fix: cross-platform audit Pass-1 (Windows) + C# support — v0.9.5 (#3)

[rlabarca]

Fixes #3 — purlin:audit was completely broken on Windows.

What was broken (issue #3)

scripts/audit/static_checks.py failed on Windows for three independent reasons, each fixed here:

1. import fcntl (POSIX-only) crashed the module on load → every subcommand died with ModuleNotFoundError.
2. ~16 open() calls omitted encoding= → UnicodeDecodeError reading the tool's own UTF-8 files under cp1252.
3. --load-criteria printed ✓/⚠ glyphs to an ASCII stdout → UnicodeEncodeError (surfaced during this work).

Plus: Pass 1 had no C#/.NET support — xUnit/NUnit/MSTest tests produced zero proofs.

What changed

• fcntl imported under try/except ImportError with a _HAS_FCNTL flag; _lock_exclusive/_unlock use fcntl.flock (POSIX) or msvcrt.locking (Windows). Cache serialization (RULE-25) preserved (static_checks RULE-29).
• encoding='utf-8' on every text-mode open() + stdout/stderr reconfigured to UTF-8 at startup (static_checks RULE-30).
• New check_csharp analyzer: parses [Trait("PurlinProof", …)] markers, C#-aware brace/string scanner, assert-true / no-assertion detection across xUnit/NUnit/MSTest/FluentAssertions; .cs routed via new analyze_test_file() dispatch (static_checks RULE-31).
• skills/audit/SKILL.md documents a python3 → python → py -3 interpreter fallback (skill_audit RULE-15).

Verification

• static_checks VERIFIED 29/29, skill_audit 15/15.
• New PROOF-44..52 + skill_audit PROOF-15. Independent audit: 7/7 behavioral proofs STRONG (100% integrity), 0 WEAK/HOLLOW.
• Windows is verified by simulation (injected fake msvcrt) + a faithful cp1252 repro (--load-criteria under PYTHONUTF8=0/LC_ALL=C). Not yet a Windows CI runner — see release notes caveat.

Tagged v0.9.5.

🤖 Generated with Claude Code

[LCbarsenault]

Tested on Windows — fix works ✅ (one false-positive to note)

Tested this branch on Windows 11 / CPython 3.12 against a real .NET 7 (Blazor Server + xUnit) project. Installed this branch's scripts/audit/static_checks.py over the released 0.9.4 copy, removed all local workarounds (no PYTHONPATH, no fcntl shim, no env vars), cleared __pycache__, and ran each command that used to crash:

Operation (previously crashed on Windows)	Result
--read-cache (Unix-only import fcntl)	✅ works
--write-cache (fcntl.flock)	✅ works — the fcntl→msvcrt locking fallback holds
--load-criteria (cp1252 decode of the criteria md, then stdout encode of the ✓)	✅ Criteria-Version: 16 + full text, exit 0
--check-proof-file	✅ clean
Pass-1 on a C# xUnit file (was a silent no-op pre-fix)	✅ now parses [Trait("PurlinProof", "feature:PROOF-N:RULE-N:tier")] and runs the structural checks

All three Windows encoding/fcntl facets from #3 are resolved, and the C# Pass-1 support is a great addition — deterministic structural checks now actually run against .cs test bodies. Regression-swept it across ~75 real unit/integration/e2e tests: no crashes, and well-formed tests correctly report pass.

---

⚠️ One false positive: C# no_assertions doesn't recognize Playwright's fluent assertions

A C# test that asserts only via Playwright's Assertions.Expect(...).ToBeVisibleAsync() is flagged HOLLOW:

PROOF-7 (RULE-7) Nav_ShowsUser_AndSignOut
  status: "fail", check: "no_assertions"
  reason: "test method has no Assert./.Should()/.Verify() call"

…but the test does assert:

await Assertions.Expect(page.Locator("text=" + user)).ToBeVisibleAsync();
await Assertions.Expect(page.Locator("a[href='logout']")).ToBeVisibleAsync();

The no_assertions heuristic looks for Assert. / .Should() / .Verify(), which misses Playwright's assertion API. Tests that also use a plain Assert. pass fine; the ones asserting solely through Expect(...) get false-flagged — common in browser e2e suites.

