archtest

Overview ¶

Importable rule body for ADAPTER-RETURNS-DECLARED-TYPES-01. Migrated from the legacy _test.go form to a non-test .go (M3 #1639) so the rule is module-path-agnostic — the running module path is derived from go.mod via moduleImportPath, NOT bare "github.com/ghbvf/gocell…" literals (ARCHTEST-MODULE-PATH-FUNNEL-01). The dogfood + good/bad-fixture precision gates live in adapter_returns_declared_types_test.go.

Not registered in StandardCellRules: this rule reads contract.yaml metadata and scans generated contract package imports, which are present in any Cell repo that uses GoCell codegen. Registration + external vacuous/effective semantics verification is a deferred backlog follow-up per #1639 D2 (tracked at #1706). Kept importable + module-path-agnostic.

ADAPTER-RETURNS-DECLARED-TYPES-01 ¶

ADAPTER-RETURNS-DECLARED-TYPES-01: adapter return status ⊆ contract declared. Scope: Ceiling guard only (adapter zero typed return is legal — full framework fallback is permitted). Floor guards land via roadmap GOCELL-INVARIANT-AUDIT-V1.

Algorithm:

1. metadata.NewParser(repoRoot).Parse() to load declared status sets: filter kind=="http" && Codegen==true, set = SuccessStatus ∪ Responses keys.
2. Glob cells/*/slices/*/handler.go ∪ cells/*/slices/*/service.go ∪ examples/*/cells/*/slices/*/handler.go ∪ examples/*/cells/*/slices/*/service.go.
3. For each file: AST parse, walk FuncDecl. Identify adapter methods by first return type name ending in "ResponseObject". Resolve contract ID from imports. Walk ReturnStmt → CompositeLit, extract status from struct name regex. Status ∉ declared → Diagnostic.
4. nil / ident (non-CompositeLit) returns → skip (ceiling guard).

Blind spots (BS) — declared per ai-robust.md §"工具选定后强制盲区自检" ¶

This is a CEILING guard: it must never false-positive, so it tolerates the false negatives below (each skips, never mis-flags). A1 (FIXTURE-CELLID) / floor guards (roadmap GOCELL-INVARIANT-AUDIT-V1) close the other direction.

• BS-1 Multi-import ambiguity: contractIDForTypeName resolves the owning contract by best-effort method-name-prefix match across the file's contract imports; a file importing several contracts whose generated struct prefixes collide may resolve to the wrong contract → that return is checked against the wrong declared set (skipped, not mis-flagged).
• BS-2 Dot / aliased contract import: importAlias falls back to the last import-path segment, which can collide; an unresolved alias yields contractID == "" → skip.
• BS-3 Reflection / dynamically-built response value (non-CompositeLit return): out of scope per ai-robust.md §3 — only inline CompositeLit returns are inspected.

ref: goa goagen/codegen/types/types.go ref: connect-go cmd/protoc-gen-connect-go

Package archtest callresolver.go — façade re-exports for the callsite resolution convenience layer (internal/callresolver).

This completes the façade contract for callsite-resolution: business archtest *_test.go files reach the walker + resolution helpers through archtest.{WalkFuncDecls,WalkFuncDeclsAST,IsCallToPkgFunc,HasReceiver}, never importing internal/callresolver directly. PASS-FUNNEL-RESOLVE-01 (pass_funnel_test.go) bans the direct-import path.

The *Pass-taking walker (WalkFuncDecls) lives here rather than in internal/callresolver because Pass is declared in package archtest: an internal package referencing *archtest.Pass would form an import cycle (archtest already imports internal/callresolver to re-export it). Both walker forms delegate to the single decoupled engine internal/callresolver.WalkFuncDecls, so there is exactly one traversal implementation.

Importable rule body for CAPABILITY-PROVIDER-FUNNEL-01. Migrated from the legacy _test.go form to a non-test .go (M3 #1639) so the rule is module-path-agnostic — platform symbol paths are derived from PlatformModulePath (external.go), NOT bare "github.com/ghbvf/gocell…" literals (ARCHTEST-MODULE-PATH-FUNNEL-01). The dogfood + RED-fixture precision gate live in capability_provider_funnel_test.go.

Not registered in StandardCellRules: the sole sanctioned provisioning site (cmd/corebundle/cap_wiring.go) and the banned shared-infra constructors are GoCell-internal composition-root layout; an external Cell repo has no such file, so the allowlist never matches and the rule degrades to a pure ban that would false-red any external module that legitimately constructs its own pool / client. Kept importable + module-path-agnostic but OUT of StandardCellRules (same disposition as the #1632 auth funnels).

CAPABILITY-PROVIDER-FUNNEL-01 ¶

The shared-infrastructure constructors

adapters/postgres.NewPool / NewTxManager / NewOutboxWriter / NewJournalingOutboxWriter
adapters/redis.NewClient

may only be invoked from the assembly's single provisioning site (cmd/corebundle/cap_wiring.go). Cell module files (cellmodules/<cell>/module.go) and every other cmd/ file must consume the injected capability.PGProvider / capability.RedisProvider instead of constructing the shared pool / client / the pool-bound TxManager+OutboxWriter themselves.

This is the downstream half of the funnel; the upstream half is the sealed capability.PGProvider / capability.RedisProvider (unexported marker methods + private impls + sole NewPGProvider/NewRedisProvider constructors in runtime/capability), which Go's type system makes unforgeable outside package capability.

Not banned (per-cell / per-role derivations) ¶

adapters/postgres.NewSessionStore / NewRefreshStore / NewLedgerStore / NewOutboxStore and adapters/redis.NewCache / NewRedisDriver / NewIdempotencyClaimer / NewNonceStore take an already-acquired pool handle (*pgxpool.Pool) or *redis.Client and derive a per-cell / per-role object. They are the legitimate downstream of the provider (CLAUDE.md observability §"per-cell 资源：cell 直接构造 NewCache(client, …)") and stay in module files.

AI-robust: upstream Hard + downstream Medium (transition form) ¶

Upstream is Hard (sealed construction, type system). Downstream is Medium: archtest resolves every CallExpr callee via archtest.ResolvePackageRef (owning package import path, not the source Ident), matching by (pkgPath, name). Per ai-robust.md §"Funnel 双向锁评级" a Hard-upstream + Medium-downstream funnel is an allowed transition form; the downstream→Hard upgrade (cmd/corebundle module files moved out of `package main` so the banned constructors are import-unreachable) is tracked at gh issue #988.

The sole sanctioned provisioning site (capWiringRel) is matched by isCapWiringSanctionedSite, which binds the exemption to PLATFORM PACKAGE IDENTITY (isGoCellPlatformPkgPath) — not a bare repo-relative path. This rule is importable: an external Cell repo can wire it via cfg.ExtraRules, and a consumer module could otherwise place its own cmd/corebundle/cap_wiring.go and call the banned constructors to claim the GoCell-internal exemption. A forged site has pkgPath = <consumer-module>/… (not under PlatformModulePath), so it is correctly never exempt and the rule stays a true pure ban there. Same provenance bind as isReconstructionAllowedSite (OUTBOX-RECONSTRUCTION-CALLER-01).

_test.go scope ¶

Run(t, Typed(TypedOpts{Tests: false}, ...)) loads only production-variant packages, so _test.go files are not in pass.Files; the scanner additionally filters by rel suffix as defense-in-depth — so the rule stays correct if a future caller passes Tests: true or runs it over a fixture (Run(t, Fixture(...))) load path where _test.go files would be present.

Blind spots (BS) ¶

• BS-1 Name shadowing: a non-adapter package exporting a function literally named NewPool does NOT match — ResolvePackageRef compares the callee's owning package path via go/types, not the import-site Ident.
• BS-2 Function-value indirection: `var f = adapterredis.NewClient; f(...)` resolves the call's callee to a *types.Var (ok=false) and is not flagged. Accepted: this is exactly how cmd/corebundle/redis.go injects the client factory (redisClientFactory), and it lives in the composition root, not a module file. Same accepted BS as CAS-PROTOCOL-COMPOSITION-ROOT-01 BS-2.
• BS-3 Reflection construction: out of scope per ai-robust.md §3.

Importable rule body for CELLTLS-MATERIAL-FUNNEL-01. Non-test .go file so the rule is module-path-agnostic — platform symbol paths are derived from PlatformFrameworkModulePath (external.go), NOT bare "github.com/ghbvf/gocell/framework…" literals (ARCHTEST-MODULE-PATH-FUNNEL-01). The dogfood + RED-fixture precision gate live in celltls_material_funnel_test.go.

Not registered in StandardCellRules: the sanctioned provisioning sites (cellmodules/celltls, adapters/grpc) and the banned tlsutil mTLS-material constructors are GoCell-internal packages; an external Cell repo has no such files, so the allowlist never matches and the rule degrades to a pure ban that would false-red any external module that legitimately calls the tlsutil helpers from its own provisioning site. Kept importable + module-path-agnostic but OUT of StandardCellRules (same disposition as CAPABILITY-PROVIDER-FUNNEL-01 and the #1632 auth funnels).

CELLTLS-MATERIAL-FUNNEL-01 ¶

The transport mTLS-material constructors

framework/runtime/http/tlsutil.NewClientIdentity
framework/runtime/http/tlsutil.NewServerMTLSConfig

may only be called from the following sanctioned sites (verified by repo scan on 2026-06-17, issue #2263):

• cellmodules/celltls (celltls.Resolve) — cell-to-cell HTTP mTLS for the internal listener in split topology (the primary funnel site; topology- gated, fail-closed). Calls both NewClientIdentity and NewServerMTLSConfig.
• adapters/grpc (buildCredentials) — gRPC listener transport-layer mTLS: a separate TLS channel provisioned directly from PEM bytes in the gRPC server TLSConfig, independent of the HTTP cross-cell transport. Calls NewServerMTLSConfig only; NewClientIdentity is NOT used here (the gRPC transport-layer does not build the ClientIdentity sealed bundle).
• cellmodules/deviceidentity (NewDeviceMTLSServerConfig, #1904) — the device-mTLS (renew) listener verifies DEVICE client certificates against the issuing CA trust bundle (RFC 7030 device cert renewal). A third legitimate mTLS server site, device-facing rather than cell-to-cell. Calls NewServerMTLSConfig only; NewClientIdentity is celltls-only.

