v0.5.3-pre.002

scripts/audit_khadhroony_workspace_rules.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 # file: scripts/audit_khadhroony_workspace_rules.py
-# version: 28
+# version: 31
 
 """Audit mechanically verifiable rules specific to khadhroony-bot3."""
 
@@ -1097,6 +1097,38 @@ def audit_configuration_split(root: pathlib.Path) -> list[Violation]:
                 violations.append(Violation("KH_CFG013", relative, index, "resolved/source configuration contracts must not derive Serialize because they may contain resolved secrets"))
             if re.search(r"\bDebug\b", line):
                 violations.append(Violation("KH_CFG014", relative, index, "resolved/source configuration contracts must not derive Debug because they may contain resolved secrets or internal values"))
+    config_lib = root / "ks-config/src/lib.rs"
+    if config_lib.is_file():
+        config_exported_types = {
+            match.group(1)
+            for match in re.finditer(
+                r"(?m)^pub(?:\(crate\))? use self::[^;]+::([A-Z][A-Za-z0-9_]*)\s*;",
+                config_lib.read_text(encoding="utf-8"),
+            )
+        }
+        for path in sorted((root / "ks-config/src").glob("*.rs")):
+            if path.name == "lib.rs":
+                continue
+            relative = path.relative_to(root).as_posix()
+            for index, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
+                stripped = line.lstrip()
+                if stripped.startswith("//") or stripped.startswith("#["):
+                    continue
+                code = re.sub(r'"(?:\\.|[^"\\])*"', '""', line)
+                for type_name in sorted(config_exported_types):
+                    declaration_pattern = rf"\bpub(?:\([^)]*\))?\s+(?:struct|enum|type|trait)\s+{re.escape(type_name)}\b"
+                    if re.search(declaration_pattern, code):
+                        continue
+                    if re.search(rf"(?<![A-Za-z0-9_:]){re.escape(type_name)}\b", code) is None:
+                        continue
+                    violations.append(
+                        Violation(
+                            "KH_CFG015",
+                            relative,
+                            index,
+                            f"crate-owned public configuration type `{type_name}` must be referenced through `crate::{type_name}`",
+                        )
+                    )
     return violations
 
 
@@ -1309,6 +1341,105 @@ def audit_sensitive_transport_surfaces(root: pathlib.Path) -> list[Violation]:
                 )
     return violations
 
+
+def audit_store_backend_boundary(root: pathlib.Path) -> list[Violation]:
+    """Keep concrete storage backends private to `ks-store`."""
+
+    violations: list[Violation] = []
+    forbidden_external = {
+        "sqlx::": "SQLx must not cross the public ks-store boundary",
+        "PgPool": "PostgreSQL pool types must remain private to ks-store",
+        "PostgresStore": "PostgresStore must remain private to ks-store",
+        "PostgresStoreOptions": "PostgresStoreOptions must remain private to ks-store",
+        "PostgresReplay": "Postgres-prefixed replay contracts must not escape ks-store",
+        "ks_store::postgres": "backend module paths must not escape ks-store",
+    }
+    for path in sorted(root.glob("*/src/**/*.rs")):
+        relative_path = path.relative_to(root)
+        if relative_path.parts[0] == "ks-store":
+            continue
+        text = path.read_text(encoding="utf-8")
+        relative = relative_path.as_posix()
+        for fragment, message in forbidden_external.items():
+            start = 0
+            while True:
+                offset = text.find(fragment, start)
+                if offset < 0:
+                    break
+                violations.append(
+                    Violation(
+                        "KH_STORE001",
+                        relative,
+                        text[:offset].count("\n") + 1,
+                        message,
+                    )
+                )
+                start = offset + len(fragment)
+    crate_root = root / "ks-store/src/lib.rs"
+    if crate_root.is_file():
+        text = crate_root.read_text(encoding="utf-8")
+        for index, line in enumerate(text.splitlines(), 1):
+            if line.startswith("pub use ") and any(fragment in line for fragment in ("Postgres", "PgPool", "sqlx")):
+                violations.append(
+                    Violation(
+                        "KH_STORE002",
+                        "ks-store/src/lib.rs",
+                        index,
+                        "public ks-store exports must remain backend-agnostic",
+                    )
+                )
+    postgres_root = root / "ks-store/src/postgres"
+    if postgres_root.is_dir():
+        for path in sorted(postgres_root.rglob("*.rs")):
+            text = path.read_text(encoding="utf-8")
+            relative = path.relative_to(root).as_posix()
+            for match in re.finditer(r"tracing::(?:trace|debug|info|warn|error)!\(", text):
+                end = text.find(");", match.start())
+                fragment = text[match.start():] if end < 0 else text[match.start(): end + 2]
+                line = text[:match.start()].count("\n") + 1
+                if "target: crate::TRACING_TARGET" not in fragment:
+                    violations.append(
+                        Violation(
+                            "KH_STORE003",
+                            relative,
+                            line,
+                            "PostgreSQL tracing must use the canonical `crate::TRACING_TARGET`",
+                        )
+                    )
+                    continue
+                if 'backend = "postgres"' not in fragment or 'domain = "ks-store.pg"' not in fragment:
+                    violations.append(
+                        Violation(
+                            "KH_STORE004",
+                            relative,
+                            line,
+                            "PostgreSQL tracing must declare `backend = \"postgres\"` and `domain = \"ks-store.pg\"`",
+                        )
+                    )
+                if "action =" not in fragment:
+                    violations.append(
+                        Violation(
+                            "KH_STORE006",
+                            relative,
+                            line,
+                            "PostgreSQL tracing must declare one structured `action` field",
+                        )
+                    )
+    cargo = root / "ks-store/Cargo.toml"
+    if cargo.is_file():
+        data = tomllib.loads(cargo.read_text(encoding="utf-8"))
+        if "ks-config" in data.get("dependencies", {}):
+            violations.append(
+                Violation(
+                    "KH_STORE005",
+                    "ks-store/Cargo.toml",
+                    1,
+                    "ks-store must not depend on ks-config",
+                )
+            )
+    return violations
+
+
 def audit_wincode_resolution(root: pathlib.Path) -> list[Violation]:
     """Require the currently compatible Solana wincode dependency family."""
 
@@ -1395,6 +1526,7 @@ def main() -> int:
         +audit_ts_rs_boundaries(root)
         +audit_configuration_split(root)
         +audit_sensitive_transport_surfaces(root)
+        +audit_store_backend_boundary(root)
         +audit_wincode_resolution(root)
     )
     violations.sort(key=lambda item: (item.code, item.path, item.line, item.message))