feat(af02): add deterministic surface scanner

[TheHalfMoon]

AF-02 Stack A0 — T012 scanner infrastructure

Stack predecessor:

PR #58 head: 61cb152ae4284b2ac78991ea843b180027bdbf25
base branch: feat/af02-a0-authority-reconstruction
candidate head: ee0da6a789a19f2f0d289e672653e9cbd463e0c5

This is a stacked A0 infrastructure candidate. It does not alter surface-policy.json, does not commit source-universe/finding evidence, and does not claim T013.

T012 implementation

• add exact syn = 3.0.3 with full and visit, matching the planning-frozen syn-af02-scanner identity;
• add tools/af02-verifier/src/surface.rs as the planned SURFACE_SCANNER / SURFACE_POLICY_PARSER implementation path;
• parse policy JSON with recursive duplicate-key rejection before typed projection;
• enforce closed surface-policy structure and semantic references;
• discover only Git-tracked Rust sources under the two closed roots;
• parse every source with syn and scan cfg-disabled/dead syntax without scanning comments or literal contents;
• resolve explicit/nested use aliases deterministically and emit uncertain findings for relevant glob ambiguity;
• implement PATH_CALL, TYPE_CONSTRUCTOR, METHOD_CALL, and MACRO_TOKEN matching with exact identities;
• prove constructor-bound method ownership only for a direct exact constructor or immutable same-block binding; mutable/unknown ownership remains uncertain;
• assign deterministic per-file pre-order boundary-syntax ordinals and reject duplicate finding identities;
• expose parse-surface-policy and scan-surface CLI entrypoints while leaving verify-pr fail-closed.

Temporal/lineage boundary

The currently canonical surface policy remains the earlier BOOTSTRAP policy. This candidate intentionally does not rebase that policy and does not carry dependent source-universe/finding evidence. dependent_evidence_allowed_in_same_candidate remains false. Policy rebase and T013 evidence must be separately governed after the predecessor/scanner authority is canonical.

Qualification

This initial head is intentionally unqualified. GitHub Actions is the authoritative compile/format/test environment for this stack; any failure will be repaired on a new exact head. No merge is authorized while the predecessor PR remains unmerged or review governance is unsatisfied.

---

Summary by cubic

Adds the deterministic T012 surface scanner to tools/af02-verifier so boundary syntax in Git-tracked Rust sources can be matched against surface-policy JSON. The canonical surface policy and evidence are unchanged, and verify-pr remains fail-closed.

New Features

• Adds syn = 3.0.3 (full, visit) and the new surface.rs module, exposed through parse-surface-policy and scan-surface CLI commands.
• Parses policy JSON with recursive duplicate-key rejection and validates the closed policy structure before scanning.
• Scans every Rust file under the closed crates and tools roots, including cfg-disabled/dead syntax but never comments or literal contents.
• Resolves explicit and nested use aliases deterministically; glob ambiguity yields uncertain findings.
• Matches path calls, type constructors, method calls, and macro tokens by exact identity; constructor-bound method ownership is proven only for direct constructor calls or immutable same-block bindings.
• Assigns deterministic per-file pre-order syntax ordinals and rejects duplicate finding identities.

Qualification

• The bootstrap workflow pinned syn, ran fmt/clippy/test and the canonical policy scans, and committed the qualification back.
• A new commandf-pkg integration test locks the scanner (syn version and checksum), runs clippy/test, and executes both CLI entrypoints, binding the scanner to the required rust gate.
• Generated build outputs are removed and the verifier's /target/ is ignored.
• The canonical policy remains the earlier BOOTSTRAP policy and is not rebased here; policy rebase and T013 evidence are governed separately, and no merge is authorized while the predecessor PR is unmerged.

^{Written for commit dc4b9a3. Summary will update on new commits.}

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}