main is red. #436 and #437 each added a guard and merged independently:
the presentation-layer guard has to spell packageurl-go in order to ban
it, and the module-boundary guard reports any file under internal/ that
names it. Two rules doing their job, one flagging the other.

The exemption is a set of canonical paths now. Not a name -- exempting
anything called guards_test.go was the earlier bug in this same line, and
it hid a forbidden import in a second guard file. Not one hard-coded path
either, which is what made the guards collide the moment a second one
existed.

Adding a guard costs one line in that set, deliberately: a new exemption
should be an edit somebody reviews, not a pattern that widens on its own.

The predicate is extracted so the property can be pinned rather than
described. TestGuardExemptionIsByPathNotByName fails if a file becomes
exempt for being *named* like a guard, and if an entry names a file that
no longer exists -- a dead exemption is a rule nobody is applying. The
first mutation I ran against the old shape passed, which is how the
missing test surfaced.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Codex found the hole and it reproduced: the path-keyed exemption excused a
guard file from *every* module rule, not from the one it states. The
presentation-layer guard must spell packageurl-go, and was thereby also
free to name go-spdx and the deprecated anchore fork with nothing
reporting it. Appending both to that file left all guards green.

The table maps a guard to the modules it is entitled to name, and
guardMayName takes the module under test. internal/output's guard forbids
one module, so it may name one. This file states every rule, so it names
every module. The three module paths are constants now, shared by the
forbidding rule and the exemption -- spelled twice, a typo would have
opened a hole in the passing direction.

TestGuardExemptionIsByPathAndPerModule replaces the by-path-not-by-name
test and keeps that half. It also fails if a guard is entitled to a module
it never names: an unused entitlement is a dead rule, the same way a path
that no longer exists is.

Mutations: the original probe now fails both module rules; a predicate
ignoring the module fails; a predicate matching the base name fails.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…y-name-what-they-forbid

# Conflicts:
#	internal/detectors/guards_test.go

Codex again, and it reproduced again. Adding a real import of
packageurl-go to the entitled guard file left every guard green: this
rule skipped the file for that module, and internal/output's own guard
skips _test.go, so nothing was looking at the one file allowed to say the
name.

Naming and importing are different acts. A guard spells the module in a
string so it can forbid it; an import is the hazard the rule exists to
prevent. The entitlement now covers only the first.

go/parser answers what a file imports. A textual scan cannot tell the two
apart -- it reads this file's own const block as an import, which is the
distinction the whole fix rests on. The prefix match carries its
separator because a module path is not always the import path: go-spdx is
reached as go-spdx/v2/spdxexp.

TestNamingAModuleIsNotImportingIt pins the predicate on fixtures rather
than on the repository, in four directions: a const and a comment are not
an import, a blank import is, a subpackage import reaches the module, and
a neighbour sharing the path prefix does not. The live guard files are
asserted not to import what they are entitled to name.

Mutations: the original probe now fails both the walker and the
assertion; an entitlement ignoring imports fails; a prefix match without
its separator fails.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…istyped

Codex found the fifth hole in this file, and it is the same shape as the
other four: a field that can be wrong in the direction that passes. A
module carrying an owner string of "TestNoDirectPurlUse" belonged to no
rule, was scanned by nothing, and still satisfied an entitlement, because
the check asked whether the module was a map key rather than whether any
live rule forbade it.

Validating the owner against a list of known rules would have closed it.
Inverting the registry removes the field instead: forbiddenModules is
keyed by rule now, so there is no owner to mistype -- only a key, and a
key that is not a rule is caught from both sides.
TestRuleRegistryCoversEveryRule fails when a key names no rule that runs
and when a rule that runs has no key.

modulesForRule takes t and fails on an empty or missing list rather than
returning nothing. A rule scanning no modules reports no offenders
however many exist, which is indistinguishable from a rule that passed --
the failure mode this whole file exists to prevent, one level up.

Mutations: Codex's mistyped key fails twice over, once in the registry
test and once in the rule that would have scanned nothing. An emptied
list fails. A modulesForRule that returns silently still fails the
registry test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>