Every other production caller is a violation.

AI-robust: upstream Hard + downstream Medium (Go-ceiling transition form) ¶

Upstream is Hard: [tlsutil.ClientIdentity] has only unexported fields; the sole constructor is [tlsutil.NewClientIdentity]; outside package tlsutil a zero-value ClientIdentity.IsZero() call is the only shape available — forging a populated value (and therefore bypassing this funnel) is a compile error. Downstream is Medium: archtest resolves every CallExpr callee via ResolvePackageRef (owning package import path from go/types, not the source Ident), so import aliases don't defeat it. Per ai-robust.md §"Funnel 双向锁评级" a Hard-upstream + Medium-downstream funnel is the accepted transition form; the downstream→Hard upgrade path is the same as CAPABILITY-PROVIDER-FUNNEL-01 (gh #988).

_test.go scope ¶

Production(TypedOpts{Tests: false}) loads only production-variant packages, so _test.go files are not in pass.Files; the scanner additionally filters by rel suffix as defense-in-depth — so the rule stays correct if a future caller passes Tests: true or runs it over a fixture.

Blind spots (BS) ¶

• BS-1 Name shadowing: a non-tlsutil package exporting a function literally named NewClientIdentity or NewServerMTLSConfig does NOT match — ResolvePackageRef compares the callee's owning package path via go/types, not the import-site Ident.
• BS-2 Function-value indirection: `var f = tlsutil.NewClientIdentity; f(...)` resolves to *types.Var (ok=false) and is not flagged. Accepted: the sanctioned callers don't do this.
• BS-3 Reflection construction: out of scope per ai-robust.md §3.

clock_invariants.go — importable clock injection rule logic (#1640 M3 PR-9).

Non-test home for KERNEL-CLOCK-LEAF-FALLBACK-01, KERNEL-CLOCK-RESET-RELATIVE-PROD-01, PROD-CLOCK-INJECTION-01, and CLOCK-POSITIONAL-INJECTION-01 scanner logic, so it can be compiled and run by an external Cell repository (Go never compiles a dependency's _test.go, so rule logic external repos must run cannot live in a _test.go file). GoCell's own Test* functions in clock_invariants_test.go dogfood the same Check* — single source, no parallel rule body.

Four rules are implemented here:

• KERNEL-CLOCK-LEAF-FALLBACK-01: leaf-level clock.Real() construction is forbidden outside the composition root.
• KERNEL-CLOCK-RESET-RELATIVE-PROD-01: production code must use the absolute Timer.ResetAt(deadline time.Time) API.
• PROD-CLOCK-INJECTION-01: no direct reference to stdlib time wall-clock entry points in production code; all wall-clock interactions must flow through an injected kernel/clock.Clock.
• CLOCK-POSITIONAL-INJECTION-01: clock.MustHaveClock arg0 must be a positional parameter; no exported clock option-injector functions; no exported Config/Options struct fields of type clock.Clock.

Dogfood tests: TestKernelClockLeafFallback, TestKernelClockResetRelativeProd, TestProdClockInjection, TestClockPositionalInjection (clock_invariants_test.go).

Register status ¶

Not registered in StandardCellRules: allowlist/scan-scope is gocell-hardcoded (kernel/clock layout, composition-root carve-outs) with no ConfigForExternalCell consumer-extension -> vacuous/false-red externally; kept importable + module-path-agnostic + fork-safe.

Package archtest enforces Go source-level import layering rules for the GoCell architecture.

This complements kernel/governance which validates metadata-level dependencies (DEP-01 to DEP-03: cell ownership, cycle detection, L0 co-location) from YAML files. archtest operates on the typed Go package graph supplied by tools/depgraph (single packages.Load shared across LAYER-05/05T/06/06T/07/08/09/09T/10) to catch violations that metadata validation cannot see.

Rules enforced (from CLAUDE.md):

LAYER-01: kernel/ may only import stdlib, pkg/, and kernel/ (allow-list)
          [moved to depguard (.golangci.yml linters.settings.depguard.rules)]
LAYER-02: cells/ must not import adapters/
          [moved to depguard (.golangci.yml linters.settings.depguard.rules)]
LAYER-03: runtime/ must not import cells/ or adapters/
          [moved to depguard (.golangci.yml linters.settings.depguard.rules)]
LAYER-04: adapters/ must not import cells/, cmd/, or examples/
          [moved to depguard (.golangci.yml linters.settings.depguard.rules)]
LAYER-05:  cells/A must not directly import cells/B/internal/ (cross-cell isolation)
LAYER-05T: cells/A must not transitively import cells/B/internal/ via any
           production-edge closure (T = transitive; depgraph.TransitiveImports)
LAYER-06:  cell-owned public subpackages (see cellOwnedSubpackages) may
           only be imported by their owning cell, cmd/, or examples/
LAYER-06T: same as LAYER-06 but checked against the transitive closure
LAYER-07:  cells/ must not import runtime/http/router directly
LAYER-08:  the legacy cell-level HTTP route registrar interface must remain
           absent — enforced at the type level by walking each module
           package's types.Scope() for a top-level TypeName matching the
           legacy name. String literals in comments / struct tags are
           accepted (type-level scope is precise where text scanning
           over-matches into prose)
LAYER-09:  cells/A must not directly import cells/B/events
LAYER-09T: cells/A must not transitively import cells/B/events
LAYER-10:  cells/<cell> root package exported APIs must not expose concrete
           adapter/driver types
PGQUERY-01: PostgreSQL SQL builder/keyset helpers must live in pkg/pgquery;
            pkg/query remains limited to generic pagination, cursor,
            runmode, and in-memory pagination helpers

In-process cross-cell Go handoff = 0 — guard inventory (epic #1423 / US8) ¶

US8's acceptance signal (SC-003 / FR-009) requires "进程内跨 cell Go 直传 = 0" (zero in-process cross-cell Go handoff) be permanently archtest-guarded at Medium+. The guards that together enforce it, organized by handoff FORM (the inventory deliverable of #1961 / T071 — this is the口径 single source; per-rule symbols/blind spots live in each rule's own godoc):

MODULE-PROVIDE-NO-VALUE-HANDOFF-01   Hard    re-opening the ModuleResult
  (module_provide_signature_frozen_test.go)  value-handoff channel — a cell
                                             handing sibling values back through
                                             Provide (reflect field freeze)
LAYER-05 / LAYER-05T                  Medium  cell A importing cell B/internal/
  (archtest_test.go)                          (direct / transitive)
LAYER-06 / LAYER-06T                  Medium  cell A importing a cell-owned
  (archtest_test.go)                          public subpackage of cell B
LAYER-09 / LAYER-09T                  Medium  cell A importing cell B/events
  (archtest_test.go)                          (direct / transitive)
GRPC-CELL-NO-CLIENT-DIAL-01           Medium  a cell constructing OR holding a
  (grpc_cell_no_client_dial_test.go)          gRPC client (dial / *grpc.ClientConn /
                                             generated <Svc>Client surface) to reach
                                             a sibling cell in-process — incl. the
                                             inject-a-built-client escape (#1961;
                                             closes the #1752 runtime/grpc gap)

Open blind spots (NOT yet guarded — tracked, not silently dropped):

interface{} / any pointer smuggling — a cell holding a sibling cell's concrete
  value behind an `any` field/param; type erasure defeats the LAYER-05/06 import
  edges and the MODULE-PROVIDE field freeze. Backlog: gh #2002 (Medium+ target).
sync HTTP direct dial — a cell calling a sibling contract via a raw http.Client.
  OUT OF SCOPE here: owned by US4's CellTransport funnel task, not #1961.

Themed invariant files & reverse-index anchors ¶

Beyond the LAYER-* / PGQUERY-01 rules above, this package hosts the rest of the invariant gates organized into per-theme `*_invariants_test.go` files (and single-rule `{rule}_test.go` companions for narrowly-scoped invariants). Every file carries a `// INVARIANT: {ID}` anchor in its file-header CommentGroup; `INVENTORY-ANCHOR-REQUIRED-01` enforces this unconditionally, making the anchors the single source of the reverse index from rule ID to asserting test code:

grep -rn 'INVARIANT: <ID>' tools/archtest/

jumps directly to the gate. Multi-rule themed files use list-form continuation (`// - INVARIANT: <ID>`) so every distinct rule the file asserts is grep-discoverable.

assembly_invariants_test.go    ASSEMBLY-* / ASSEMBLYREF-*
clock_invariants_test.go       CLOCK-* / KERNEL-CLOCK-* / PROD-CLOCK-*
codegen_invariants_test.go     CODEGEN-* / SPEC-GEN-*
errcode_invariants_test.go     ERRCODE-KIND-LITERAL / MESSAGE-CONST-LITERAL /
                               ERROR-FIRST-* / DETAILS-SLOG-ATTR / EXPORTED-ERROR-NEW
handler_policy_required_test.go HANDLER-POLICY-REQUIRED-01 (caller-side
                               wiring scan; the other 4 HANDLER-* rules
                               were funnel-pinned via handler.tmpl +
                               golden in tools/codegen/contractgen by
                               PR-FUNNEL-02)
httputil_invariants_test.go    HTTPUTIL-*
outbox_invariants_test.go      OUTBOX-*
panic_invariants_test.go       PANIC-*
prod_invariants_test.go        PROD-DURATION-CONST-01
refresh_invariants_test.go     REFRESH-*
rmq_invariants_test.go         RMQ-*

Single-rule files retain the `{rule}_test.go` naming (e.g. `adapter_returns_declared_types_test.go`); they convert to `{theme}_invariants_test.go` once the theme accumulates ≥ 3 rules — see CLAUDE.md `## 新增 invariant 决策原则` for the file-naming branch.

On-demand inventory listing (no persisted view):

bash hack/scripts/audit/list-archtests.sh

prints every anchor + file + line + theme to stdout. Persisted `docs/audit/archtest-inventory.md` and its drift gate were removed in PR-A' (2026-05-10); the archtest gate above is the single source.

