audit: systemic Node/Python + root-only scanning bias in detectors — add ecosystem fixture matrix

[AlexanderMakarov]

Effort: ~3–4 days

Profit: medium — JVM (and other non-Node/Python) stacks dominate enterprise client portfolios, so the difference shows up on a large fraction of real audits; correctness is easy to verify once you look (deterministic detectors), which is why each instance so far was confirmed as a plain bug within minutes of a user reporting it. The value of this issue is stopping the one-bug-at-a-time drip: three consecutive Java findings from a single external tester (Slack thread) each got a spot-fix while the generator survived.

Problem

Detector signal tables were authored from Node/Python conventions and scan the repo root only. Instances so far, all reported by the same tester on one Maven repo:

1. *IT.java (Maven Failsafe) invisible to every QA check — fixed in fix(audit): recognize Maven failsafe *IT.java integration tests #150.
2. mvnw/gradlew etc. missing from AI-07's run-mechanism list — fixed in audit: AI-07 detectCanRunApp has no JVM run signal — mvnw/gradlew invisible, Java repos fail the check #151/fix(audit): recognize JVM and other language-standard run mechanisms (#151) #154.
3. Still open after both fixes:
   • AI-07 detectCanRunApp is a root-only literal-filename check (detectors/ai_development_tooling.ts:239-302): scripts/backend-start.sh is never seen (no scripts/ scan, name not in list), pom.xml without wrapper is excluded by design, and multi-module layouts (backend/pom.xml) are invisible to any root-only signal.
   • uses_env_vars regex (topology.ts:203-209) matches os.environ|os.getenv|process.env|dotenv|godotenv but not Java's System.getenv — the flag (and everything gated on it, e.g. AS-13, ADP-15's .env.example signal) misbehaves in both directions on JVM repos.

Each fix has been reactive; nothing prevents the next ecosystem hole.

Fix

1. Ecosystem fixture matrix: add realistic per-ecosystem test fixtures (at minimum a Maven multi-module project with scripts/*.sh and CLAUDE.md-documented run commands; ideally Gradle, Go, and a plain-Python project) and assert expected check outcomes per fixture. The Maven fixture alone would have caught all three reported bugs pre-release.
2. Root-only scan audit: review every existsSync(join(repoPath, …))-style root-only check in detectors/*.ts, metrics/*.ts, topology.ts and decide per check: keep root-only (justified), walk one level / known subdirs (scripts/, module roots in multi-module builds), or add ecosystem-specific signals.
3. AI-07 concretely: count scripts/*.sh (or similar conventional script dirs) as a run signal, and handle multi-module manifests (root pom.xml/settings.gradle with wrapper in root or module).
4. uses_env_vars: add JVM (System.getenv, Spring ${…} env placeholders) and other mainstream ecosystems to the regex, with tests.

Definition of done

• Ecosystem fixture matrix exists under the engine test layer with per-fixture expected-outcome assertions, run by npm run test:audit-engine.
• The Maven multi-module fixture passes AI-07 and gets correct uses_env_vars/QA outcomes.
• Root-only scan audit results recorded (issue comment or doc): each root-only check either justified or widened, with tests for the widened ones.
• dist/ rebuilt and committed; plugin version bumped.
• Re-run against the original feedback repo shape (pom.xml, no wrapper, scripts/backend-*.sh): AI-07 no longer FAILs.