Epic: Harden the strict structural-signature test suite (non-extraction-pillar rules) per language

[squid-protocol]

Why

This epic is a #518-lineage follow-on addressing structural test rigor gaps found in a fresh audit (2026-08-05) of the 45 tests/extraction/languages/test_<lang>_strict.py files against their corresponding LANGUAGE_DEFINITIONS rules in gitgalaxy/standards/language_standards.py.

Epic #518 (closed 2026-08-01) established the per-language _strict.py test suite for all non-None structural signatures — but that audit followed a premise that only 6 languages had prior coverage, and coverage depth was checked at suite-completion time only, not against a rigor baseline.

Epic #813 (closed 2026-08-03) hardened the four extraction gauntlets (func_start/args/class_start/_dependency_capture) using an explicit valid/invalid/pathological three-tier methodology with strong depth requirements (10-15+ cases per rule). The founding audit rejected as "dangerously sparse" the prior state: "2-3 cases per tier, 1 pathological case" — the same rigor bar was never applied retroactively to this epic's sibling _strict.py suite.

A read-only re-audit (2026-08-05) found five systematic gaps in the non-extraction-pillar structural signatures:

1. Zero-ReDoS gap: 6 languages (haskell, kotlin, lua, ruby, scala, swift) have literally zero assert_redos_immune(...) calls anywhere in their _strict.py files.
2. Single-timeout vs. scaling-ratio rigor: 37 of 45 languages rely solely on the weaker assert_redos_immune (single payload, single 1.0s timeout) rather than _best_of_timing (geometric-growth scaling-ratio method — the actual methodology how_to_add_a_language.md's Strict Testing Prompt mandates for Rule 14 adjacent-quantifier-overlap detection).
3. Missing signature coverage, especially AI/ML pack: python is missing 19 signatures including its entire AI/ML extension pack (llm_api, llm_orchestrator, llm_vector_store, dl_frameworks, etc.), javascript 16 (same AI/ML pack), and others.
4. Ghost-prevention gap (negative-case testing): 17 of 45 languages have >70% of their _SIMPLE_CASES paired with None (zero false-positive testing), mirroring exactly the "invalid — Ghost Prevention" tier gap epic Epic: Harden the four extraction gauntlets (function/args/class/dependency) per language #813 found and fixed in the sibling extraction pillars.
5. Single-case-per-signature depth: almost every language has exactly one case per signature key — none approach the 10-15+ case depth the extraction gauntlets now require.

Scope

This epic covers ONLY the non-extraction-pillar _strict.py test files — do NOT conflate with #813's extraction-gauntlet work (func_start/args/class_start/_dependency_capture are #813's domain). The rules in scope here are: branch, io, safety_bypasses, cryptography, hardcoded_secrets, regex_execution, serialization_parsing, time_date_logic, ipc_rpc_bridges, api, bitwise_ops, closures, comprehensions, encapsulation, exfiltration_camouflage, hardware_bridge, import, lazy_evaluation, llm_api, llm_orchestrator, llm_vector_store, memory_scraping, ml_traditional, structural_boundaries, test, vectorized_math, and others not in the extraction-pillar set.

Reference docs

• gitgalaxy/standards/how_to_add_a_language.md — the canonical spec for structural signature semantics and the full recurring-bug-class checklist (16 numbered engine rules).
• tests/extraction/how_to_harden_extraction.md — the extraction-gauntlet methodology epic Epic: Harden the four extraction gauntlets (function/args/class/dependency) per language #813 established; this epic borrows its three-tier valid/invalid/pathological template.
• tests/extraction/languages/_strict_harness.py — shared ReDoS-testing helpers: assert_redos_immune (weak, single-timeout) and _best_of_timing (strong, scaling-ratio).

