proofctl 0.5.6__tar.gz → 0.6.0__tar.gz

{proofctl-0.5.6 → proofctl-0.6.0}/MANIFEST.in

@@ -11,8 +11,6 @@ prune examples
 prune build
 prune dist
 prune .github
-exclude AUDIT_AND_ROADMAP.md
-exclude AUDIT_VERIFICATION_v0.1.11.md
 
 global-exclude __pycache__
 global-exclude *.py[cod]

{proofctl-0.5.6/proofctl.egg-info → proofctl-0.6.0}/PKG-INFO

@@ -1,10 +1,14 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.5.6
-Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
-Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
+Version: 0.6.0
+Summary: DevOps linter and security scanner for AI slop and misconfigurations — runs in pre-commit, CI, or post-commit; no external tools required
+Author: Kolawolu Odunola
 License: MIT
-Keywords: linter,security,terraform,kubernetes,ai,static-analysis,pre-commit
+Project-URL: Homepage, https://github.com/devopscatalyst/proofctl
+Project-URL: Repository, https://github.com/devopscatalyst/proofctl
+Project-URL: Changelog, https://github.com/devopscatalyst/proofctl/blob/main/HISTORY.md
+Project-URL: Issues, https://github.com/devopscatalyst/proofctl/issues
+Keywords: linter,security-scanner,sast,iac,secrets-detection,terraform,kubernetes,ai,static-analysis,pre-commit,ci-cd,devops
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -13,6 +17,7 @@ Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development :: Quality Assurance
 Classifier: Topic :: Security
 Requires-Python: >=3.11
@@ -24,27 +29,29 @@ Requires-Dist: pyyaml>=6
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: pytest-mock>=3; extra == "dev"
+Requires-Dist: mypy>=1.8; extra == "dev"
+Requires-Dist: ruff>=0.4; extra == "dev"
 Dynamic: license-file
 
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **269 rules**, zero dependencies, runs in under a second.
+A static-analysis linter and security scanner for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, no external tools, runs in under a second.
 
 ```
 proofctl check .
 ```
 
-```
-PROOFCTL-S-001     module/auth.py:42                 SQL injection via string format in .execute()           ERROR
-PROOFCTL-Q-001     module/models.py:17               Mutable default argument — list assigned at def time    ERROR
-PROOFCTL-S-AI-006  module/loaders.py:88              Empty `except Exception:` swallows all errors silently  WARNING
-PROOFCTL-TF-A024   infra/sg.tf:14                    SG rule 0.0.0.0/0 ingress on port 22                    ERROR
-PROOFCTL-YAML-022  k8s/deployment.yaml:8             Workload uses default namespace                         WARNING
-PROOFCTL-YAML-007  .github/workflows/release.yml:23  Action not pinned to SHA                                ERROR
-PROOFCTL-SECRET-001 infra/lambda.tf:8                AWS access key (AKIA...)                                ERROR
-──────────────────────────────────────────────────────────────────
-7 findings (4 ERROR, 3 WARNING) — exit 2
-```
+| Rule | Location | Issue | Severity |
+|------|----------|-------|:--------:|
+| `PROOFCTL-S-001` | `module/auth.py:42` | SQL injection via string format in `.execute()` | **ERROR** |
+| `PROOFCTL-Q-001` | `module/models.py:17` | Mutable default argument — list assigned at def time | **ERROR** |
+| `PROOFCTL-Q-002` | `module/loaders.py:88` | Empty `except Exception:` swallows all errors silently | WARNING |
+| `PROOFCTL-TF-A024` | `infra/sg.tf:14` | SG rule `0.0.0.0/0` ingress on port 22 | **ERROR** |
+| `PROOFCTL-YAML-022` | `k8s/deployment.yaml:8` | Workload uses default namespace | WARNING |
+| `PROOFCTL-YAML-007` | `.github/workflows/release.yml:23` | Action not pinned to SHA | **ERROR** |
+| `PROOFCTL-SECRET-001` | `infra/lambda.tf:8` | AWS access key (`AKIA...`) | **ERROR** |
+
+> **7 findings** (4 ERROR, 3 WARNING) — exits non-zero (`exit 2`) so CI fails the build.
 
 ---
 
@@ -53,11 +60,11 @@ PROOFCTL-SECRET-001 infra/lambda.tf:8                AWS access key (AKIA...)
 LLM coding assistants ship code that compiles and looks correct but fails in predictable ways:
 
 - **Insecure** — SQL/command injection, hardcoded credentials, weak crypto, JWT signature bypass, public S3 buckets, K8s default namespaces.
-- **Broken** — hallucinated imports, phantom methods, type-hint vs implementation mismatch, `pass`-bodied functions shipped as real implementations.
+- **Broken** — hallucinated imports, type-hint vs implementation mismatch, `pass`-bodied functions shipped as real implementations.
 - **Fragile** — broad `except Exception:`, no timeouts, mutable defaults, defensive guards for impossible states, unused configuration kwargs.
 - **Wasteful** — single-method classes that should be functions, near-duplicate files, sprawling kwargs surface.
 
-proofctl runs as a pre-commit linter and catches these patterns before they merge. The top-firing rules on real AI-authored code are **Q-002 broad except**, **Q-005 complexity**, **Q-006 long functions**, **YAML-007 / YAML-GHA-006 GitHub Actions hygiene**, and **YAML-GHA-003 missing permissions**.
+proofctl runs in pre-commit hooks, CI pipelines, or against an existing tree, catching these patterns before they merge. The top-firing rules on real AI-authored code are **Q-002 broad except**, **Q-005 complexity**, **Q-006 long functions**, **YAML-007 / YAML-GHA-006 GitHub Actions hygiene**, and **YAML-GHA-003 missing permissions**.
 
 ---
 
@@ -165,23 +172,23 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-269 rules across 14 families. Run `proofctl rules` after install to enumerate.
+267 rules across 13 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
 | Python — Quality (`Q`) | 17 | Mutable defaults, broad `except`, complexity, long functions, AI-slop patterns (echo docstrings, single-method classes, stale kwargs, defensive guards) |
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
-| Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
-| Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
+| Python — Other | 15 | Placeholders, leakage (cross-language idioms, PII), import hallucination, variant detection, LLM guardrails (OWASP LLM Top-10) |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 25 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
+| Terraform — AWS (`TF-A`) | 36 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
+| Terraform — GCP (`TF-G`) | 46 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
-| Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
+| Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 10 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |
 | Dockerfile (`DF`) | 15 | Latest tag, root user, secret leakage, OCI labels, HEALTHCHECK, legacy ENV form |
-| Kubernetes YAML (`YAML`) | 26 | Pod Security Standards, hostPath, default namespace, image digest pinning, RBAC wildcards |
-| GitHub Actions (`YAML-GHA`) | — | SHA pinning, expression injection, missing permissions, secret env-var leakage, missing timeouts |
+| Kubernetes YAML (`YAML`) | 32 | Pod Security Standards, hostPath, default namespace, image digest pinning, RBAC wildcards |
+| GitHub Actions (`YAML-GHA`) | 6 | SHA pinning, expression injection, missing permissions, secret env-var leakage, missing timeouts |
 | Shell (`SH`) | 8 | Dangerous globbing, missing `set -euo pipefail` |
 
 ```bash
@@ -280,7 +287,7 @@ Options:
   --format / -f        terminal | json | html           (default: terminal)
   --output / -o        Write report to file
   --changed-only       Only scan git-changed files
-  --families           P,Q,S,L,I,M,V,LLM,TF,TG,DF,YAML,SH,SECRET
+  --families           P,Q,S,L,I,V,LLM,TF,TG,DF,YAML,SH,SECRET
   --min-severity       INFO | WARNING | ERROR
   --fail-on            Exit non-zero at this severity (default: WARNING)
   --no-pypi            Skip PyPI lookups (faster, works offline)

{proofctl-0.5.6 → proofctl-0.6.0}/README.md

@@ -1,22 +1,22 @@
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **269 rules**, zero dependencies, runs in under a second.
+A static-analysis linter and security scanner for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, no external tools, runs in under a second.
 
 ```
 proofctl check .
 ```
 
-```
-PROOFCTL-S-001     module/auth.py:42                 SQL injection via string format in .execute()           ERROR
-PROOFCTL-Q-001     module/models.py:17               Mutable default argument — list assigned at def time    ERROR
-PROOFCTL-S-AI-006  module/loaders.py:88              Empty `except Exception:` swallows all errors silently  WARNING
-PROOFCTL-TF-A024   infra/sg.tf:14                    SG rule 0.0.0.0/0 ingress on port 22                    ERROR
-PROOFCTL-YAML-022  k8s/deployment.yaml:8             Workload uses default namespace                         WARNING
-PROOFCTL-YAML-007  .github/workflows/release.yml:23  Action not pinned to SHA                                ERROR
-PROOFCTL-SECRET-001 infra/lambda.tf:8                AWS access key (AKIA...)                                ERROR
-──────────────────────────────────────────────────────────────────
-7 findings (4 ERROR, 3 WARNING) — exit 2
-```
+| Rule | Location | Issue | Severity |
+|------|----------|-------|:--------:|
+| `PROOFCTL-S-001` | `module/auth.py:42` | SQL injection via string format in `.execute()` | **ERROR** |
+| `PROOFCTL-Q-001` | `module/models.py:17` | Mutable default argument — list assigned at def time | **ERROR** |
+| `PROOFCTL-Q-002` | `module/loaders.py:88` | Empty `except Exception:` swallows all errors silently | WARNING |
+| `PROOFCTL-TF-A024` | `infra/sg.tf:14` | SG rule `0.0.0.0/0` ingress on port 22 | **ERROR** |
+| `PROOFCTL-YAML-022` | `k8s/deployment.yaml:8` | Workload uses default namespace | WARNING |
+| `PROOFCTL-YAML-007` | `.github/workflows/release.yml:23` | Action not pinned to SHA | **ERROR** |
+| `PROOFCTL-SECRET-001` | `infra/lambda.tf:8` | AWS access key (`AKIA...`) | **ERROR** |
+
+> **7 findings** (4 ERROR, 3 WARNING) — exits non-zero (`exit 2`) so CI fails the build.
 
 ---
 
@@ -25,11 +25,11 @@ PROOFCTL-SECRET-001 infra/lambda.tf:8                AWS access key (AKIA...)
 LLM coding assistants ship code that compiles and looks correct but fails in predictable ways:
 
 - **Insecure** — SQL/command injection, hardcoded credentials, weak crypto, JWT signature bypass, public S3 buckets, K8s default namespaces.
-- **Broken** — hallucinated imports, phantom methods, type-hint vs implementation mismatch, `pass`-bodied functions shipped as real implementations.
+- **Broken** — hallucinated imports, type-hint vs implementation mismatch, `pass`-bodied functions shipped as real implementations.
 - **Fragile** — broad `except Exception:`, no timeouts, mutable defaults, defensive guards for impossible states, unused configuration kwargs.
 - **Wasteful** — single-method classes that should be functions, near-duplicate files, sprawling kwargs surface.
 
-proofctl runs as a pre-commit linter and catches these patterns before they merge. The top-firing rules on real AI-authored code are **Q-002 broad except**, **Q-005 complexity**, **Q-006 long functions**, **YAML-007 / YAML-GHA-006 GitHub Actions hygiene**, and **YAML-GHA-003 missing permissions**.
+proofctl runs in pre-commit hooks, CI pipelines, or against an existing tree, catching these patterns before they merge. The top-firing rules on real AI-authored code are **Q-002 broad except**, **Q-005 complexity**, **Q-006 long functions**, **YAML-007 / YAML-GHA-006 GitHub Actions hygiene**, and **YAML-GHA-003 missing permissions**.
 
 ---
 
@@ -137,23 +137,23 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-269 rules across 14 families. Run `proofctl rules` after install to enumerate.
+267 rules across 13 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
 | Python — Quality (`Q`) | 17 | Mutable defaults, broad `except`, complexity, long functions, AI-slop patterns (echo docstrings, single-method classes, stale kwargs, defensive guards) |
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
-| Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
-| Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
+| Python — Other | 15 | Placeholders, leakage (cross-language idioms, PII), import hallucination, variant detection, LLM guardrails (OWASP LLM Top-10) |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 25 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
+| Terraform — AWS (`TF-A`) | 36 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
+| Terraform — GCP (`TF-G`) | 46 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
-| Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
+| Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 10 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |
 | Dockerfile (`DF`) | 15 | Latest tag, root user, secret leakage, OCI labels, HEALTHCHECK, legacy ENV form |
-| Kubernetes YAML (`YAML`) | 26 | Pod Security Standards, hostPath, default namespace, image digest pinning, RBAC wildcards |
-| GitHub Actions (`YAML-GHA`) | — | SHA pinning, expression injection, missing permissions, secret env-var leakage, missing timeouts |
+| Kubernetes YAML (`YAML`) | 32 | Pod Security Standards, hostPath, default namespace, image digest pinning, RBAC wildcards |
+| GitHub Actions (`YAML-GHA`) | 6 | SHA pinning, expression injection, missing permissions, secret env-var leakage, missing timeouts |
 | Shell (`SH`) | 8 | Dangerous globbing, missing `set -euo pipefail` |
 
