feat: TeamPCP PyPI campaign detection — IOC ledger, litellm .pth tests, import-time spec

[MoSLoF]

Intent

Turn the telnyx/litellm supply-chain analysis (TeamPCP campaign) into depSNORT detection capability, across three tracks. No new check and no scope/gate change — tracks 1–2 reuse existing VC-003 and VC-002e; track 3 is spec + decision only.

Changes

1. IOC ledger (VC-003) — immediate detection

• docs/ioc-teampcp.example.json — reference feed flagging litellm 1.82.8, telnyx 4.87.1, telnyx 4.87.2 (critical).
• internal/datasource/ioc/ioc_test.go — loads the shipped feed; asserts it matches the compromised versions and not a clean telnyx@4.85.0.

2. litellm .pth — validates existing detection (Track A)

• internal/ecosystem/pypi/installsurface_test.go — the real .pth trigger reads obfuscation+exec; a benign bootstrap-import .pth does not (the FP boundary).
• internal/check/builtin/teampcp_pth_test.go — VC-002e fires on the litellm shape, stays silent on the benign one.

3. telnyx import-time gap (Track B) — spec + decision, no code

• docs/VC-002L-python-import-time.md — scoped AnalyzePythonLoadTime spec: capability-gated, advisory-only, corpus-gated.
• D-165 in docs/DECISIONS.md — records the boundary: gap acknowledged, held out of scope until the spec's corpus eval is met; never gates prematurely.

Security semantics

No scope expansion, no new gate class. The import-time gap (telnyx _client.py runs on import, outside the install-surface model) is documented, not silently coded — honoring zero-silent-failure and gate-vs-severity disciplines. Coverage honesty preserved (offline sdist gap still reported as "NOT an all-clear" in E2E).

Validation

• go test ./... — all pass · go vet clean · go build ok · new Go files gofmt-clean.
• E2E: scan -ioc docs/ioc-teampcp.example.json on telnyx==4.87.1 → exit 1, one VC-003 block finding.

Adversarial / FP review

• Benign-lookalike controls on both new detections: clean telnyx@4.85.0 (ledger) and benign bootstrap-import .pth (VC-002e).
• Track B spec §6 enumerates the import-time FP corpus (env reads, plugin registries, embedded-data decode) as the promotion gate.

Remaining limitations

Track B is spec-only; the import-time analyzer is not implemented. npm non-entry runtime modules are the same class of gap, noted but not closed.

🤖 Generated with Claude Code