Importable rule body for TYPESEVAL-EVAL-PREDICATE-CENTRALIZED-01. Migrated from the legacy _test.go form to a non-test .go (M3 #1639) so the rule is module-path-agnostic — platform symbol paths are derived from PlatformModulePath (external.go), NOT bare "github.com/ghbvf/gocell…" literals (ARCHTEST-MODULE-PATH-FUNNEL-01). The dogfood + RED-fixture precision gate live in eval_predicate_centralization_test.go.

Not registered in StandardCellRules: this is a framework-self-referential meta-rule that scans GoCell's own tools/archtest/*_test.go for constraint.Expr.Eval callsites. An external Cell repo has its own archtest package — the scan target (./tools/archtest/...) would resolve to that repo's archtest (if it exists) or yield zero files, making the rule vacuous-green there. Kept importable and module-path-agnostic (all platform paths derived from PlatformModulePath) but OUT of StandardCellRules (same disposition as the #1632 auth funnels and CAPABILITY-PROVIDER-FUNNEL-01).

TYPESEVAL-EVAL-PREDICATE-CENTRALIZED-01 ¶

Every constraint.Expr.Eval(arg) callsite in tools/archtest/*_test.go (top- level package, excluding internal/ subpackages) MUST pass either:

Form A — a *ast.CallExpr whose callee resolves to either
         tools/archtest/internal/typeseval.BuildContextPredicate
         (qualified cross-package form) OR
         tools/archtest.BuildContextPredicate (same-package bare form,
         which is a thin delegation to typeseval.BuildContextPredicate).
         Any extraTags arguments are fine; the funnel is the call form.
Form B — an inline *ast.FuncLit of shape  func(_ string) bool { return false }
         — the all-false sentinel — body must be exactly one ReturnStmt
         whose single result is the identifier `false`. Indirection via a
         var binding (`var fn = func(...) { return false }; expr.Eval(fn)`)
         is NOT accepted: the inline FuncLit shape is the Hard surface.

Any other predicate shape — `func(tag string) bool { return tag == "X" }`, a named helper, a variable identifier, a method reference, a composite return expression — fails this rule.

Why a static funnel (Hard) and not a doc convention (Soft):

• The toolchain-default tag set (GOOS/GOARCH/cgo/unix/gc/go1.X) drifts every release. A hand-written predicate that hard-codes "linux || darwin || amd64 || ..." silently misses additions. BuildContextPredicate sources implicitDefaults from build.Default.ReleaseTags + a single mirror of internal/syslist, so go.mod floor bumps propagate automatically. Forcing every consumer through the call form makes the drift unreachable.

• The all-false sentinel is the canonical "evaluate under empty tag set" form; allowing it explicitly avoids forcing a contrived BuildContextPredicate() call where the intent is to deny every tag.

AI-robust rating: Hard. Per .claude/rules/gocell/ai-robust.md "Hard 范本" — "typed function call as Hard funnel for unbounded operations": form uniqueness + archtest fail-on-deviation is the highest grade reachable in Go for this rule shape. The Go type system does not prevent passing arbitrary func(string)bool to constraint.Expr.Eval at compile time; static archtest at CI is the canonical Hard enforcement.

Covered (NOT a blind spot — listed to preempt the question): indirection through a var binding (`var f = func(...) bool { return false }; expr.Eval(f)`) resolves the arg to an *ast.Ident — neither the canonical BuildContextPredicate(...) call nor an all-false FuncLit — so it is REJECTED, forcing the inline canonical form (intentional strictness, not a gap).

Blind spots (BS) ¶

• BS-1 Reflection / code generation producing constraint.Expr.Eval calls: out of scope per ai-robust.md §3.
• BS-2 Scope: only top-level tools/archtest/ _test.go files are checked (internal/ sub-packages are excluded per the rule intent).

fence_token_mint_funnel.go — caller-allowlist funnel for credentialfence.Mint. Closes the upstream half of the credential-invalidate funnel: combined with the Go type system seal (FenceToken interface has an unexported isCredentialFenceToken marker method, so no external type can implement it) and the runtime nil-guard in the three mutation methods, this archtest yields upstream Hard via call-site form-uniqueness — the .claude/rules/gocell/ai-robust.md §Hard 范本目录 "typed marker funnel for unbounded ops" pattern.

INVARIANT: FENCE-TOKEN-MINT-FUNNEL-01

Rule: every non-test caller of credentialfence.Mint must live in one of the allowlisted production paths (the credentialinvalidate funnel + storetest / conformance suites). Any other caller is a violation: production code that is not the funnel must not be able to construct a FenceToken.

AI-robust grade (Mint-caller dimension): Hard via call-site form-uniqueness per ai-robust.md §Hard 范本目录 "typed marker funnel for unbounded ops". The scanner is form-complete: it flags EVERY reference to credentialfence.Mint (direct call, var-decl / short-var function-value capture, return, pass-through arg, reflect arg) by walking all SelectorExpr and resolving each via ResolvePackageRef (alias-immune). Because credentialfence is type-sealed, a reference to Mint is the only way to obtain a FenceToken, so flagging every reference closes the function-value-capture and reflect blindspots structurally — there is no separate per-form blindspot self-check to keep in sync. Residual blindspots (dot-import, //go:linkname, unsafe) are the universal class that defeats any static analysis; see scanFenceTokenMintRefs.

Grade caveat: enforcement is archtest-bound, not compile-time. Go cannot express "only package X may call function Y", so this is the Hard ceiling the rule's shape can reach (the PANIC-REGISTERED-01 precedent). The type-system Hard guarantee is the *construction* seal (external packages cannot implement FenceToken nor build the unexported impl); see runtime/auth/credentialfence.

Companion archtests (the downstream half of the same funnel):

• CREDENTIAL-INVALIDATE-FUNNEL-01 — RevokeForSubject caller allowlist
• USER-AUTHZ-EPOCH-BUMP-FUNNEL-01 — BumpAuthzEpoch caller allowlist
• REFRESH-REVOKE-USER-FUNNEL-01 — RevokeUser caller allowlist
• CREDENTIAL-INVALIDATE-UPSTREAM-CALLER-01 — Invalidator.Apply caller allowlist

Together these four rules (downstream Hard) plus this rule (upstream Hard) fully close the credential-invalidation safety model. See ADR docs/architecture/202605101400-adr-credential-session-protocol.md §A16 for the closure proof and threat-matrix re-evaluation.

Not registered in StandardCellRules: allowlist is gocell-hardcoded with no ConfigForExternalCell consumer-extension → would false-red an external cell's own auth code; kept importable & module-path-agnostic but vacuous-green externally.

Importable rule bodies for FIXTURE-CELLID-TYPED-BUILDER-01 and METADATATEST-IMPORT-SCOPE-01. Migrated from the legacy _test.go form to a non-test .go (M3 #1639) so both rules are module-path-agnostic — platform symbol paths (kernel/metadata, kernel/metadata/metadatatest, the carve-out map key) are derived from PlatformModulePath (external.go), NOT bare "github.com/ghbvf/gocell…" string literals (ARCHTEST-MODULE-PATH-FUNNEL-01). The self-checks (A2 body-shape, A3 negative fixture, A4 ADR-consistency, A5 var-initializer shape) live in fixture_cellid_typed_builder_test.go and call the helpers defined here — single source, no parallel rule body.

Not registered in StandardCellRules: both invariants are GoCell-internal, tied to the kernel/metadata + kernel/metadata/metadatatest layout that no external Cell repo replicates. FIXTURE-CELLID-TYPED-BUILDER-01 scans kernel/-rooted fixtures for bare cell-id literals; an external repo lacks that layout → vacuous-green. METADATATEST-IMPORT-SCOPE-01 guards against importing the GoCell-internal metadatatest package from production code; an external repo that does not import metadatatest at all is trivially clean. Kept importable + module-path-agnostic but OUT of StandardCellRules (same disposition as the #1632 auth funnels and CAPABILITY-PROVIDER-FUNNEL-01).

FIXTURE-CELLID-TYPED-BUILDER-01 ¶

Every cell-id field position in a kernel/metadata.* struct or map composite literal — anywhere in the module's hand-written code (production + tests, all tag combinations) — must be sourced from one of three sanctioned forms:

1. kernel/metadata/metadatatest.NewCellID(literal) — typed-builder call.
2. One of metadatatest's pre-validated package-level cell-id vars (CellID*).
3. metadata.FrameworkOwnerSentinel const (#1939) — the reserved "_framework" owner/provider value. It cannot go through NewCellID (leading underscore is not a legal cell id, so NewCellID would panic) and cannot be a CellID* var (A5 forbids non-NewCellID initialisers). It is therefore accepted directly via TypesInfo identity lock (metadataPkgPath + const name). Accepting it at all cell-id positions is harmless: "_framework" is not a legal cell id per MatchCellID, so inadvertent use at CellMeta.ID is caught by FMT-C1. Bare string literals at

those positions are rejected.

Scope: currently kernel/ only. Test fixtures in runtime/, cells/, cmd/, examples/, and tools/ outside the migrated tools/codegen + tools/generatedverify subset may still embed bare cell-id literals (Soft state). Mirror backlog issue #1201 tracks scope expansion to non-kernel/ packages.

Enforcement is split into sub-rules A1–A5; A1 is the importable rule body supplied by CheckFixtureCellIDTypedBuilder. A2, A3, A4, A5 are self-checks that stay in the _test.go companion and call helpers defined here.

AI-robust: downstream Hard (A1 typed-info callsite identity), upstream Hard (A2 body form-uniqueness + pkg-path identity lock), meta Hard (A3 negative fixture + A4 ADR consistency). See the _test.go package godoc for the full evaluation.

METADATATEST-IMPORT-SCOPE-01 ¶

The metadatatest package (kernel/metadata/metadatatest) must only be imported by *_test.go files or archtest_fixture-tagged code. Importing it from production code drags init-time panics into runtime and contradicts its test-only purpose. CheckMetadatatestImportScope is the importable rule body.

