset, m.group(1),
+                              "metadata_startup_script")
+            # 2. Scan nested metadata { ... } blocks (HCL block form).
+            for md in b.nested("metadata"):
+                for offset, line_text in enumerate(md.raw_lines):
+                    m = self._SENSITIVE_VAR_NAME_RE.search(line_text)
+                    if m:
+                        _emit(b, md.start_line + offset, m.group(1),
+                              "metadata block")
+            # 3. Scan metadata = { ... } attribute (HCL object-attribute form).
+            rng = self._line_range_of_attr(b, "metadata")
+            if rng is not None:
+                lo, hi = rng
+                for offset in range(lo, hi + 1):
+                    line_text = b.raw_lines[offset]
+                    m = self._SENSITIVE_VAR_NAME_RE.search(line_text)
+                    if m:
+                        _emit(b, b.start_line + offset, m.group(1),
+                              "metadata block")
+        return out
+
 
 # ── Directory-level checker (cross-file rules) ───────────────────────────────
 

{proofctl-0.4.1 → proofctl-0.4.3}/proofctl.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.4.1
+Version: 0.4.3
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT
@@ -28,7 +28,7 @@ Dynamic: license-file
 
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **264 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -165,7 +165,7 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-264 rules across 14 families. Run `proofctl rules` after install to enumerate.
+267 rules across 14 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
@@ -173,9 +173,9 @@ git commit -m "chore: add proofctl baseline"
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
 | Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 26 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 28 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 50 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress |
+| Terraform — GCP (`TF-G`) | 51 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress, compute access scopes |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
 | Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |

{proofctl-0.4.1 → proofctl-0.4.3}/proofctl.egg-info/SOURCES.txt

@@ -1,4 +1,5 @@
 LICENSE
+MANIFEST.in
 README.md
 pyproject.toml
 proofctl/__init__.py
@@ -35,36 +36,4 @@ proofctl/checkers/yaml_checker.py
 proofctl/reporters/__init__.py
 proofctl/reporters/html_reporter.py
 proofctl/reporters/json_reporter.py
-proofctl/reporters/terminal.py
-tests/test_baseline.py
-tests/test_config_proofctl.py
-tests/test_dockerfile.py
-tests/test_engine.py
-tests/test_fixer.py
-tests/test_imports.py
-tests/test_leakage.py
-tests/test_llm.py
-tests/test_local_packages.py
-tests/test_phase1_audit_fixes.py
-tests/test_phase2_audit_fixes.py
-tests/test_phase3_audit_fixes.py
-tests/test_phase4_audit_fixes.py
-tests/test_phase5_llm_imports_fixes.py
-tests/test_phase5_p_l_v_fixes.py
-tests/test_phase5_quality_fixes.py
-tests/test_phase6_audit_fixes.py
-tests/test_phase8_audit_fixes.py
-tests/test_placeholders.py
-tests/test_quality.py
-tests/test_quality_ext.py
-tests/test_secrets.py
-tests/test_security.py
-tests/test_security_ext.py
-tests/test_security_external.py
-tests/test_suppression.py
-tests/test_terraform.py
-tests/test_terraform_ext.py
-tests/test_terragrunt.py
-tests/test_variants.py
-tests/test_yaml.py
-tests/test_yaml_k8s_gha.py
+proofctl/reporters/terminal.py

{proofctl-0.4.1 → proofctl-0.4.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofctl"
-version = "0.4.1"
+version = "0.4.3"
 description = "Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit"
 readme = "README.md"
 license = { text = "MIT" }

