77 lines
7.1 KiB
Markdown
77 lines
7.1 KiB
Markdown
---
|
|
name: bug-class-detectors
|
|
description: "Find bug CLASSES, not instances. A pack of 37 root-cause detectors (hardcoded-universe, schema-by-name, units-mismatch, stale-config landmines, fail-open config, double-count metrics, swallowed-exceptions-around-writes, dead-backend, duplicate-file-divergence, clone-class, and more) that scan a codebase for whole categories of defects and emit CI auto-fix PRs. A Snyk/Sonar alternative focused on architectural bug classes. By Elite Agentic Solutions (EAS)."
|
|
license: MIT
|
|
homepage: https://bugclass.eliteaiempire.com
|
|
tested_with: claude-code v2.x
|
|
---
|
|
|
|
# Bug-Class Detectors
|
|
|
|
Most static analyzers find bug *instances* — one null-deref, one injection. **Bug-class
|
|
detectors find the whole CLASS**: every place the same root-cause pattern recurs, so fixing
|
|
one fixes all and the class never regresses. This is the EAS BugClass engine
|
|
(`bugclass.eliteaiempire.com`), distilled into a portable skill.
|
|
|
|
## When to use
|
|
- Auditing an unfamiliar codebase for systemic defects (not lint noise).
|
|
- Before a refactor or a release gate — catch the *category* of bug.
|
|
- In CI — emit auto-fix PRs that close a class atomically.
|
|
|
|
## The 37 detected classes
|
|
|
|
| ID | Class | What it catches |
|
|
|---|---|---|
|
|
| C1 | HARDCODED_UNIVERSE_LIST | A hardcoded universe/entity roster that silently drops a registered member when one is add |
|
|
| C2 | SCHEMA_BY_NAME | A data source validated/dispatched by name without asserting its schema (column/field shap |
|
|
| C3 | UNITS_MISMATCH | Money/quantity arithmetic (size_usd*price, qty by side) without an explicit unit/side corr |
|
|
| C4 | STALE_PW_CONFIG_LANDMINE | An inline/hardcoded secret (systemd Environment=, literal pw) that diverges from the live |
|
|
| C5 | FAIL_OPEN_NAIVE_CONFIG | A kill/arming/safety/feature gate whose backing store is missing/malformed and it defaults |
|
|
| C6 | METRIC_CONFLATION_DOUBLE_COUNT | Aliased/duplicate universe identity in capital/PnL math (double-count source), or corrupt |
|
|
| C7 | ROTATION_MISS | A long-lived consumer captures a secret at startup and never re-reads it after rotation. |
|
|
| C8 | SWALLOWED_EXCEPTION_AROUND_WRITE | A bare/catch-all except swallows a redis/db/file WRITE with no logging -> silent data loss |
|
|
| F2613 | UNIVERSE_FEE_FALLTHROUGH | A registry universe hits the generic ~2% fee fallback (silent mispricing); also peer share |
|
|
| F2614 | DUPLICATE_FILE_DIVERGENCE | A filename present in two source trees (e.g. /root/scripts and /root/shared-components) ha |
|
|
| F2649a | METRIC_MISREAD_DENOMINATOR_DRIFT | A ratio is read against the wrong denominator (coverage_frac over ALL markets vs traded ma |
|
|
| F2649b | BUILT_BUT_DARK_PRODUCER | A producer is built + default-OFF but has NO systemd unit and NO arming trigger -> sits da |
|
|
| F2650 | PERSONA_CLONE_CLASS | A signal-weight vector is byte-identical across >1 universe (same weights applied to diffe |
|
|
| F2654 | DEAD_BACKEND | A backend (container, host:port, ssh tunnel, CH table) moved/died post-migration; writers/ |
|
|
| F2602 | STALE_CRED_INHERITED_ENV | Active file uses a stale HARDCODED pw as a live connection (or a stale inherited env) -> 4 |
|
|
| F2665 | SIGNAL_RACE_FOREIGN_WRITE | An owner recomputes+overwrites its namespace each cadence; a FOREIGN writer to the same ca |
|
|
| F2666 | WRONG_ENGINE_WRONG_LAUNCHER | The launcher default engine/launcher mismatches the corpus/runtime shape (raw vs compacted |
|
|
| F2602b | LEAKED_TOKEN_IN_GIT_CONFIG | A credential (PAT/API token/password) embedded in a .git/config remote URL (https://user:T |
|
|
| F2681a | UNINITIALIZED_NAME | A name is used (Load) that is never bound in its scope and is not a builtin/import/global/ |