AI-robust: Medium, single-axis (path-based archtest scope — NOT a funnel, so no caller-allowlist / sealed-construction double-lock applies). Go cannot express a "test-only package" at the type level, so the sole Hard-upgrade path is a Go language feature that does not exist — a permanent Go-ceiling won't-do (no GoCell-side issue; same ceiling family as #851 / #893 / #1282). The AST import-scan (production .go importing metadatatest) is the canonical enforcement; dot-import is resolved via importsMetadatatest.

Importable rule body for INSECURE-SKIP-VERIFY-LITERAL-01. Non-test .go file so the rule is module-path-agnostic — platform symbol paths are derived from PlatformFrameworkModulePath (external.go), NOT bare string literals (ARCHTEST-MODULE-PATH-FUNNEL-01). The dogfood + RED-fixture precision gate live in insecure_skip_verify_funnel_test.go.

Not registered in StandardCellRules: the allowed site (framework/runtime/http/tlsutil) is a GoCell-internal package; an external Cell repo has no such file, so the allowlist is vacuous and the rule degrades to a pure repo-wide ban — which is the correct posture for an external consumer that should never set InsecureSkipVerify:true. An ExtraRule wire is the correct way to pick it up. Kept importable + module-path-agnostic but OUT of StandardCellRules.

INSECURE-SKIP-VERIFY-LITERAL-01 ¶

No PRODUCTION .go file may set the composite-literal struct field

InsecureSkipVerify: true

(a KeyValueExpr whose Key ident is "InsecureSkipVerify" and Value is the "true" ident) EXCEPT inside framework/runtime/http/tlsutil (the sole sanctioned home, where the field is paired with a VerifyConnection callback that performs the full SPIFFE-ID + chain check — see tlsutil.NewClientMTLSConfig godoc).

This catches a future fail-open `&tls.Config{InsecureSkipVerify: true}` written without the compensating VerifyConnection verifier. It is DISTINCT from SEC-FAIL-CLOSED-04 (security_defaults.go), which scans only adapters/websocket for the ASSIGNMENT form

opts.InsecureSkipVerify = true

This rule covers the composite-literal FIELD form repo-wide.

AI-robust: Medium ¶

The composite literal `InsecureSkipVerify: true` is expressible anywhere — this is exactly the Go-language ceiling that prevents Hard. The rule uses text-free AST scan (KeyValueExpr key ident + value ident) across all production .go files, so it fires on every future literal regardless of variable name, struct type name, or import alias. Anti-vacuity proven by the RED fixture in insecure_skip_verify_funnel_test.go.

Allowed site ¶

framework/runtime/http/tlsutil (package dir prefix, bound to platform package identity via isGoCellPlatformPkgPath). The single current literal is inside NewClientMTLSConfig where InsecureSkipVerify:true is paired with a VerifyConnection callback. Adding a second literal inside tlsutil requires the same pairing (enforced by code review; the archtest only closes the out-of-package bypass vector).

_test.go scope ¶

_test.go files are skipped by rel-suffix filter — tests may legitimately construct tls.Config{InsecureSkipVerify: true} for local dial without a peer verifier.

Blind spots (BS) ¶

• BS-1 Variable assignment: `cfg.InsecureSkipVerify = true` (AssignStmt) is covered by SEC-FAIL-CLOSED-04 (adapters/websocket scope). This rule covers the composite-literal form only; assignment form outside adapters/websocket is a gap shared with SEC-04's scoped design.
• BS-2 Indirect true: `var t = true; tls.Config{InsecureSkipVerify: t}` — the Value is *ast.Ident with Name != "true", so it is not flagged. Accepted: fabricating a true-alias to circumvent the check requires deliberate evasion, outside the incidental-mistake threat model.

INVARIANT: MQTT-CLIENT-ID-NAMESPACE-01 INVARIANT: MQTT-TOPIC-NAMESPACE-01 INVARIANT: MQTT-CONFIG-SEALED-FIELD-FROZEN-01

mqtt_funnel.go — importable sealed-struct construction funnel logic for adapters/mqtt.ClientID, adapters/mqtt.TopicNamespace, and adapters/mqtt.Config.

This is the non-test home of the MQTT-CLIENT-ID-NAMESPACE-01 and MQTT-TOPIC-NAMESPACE-01 scanner helpers so they can be compiled by external Cell repositories through the CellRule pattern (Go never compiles a dependency's _test.go, so rule logic that external repos must run cannot live in a _test.go file). GoCell's own TestMQTTClientIDNamespace01 / TestMQTTTopicNamespace01 functions (mqtt_funnel_test.go) call the same shared helpers — single source, no parallel rule body.

register=no — gocell-internal-layout (scans adapters/mqtt), NOT in StandardCellRules() and NOT promised to run externally — these dogfood-only rules target a package an external repo lacks, so a manual ExtraRules caller does not get a clean pass; migrated for unified PlatformModulePath parameterization + fork-safety, dogfooded via the per-rule Tests).

Platform-symbol paths are anchored to PlatformModulePath so a module rename updates exactly one place and no bare literal appears here.

INVARIANT: REASON-NAME-REDACTION-01

mqtt_reason_redaction.go — importable REASON-NAME-REDACTION-01 rule logic.

This is the non-test home of the REASON-NAME-REDACTION-01 scanner so it can be compiled by external Cell repositories through the CellRule pattern (Go never compiles a dependency's _test.go, so rule logic that external repos must run cannot live in a _test.go file). GoCell's own TestMQTTReasonNameRedaction_FunnelOnly / TestMQTTReasonNameRedaction_ScannerNonVacuous (mqtt_reason_redaction_test.go) call the same shared helpers — single source, no parallel rule body.

register=no — gocell-internal-layout (scans adapters/mqtt), NOT in StandardCellRules() and NOT promised to run externally — this dogfood-only rule targets a package an external repo lacks, so a manual ExtraRules caller does not get a clean pass; migrated for unified PlatformModulePath parameterization + fork-safety, dogfooded via the per-rule Tests).

Platform-symbol paths are anchored to PlatformModulePath so a module rename updates exactly one place and no bare literal appears here.

notfound_test_strict.go — importable POSTGRES-NOTFOUND-TEST-OTHER-ERROR-MIXUP-ARCHTEST-01 rule logic (#1640 M3 PR-9).

Non-test home for POSTGRES-NOTFOUND-TEST-OTHER-ERROR-MIXUP-ARCHTEST-01 scanner logic, so it can be compiled and run by an external Cell repository.

Dogfooded by tools/archtest/notfound_test_strict_test.go:

TestNotFoundTestStrict → Report(t, "POSTGRES-NOTFOUND-TEST-OTHER-ERROR-MIXUP-ARCHTEST-01", CheckNotFoundTestStrict(...))

Register status ¶

Not registered in StandardCellRules: this rule's scan scope (errcodetest + errcode packages) is gocell-internal layout specific with no ConfigForExternalCell consumer-extension → vacuous/false-red externally.

Importable rule bodies for outbox invariants migrated to non-test .go (M3 #1302 PR-5) so external Cell repos can import and run them via StandardCellRules / RunStandardCellRules. The dogfood + RED-fixture precision gates live in outbox_invariants_test.go.

OUTBOX-HANDLERESULT-FACTORY-PREFERRED-01 ¶

Production code (non-_test.go) must use kernel/outbox factories Ack/Requeue/Reject instead of constructing outbox.HandleResult{...} composite literals, except for the files in handleResultLiteralAllowlist (factories themselves + shared conformance harness).

External Cell repo semantics: the allowlist is consulted by isHandleResultLiteralAllowed, which FIRST requires the constructing package to be a GoCell platform package (isGoCellPlatformPkgPath). The allowlist entries (kernel/outbox/result.go, kernel/outbox/outboxtest/conformance.go) belong to the GoCell platform module; a consumer module that forges one of these rel paths has a non-platform package path and is correctly NOT exempt, so the rule degrades to a PURE BAN on HandleResult{} literals — the intended behavior: business handlers must use the typed factories.

OUTBOX-TOPIC-FAILOPEN-01 ¶

An outbox.Entry composite literal whose Topic or EventType string constant matches one of the security-sensitive prefixes (session.*, user.*, role.*, audit.* and their event.* contract forms) must not set FailurePolicy: outbox.FailurePolicyFailOpen.

NOT registered in StandardCellRules (vacuous-external): kernel/outbox.Entry is a sealed type — all fields are unexported and a populated outbox.Entry{...} composite literal outside kernel/outbox is a COMPILE ERROR (OUTBOX-ENTRY-SEALED-CONSTRUCTION-01, kernel/outbox/outbox.go). No production package — in GoCell or in any external Cell repo — can construct the literals this rule scans for, so the production scan is vacuous everywhere; the rule's real coverage is the fixturetest/outbox fake-package fixtures under testdata/. It is migrated here for PlatformModulePath parameterization + fork-safety only (analogous to SCAFFOLD-LISTENER-MARKER-TYPED-CONST-01), enforced in GoCell via the dogfood + fixture sub-tests in outbox_invariants_test.go.

AI-robust ratings ¶

Both rules are Medium downstream (archtest type-aware caller-allowlist / type-identity scan); Hard upstream is not reachable — Go cannot express "callers in cells/ must use factory names" without unexporting HandleResult (which breaks kernel-internal plumbing), nor can Go prevent an outbox.Entry composite literal from setting any public field. This permanent upstream ceiling is the same Go-visibility limit tracked for the #851 / #893 / #1282 holder-seal family (won't-do).

outbox_reconstruction_caller.go — importable rule body for OUTBOX-RECONSTRUCTION-CALLER-01. Migrated from the legacy _test.go form to a non-test .go (M3 #1302 / #1635) so external Cell repos can import and run it via StandardCellRules / RunStandardCellRules. The dogfood + anti-vacuity reverse self-check live in outbox_reconstruction_caller_test.go.