Sub-issues

• Add ReDoS regression tests for 6 languages with zero current coverage (haskell, kotlin, lua, ruby, scala, swift) #1070 — Add ReDoS regression tests for 6 languages with zero current coverage (haskell, kotlin, lua, ruby, scala, swift)
• Migrate single-timeout ReDoS checks to scaling-ratio methodology across 37 languages #1071 — Migrate single-timeout ReDoS checks to scaling-ratio methodology across remaining 37 languages
• Close missing-signature-case gaps, prioritizing Python/JavaScript AI/ML extension pack #1072 — Close missing-signature-case gaps, prioritizing Python/JavaScript AI/ML extension pack
• Add ghost-prevention (negative-case) coverage for 17 languages with >70% None in test cases #1073 — Add ghost-prevention (negative-case) coverage for 17 languages with >70% None in test cases
• [Good First Issue] Deepen per-signature case counts beyond current ~1-pair floor (stretch/lower-priority) #1074 — (Good First Issue) Deepen per-signature case counts beyond current ~1-pair floor (stretch/lower-priority)

Related epics:

• Epic: Strict & exact regex test coverage for all structural signatures, per language #518 — Epic: Strict & exact regex test coverage for all structural signatures, per language (CLOSED 2026-08-01)
• Epic: Harden the four extraction gauntlets (function/args/class/dependency) per language #813 — Epic: Harden the four extraction gauntlets... per language (CLOSED 2026-08-03)

Resolution

All 5 sub-issues closed 2026-08-05/06:

• Add ReDoS regression tests for 6 languages with zero current coverage (haskell, kotlin, lua, ruby, scala, swift) #1070 (zero-ReDoS gap, 6 languages) — PR test(extraction): add ReDoS regression coverage for 6 zero-coverage languages #1077. Added assert_redos_immune coverage for haskell/kotlin/lua/ruby/scala/swift; all 6 languages' riskiest quantifier shapes diagnosed clean, no real regex bugs found, just missing test pins.
• Migrate single-timeout ReDoS checks to scaling-ratio methodology across 37 languages #1071 (single-timeout vs. scaling-ratio ReDoS rigor, 37 languages) — PR test(extraction): add geometric redos sweeping tool to verify strict rules (#1071) #1083 (sweep_redos_scaling.py, a geometric-sweep diagnostic tool per _best_of_timing's methodology). Per the doc's corrected framing, this ran a diagnostic sweep across all 37 rather than mechanically rewriting every passing test — most came back clean; the tool itself is now the permanent artifact for future scaling-ratio checks.
• Close missing-signature-case gaps, prioritizing Python/JavaScript AI/ML extension pack #1072 (missing signature-case coverage, esp. AI/ML pack) — PR test(extraction): close missing signature-case gaps, python/js AI/ML pack first #1079. Closed all missing_case_entirely gaps, prioritizing python/javascript's llm_api/llm_orchestrator/cryptography/rce_funnel/etc. extension pack, plus haskell/objective-c/solidity/yaml.
• Add ghost-prevention (negative-case) coverage for 17 languages with >70% None in test cases #1073 (ghost-prevention/negative-case coverage, 17 languages >70% None) — PR test(extraction): close ghost-prevention negative-case gaps (#1073) #1081. Every flagged signature now has a verified structural-lookalike negative case.
• [Good First Issue] Deepen per-signature case counts beyond current ~1-pair floor (stretch/lower-priority) #1074 (deepen per-signature case depth, stretch goal) — PR test(extraction): deepen strict structural-signature coverage across all languages (#1074) #1087. Multi-case adversarial matrices across all 45 languages; verified against the golden-master corpus (6,046 field-level corrections across 92 repos — see the Resolution section on [Good First Issue] Deepen per-signature case counts beyond current ~1-pair floor (stretch/lower-priority) #1074 for the full breakdown), confirming this surfaced real regex bugs (Swift throws, PowerShell hidden/static, Lua generics, a couple of ReDoS bounds on closures/lambdas), not just added test volume.

tests/extraction/how_to_harden_strict_signatures.md and the audit_strict_coverage.py / verify_candidates.py / redos_scaling_check.py tooling built for this epic (PR #1075) remain checked in for the next language or bug-class sweep.

[squid-protocol]

Sub-issue #1071 (ReDoS geometric scaling coverage) has been fully resolved and closed via PR #1083. We committed the global diagnostic tool to permanently document the safety proof in the codebase.

[squid-protocol]

All 5 sub-issues (#1070-#1074) closed — see the Resolution section added to the issue description for per-sub-issue PR links and the #1074 golden-master impact summary. Epic complete.