pycheck-neuron 1.0.8__tar.gz → 1.1.0__tar.gz

{pycheck_neuron-1.0.8 → pycheck_neuron-1.1.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: pycheck-neuron
-Version: 1.0.8
-Summary: 34-rule static AST analyzer catching temporal lookahead bias, causal confusion, and uncertainty bugs in Python ML code. Zero dependencies.
+Version: 1.1.0
+Summary: 37-rule static AST analyzer catching temporal lookahead bias, causal confusion, and uncertainty bugs in Python ML code. Zero dependencies.
 Author: NEURON Team
 Author-email: Fayo Ibrahim <fayo@neuron-lab.org>
 License-Expression: MIT
@@ -38,7 +38,7 @@ Dynamic: license-file
 
 # PyCheck — ML Safety Analyzer
 
-**34 rules. Zero dependencies. Catches the bugs that cost millions.**
+**37 rules. Zero dependencies. Catches the bugs that cost millions.**
 
 PyCheck is a static AST analyzer that detects **temporal lookahead bias**, **causal confusion**, and **unguarded uncertainty** in Python ML and trading scripts — before you run a single line of code.
 
@@ -68,7 +68,7 @@ PyCheck catches all three before execution:
 =================================================================
   PyCheck — NEURON ML Safety Analyzer
   Scanning: strategy.py
-  Rules: 34 active + Data Flow & Provenance Engine
+  Rules: 37 active + Data Flow & Provenance Engine
 =================================================================
 
   ERROR[T001]: .shift(-1) accesses data 1 rows INTO THE FUTURE
@@ -190,7 +190,7 @@ pycheck script.py              # Errors + warnings (default)
 pycheck script.py --info       # Include info-level diagnostics
 pycheck script.py --quiet      # Errors only
 pycheck script.py --json       # JSON output — pipe into CI/CD
-pycheck --list                 # List all 34 rules
+pycheck --list                 # List all 37 rules
 pycheck --help
 ```
 

{pycheck_neuron-1.0.8 → pycheck_neuron-1.1.0}/README.md

@@ -1,6 +1,6 @@
 # PyCheck — ML Safety Analyzer
 
-**34 rules. Zero dependencies. Catches the bugs that cost millions.**
+**37 rules. Zero dependencies. Catches the bugs that cost millions.**
 
 PyCheck is a static AST analyzer that detects **temporal lookahead bias**, **causal confusion**, and **unguarded uncertainty** in Python ML and trading scripts — before you run a single line of code.
 
@@ -30,7 +30,7 @@ PyCheck catches all three before execution:
 =================================================================
   PyCheck — NEURON ML Safety Analyzer
   Scanning: strategy.py
-  Rules: 34 active + Data Flow & Provenance Engine
+  Rules: 37 active + Data Flow & Provenance Engine
 =================================================================
 
   ERROR[T001]: .shift(-1) accesses data 1 rows INTO THE FUTURE
@@ -152,7 +152,7 @@ pycheck script.py              # Errors + warnings (default)
 pycheck script.py --info       # Include info-level diagnostics
 pycheck script.py --quiet      # Errors only
 pycheck script.py --json       # JSON output — pipe into CI/CD
-pycheck --list                 # List all 34 rules
+pycheck --list                 # List all 37 rules
 pycheck --help
 ```
 

{pycheck_neuron-1.0.8 → pycheck_neuron-1.1.0}/pycheck/__init__.py

@@ -3,7 +3,7 @@ PyCheck — NEURON ML Safety Analyzer
 Catches temporal leaks, causal confusion, and uncertainty bugs in Python ML scripts.
 """
 
-__version__ = "1.0.8"
+__version__ = "1.1.0"
 
 from pycheck.analyzer import analyze_file, analyze_code, format_output
 from pycheck.rules import ALL_RULES, RULES_BY_CODE

{pycheck_neuron-1.0.8 → pycheck_neuron-1.1.0}/pycheck/audit.py

@@ -12,6 +12,8 @@ import time
 from datetime import datetime, timezone
 from typing import Dict, List, Any, Optional, Set, Tuple
 