OUTBOX-RECONSTRUCTION-CALLER-01 ¶

outbox.Entry is sealed construction (OUTBOX-ENTRY-SEALED-CONSTRUCTION-01): a populated composite literal outside kernel/outbox is a compile error. That makes Entry FORGERY-BY-LITERAL unrepresentable (type-system Hard upstream). But Entry has two cross-package RECONSTRUCTION funnels that legitimately must exist — and both accept attacker-controllable Principal / OccurredAt without any provenance check (Entry.Validate only checks well-formedness, never "where did this Principal come from"):

• outbox.UnmarshalEnvelope(topic, raw []byte) — decodes arbitrary wire bytes into a sealed Entry. A caller that crafts the JSON controls the principal.
• outbox.EntryScan{...}.ToEntry() — rebuilds a sealed Entry from exported scan-target fields. A caller that fills EntryScan controls the principal.

If a business producer (cells/* or examples/*) could call either funnel, it would have a second path — alongside ctxkeys-forgery (CTXKEYS-PRINCIPAL-WRITE- CALLER-01) — to fabricate an Entry with a forged audit identity and Emit it, defeating the "NewEntry-from-ctx is the single injection trust boundary" claim. This archtest pins the callsite identity of both funnels to the sanctioned framework-infrastructure files: storage adapters (which reconstruct from already-persisted DB rows) and wire/consumer decoders (which decode inbound broker bytes). Neither funnel is reachable from a producer.

Architectural note (why no runtime guard on Emit): the relay and the consumer path never feed a reconstructed Entry back into Emitter.Emit — the relay MarshalEnvelopes the claimed Entry straight to Publisher.Publish, and the consumer dispatches the decoded Entry to a handler. So locking the two reconstruction callsites is sufficient; Emit needs no extra check.

AI-robust rating (charter §"Funnel 双向锁评级") ¶

• Downstream: HARD by archtest caller-allowlist. The callee is resolved via go/types (ResolvePackageRef / ResolveMethodCall / types.Info.Uses), so import aliases (kout "…/kernel/outbox"), dot-imports (bare-identifier UnmarshalEnvelope), and method-expression forms are all resolved to the same symbol — there is no "looks like but isn't" gap. The allowlist is bound to PLATFORM PACKAGE IDENTITY (isGoCellPlatformPkgPath), not a bare repo-relative path, so a consumer module that forges an allowlisted rel path (e.g. its own "runtime/eventbus/eventbus.go") is NOT exempt — the rule stays a true pure ban for external repos. Any callsite outside the allowlist fails in CI.
• Upstream: MEDIUM, and this is a GO-LANGUAGE CEILING, not a deferred TODO. Hard upstream would require the two funnels to be unreachable outside the sanctioned packages. They cannot be: reconstruction is inherently cross-package (adapters/postgres, runtime/eventbus, adapters/rabbitmq are all distinct packages from kernel/outbox), so Go visibility cannot express "only these packages may call an exported func/method". This is the same permanent ceiling documented for SPAN-SETATTR-HOLDER-SEAL (#851) and HEALTHZ-HOLDER-SEAL (#893 won't-do); tracked here as #1282. The downstream archtest is the enforcement; the ceiling is documented, not silently accepted.

Detection is REFERENCE-based, not call-based ¶

The scanner walks BOTH SelectorExpr and bare *ast.Ident references that go/types resolves to a funnel symbol — whether the reference is the callee of a call OR passed as a function/method value. This deliberately closes the "indirection through a function value" gap: a file that does `f := outbox.UnmarshalEnvelope; f(b)` references the symbol at the `outbox.UnmarshalEnvelope` SelectorExpr and is caught. The bare-Ident walk additionally closes the dot-import form (import . "…/kernel/outbox"; UnmarshalEnvelope(b)), which references the package func as a bare *ast.Ident — resolved via types.Info.Uses, alias/dot-import-proof. The mirror of scaffold_derived_forceoverwrite.go's dual SelectorExpr+Ident walk. (The (EntryScan).ToEntry method funnel is always a SelectorExpr — a method call on a receiver value — even under a dot-import of kernel/outbox, so only the package func has a bare-Ident form.)

Tool blind spots (charter §"强制盲区自检") ¶

• A bypass added in a //go:build-gated PRODUCTION file under a tag not in the default build context would be missed by the default-tags scan. The funnel callers today are all default-build; the integration-tagged code is _test.go (excluded from production load anyway). Mitigated by the default+tagged double scan when cfg.BuildTags is supplied. Documented.
• The anti-vacuity guard (every allowlisted file must reference its funnel ≥1×) lives in the _test.go dogfood (checkReconstructionAntiVacuity) — NOT in the importable Check (which returns only forward caller-allowlist violations). It proves the scanner actually resolves the real references (not a vacuous pass) AND forbids stale allowlist rot — a dead allowlist entry is a latent bypass slot, so an entry that no longer corresponds to a real reference fails the dogfood (charter "no silent carve-over / empty steady state").

External Cell repo semantics ¶

This rule is registered in StandardCellRules. The allowlisted infra files live in GoCell's own adapters/ and runtime/ packages, which are dependencies of an external Cell repo — not in the consumer's own module. Therefore in a clean external Cell repo there are zero references to either funnel in the scanned source, and the rule degrades to a PURE BAN (vacuous-green). That is intended: business / consumer code must never call UnmarshalEnvelope or EntryScan.ToEntry. importable non-test home; external repos run it via StandardCellRules; GoCell dogfoods it via the _test.go.

pg_repo_ambient_tx.go — importable PG-REPO-AMBIENT-TX-01 rule logic (#1640 M3 PR-9).

Non-test home for PG-REPO-AMBIENT-TX-01 scanner logic, so it can be compiled and run by an external Cell repository.

Dogfooded by tools/archtest/pg_repo_ambient_tx_test.go:

TestPGRepoAmbientTx           → Report(t, "PG-REPO-AMBIENT-TX-01", CheckPGRepoAmbientTx(...))
TestPGRepoApprovedSealed       → Report(t, "PG-REPO-APPROVED-SEALED", CheckPGRepoApprovedSealed(...))

Register status ¶

Not registered in StandardCellRules: this rule's allowlists and scan scope (postgres repo layout / pgrepoapproved package) are gocell-internal layout specific with no ConfigForExternalCell consumer-extension → vacuous/false-red externally.

prod_main_wiring_noop_reject.go — importable rule body for PROD-MAIN-WIRING-NOOP-REJECT-01. Lives in a non-test .go (like outbox_reconstruction_caller.go) so an external Cell repo can import and run it via StandardCellRules / RunStandardCellRules. The dogfood, detector reds, green fixture, anti-vacuity and matcher unit tests live in prod_main_wiring_test.go.

PROD-MAIN-WIRING-NOOP-REJECT-01 ¶

A production composition-root (main) package — those a consumer declares in cfg.ProductionMainPkgs — must not DIRECTLY construct a raw "noop / degraded" outbox event sink. Raw noop sinks silently drop events (or lose L2 atomicity); in a production binary that is data loss, not a missing feature. The five forbidden symbols are the complete raw-noop sink surface of kernel/outbox:

kernel/outbox.NoopWriter        — Writer that validates then discards every entry
kernel/outbox.NewNoopEmitter    — Emitter backed by NoopWriter (discards)
kernel/outbox.NewDirectEmitter  — DirectEmitter ctor that bypasses ResolveEmitter
kernel/outbox.DiscardPublisher  — Publisher that logs+discards (the "noop publisher")
kernel/outbox.DemoTxRunner      — pass-through TxRunner (no real transaction)

All five implement (or back) cell.Nooper and are rejected at runtime by outbox.CheckNotNoop in DurabilityDurable mode. This rule is the STATIC, pre-Init counterpart: a composition root could mint one before any cell Init runs, where no pool/cell probe can see it.

Sanctioned — deliberately NOT forbidden (the rule pushes raw noop THROUGH these; banning them would break legitimate wiring). Split by altitude so a composition-root author and a cell author each see their own sanctioned set:

Composition-root (what a main package SHOULD call instead of a raw sink):

outbox.DemoCellEmitter()    — sealed demo emitter funnel (sanctioned way to
                              inject a noop emitter into a cell Option)
outbox.DemoCellTxManager()  — sealed demo tx-manager funnel
outbox.ResolveEmitter       — durable-vs-direct emitter resolver
runtime/eventbus.New / InMemoryEventBus — the in-process DEMO publisher. It is
                              not a raw noop sink, so this rule does not forbid
                              it. The "in-memory publisher in postgres mode" gap
                              that option A of #1303 deliberately left open is
                              now CLOSED by #1940: postgres topology wires a real
                              broker via cellmodules/eventtransport.Resolve, and
                              cmd/corebundle is additionally barred from
                              direct-importing runtime/eventbus by depguard
                              COREBUNDLE-EVENTBUS-FUNNEL-01 (a transport-funnel
                              guard, orthogonal to this noop-sink ban; eventbus
                              stays legal in demo mains / examples). See ADR
                              202606131500 (#1940).

Cell-level (used inside a cell's Init, not a composition root — listed so the rule's relationship to them is unambiguous, NOT as main-package guidance):

outbox.ResolveCellEmitter   — cell-level durable-vs-direct resolver
outbox.NewDirectCellEmitter — intended L4 direct-publish-by-design production

Rule semantic: raw noop sinks must route through the sealed demo funnels or wire real infra.

Non-redundant failure domain (contract-fanout) ¶

Three existing guards touch noop outbox; none scans main-package wiring:

• outbox.CheckNotNoop — RUNTIME, inside a cell's Init, durable mode only.
• OUTGUARD-01 — METADATA, over cell.yaml durabilityMode.
• CELL-L2-INIT-CHECKNOTNOOP-CALLED-01 — archtest over a CELL package's Init.

This rule's domain is the COMPOSITION-ROOT (main) package, statically, before any cell Init.

# AI-robust rating (charter §"Funnel 双向锁评级"), same shape as OUTBOX-RECONSTRUCTION-CALLER-01

• Downstream HARD. The reference is resolved via go/types (ResolvePackageRef over both SelectorExpr and dot-import bare *ast.Ident), so import alias, dot-import, and function-value forms all resolve to the same symbol — no "looks-like-but-isn't" gap. There is NO allowlist (unlike reconstruction): within the scanned main pkgs this is a PURE BAN — zero exemption surface, zero allowlist-rot. The anti-vacuity self-test (TestProdMainWiringNoopReject_AntiVacuity_CorebundleInScope) proves the workspace Production scan reaches the separate cmd/corebundle module, so a 0-files-scanned vacuous-green cannot pass as a clean dogfood (a downstream Medium→Soft regression guard).
• Upstream MEDIUM — permanent Go ceiling, NOT a deferred TODO. Go visibility cannot forbid a main package from calling a PUBLIC func/type; the five symbols MUST stay public (tests / demos / examples legitimately construct them). Sealing them is unreachable without breaking those callers. The consumer's ProductionMainPkgs declaration completeness is also consumer-side (same ceiling as BuildTags). Same permanent-ceiling family as #851/#893/#1282.
• Charter single-grade floor = Medium (weakest leg governs).

强制盲区自检 (reverse self-test backs each claim) ¶

• import alias — CAUGHT (go/types). Backed by red_aliasimport fixture.
• dot-import bare ident — CAUGHT (ast.Ident walk). Backed by red_dotimport.
• function value (`f := outbox.NewNoopEmitter`) — CAUGHT (reference walk, not call-only). Backed by the NewDirectEmitter function-value line in red_qualified.
• cross-package call-graph transitivity / factory wrapping — NOT CAUGHT: a main pkg that calls a helper in ANOTHER (non-scanned) package which constructs the sink is invisible to this callsite scan. Permanent Go-language ceiling (a callsite scan cannot follow arbitrary cross-package call graphs; same family as reconstruction's upstream Medium). Mitigation: the established wiring goes through composition.NewSharedDeps / the sealed funnels, and a durable assembly still trips runtime CheckNotNoop. Documented, not silently accepted.
• //go:build-tagged production files under a non-default tag — covered by the default + cfg.BuildTags double scan (scanner.Canonical dedups the overlap).

External Cell repo semantics ¶

Registered in StandardCellRules. Opt-in by declaration: an external repo lists its composition roots in cfg.ProductionMainPkgs; an empty slice means "do not scan composition roots" (mirrors BuildTags) — no false positives on a repo that has not opted in. The forbidden symbols live in GoCell's kernel/outbox, imported as a dependency, so the go/types resolution works identically in a consumer module.

Importable rule body for PROJECTION-APPLY-HOOK-FUNNEL-01. Migrated from the legacy _test.go form to a non-test .go (M3 #1302 / issue #1635) so external Cell repos can import and run it via StandardCellRules / RunStandardCellRules. The dogfood + RED/blind-spot reverse fixtures live in the non-test companion projection_apply_hook_funnel_test.go.

PROJECTION-APPLY-HOOK-FUNNEL-01 ¶

kernel/projection.Coordinator.Subscribe registers an Apply hook with the cell.Registrar (it calls reg.Subscribe internally). This is the per-projection wiring callsite; it must only appear in:

• kernel/projection/ itself (the method body calls reg.Subscribe internally)
• _test.go files (tests of the Coordinator API — explicitly allowed)
• the single sanctioned bootstrap projection drain file runtime/bootstrap/phases_projection.go — the ONE place that constructs a Coordinator from framework-owned deps and drives Coordinator.Subscribe.

Relocation (PR-04a, Option A — ADR §7 amendment 2026-05-31): the sanctioned callsite moved from the cellgen-generated cell_gen.go to the bootstrap drain. Reason: Coordinator.Subscribe must be fed framework-owned raw infrastructure (CheckpointStore / TxRunner / Cursor / ReplaySource), which cell code may never hold (sealed-marker architecture). So cellgen emits the record-only reg.RegisterProjection (guarded by PROJECTION-REGISTER-FUNNEL-01) into cell_gen.go, and bootstrap — which legally holds the raw deps — constructs the Coordinator and calls Subscribe. The Subscribe terminal is now a single hand-written kernel/runtime file under tight review, a TIGHTER sanctioned set than "any cell_gen.go".

Any other production callsite bypasses the drain funnel and constitutes a hand-rolled wiring that diverges from the single source of truth.

PR-04a status: genuinely-green active guard (NOT t.Skip). The only production callsite is runtime/bootstrap/phases_projection.go; any other fires.

External Cell repo semantics (this rule is registered in StandardCellRules) ¶

The sanctioned bootstrap drain (runtime/bootstrap/phases_projection.go) lives in the GoCell platform module, NOT in a consumer repo. The production-file exemptions are bound to platform package identity (isProjectionApplyHookAllowed → isGoCellPlatformPkgPath), so a consumer module CANNOT claim them by forging the kernel/projection/… or drain rel path — its package path is not under PlatformModulePath. The rule therefore degrades to a PURE BAN for external Cell repos: any Coordinator.Subscribe call in consumer code fires immediately. That is the intended semantics — consumers must declare projections via reg.RegisterProjection (cellgen-generated from slice.yaml) and never wire the Coordinator directly. A clean external repo has zero Coordinator.Subscribe calls (vacuous-green).

AI-robust grading (Funnel 双向锁评级) ¶

• Downstream: Medium archtest caller allowlist. Go has no type-system mechanism to restrict who calls a public method (Go visibility applies to packages, not callers), so this is the strongest achievable form for a method-call restriction. Archtest enforcement is CI fail-closed. The sanctioned set is a single named file, tighter than the prior "any cell_gen.go".
• Upstream: Medium — and permanently so (won't-do, gh #1372). A "cellgen-only sealed token" that would make a hand-written Subscribe call uncompilable is NOT expressible in Go: cellgen emits this call into the cell's OWN package (cell_gen.go sits beside the hand-written cell.go), and Go has no compile-time identity for "generated code". Any token constructor the generated file can call, a hand-written sibling in the same package can call too. Same permanent Go-language ceiling as Subscribe / RegisterWebhookReceiver and the holder-seal family #851 / #893 / #1282.

Because both sides are Medium and the upstream side cannot be Hard-ized, this is NOT a closed-loop Hard funnel and will not become one (gh #1372 closed won't-do). The raw-infra-stays-in-bootstrap property IS Hard (type system): cells hold sealed markers, never the CheckpointStore/TxRunner constructed in the drain — that is what makes Option A sound vs emitting NewCoordinator into generated cell code.

Blind spots (forms *types.Info / ResolveMethodCall cannot see) ¶

• B1. Function-value / method-expression indirection: `f := coord.Subscribe; f(ctx, spec, id, apply)` — the CallExpr's Fun is an *ast.Ident resolving to a *types.Var, not a *types.Func, so ResolveMethodCall returns (nil, false) and the call is invisible to R1. Reverse self-check TestProjectionApplyHookFunnel01_ReverseBlindSpot_NoFuncValue asserts no production code holds a Coordinator.Subscribe function value.

• B2. Wrapper method indirection: a wrapper struct that embeds *Coordinator and calls Subscribe inside its own method body — the wrapper's callsite IS caught (it's a direct method call on the embedded receiver), but the wrapper struct itself could be in a non-allowlisted package. Covered by the regular rule scan; not a blind spot.

• B3. Dot-import: `import . "…/projection"` — ResolveMethodCall handles dot-import via *types.Info.Uses, so this form is caught. Not a blind spot.

ref: tools/archtest/healthz_invariants_test.go (HEALTHZ-WRITE-01/A2 caller-allowlist pattern) ref: docs/architecture/202605261620-adr-cqrs-projection-lifecycle-harness.md §3 PR-01

Package archtest resolve.go — façade helper re-exports for business archtest rules.

This file completes the façade contract: after Stage 1.5, all business archtest *_test.go files need only import "…/tools/archtest" — zero direct imports of internal/scanner, internal/typeseval, or x/tools/go/packages.

Deliberately excluded: loader symbols ¶

The six loader symbols (LoadPackages, SharedResolver, LoadProductionPackages, Resolver, ProductionResolver, EachFileInPackage) are intentionally NOT re-exported here. They are reachable only via archtest.Run with a typed scope (Run(t, Typed(...)) / Production(...) / Fixture(...) / StandaloneModule(...)), which wraps the SharedResolver cache and constructs a *Pass with *types.Package (not *packages.Package). This is the Hard defensive layer described in docs/architecture/202605141519-adr-archtest-pass-funnel.md: a business *_test.go that receives a *Pass cannot reach .Syntax or reconstruct a fresh packages.Load, so the INV-1 bug class (pairing AST nodes from one load with a *types.Info from a different load) is inexpressible at the compiler level.

Why helper re-exports are necessary (D2 rationale) ¶

Business archtest rules frequently need to:

• resolve a SelectorExpr / Ident to its (pkgPath, symbolName) pair across qualified / alias / dot-import forms — ResolvePackageRef;
• identify the *types.Func a method call resolves to — ResolveMethodCall;
• evaluate a cross-package constant string — EvaluateConstString;
• enumerate build-tag groups for multi-tag SharedResolver loops — FlatNonDefaultTags / KnownNonDefaultTags;
• extract a file's build constraint expression for 3-way evaluation under custom tag sets — ParseBuildConstraint.

Generated-path detection is NOT a free re-export: use the Pass.IsGenerated(f) method (#1037 removed the IsGeneratedRelPath free function).

Hand-rolling these patterns via raw go/types in each rule is error-prone (missed dot-import bare-Ident path, missed alias form, missed untyped const folding). The façade re-exports ensure all rules use the same INV-1-safe implementations that have been tested against the three import shapes in typeseval's own test suite.

PASS-FUNNEL-RESOLVE-01 (enforcement) ¶

The meta-archtest PASS-FUNNEL-RESOLVE-01 in pass_funnel_test.go bans business *_test.go files from calling the nine typeseval helpers or scanner.ImportBan directly. Files in passFunnelPermanentExempt (3 framework files) are permanently exempt; LegacyAllowlist deleted in Stage 4.

INVARIANT: RMQ-CHANNEL-DESTRUCTION-VIA-CONN-01

• INVARIANT: RMQ-CHANNEL-MAX-PER-CONN-01
• INVARIANT: RMQ-PUBLISHER-FAILURE-HANDLING-01
• INVARIANT: RMQ-PUBLISHER-RELEASES-CHANNEL-01
• INVARIANT: RMQ-STOPINTAKE-INFLIGHT-WAIT-01

rmq_invariants.go — importable RabbitMQ adapter rule logic.