Suggested: add Playwright's forms to the recognized-assertion set — Assertions.Expect(, .Expect(, and the ToBe*Async() / ToHave*Async() families (FluentAssertions .Should() is already covered).

Net: the Windows fix is good to merge from my testing; the Playwright-assertion gap is a minor follow-up. Thanks for the quick turnaround!

[LCbarsenault]

Note (separate from this PR's static_checks.py fix): C# proof JSONs have empty test_file, which blocks the new C# Pass-1 from being driven by the audit skill

While running the audit end-to-end on Windows with this branch, the deterministic engine itself worked great — but the audit skill couldn't auto-locate the C# test code, because every proof entry the xUnit logger emitted has an empty test_file:

{ "feature": "auth_credentials", "id": "PROOF-1", "rule": "RULE-1",
  "test_file": "",
  "test_name": "UtilityAssistant.Tests.AuthLogicTests.Evaluate_NullRow_IsInvalidCredentials",
  "status": "pass", "tier": "unit" }

test_name (fully-qualified, includes the class) is populated, but test_file is blank. The logger does MakeRelative(_root, tc.CodeFilePath ?? ""), and under dotnet test here TestCase.CodeFilePath comes back null (source info isn't surfaced to the logger), so it falls back to "".

Why it matters for "C# support": the audit skill (Step 2 Pass-1 and Pass-2) reads each proof's test_file to find the code to scan / read. With it empty, auto-discovery fails — I had to supply the file paths manually to exercise the new C# Pass-1. So the cross-platform/C# Pass-1 code is correct and works when given a path (confirmed across 82 proofs, 0 crashes), but it isn't reachable through the skill on a C# project until test_file is populated.

Options (any one closes it):

• Populate CodeFilePath in the logger path — may require the test project to emit source info (full PDBs / SourceInformationProvider), so possibly a documented requirement rather than a code fix.
• Or have the audit skill fall back to resolving the file from the fully-qualified test_name (namespace/class → search **/*.cs) when test_file is empty.

Not a blocker for merging the static_checks.py fix — flagging it because it's the practical gap between "C# Pass-1 works" and "C# Pass-1 is usable via purlin:audit." Happy to open a separate issue if you'd prefer.

[rlabarca]

Thanks for the thorough Windows pass and the two follow-up notes — both are addressed in a stacked follow-up PR: #5.

Playwright C# assertions (your false-positive note): check_csharp's no_assertions guard now recognizes Playwright fluent assertions — Expect(...) / Assertions.Expect(...) chained to a To*Async() matcher (ToBeVisibleAsync, ToHaveTextAsync, ToContainTextAsync, …). So Nav_ShowsUser_AndSignOut and friends pass; a bare Expect(x) with no matcher chain is still flagged (static_checks RULE-31, PROOF-55). To keep the broader acceptance from waving through weak tests, Pass-2 audit criteria gained a "presence/visibility-only assertion" WEAK check (Criteria-Version 17).

Empty test_file blocking C# auto-discovery (your second note): went with the skill-side resolver. static_checks.py now has --resolve-source <test_name>, which derives the declaring type from the fully-qualified test_name and locates the .cs file (skipping bin/obj); purlin:audit falls back to it whenever test_file is empty, so C# Pass-1/Pass-2 is reachable without a populated path (static_checks RULE-32 / PROOF-56, skill_audit RULE-16 / PROOF-16). The native route — RunConfiguration.CollectSourceInformation=true + full PDBs — is now documented as the way to populate it directly. No separate issue needed; closed by #5.

Windows is now real CI, not simulation: RULE-29/30 are verified on a windows-latest Action via a new @windows proof tier (PROOF-53/54), in addition to the host sims.

All 40 features VERIFIED at 100% integrity on the follow-up branch; the Windows Action is green.

[rlabarca]

Verified on real Windows by the reporter and green on the windows-latest Action. Merging into main for the v0.9.5 release. The follow-up (#5 — Playwright C# assertions, real Windows CI proofs, and the C# test_file resolver) merges right after this.