proofctl-0.4.1/tests/test_baseline.py

@@ -1,133 +0,0 @@
-from __future__ import annotations
-
-import json
-import tempfile
-from pathlib import Path
-
-from proofctl.baseline import (
-    filter_new_findings,
-    load_baseline,
-    save_baseline,
-)
-from proofctl.models import Finding, Severity
-
-
-def _f(rule_id: str, file: str = "foo.py", msg: str = "test msg", line: int = 1) -> Finding:
-    return Finding(
-        file=file, line=line, col=0,
-        rule_id=rule_id, rule_name="Test",
-        severity=Severity.ERROR, message=msg,
-    )
-
-
-# ── save / load ───────────────────────────────────────────────────────────────
-
-def test_save_creates_file():
-    with tempfile.TemporaryDirectory() as td:
-        root = Path(td)
-        findings = [_f("PROOFCTL-P-001")]
-        out = save_baseline(findings, root)
-        assert out.exists()
-
-
-def test_save_load_roundtrip():
-    """H-10: load_baseline returns the full versioned dict; the actual finding
-    list lives under `findings`. Schema is bumped to 2 by save_baseline."""
-    with tempfile.TemporaryDirectory() as td:
-        root = Path(td)
-        findings = [_f("PROOFCTL-P-001", msg="'foo' body is pass")]
-        save_baseline(findings, root)
-        loaded = load_baseline(root)
-        assert loaded is not None
-        assert loaded["schema_version"] >= 2
-        assert len(loaded["findings"]) == 1
-        assert loaded["findings"][0]["rule_id"] == "PROOFCTL-P-001"
-        assert loaded["findings"][0]["message"] == "'foo' body is pass"
-
-
-def test_load_returns_none_when_no_file():
-    with tempfile.TemporaryDirectory() as td:
-        assert load_baseline(Path(td)) is None
-
-
-def test_load_returns_none_on_corrupt_file():
-    with tempfile.TemporaryDirectory() as td:
-        root = Path(td)
-        (root / ".proofctl-baseline.json").write_text("not json")
-        assert load_baseline(root) is None
-
-
-def test_save_count_field():
-    with tempfile.TemporaryDirectory() as td:
-        root = Path(td)
-        save_baseline([_f("PROOFCTL-P-001"), _f("PROOFCTL-L-001")], root)
-        data = json.loads((root / ".proofctl-baseline.json").read_text())
-        assert data["count"] == 2
-
-
-# ── filter_new_findings ───────────────────────────────────────────────────────
-
-def test_all_in_baseline_suppressed():
-    f = _f("PROOFCTL-P-001", msg="'foo' body is pass")
-    baseline = [{"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"}]
-    assert filter_new_findings([f], baseline) == []
-
-
-def test_new_finding_not_suppressed():
-    f = _f("PROOFCTL-P-001", msg="'bar' body is pass")
-    baseline = [{"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"}]
-    assert filter_new_findings([f], baseline) == [f]
-
-
-def test_different_rule_not_suppressed():
-    f = _f("PROOFCTL-L-001", msg="'foo' body is pass")
-    baseline = [{"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"}]
-    assert filter_new_findings([f], baseline) == [f]
-
-
-def test_different_file_not_suppressed():
-    f = _f("PROOFCTL-P-001", file="bar.py", msg="'foo' body is pass")
-    baseline = [{"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"}]
-    assert filter_new_findings([f], baseline) == [f]
-
-
-def test_line_shift_suppressed():
-    # Same bug moved from line 10 to line 42 — message unchanged → still suppressed.
-    f = _f("PROOFCTL-P-001", msg="'foo' body is pass", line=42)
-    baseline = [{"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"}]
-    assert filter_new_findings([f], baseline) == []
-
-
-def test_empty_baseline_suppresses_nothing():
-    f = _f("PROOFCTL-P-001")
-    assert filter_new_findings([f], []) == [f]
-
-
-def test_multiset_exact_count_suppressed():
-    # Two identical findings in baseline suppress exactly two in new run.
-    f1 = _f("PROOFCTL-P-001", msg="'foo' body is pass")
-    f2 = _f("PROOFCTL-P-001", msg="'foo' body is pass")
-    baseline = [
-        {"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"},
-        {"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"},
-    ]
-    assert filter_new_findings([f1, f2], baseline) == []
-
-
-def test_multiset_one_extra_reported():
-    # Three identical in new run, two in baseline → one new.
-    f = _f("PROOFCTL-P-001", msg="'foo' body is pass")
-    baseline = [
-        {"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"},
-        {"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "'foo' body is pass"},
-    ]
-    result = filter_new_findings([f, f, f], baseline)
-    assert len(result) == 1
-
-
-def test_mixed_findings():
-    f_old = _f("PROOFCTL-P-001", msg="old")
-    f_new = _f("PROOFCTL-Q-001", msg="new")
-    baseline = [{"rule_id": "PROOFCTL-P-001", "file": "foo.py", "message": "old"}]
-    result = filter_new_findings([f_old, f_new], baseline)
-    assert result == [f_new]