This is the non-test home of the RMQ-* scanner helpers so they can be compiled by external Cell repositories through the CellRule pattern (Go never compiles a dependency's _test.go, so rule logic that external repos must run cannot live in a _test.go file). GoCell's own TestRMQ* functions (rmq_invariants_test.go) call the same shared helpers — single source, no parallel rule body.

register=no — gocell-internal-layout (scans adapters/rabbitmq), NOT in StandardCellRules() and NOT promised to run externally — these dogfood-only rules target a package an external repo lacks; migrated for unified PlatformModulePath parameterization + fork-safety, dogfooded via the per-rule Tests.

Platform-symbol paths are anchored to PlatformModulePath so a module rename updates exactly one place and no bare literal appears here. The scan SCOPE (./adapters/rabbitmq/...) is the running module's own adapter package; this is intentionally gocell-internal-layout and dogfood-only — in an external repo with no such adapter tree the rule does not get a clean pass.

RMQ-CHANNEL-DESTRUCTION-VIA-CONN-01 ¶

Enforces that every AMQPChannel destruction site in adapters/rabbitmq/ goes through Connection.CloseEphemeralChannel. Direct ch.Close() calls outside of CloseEphemeralChannel or waitAndClose bypass the inUseChannels.Add(-1) decrement and permanently leak MaxChannelsPerConn slots, causing spurious ERR_ADAPTER_AMQP_CHANNEL_MAX_EXCEEDED false-positives after enough reconnect cycles or subscription teardowns.

AI-robust grading:

• Downstream: Medium — go/types receiver classification via types.Implements; naming-immune (renaming the receiver var does not weaken the gate); allowlisted funcs are string-name matched (Soft residual — renaming CloseEphemeralChannel bypasses without scanner update; tracked as known blind spot: function-name allowlist is not type-qualified).
• Upstream: N/A — this is a single-package restriction rule, not a funnel-type constraint.

RMQ-CHANNEL-MAX-PER-CONN-01 ¶

Enforces that adapters/rabbitmq.Config declares MaxChannelsPerConn with a setDefaults guard (`<= 0`) and AcquireChannel references the inUseChannels counter. Without the cap, pool-miss paths can silently exceed broker channel_max and cause a connection-level shutdown.

AI-robust grading (all sub-rules: A/B/C):

• Medium — pure AST struct-field and selector scan; not type-qualified. Hard upgrade path: generate a typed golden that locks the Config struct field presence and setDefaults assignment form.

RMQ-PUBLISHER-FAILURE-HANDLING-01 ¶

Enforces that Publisher.Publish in adapters/rabbitmq/publisher.go:

• references ErrAdapterAMQPNack (distinct from ErrAdapterAMQPConfirmTimeout)
• calls slog.Warn at least 3 times (NACK / timeout / confirmCh-closed)
• calls RecordPublishFailure at least once
• pairs every error-returning if-block with a RecordPublishFailure call

AI-robust grading:

• Medium — AST identifier and call-expression scan; string-name matching (renaming slog.Warn or RecordPublishFailure bypasses without scanner update). The -D sub-rule (AllReturnsMustRecord) uses a block-recursive walker that covers ForStmt / RangeStmt / SwitchStmt / TypeSwitchStmt / SelectStmt containers (Wave 4 extension). Blind spot: the string-name gate means a renamed callee bypasses silently (documented in RED fixture).

RMQ-PUBLISHER-RELEASES-CHANNEL-01 ¶

Enforces that Publisher.Publish acquires a channel via AcquireChannel and pairs it with a deferred CloseEphemeralChannel or ReleaseChannel call. Without this pairing, each Publish leaks one inUseChannels slot; after MaxChannelsPerConn (=256) publishes all subsequent calls fail with ErrAdapterAMQPChannelMaxExceeded.

AI-robust grading:

• Medium — AST DeferStmt + SelectorExpr name scan; not type-qualified.

RMQ-STOPINTAKE-INFLIGHT-WAIT-01 ¶

Enforces that Subscriber.StopIntake waits for in-flight processDelivery goroutines before returning, and that drainRemaining uses a detached context (context.WithoutCancel) with no bare ctx.Done case. Also enforces that StopIntake does NOT call localWg.Wait() directly (Add-after-Wait race).

AI-robust grading:

• Medium — AST call-expression and CommClause name scan; not type-qualified.

Importable rule body for SCAFFOLD-DERIVED-FORCEOVERWRITE-01. Migrated from the legacy _test.go form to a non-test .go (M3 #1302) so external Cell repos can import and run it via StandardCellRules / RunStandardCellRules. The dogfood + RED-fixture precision gate live in scaffold_derived_forceoverwrite_test.go.

SCAFFOLD-DERIVED-FORCEOVERWRITE-01 ¶

Every production reference to pathsafe.DerivedOverwrite must occur inside tools/codegen/cellgen/stage_render.go::planDerivedArtifact — the sole site that restores the governance.IsGoCellGenerated overwrite gate. planDerivedArtifact is the SOLE production caller of the typed pathsafe.DerivedOverwrite constructor in the entire repository.

AI-robust: Hard (compile-time + archtest funnel) ¶

• Upstream Hard (compile-time): pkg/pathsafe.PlannedFile.forceOverwrite is package-private and the only public path that produces a force-overwrite PlannedFile is pathsafe.DerivedOverwrite. A composite literal outside the pathsafe package cannot set forceOverwrite — the Go compiler rejects the field-name reference (PATHSAFE-FORCEOVERWRITE-TYPED-CTOR-01).
• Downstream Hard (archtest): every CallExpr that resolves via *types.Info to pkg/pathsafe.DerivedOverwrite in any production package must occur inside planDerivedArtifact. Tests are excluded so fixture code can still exercise DerivedOverwrite directly.

Recognition: type-aware (Ident + SelectorExpr unified) ¶

pathsafe.DerivedOverwrite(...) parses as *ast.SelectorExpr whose .Sel is the function name; alias imports keep the same shape. Dot-import collapses to a bare *ast.Ident. Both are resolved through *types.Info.Uses to the underlying *types.Func by resolveDerivedOverwriteIdent.

Blind spots (declared per ai-robust §载体决策原则) ¶

1. Indirect call through a function-typed variable: covered by the reverse scan (derivedIndirectViolations) which rejects any non-CallExpr reference.
2. A future caller written as a direct CallExpr could pass the type check but produce content that bypasses the upstream governance gate planDerivedArtifact runs — the archtest accepts planDerivedArtifact as the trusted gatekeeper.

Scan scope is the running module (Production → findModuleRoot), supplied by the driver; cfg.BuildTags adds tag-gated production files. The platform symbol path is derived from PlatformModulePath (ARCHTEST-MODULE-PATH-FUNNEL-01).

Importable rule body for SCAFFOLD-LISTENER-MARKER-TYPED-CONST-01. Migrated from the deleted scaffold_bundle_invariants_test.go (M3 #1302). The dogfood + template precision gate live in scaffold_listener_marker_invariants_test.go.

SCAFFOLD-LISTENER-MARKER-TYPED-CONST-01 ¶

cellgen.ListenerMarker must exist as an exported string const carrying the canonical K#05 marker literal, and the scaffold-cell template must reference it via {{.ListenerMarker}} rather than hand-typing the literal. This keeps the marker→cell.yaml drift guard (MARKERGEN-DRIFT-VERIFY-01) anchored to a single typed-const source instead of a free-floating string.

AI-robust: Medium (typed const + typeseval cross-validation) ¶

The const half resolves cellgen.ListenerMarker via the typed Run façade and compares its constant.StringVal; the template half is a pure string check (checkListenerTemplate) that the precision gate table-tests directly.

Scope: gocell-internal-layout ¶

It scans the platform's own tools/codegen/cellgen package + the templates/scaffold-cell.tmpl asset, neither of which exists in an external Cell repo — so it is NOT enrolled in StandardCellRules (it would be vacuous-green there). It gets the unified PlatformModulePath parameterization (ARCHTEST-MODULE-PATH-FUNNEL-01) + fork-safety only.

Package archtest is the single-entry façade for GoCell architectural tests. Authors write rules as Rule closures and dispatch them through the single Run entry point, selecting the mode with a sealed RunScope constructor: AST (AST-only, no go/types), Typed (with go/types info), Production (typed, generated/ excluded), Fixture (typed, archtest_fixture-tagged), or StandaloneModule (typed, standalone fixture module). Direct access to the underlying internal/scanner and internal/typeseval primitives is forbidden by the PASS-FUNNEL-* meta-archtest and the depguard archtest-no-direct-packages-load rule.

Hard-line defense layering:

1. Pass.Pkg is *types.Package (go/types stdlib), NOT *packages.Package (golang.org/x/tools/go/packages). Authors that receive a *Pass cannot reach .Syntax + an out-of-scope *types.Info pair — the INV-1 root cause class becomes inexpressible at the compile level.
2. depguard rule archtest-no-direct-packages-load bans tools/archtest/*_test.go from importing packages, internal/scanner, internal/typeseval.
3. Meta-archtest PASS-FUNNEL-EACHFILE-01 / LOADPACKAGES-01 / PACKAGES-IMPORT-01 re-detect any bypass via type-aware *types.Info resolution.

See docs/architecture/202605141519-adr-archtest-pass-funnel.md for the full rationale and migration path.

test_polling_external_reason_literal.go — importable TEST-POLLING-EXTERNAL-REASON-LITERAL-01 rule logic (#1640 M3 PR-9).

Non-test home for TEST-POLLING-EXTERNAL-REASON-LITERAL-01 scanner logic, so it can be compiled and run by an external Cell repository.

Dogfooded by tools/archtest/test_polling_external_reason_literal_test.go:

TestExternalReasonLiteral → Report(t, "TEST-POLLING-EXTERNAL-REASON-LITERAL-01", CheckTestwaitExternalReasonLiteral(...))

Register status ¶

Not registered in StandardCellRules: this rule's scan scope (testwait package) is gocell-internal layout specific with no ConfigForExternalCell consumer-extension → vacuous/false-red externally.

Importable rule body for TLS-TEST-MATERIAL-FUNNEL-01. Non-test .go file so the dogfood + RED-fixture precision gate (tls_test_material_funnel_test.go) share a single scanner — no parallel rule body. The sanctioned set is matched by workspace-relative directory prefix (not import path), which is robust against go/packages test-variant path mangling (foo / foo_test / foo.test) and needs no module-path literal.

TLS-TEST-MATERIAL-FUNNEL-01 ¶

crypto/x509.CreateCertificate — the act of minting an X.509 certificate — may only be called from a closed set of sanctioned packages:

• framework/runtime/http/tlsutil/tlsutiltest — the single sanctioned source of self-signed mTLS cert material for tests (issue #2287). Before it, 9 near-equivalent cert-gen helpers (8 "self-signed CA + cell leaf" chains + 1 CA-only pool fixture) were copy-pasted across the test tree (the mqtt copy even carried a "Ported from adapters/grpc/cert_test.go" comment). cert-gen detail — curve, validity, EKU, SAN — is sensitive to mTLS correctness, so a bug in one copy is invisible to the others; centralizing the mint makes the shape a single source and this funnel keeps it centralized.
• framework/runtime/certsigning/request_test.go, framework/runtime/certlifecycle/testsupport_test.go — the CSR→certificate issuance pipeline tests. They fabricate certificates as system-under-test INPUT (the cert is what the signing/lifecycle code consumes), not reusable cell-identity fixtures, so routing them through tlsutiltest would be circular. These are sanctioned as EXACT FILES (not whole package): the production code in those packages does not mint, so a whole-package allowlist would fail-open a future production CreateCertificate (#2414 F1).
• adapters/softca — the production soft-CA implementation. It is the real certificate authority (not test material); the scan covers production packages too, so it is allowlisted here.

Every other caller — production or test — is a violation.

AI-robust: Medium (downstream type-aware scan; no Hard ceiling) ¶

This is a Medium funnel, NOT Hard, and there is no low-cost Hard path: crypto/x509.CreateCertificate is a stdlib free function, so there is no sealed type or unexported field that could make an unsanctioned call unrepresentable at compile time (contrast CELLTLS-MATERIAL-FUNNEL-01, whose upstream is Hard because tlsutil.ClientIdentity is sealed). The downstream scan is type-aware: ResolvePackageRef resolves each callee to its owning package via go/types, so import aliases (x509alias.CreateCertificate) do not defeat it.

Not registered in StandardCellRules: the sanctioned packages are GoCell- internal; an external Cell repo has no such files, so the allowlist would never match and the rule would degrade to a pure ban that false-reds any repo legitimately minting test certs from its own helper. Same disposition as CELLTLS-MATERIAL-FUNNEL-01.

Scope ¶

Scanned via Production(Tests:true) under both the default build context and FlatNonDefaultTags() (so integration / mqtt_tls-gated test files are covered), union-deduped. generated/ is excluded by Production; the archtest_fixture tag is deliberately absent from FlatNonDefaultTags (#944), so the RED fixture is never compiled into the dogfood.

CI lane (nightly-only, like CELLTLS-MATERIAL-FUNNEL-01) ¶

This rule runs Production(Tests:true) + FlatNonDefaultTags() — a heavy whole-tree packages.Load (two passes) — so it belongs to the nightly archtest bucket (verify-archtest.sh / `go test -tags=archtest ./tools/archtest/...`), NOT the cheap PR-time fast lane (hack/verify-archtest-invariants.sh, reserved for non-packages.Load invariants). Same disposition + cost class as CELLTLS-MATERIAL-FUNNEL-01.

Blind spots (BS) ¶

• BS-1 Reverse build constraints (//go:build !tag): files excluded from a -tags=...,tag,... union load are not scanned. No such cert-gen file exists today; the nil-tags companion pass covers the default context.
• BS-2 CreateCertificateRequest (CSR creation) is intentionally NOT banned — it is a distinct concern used legitimately by the pipeline tests and is not cell mTLS cert material.
• BS-3 Function-value indirection (var f = x509.CreateCertificate; f(...)) resolves to *types.Var (ok=false) and is not flagged. Accepted: no sanctioned or migrated caller does this.
• BS-4 Reflection construction: out of scope per ai-robust.md §3.
• BS-5 Rel-prefix coupling: tlsTestMaterialSanctionedDirs matches Pass.Rel's framework-stripped, module-relative form (runtime/… for the framework module, <module>/… otherwise). If newPackageRel / stripFrameworkPrefix changes, this list AND TestIsTLSTestMaterialSanctioned (which feeds pre-stripped literals) must be updated together. A strip-behavior change would silently false-RED (a sanctioned caller stops matching) — fail-safe, not fail-open, so it surfaces as CI red rather than a missed violation.

INVARIANT: WEBHOOK-HMAC-FUNNEL-01

webhook_hmac_funnel.go — importable webhook HMAC signing funnel rule logic.

WEBHOOK-HMAC-FUNNEL-01 — kernel/webhook HMAC signing funnel (KERNEL-WEBHOOK-01).

• A1 (downstream Hard): crypto/hmac.New has exactly one callsite in the kernel/webhook package — the computeMAC function. The check is FUNCTION-IDENTITY level via go/types FullName (file-independent; #1493): an hmac.New whose enclosing func FullName != computeMAC's fails, and a same-named function in another package cannot inherit the allowance (mirrors WEBHOOK-SSRF-GUARD-01/A2). Detection: ResolvePackageRef(callee) == crypto/hmac.New AND ResolveEnclosingFunc(call).FullName() != hmacSanctionedComputeMACFunc.
• A2 (downstream Hard): signature comparison must use crypto/hmac.Equal or crypto/subtle.ConstantTimeCompare. The non-constant-time comparison callees bytes.Equal / bytes.Compare / slices.Equal / reflect.DeepEqual are banned in the package. This makes the constant-time invariant an AST lock rather than a flaky timing test. Detection: ResolvePackageRef(callee) ∈ the banned set.
• A3 (upstream Hard external / Medium internal): the Signer and Verifier interfaces each carry an unexported sealed() marker method, so package-external implementations are a compile error (Hard external). Package-internal new holders are NOT blocked by sealing — and contrary to a prior overclaim, A1 does NOT transitively cover them: A1 locks only crypto/hmac.New, not reuse of the package-level computeMAC helper, so a rogue in-package struct could call computeMAC and produce a valid signature without its own hmac.New. That internal axis is instead covered by A4 (computeMAC caller-allowlist, Medium). True type-system Hard for the internal axis is a PERMANENT Go ceiling (in-package code can always declare sealed(), read Source.secret, and call computeMAC) — same family as #851 / #893 / #1282 / #1375; #1243 is relabeled won't-do and named here as that ceiling's tracker. Detection: the Signer/Verifier interface type decls must contain an unexported method.
• A4 (Medium, internal axis; #1243): every USE of the package-internal computeMAC symbol — direct call, parenthesized call, OR function-value capture (`macFn := computeMAC`; the bypass review #1733 F4 flagged) — must have an enclosing func whose go/types FullName ∈ {hmacSigner.Sign, hmacVerifier.Verify}. This is the actual enforcement of "only the sanctioned signer/verifier may compute a MAC", closing the A3 internal axis at Medium (Hard is the permanent ceiling above). Detection: walk every ident, match info.Uses FullName == computeMAC's, require enclosing FullName ∈ allowlist (the computeMAC definition is in info.Defs, not info.Uses, so it never fires).

Blind spots (ai-robust 强制反向自检; each has a reverse self-test in the _test.go):

B-A1/A2 — rule-logic regression: a reverse fixture module
  (testdata/webhook_hmac_violate) calls hmac.New outside computeMAC (both
  outside signer.go and inside signer.go in a non-computeMAC func) and the
  banned comparison callees; TestWebhookHMACFunnel_ReverseFixture asserts A1/A2
  fire on each form.
B-A4 — rule-logic regression (computeMAC is unexported, so no standalone-module
  RED fixture can call it): TestWebhookHMACFunnel_ComputeMACCallerAntiVacuity
  re-runs the A4 scan over real production with an EMPTY allowlist and asserts it
  fires on the ≥2 real computeMAC callers (Sign + Verify) — proving the scan
  detects computeMAC calls and the allowlist is what suppresses them (non-vacuous).
B6 — Source.Secret leak: slog of the raw unexported secret field would leak
  it (Source.LogValue + slog.LogValuer covers slog.Any of a whole Source, but
  not slog of src.secret directly). scanWebhookSecretSlog covers BOTH the
  package-function form (slog.Info(...)) and the method form
  (logger.Info(...)). TestWebhookFunnel_NoRawSecretSlog asserts no such call in
  the package references a `.secret` selector.
B7 — non-AST-detectable constant-time bypass: comparing the base64 signature
  STRINGS with `==` (e.g. expectedB64 == presentedB64) is non-constant-time but
  is a plain *ast.BinaryExpr with no resolvable callee, so the A2 callee scan
  cannot see it. Detecting it would need type-level data-flow analysis. Bounded
  response: production matchAnySignature compares raw MAC bytes via hmac.Equal
  (A2-clean), and this blind spot is documented here so a future reviewer knows
  the AST scan does not cover string-`==`.

This is the non-test home of the WEBHOOK-HMAC-FUNNEL-01 scanner helpers so they can be compiled by external Cell repositories through the CellRule pattern (Go never compiles a dependency's _test.go, so rule logic that external repos must run cannot live in a _test.go file). GoCell's own TestWebhookHMACFunnel function (webhook_hmac_funnel_test.go) calls the same shared helpers — single source, no parallel rule body.

register=no — gocell-internal-layout (scans kernel/webhook), NOT in StandardCellRules() and NOT promised to run externally — this dogfood-only rule targets a package an external repo lacks, so a manual ExtraRules caller does not get a clean pass; migrated for unified PlatformModulePath parameterization + fork-safety, dogfooded via TestWebhookHMACFunnel).

Platform-symbol paths are anchored to PlatformModulePath so a module rename updates exactly one place and no bare literal appears here.

ref: docs/architecture/202605291200-adr-webhook-signing-algorithm.md ref: tools/archtest/healthz_invariants_test.go (callsite-allowlist template)