lint

Documentation

Overview

Package lint hosts the repo-level import-lint guard for the core/ tree.

The product runtime — everything under core/ that ships in the mallcop binary — must depend on NO agent-orchestration framework. The model is reached only through the hand-rolled anthropic.Client interface in core/agent, threaded in by the caller; the core packages themselves must not import a campfire transport, the legion automaton engine, a Claude Code / agent-orchestration framework, or a vendor LLM SDK.

This package contains no production code — only imports_test.go, which walks every production .go file under core/ and fails the build if any of them imports a banned family. It exists as its own package so the test can reach the whole core/ subtree (located by walking up to go.mod) rather than a single package directory, the way the per-package imports_test.go files do.

Index

• func ModulePath(repoRoot string) (string, error)
• type Violation
  • func CheckAuthoredDetectorTree(repoRoot, modulePath, authoredRel string) ([]Violation, error)

Functions

func ModulePath

func ModulePath(repoRoot string) (string, error)

ModulePath parses the module path from repoRoot/go.mod. Callers of CheckAuthoredDetectorTree use it so MODULE is always the real module identity, never a hardcoded guess.

Types

type Violation

type Violation struct {
	// File is the repo-root-relative (slash-separated) path of the file that
	// literally contains the offending import.
	File string
	// Import is the offending import path as written in the source.
	Import string
	// Reason explains which rule the import broke.
	Reason string
	// Via names the smuggling path for a TRANSITIVE hit: the root authored
	// file that was being checked, followed by each in-module authored-helper
	// import traversed to reach File. Nil for a direct hit in the root file
	// itself.
	Via []string
}

Violation is one illegal import found in the authored detector tree.

func CheckAuthoredDetectorTree

func CheckAuthoredDetectorTree(repoRoot, modulePath, authoredRel string) ([]Violation, error)

CheckAuthoredDetectorTree walks every non-test .go file under repoRoot/authoredRel and returns a Violation for each import that is not on the allow list. modulePath is the module identity from go.mod (see ModulePath); authoredRel is the repo-relative authored tree root (canonical: "core/detect/authored").

Classification, per import path p:

• exact allowedStdlib match -> OK
• exact framework surface match -> OK, TERMINAL (no recursion)
• in-module under MODULE/authoredRel -> authored helper: resolve to its directory and check it transitively (visited set breaks cycles), so a helper cannot smuggle contraband for its importers
• any OTHER in-module path -> Violation (e.g. MODULE/core/agent)
• anything else -> Violation (os, net/http, unsafe, "C", third-party, ...)

If the authored root does not exist the walk error (wrapping fs.ErrNotExist) is returned; callers that treat an empty authored tree as trivially green check for that.