proofctl-0.4.1/tests/test_config_proofctl.py

@@ -1,133 +0,0 @@
-"""Tests for proofctl config loading."""
-from __future__ import annotations
-
-from pathlib import Path
-
-import pytest
-
-from proofctl.config import ProofctlConfig, load_config
-from proofctl.models import Severity
-
-
-# ── defaults ──────────────────────────────────────────────────────────────────
-
-def test_load_config_no_file_returns_defaults(tmp_path):
-    cfg = load_config(tmp_path)
-    assert isinstance(cfg, ProofctlConfig)
-    assert "**/.venv/**" in cfg.exclude_paths
-    assert cfg.disable == []
-    assert cfg.severity_overrides == {}
-    assert cfg.any_threshold == 3
-
-
-def test_default_excludes_include_vendor_generated_paths(tmp_path):
-    """All vendor/generated tool paths must be present in default excludes."""
-    cfg = load_config(tmp_path)
-    required = [
-        # Flux CD bootstrap files
-        "**/flux-system/gotk-components.yaml",
-        "**/flux-system/gotk-sync.yaml",
-        # ArgoCD Autopilot bootstrap files
-        "**/bootstrap/argo-cd/kustomization.yaml",
-        "**/bootstrap/argo-cd.yaml",
-        # Terraform generated artifacts
-        "**/*.tfstate",
-        "**/*.tfplan",
-        # CDK tools
-        "**/cdk.out/**",
-        "**/.gen/**",
-        # Helm chart tarballs
-        "**/charts/*.tgz",
-        # Pulumi local backend
-        "**/.pulumi/**",
-        # Go vendor
-        "**/vendor/**",
-        # Python caches
-        "**/.tox/**",
-        "**/.pytest_cache/**",
-        "**/.mypy_cache/**",
-    ]
-    for pat in required:
-        assert pat in cfg.exclude_paths, f"missing default exclude: {pat}"
-
-
-def test_load_config_empty_file_returns_defaults(tmp_path):
-    (tmp_path / ".proofctl.yaml").write_text("")
-    cfg = load_config(tmp_path)
-    assert cfg.any_threshold == 3
-
-
-# ── overrides ─────────────────────────────────────────────────────────────────
-
-def test_load_config_disable_rule(tmp_path):
-    (tmp_path / ".proofctl.yaml").write_text("disable:\n  - PROOFCTL-P-001\n")
-    cfg = load_config(tmp_path)
-    assert cfg.is_disabled("PROOFCTL-P-001")
-    assert not cfg.is_disabled("PROOFCTL-P-002")
-
-
-def test_load_config_severity_override(tmp_path):
-    yaml = "severity_overrides:\n  PROOFCTL-P-001: ERROR\n"
-    (tmp_path / ".proofctl.yaml").write_text(yaml)
-    cfg = load_config(tmp_path)
-    assert cfg.effective_severity("PROOFCTL-P-001", Severity.WARNING) == Severity.ERROR
-
-
-def test_load_config_severity_override_invalid_raises_at_load(tmp_path):
-    """AUDIT H-8: bad severity_overrides values must fail at load_config(),
-    not silently propagate to the first finding (which had no file context)."""
-    yaml = "severity_overrides:\n  PROOFCTL-P-001: BOGUS\n"
-    (tmp_path / ".proofctl.yaml").write_text(yaml)
-    with pytest.raises(ValueError, match="invalid"):
-        load_config(tmp_path)
-
-
-def test_load_config_exclude_paths_override(tmp_path):
-    (tmp_path / ".proofctl.yaml").write_text("exclude_paths:\n  - '**/generated/**'\n")
-    cfg = load_config(tmp_path)
-    assert "**/generated/**" in cfg.exclude_paths
-
-
-# ── rule-level config ─────────────────────────────────────────────────────────
-
-def test_load_config_p002_any_threshold(tmp_path):
-    yaml = "rules:\n  PROOFCTL-Q-003:\n    any_threshold: 5\n"
-    (tmp_path / ".proofctl.yaml").write_text(yaml)
-    cfg = load_config(tmp_path)
-    assert cfg.any_threshold == 5
-
-
-def test_load_config_p002_todo_allowed(tmp_path):
-    yaml = "rules:\n  PROOFCTL-P-002:\n    allowed_formats:\n      - 'TODO\\(#\\d+\\)'\n"
-    (tmp_path / ".proofctl.yaml").write_text(yaml)
-    cfg = load_config(tmp_path)
-    assert len(cfg.todo_allowed_formats) == 1
-
-
-# ── is_disabled ───────────────────────────────────────────────────────────────
-
-def test_is_disabled_true():
-    cfg = ProofctlConfig(disable=["PROOFCTL-S-001"])
-    assert cfg.is_disabled("PROOFCTL-S-001")
-
-
-def test_is_disabled_false():
-    cfg = ProofctlConfig(disable=["PROOFCTL-S-001"])
-    assert not cfg.is_disabled("PROOFCTL-S-002")
-
-
-def test_is_disabled_empty():
-    cfg = ProofctlConfig()
-    assert not cfg.is_disabled("ANYTHING")
-
-
-# ── effective_severity ────────────────────────────────────────────────────────
-
-def test_effective_severity_no_override_returns_default():
-    cfg = ProofctlConfig()
-    assert cfg.effective_severity("PROOFCTL-P-001", Severity.WARNING) == Severity.WARNING
-
-
-def test_effective_severity_override_applied():
-    cfg = ProofctlConfig(severity_overrides={"PROOFCTL-P-001": "ERROR"})
-    assert cfg.effective_severity("PROOFCTL-P-001", Severity.WARNING) == Severity.ERROR