[Epic] Recurring pattern: keys read by a consumer that no producer ever writes

[squid-protocol]

Pattern observed

In one review pass, we found six independent instances of the same failure
shape: a consumer reads a dict/schema key that no producer ever writes,
under either the exact name or a near-miss rename.

1. SecurityLens.evaluate_risk() vs SignalProcessor's _calc_* methods --
   two full disagreeing implementations of the same five risk categories (Two independent, disagreeing implementations of the same risk-scoring logic #249)
2. supply_chain_firewall.py reading dependency_network -- key never written
   anywhere; real data lives at telemetry.network_metrics (found during Two independent, disagreeing implementations of the same risk-scoring logic #249)
3. signal_processor.py reading ghost_meta["aperture_reason"] -- real key
   is reason, and even that only gets copied on the opposite branch condition
   from the one that matters (the "CRITICAL LEAK" shunt case)
4. statistical_auditor.py reading artifact["lang_mix"] -- never written
   anywhere, silently disabling polyglot-file detection
5. language_standards.py's AI/LLM SDK names hand-pasted into 2 of 57
   language blocks instead of using the established GLOBAL_ pattern (AI/LLM detection sensor cluster (llm_api, llm_orchestrator, ai_tools, etc.) is entirely non-functional -- no rule ever produces these signals #313
   follow-up)
6. AIAppSecSensor reading 7 of 8 inputs from a telemetry namespace that
   nothing populates (companion issue)

That's a strong enough pattern to treat as a process problem, not a string
of unlucky typos. All six were invisible at runtime (no exceptions, no
crashes -- code just silently computed nothing, or the wrong thing) and were
only found by manually grepping every .get("key"...) call against every
["key"] = / "key": assignment across the codebase.

Proposed fix: automate the manual diff

A one-time investment: a small static-analysis script that:

1. Walks every .get("some_key" (and equivalent dict-access patterns)
   across the repo.
2. Cross-references each key against every place it's ever assigned
   (["key"] =, dict-literal construction, .setdefault(, etc.).
3. Flags any read key with zero matching writes anywhere in the codebase.
4. Runs as a CI check (or pre-commit hook), not just an ad-hoc audit.

Expect real noise on the first pass (config constants from external files,
legitimate external JSON schema keys like lockfile fields, keys that are
genuinely optional by design) -- the first sub-task is tuning it down to a
low-noise signal, not just writing the walker.

Sub-tasks

• Build the key-read vs key-write static analysis script
• Tune out false positives (external config constants, legitimate
  optional keys, third-party JSON schema fields)
• Wire into CI as a required check
• Fix each of the 6 enumerated instances above (linked once individually filed)

Workflow context

Several of these instances (at least #249's duplicate-math case and the
AIAppSecSensor telemetry mismatch) trace back to AI-assisted coding sessions
(Gemini) producing plausible-looking consumer code against a producer that
was never actually built or was renamed later without updating the consumer.
Worth keeping this epic open as the place that documents the pattern, even
as individual instances get fixed piecemeal.

[squid-protocol]

Found a 7th instance of this pattern while scoping #102/#106: dev_agent_firewall.py's "Metaprogramming Hallucination Risk" rule reads telemetry["doc_density"], which no producer anywhere in the codebase ever writes — the .get(..., 1.0) default always wins, so the < 0.2 check can never fire. Filed as #345, since it's being superseded by #106's rework rather than patched in isolation.