 ```bash
@@ -252,7 +252,7 @@ Options:
   --format / -f        terminal | json | html           (default: terminal)
   --output / -o        Write report to file
   --changed-only       Only scan git-changed files
-  --families           P,Q,S,L,I,M,V,LLM,TF,TG,DF,YAML,SH,SECRET
+  --families           P,Q,S,L,I,V,LLM,TF,TG,DF,YAML,SH,SECRET
   --min-severity       INFO | WARNING | ERROR
   --fail-on            Exit non-zero at this severity (default: WARNING)
   --no-pypi            Skip PyPI lookups (faster, works offline)

{proofctl-0.5.6 → proofctl-0.6.0}/proofctl/__init__.py

@@ -1,4 +1,4 @@
-"""proofctl — zero-dependency linter for AI-generated slop and security misconfig."""
+"""proofctl — linter and security scanner for AI slop and misconfig."""
 from __future__ import annotations
 
 from importlib.metadata import PackageNotFoundError, version as _pkg_version

{proofctl-0.5.6 → proofctl-0.6.0}/proofctl/baseline.py

@@ -3,7 +3,7 @@
 Older versions used `(rule_id, file, message)` as the fingerprint, which broke
 the moment a message embedded numerics ("complexity 23", "17 parameters") —
 a trivial edit that nudged the number defeated the match and the finding
-re-surfaced as "new". The H-10 fix is to *normalise* the message before
+re-surfaced as "new". The fix is to *normalise* the message before
 hashing: strip embedded numbers and quoted identifiers so semantically
 identical findings collide regardless of their printed values.
 

{proofctl-0.5.6 → proofctl-0.6.0}/proofctl/checkers/dockerfile.py

@@ -362,8 +362,8 @@ def _df008(instructions: list[tuple[int, str, str]], path: Path) -> list[Finding
             severity=Severity.ERROR,
             message=f"ADD fetches '{url}' without checksum verification — supply chain integrity risk",
             hint="Use ADD with --checksum=sha256:<hash>, or RUN curl ... && sha256sum -c to verify before using.",
-            authority="OWASP CICD-SEC-6 – Insufficient Artifact Integrity Validation",
-            docs_url="https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-06-Insufficient_Credential_Hygiene",
+            authority="OWASP CICD-SEC-9 – Improper Artifact Integrity Validation",
+            docs_url="https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-09-Improper_Artifact_Integrity_Validation",
         ))
     return findings
 
@@ -510,7 +510,9 @@ def _df_ai002(instructions: list[tuple[int, str, str]], path: Path) -> list[Find
         if instr != "ENV":
             continue
         # Legacy form has no '=' in the first token pair: ENV PATH /usr/bin
-        if "=" not in args.split()[0] if args.split() else True:
+        tokens = args.split()
+        first_has_eq = bool(tokens) and "=" in tokens[0]
+        if not first_has_eq:
             if _LEGACY_ENV_RE.match(args.strip()):
                 findings.append(Finding(
                     file=str(path),

{proofctl-0.5.6 → proofctl-0.6.0}/proofctl/checkers/hcl_utils.py

@@ -160,7 +160,7 @@ def _parse(lines: list[str], base: int, skip_outer: bool) -> list[HclBlock]:
             # side allowed for `<<-` indented heredocs). The previous loose
             # `rstrip("-~")` matched lines like `EOF~~~` as terminators, which
             # could prematurely close a heredoc whose body legitimately ended
-            # with `~`. C-11 fix: strict whole-line match after .strip().
+            # with `~`. Fix: strict whole-line match after .strip().
             if line.strip() == heredoc_end:
                 heredoc_end = None
             continue

{proofctl-0.5.6 → proofctl-0.6.0}/proofctl/checkers/imports.py

@@ -4,8 +4,6 @@ import ast
 import functools
 import json
 import re
-import shutil
-import subprocess
 import sys
 import time
 import urllib.error
@@ -294,13 +292,6 @@ def _parse_setup_cfg(text: str) -> list[tuple[str, str | None, int]]:
                 results.append((m.group(1), m.group(3) or None, lineno))
     return results
 
-# mypy error patterns indicating phantom method calls
-_MYPY_ATTR_RE = re.compile(
-    r'^(.+):(\d+):\s+error:\s+(?:Item\s+"[^"]+"\s+of\s+)?"([^"]+)"\s+has\s+no\s+attribute\s+"([^"]+)"'
-    r'|^(.+):(\d+):\s+error:\s+Module\s+"[^"]+"\s+has\s+no\s+attribute\s+"([^"]+)"'
-)
-
-
 def _normalize_pkg_name(name: str) -> str:
     return re.sub(r"[-_.]+", "-", name).lower()
 
@@ -817,104 +808,3 @@ class DependencyChecker(DirectoryChecker):
         return findings
 
 
-class MethodChecker(DirectoryChecker):
-    """PROOFCTL-M-001: Phantom method calls detected by a single mypy invocation.
-
-    Running mypy once on all files is orders of magnitude faster than once per
-    file: mypy's startup and import-resolution cost is paid once, not N times.
-    """
-
-    def check(self, root: Path, py_files: list[Path]) -> list[Finding]:
-        if not py_files:
-            return []
-        if not shutil.which("mypy"):
-            # Surface the disabled state as a single INFO finding so CI users
-            # don't silently lose phantom-method coverage.
-            return [self._mypy_missing_finding(root)]
-        try:
-            return self._run_mypy(py_files)
-        except FileNotFoundError:
-            return [self._mypy_missing_finding(root)]
-
-    def _mypy_missing_finding(self, root: Path) -> Finding:
-        return Finding(
-            file=str(root),
-            line=None,
-            col=None,
-            rule_id="PROOFCTL-M-001",
-            rule_name="Phantom method check disabled",
-            severity=Severity.INFO,
-            message=(
-                "M-001 disabled — mypy not installed; install proofctl[dev] or "
-                "pip install mypy to enable phantom-method detection"
-            ),
-            hint="pip install mypy   # or: pip install proofctl[dev]",
-            authority="mypy attr-defined — AI calls methods that don't exist",
-            docs_url="https://mypy.readthedocs.io/en/stable/error_codes.html",
-        )
-
-    def _run_mypy(self, py_files: list[Path]) -> list[Finding]:
-        try:
-            result = subprocess.run(
-                [
-                    "mypy",
-                    "--ignore-missing-imports",
-                    "--no-error-summary",
-                    "--no-pretty",
-                    *[str(p) for p in py_files],
-                ],
-                capture_output=True,
-                text=True,
-                timeout=300,
-            )
-        except subprocess.TimeoutExpired:
-            return []
-        except FileNotFoundError:
-            raise
-        except OSError:
-            return []
-
-        # Index scoped files for quick membership check after path normalisation.
-        scoped = {str(p.resolve()) for p in py_files}
-
-        findings = []
-        for line in result.stdout.splitlines():
-            m = _MYPY_ATTR_RE.match(line)
-            if not m:
-                continue
-
-            if m.group(1):
-                file_path, lineno_str = m.group(1), m.group(2)
-                obj_type, attr = m.group(3), m.group(4)
-                msg = f"'{obj_type}' has no attribute '{attr}'"
-            else:
-                file_path, lineno_str = m.group(5), m.group(6)
-                attr = m.group(7)
-                msg = f"Module has no attribute '{attr}'"
-
-            # Skip findings for files outside the scan scope (e.g. installed libs).
-            try:
-                if str(Path(file_path).resolve()) not in scoped:
-                    continue
-            except OSError:
-                continue
-
-            try:
-                lineno = int(lineno_str)
-            except ValueError:
-                lineno = None
-
-            findings.append(Finding(
-                file=file_path,
-                line=lineno,
-                col=None,
-                rule_id="PROOFCTL-M-001",
-                rule_name="Phantom method call",
-                severity=Severity.ERROR,
-                message=msg,
-                hint="Check the library's documentation for the correct method name.",
-                authority="mypy attr-defined — AI calls methods that don't exist",
-                docs_url="https://mypy.readthedocs.io/en/stable/error_codes.html",
-            ))
-
-        return findings

{proofctl-0.5.6 → proofctl-0.6.0}/proofctl/checkers/leakage.py

@@ -51,7 +51,7 @@ _JS_ATTR_NAMES = {
     "length": ("Use len(x) instead of .length.", "PROOFCTL-L-001"),
 }
 # Sub-set of _JS_ATTR_NAMES whose severity is governed by the
-# `l001_strict_idioms` toggle (see H-20).
+# `l001_strict_idioms` toggle.
 _JS_FUZZY_ATTRS: frozenset[str] = frozenset({"push", "length"})
 _JS_CALL_NAMES = {
     "console": {"log", "warn", "error", "info", "debug"},
@@ -117,7 +117,7 @@ class _LeakageVisitor(ast.NodeVisitor):
         # JS: .push(), .length
         if attr in _JS_ATTR_NAMES:
             hint, rule_id = _JS_ATTR_NAMES[attr]
-            # H-20: `.push()` / `.length` produced too many false positives
+            # Background: `.push()` / `.length` produced too many false positives
             # against Python objects that legitimately expose those names
             # (queues, ORM cursors, PyMongo). Demote to INFO unless the
             # caller explicitly opts into strict cross-language idiom
@@ -178,7 +178,7 @@ class _LeakageVisitor(ast.NodeVisitor):
     def visit_ClassDef(self, node: ast.ClassDef) -> None:
         """PROOFCTL-L-002d: Java-style getter/setter pairs.
 
-        H-21: Only flag when getX AND setX both exist for the same suffix X.
+        Only flag when getX AND setX both exist for the same suffix X.
         Two unrelated methods like `getInfo` + `setColor` are not a Java
         pattern; only matched pairs (`getFoo` + `setFoo`) are.
         """
@@ -233,7 +233,7 @@ class _LeakageVisitor(ast.NodeVisitor):
 
 class LeakageChecker(FileChecker):
     def __init__(self, l001_strict_idioms: bool = False) -> None:
-        # H-20: When True, `.push()` / `.length` are reported as ERROR.
+        # When True, `.push()` / `.length` are reported as ERROR.
         # Default False keeps them at INFO to avoid noise on Python objects
         # that legitimately expose those names (queues, ORMs, etc.).
         self._l001_strict_idioms = l001_strict_idioms

{proofctl-0.5.6 → proofctl-0.6.0}/proofctl/checkers/quality.py

@@ -60,7 +60,7 @@ class _Q001Visitor(ast.NodeVisitor):
                 type_name = (
                     type(default).__name__
                     if isinstance(default, (ast.List, ast.Dict, ast.Set))
-                    else (default.func.id if isinstance(default.func, ast.Name) else "mutable")
+                    else (default.func.id if isinstance(default, ast.Call) and isinstance(default.func, ast.Name) else "mutable")
                 )
                 # Sync `fixable` with fixer.py capability: the auto-fixer can only
                 # rewrite single-line default expressions. Multi-line literals
@@ -128,13 +128,13 @@ class _Q002Visitor(ast.NodeVisitor):
             msg = "Bare except: catches KeyboardInterrupt, SystemExit, and all exceptions silently"
             hint = "Catch specific exceptions: except (ValueError, KeyError) as e:"
         elif is_suppressed or is_log_only:
-            # Tier 1 (WARNING): obvious swallow — body is `pass` or a single call (likely log).
+            # WARNING case: obvious swallow — body is `pass` or a single call (likely log).
             rule_id = "PROOFCTL-Q-002"
             sev = Severity.WARNING
             msg = "Broad except Exception with no re-raise swallows all errors"
             hint = "Catch specific exceptions or re-raise: except Exception as e: ... raise"
         else:
-            # Tier 2 (INFO, H-16): any other broad-except that doesn't re-raise.
+            # INFO case: any other broad-except that doesn't re-raise.
             # Catches the wider "swallows but does five lines of dummy recovery"
             # pattern that the WARNING tier misses.
             rule_id = "PROOFCTL-Q-002"
@@ -157,7 +157,7 @@ class _Q002Visitor(ast.NodeVisitor):
             severity=sev,
             message=msg,
             hint=hint,
-            authority="OWASP A10:2025 – Mishandling of Exceptional Conditions",
+            authority="CWE-703 – Improper Check or Handling of Exceptional Conditions",
             docs_url="https://owasp.org/www-community/vulnerabilities/Improper_Error_Handling",
         ))
         self.generic_visit(node)
@@ -247,7 +247,7 @@ def _cyclomatic_complexity(func: ast.FunctionDef | ast.AsyncFunctionDef) -> int:
             complexity += len(node.values) - 1
         elif isinstance(node, (ast.ListComp, ast.SetComp, ast.DictComp, ast.GeneratorExp)):
             complexity += 1
-        # H-17: count match/case statements toward complexity.
+        # count match/case statements toward complexity.
         # `match` itself adds 1 (the dispatch decision); each `case` arm adds 1
         # (each is a distinct execution path).
         elif match_node is not None and isinstance(node, match_node):
@@ -345,7 +345,7 @@ class _Q007Visitor(ast.NodeVisitor):
         # Remove self / cls for methods
         if params and params[0].arg in ("self", "cls"):
             params = params[1:]
-        # H-18: keyword-only arguments are real parameters too — `def f(*, a, b,
+        # keyword-only arguments are real parameters too — `def f(*, a, b,
         # c, d, e, f, g, h)` is just as overloaded as a positional version.
         params += list(args.kwonlyargs)
         count = len(params)
@@ -599,6 +599,16 @@ class QualityChecker(FileChecker):
                 v9.visit(tree)
                 findings.extend(v9.findings)
 