|
|
| F2681b | WRONG_LAYER_EDIT | A two-layer file (canonical source vs a sync/build-mirrored COPY) is edited on the COPY si |
|
|
| F2681c | LOOKAHEAD_LEAK_DECISION_TIME_JOIN | A backtest/replay signal-injection path selects a time-series point with a NON-as-of acces |
|
|
| F2681d | LIVE_STATE_CLAIM_UNVERIFIED | A memory/handoff/report file asserts a service/URL/file is missing/broken/dead/404 (or a c |
|
|
| F2681e | WRONG_BOX_INVENTORY_CLAIM | A capability/data is checked on the WRONG host/path/box (hub when the feed is apps-box-own |
|
|
| F2686 | PATCH_INJECTED_AT_WRONG_POSITION | An automated patch fragment is inserted at a position that breaks the module: a statement |
|
|
| F2687b | MISSING_TOOLING_SILENT_FALLBACK | A script/unit silently degrades when a tool/binary/import is absent: command -v X || skip- |
|
|
| F2688 | VENUE_TYPE_ARCHETYPE_MISMATCH | A persona whose archetype class is structurally impossible for its universe venue_type (se |
|
|
| F2694 | METRIC_MATURITY_CONFLATION | A monitoring/comparison reads an event-time-stamped table whose rows arrive with write-lag |
|
|
| F2694_REDIS_UNNAMED_CLIENT | Unnamed redis client (unix-socket caller un-attributable) | fc-redis unix-socket clients that never CLIENT SETNAME share addr=/tmp/fc-redis.sock:0 so |
|
|
| F2694_GITLAB_CIDR_DRIFT | GitLab webhook CIDR drift (silent auto-deploy break) | Hetzner fw rule 11082658 pins GitLab SaaS hook egress CIDRs (GCP us-east1 34.74.90.64/28+3 |
|
|
| F2685_WRONGLAYER | WRONG_LAYER_EDIT_F2402_SYNC (detector v2) | Edits made ONLY to the apps-box copy of an F2402-enforced file are reverted by the hub->ap |
|
|
| F2711_FLAG_NAMESPACE_CONFLATION | FLAG_NAMESPACE_CONFLATION | A freshness-watched service idles/skips/early-exits its MAIN LOOP on a flag F that is ALSO |
|
|
| C9 | HEARTBEAT_KEY_NAMESPACE_MISMATCH | A watchdog/monitor checks the freshness (get/ttl/exists) of a heartbeat key whose namespac |
|
|
| F228c_HEARTBEAT_KEY_DRIFT | HEARTBEAT_KEY_DRIFT_MANIFEST | Live/manifest variant: given watched_key + writer grep pattern, confirms the watched heart |
|
|
| CLONE_PERSONA | Cross-universe persona clone (byte-identical signal vector) | A persona signal-weight vector byte-identical across >1 universe, or carrying foreign-venu |
|
|
| VENUE_SIGNAL_MISMATCH | Foreign-venue / destroyer signal on a universe | A persona carries a signal structurally impossible for its venue_type (book-micro on binar |
|
|
| RETENTION_EATS_REPLAY_WINDOW | Offload/retention job re-darkens data a consumer is actively inflating | A retention/offload job (RETAIN_DAYS=4) and a long-window consumer (replay since-days=17) |
|
|
| F2765 | HARDCODED_FALLBACK_CRED_IN_SOURCE | A real credential hardcoded as a string literal in source, typically as the fallback of an |
|
|
|
|
## How to run
|
|
1. Identify the language/stack and the highest-risk classes for it (config-driven systems →
|
|
stale-config / fail-open; data pipelines → units-mismatch / double-count / schema-by-name;
|
|
distributed systems → rotation-miss / swallowed-exception-around-write / dead-backend).
|
|
2. For each class, grep/AST-scan for the pattern signature (see class descriptions). Report
|
|
every hit as `CLASS_ID @ file:line` with the minimal fix.
|
|
3. Cluster hits by class. Propose ONE architectural fix per class (not N point-fixes).
|
|
4. If in CI with write access, open a single PR per class that fixes all instances.
|
|
|
|
## Output
|
|
A per-class findings table: `class → instances → root cause → one fix that closes the class`.
|
|
|
|
## Upgrade
|
|
The full hosted engine (live CI integration, auto-fix PRs, dashboard, 100s of repos) is at
|
|
**https://bugclass.eliteaiempire.com** — this skill is the open, portable detector logic.
|