+from pycheck.rules import ALL_RULES
+
 
 def get_git_metadata(repo_path: str) -> Dict[str, str]:
     """Extract git commit hash, branch, and remote URL if available."""
@@ -299,7 +301,7 @@ def format_certificate_text(cert: Dict[str, Any]) -> str:
     unscanned_count = cert.get('unscanned_local_imports_count', 0)
 
     if cert["audit_status"] == "CERTIFIED_ZERO_LEAKAGE":
-        summary_line = f"no known patterns detected (34 rules, {scanned_count} file{'s' if scanned_count != 1 else ''} scanned, {unscanned_count} local import{'s' if unscanned_count != 1 else ''} not scanned)"
+        summary_line = f"no known patterns detected ({len(ALL_RULES)} rules, {scanned_count} file{'s' if scanned_count != 1 else ''} scanned, {unscanned_count} local import{'s' if unscanned_count != 1 else ''} not scanned)"
         cat_status = "no known patterns detected"
     elif "UNVERIFIABLE" in cert["audit_status"]:
         summary_line = f"unverifiable ({scanned_count} file{'s' if scanned_count != 1 else ''} scanned, {unscanned_count} local import{'s' if unscanned_count != 1 else ''} not scanned)"
@@ -320,7 +322,7 @@ def format_certificate_text(cert: Dict[str, Any]) -> str:
         f"  Git Branch:           {cert['git_branch']}",
         f"  Scanned Files:        {scanned_count} ({unscanned_count} local imports not scanned)",
         "+----------------------------------------------------------------------+",
-        "  INVARIANT VERIFICATION CHECKLIST (34 RULES):",
+        f"  INVARIANT VERIFICATION CHECKLIST ({len(ALL_RULES)} RULES):",
         f"  Summary: {summary_line}",
         f"    * Temporal Lookahead Bias (T001-T019):     {cat_status if cert['invariants_verified']['temporal_lookahead_free'] else 'FAILED'}",
         f"    * Cross-Fold Lineage & Leakage (F001-F002): {cat_status if cert['invariants_verified']['partition_provenance_clean'] else 'FAILED'}",

{pycheck_neuron-1.0.8 → pycheck_neuron-1.1.0}/pycheck/flow.py

@@ -290,30 +290,49 @@ class TaintTracker:
             return left_taint or right_taint
         
         if isinstance(node, ast.Subscript):
-            # Subscript propagates taint from the value being indexed
-            val_taint = self._expr_taint(node.value)
-            if val_taint:
-                return val_taint
             obj_name = self._get_var_name(node.value)
-            # Check if accessing a tracked tainted column: df['feat'] or df[['feat']]
+
+            # --- Column-level dataflow: when accessing specific columns by name,
+            # only propagate taint from THAT column, not from sibling columns.
+            # This prevents df['safe_col'] from being flagged just because
+            # df['tainted_col'] exists. ---
+
             if isinstance(node.slice, ast.Constant) and isinstance(node.slice.value, str):
                 col = node.slice.value
+                col_lower = col.lower()
+
+                # 1. Check if this specific column is tainted
                 if obj_name and f"{obj_name}.{col}" in self.tainted_vars:
                     return f"column '{col}' is tainted: {self.tainted_vars[f'{obj_name}.{col}'].reason}"
+
+                # 2. Check future-named columns
+                future_cols = {'future_price', 'future_return', 'next_close', 'next_price',
+                               'next_day', 'tomorrow', 'price_change_next_day', 'future_avg_price'}
+                if any(f in col_lower for f in future_cols):
+                    return f"accessing future-named column '{col}'"
+
+                # 3. Propagate only DIRECT variable-level taint (e.g. df = tainted.shift(-1)),
+                #    NOT column-derived taint from sibling columns
+                if obj_name and obj_name in self.tainted_vars:
+                    return self.tainted_vars[obj_name].reason
+                return None
+
             if isinstance(node.slice, (ast.List, ast.Tuple)):
+                # Multi-column access: check each column individually
                 for elt in node.slice.elts:
                     if isinstance(elt, ast.Constant) and isinstance(elt.value, str):
                         col = elt.value
                         if obj_name and f"{obj_name}.{col}" in self.tainted_vars:
                             return f"column '{col}' is tainted: {self.tainted_vars[f'{obj_name}.{col}'].reason}"
-            # Check if indexing a tainted column name
-            if isinstance(node.slice, ast.Constant) and isinstance(node.slice.value, str):
-                col_lower = node.slice.value.lower()
-                # Only flag column names that unambiguously refer to future data.
-                future_cols = {'future_price', 'future_return', 'next_close', 'next_price',
-                               'next_day', 'tomorrow', 'price_change_next_day', 'future_avg_price'}
-                if any(f in col_lower for f in future_cols):
-                    return f"accessing future-named column '{node.slice.value}'"
+                # Only propagate direct variable-level taint
+                if obj_name and obj_name in self.tainted_vars:
+                    return self.tainted_vars[obj_name].reason
+                return None
+
+            # Non-column subscript (numeric index, slice, variable): propagate all parent taints
+            val_taint = self._expr_taint(node.value)
+            if val_taint:
+                return val_taint
         
         if isinstance(node, ast.Attribute):
             return self._expr_taint(node.value)