fix(auditor): an import manifest is not a packed payload (#3583)

[squid-protocol]

Summary

Fixes #3583.

The statistical auditor's Packed Payload Guard relegates any file of 30+ lines averaging more than 3 signal hits per line. It is meant for minified, obfuscated or packed code. A re-export barrel is that dense by construction:

• flask's src/flask/__init__.py is 39 lines of from .app import Flask as Flask;
• each line is one import plus three from/import/as structural boundaries, so it averages 3.95 hits per line.

It was dropped from the scan. So:

• no import edge could land on the package root;
• any view of the scanned files read src/flask/ as a source root. That made the import-accuracy tool expect import typing to mean src/flask/typing.py, which accounted for most of Python's misses.

Fix. A payload is the opposite shape: few, long lines. New StatisticalAuditor._is_import_manifest treats a file as an import manifest, and keeps it, when both hold:

• at least 80% of its code lines are import statements;
• its average line length is ≤ 120 characters.

An import-dense file on packed lines is still relegated; a test covers exactly that.

Measured

import_graph_accuracy.py python (httpx, fastapi, flask): recall 98.9 → 100.0 (misses 22 → 1), precision 99.9. Baseline regenerated; the other 19 languages are unchanged.

Type of change

• Bug fix
• New feature / language support
• Parsing or engine logic
• Docs, tooling, or CI only
• Other

CI checklist

• tests/security_auditing/test_statistical_auditor.py: 14 passed. New tests: a manifest is kept; import-dense packed lines are still relegated.
• crucible_check.py: both fixtures pass on the rebased head (reblessed; scope below).
• ground_truth_ledger.py check: ledger clean. pytest tests/cobol_mainframe/ with the pinned corpora: 481 passed, 1 skipped.
• import_graph_accuracy.py --ci: OK, 20 languages.

Golden-master scope

The guard excluded exactly one language-crucible file: javascript/threejs/Nodes.js, which is an export { default as X } from './x.js' barrel. It is now scanned again. Every other difference is an aggregate that counts it:

• verified_files 3220 → 3221, total_loc +140;
• the javascript composition and threejs directory group;
• unparsable_files −1;
• plus coordinate ripple.

Verification

$ pytest tests/security_auditing/test_statistical_auditor.py -q         -- 14 passed
$ python tests/tools/import_graph_accuracy.py python                   -- python 99.9 / 100.0
$ python tests/tools/crucible_check.py                                 -- full_precision PASS, zero_dependency PASS
$ python tests/tools/ground_truth_ledger.py check                      -- Ledger clean.
$ pytest tests/cobol_mainframe/                                        -- 481 passed, 1 skipped

🤖 Generated with Claude Code

https://claude.ai/code/session_01YAtpBfGGyBGGovitSVaM5Q

---

Generated by Claude Code

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab