[chubirka]

Step 8 of the Vercel comparison gap plan (progress-tracker/plans/vercel-comparison-gap-plan.md, owner Michele), traust part. This is the last PR of the plan.

Merge order: traust-core#282 (Ruby) → this PR. Core is pinned at #282's head (aa38b06), which carries #276 (Java), #277 (the rule-proposal gate) and #281 (Rust).

Changes

Dependencies

• traust-core[js] → traust-core[js,java,rust,ruby], so audits enumerate Spring/JAX-RS, axum/actix-web/tonic and Rails/Sinatra by default.
• uv.lock relocked with revision = 3 kept.

Review checks (framework-checks.md): four new sections, 57 checks, each with its CWE, ASVS 5.0 section and the deterministic evidence that settles it.

• Spring and JAX-RS (JV.1–16): includes the method-security-not-enabled, spring-security:conditional-config and spring-security:default markers.
• axum and actix-web (RW.1–13): includes layer order and actix:registration-not-found.
• tonic (TN.1–7).
• Rails and Sinatra (RL.1–14, SN.1–7): includes skip_before_action:<callback> and callback asymmetries.
• Selection rows and the recording slugs are updated. /secure-code-audit's route-guards section names the new families and extras. Rails app paths are written <app>/config/… for the docs gate.

Rule proposals: traust sweep propose-rule --rule --example --shape --checkout [--json] submits an inference-proposed rule to core's deterministic gate (#277). Exit codes:

• 0: staged as an authored draft;
• 1: refused, with each failing check printed;
• 2: an error.

/mine-ledger says when to propose, how, and that a refused proposal is fixed or dropped, never loosened. An admitted draft follows the same calibrate → sweep sweep → sweep emit path, and promotion into the pack stays a human point. docs/cli-reference.md lists the op.

docs/skills.md is unchanged (A13 waiver): its entries are skill descriptions.

Verification

• pytest tests/: 2,621 passed, 69 skipped. The alignment, security-posture, docs-consistency and content-licence gates pass.
• Installed traust adapters route-guards on the seeded fixtures (traust-internal#53): each reports its family (spring, jax-rs, axum, rails) with no coverage gaps, and 3 judged rows each (the planted auth defects plus the by-design public route).
• Installed traust sweep propose-rule with real opengrep:
  • an os.system($CMD) proposal with ruleid:/ok: examples passed all six checks and was staged (rule.skeleton.yaml, rule.skeleton.py, DRAFT.md), exit 0;
  • the same rule with a (os)\1 regex was refused at the regex check, exit 1, and never ran.

Changed tests (approved by the owner, 2026-10-28)

Test	Old → new	Why
test_framework_checks.py::test_every_section_is_present_and_ids_unique	prefixes OP, GR, FA, EX → + JV, RW, TN, RL, SN, with floors 14, 11, 6, 12, 6	the four new sections

New tests: test_framework_checks.py::test_jvm_rust_and_ruby_sections_name_their_matrix_markers, tests/test_sweep_propose.py (4).

🤖 Generated with Claude Code

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chubirka

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [chubirka]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment