feat(validate): read Python, Rust, PHP and Java dependency files

[protonspy]

The stack check knew go.mod and package.json. Everything else got zero enforcement: dependencies() came back empty, and Stack returned before it ever looked for docs/stack.md. Silence is the correct answer for a file scc cannot read — it is why a Python project never failed — but it also meant the rule the knowledge base is built on held in exactly two ecosystems.

Five readers

File	What it reads
requirements.txt	one requirement per line, PEP 508 names. Options (-r, -e, --hash), comments, markers, extras, direct URLs and backslash continuations all fall out
pyproject.toml	PEP 621 ([project] dependencies, optional-dependencies), PEP 735 (dependency-groups), and Poetry's tables including per-group
Cargo.toml	dependencies, dev-, build-, [target.'cfg(…)'.dependencies], [workspace.dependencies], and the [dependencies.<crate>] long form
composer.json	require and require-dev, minus the platform keys (php, ext-*, lib-*)
pom.xml	project/dependencies/dependency and nothing else — <dependencyManagement> pins versions rather than adopting, and a <profile>'s dependencies may not apply

build.gradle, Gemfile, mix.exs and Package.swift are deliberately absent: those manifests are executable code, and reading one honestly would mean evaluating it.

The TOML reader is not a TOML parser

pyproject.toml and Cargo.toml share one, and its doc comment says outright that it must not become a parser. It recognizes exactly two shapes — a table header alone on a line, and key = value under it — which is how every dependency table in the wild is written, and ignores everything else. An array that never closes yields nothing rather than half a dependency list.

Two behavior changes worth reviewing

• Either separator counts as documented. PyPI treats Flask-SQLAlchemy and flask_sqlalchemy as one project. Each candidate spelling is now also tried with the separators swapped — and an extra spelling can only remove a finding, never add one, which is what makes the generosity safe.
• The silence contract is now asserted, not emergent. TestAnEcosystemWithNoReaderIsNotChecked drops a Gemfile, a mix.exs and a build.gradle in a root and requires zero findings. That property was true before this PR by accident of control flow; it is now a test.

Structure

The readers move to internal/validate/stack_manifests.go. The rule is fixed; the readers grow whenever somebody uses an ecosystem scc cannot see, and that difference in tempo is why they no longer share a file. Its header states the three rules every reader obeys — absent is not an error, direct dependencies only, and what cannot be read confidently is not read at all.

gofmt, go vet, go test ./... clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GchWF6iL5PjTdXAT8H3mhb