+            AiVisitor: type[
+                _QAi001Visitor | _QAi002Visitor | _QAi003Visitor
+                | _QAi004Visitor | _QAi005Visitor | _QAi006Visitor
+                | _QAi007Visitor | _QAi008Visitor
+            ]
+            v: (
+                _QAi001Visitor | _QAi002Visitor | _QAi003Visitor
+                | _QAi004Visitor | _QAi005Visitor | _QAi006Visitor
+                | _QAi007Visitor | _QAi008Visitor
+            )
             for AiVisitor in (_QAi001Visitor, _QAi002Visitor, _QAi003Visitor):
                 v = AiVisitor(path)
                 v.visit(tree)
@@ -1123,8 +1133,8 @@ class _QAi005Visitor(ast.NodeVisitor):
         for arg, default in zip(defaulted, defaults):
             if isinstance(default, ast.Constant) and default.value is None:
                 names.add(arg.arg)
-        for arg, default in zip(fn.args.kwonlyargs, fn.args.kw_defaults or []):
-            if isinstance(default, ast.Constant) and default.value is None:
+        for arg, kw_default in zip(fn.args.kwonlyargs, fn.args.kw_defaults or []):
+            if isinstance(kw_default, ast.Constant) and kw_default.value is None:
                 names.add(arg.arg)
         # Also include any param annotated with `... | None` or `Optional[...]`.
         for arg in positional + list(fn.args.kwonlyargs):
@@ -1396,11 +1406,10 @@ class AbstractionChecker(DirectoryChecker):
         abstract_classes: dict[str, _AbstractClassInfo] = {}
         all_classes: dict[str, list[str]] = {}  # class_name -> list of base names
 
-        # TODO(perf): re-parses every Python file from disk even though the
+        # Note(perf): re-parses every Python file from disk even though the
         # engine already parsed each tree once for FileChecker passes. Proper
         # fix requires extending the DirectoryChecker API to receive parsed
         # trees from the engine; deferred to a separate PR.
-        # Audit reference: AUDIT_AND_ROADMAP.md §1.3 — AbstractionChecker re-parse.
         for path in py_files:
             try:
                 source = path.read_text(encoding="utf-8", errors="replace")

{proofctl-0.5.6 → proofctl-0.6.0}/proofctl/checkers/secrets.py

@@ -689,14 +689,22 @@ class SecretChecker(FileChecker):
         findings.extend(_scan_k8s_secrets(path, source))
 
         # SECRET-012: heredoc secrets (skip lines where SECRET-001..010 already fired)
-        already = {f.line for f in findings if f.rule_id != "PROOFCTL-SECRET-011"}
+        already = {
+            f.line
+            for f in findings
+            if f.rule_id != "PROOFCTL-SECRET-011" and f.line is not None
+        }
         findings.extend(_scan_heredoc_secrets(path, source, already))
 
         # SECRET-007/013: Python AST-aware detection (kwargs, tuple-auth,
         # module-level constants, connection strings). Skip lines that already
         # fired a SECRET-* via line-scan to avoid double-reporting.
         if path.suffix == ".py":
-            already_lines = {f.line for f in findings if f.rule_id != "PROOFCTL-SECRET-011"}
+            already_lines = {
+                f.line
+                for f in findings
+                if f.rule_id != "PROOFCTL-SECRET-011" and f.line is not None
+            }
             findings.extend(_scan_python_ast(path, source, already_lines))
 
         return findings