Go Guard Auditor – Static AST Runtime Execution Guard

🔍 ARCHITECTURAL COMPLIANCE SECURED. ENFORCING RUNTIME GUARD AUDIT BLUEPRINT ONLY.

--- INPUT — live/scan1.go ---
// Live run 1: guarded Go file. Every shell call wrapped by a guard.

package main

import (
	"fmt"
	"os"
)

var allowedHosts = []string{"github.com", "pypi.org"}

func writeAudit(result map[string]any) {
	f, _ := os.OpenFile("audit.log", os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
	defer f.Close()
	fmt.Fprintln(f, result)
}

func requireConfirmation(command string) {
	fmt.Println("Confirm:", command)
}

func runGuarded(command string) map[string]any {
	result := guardExecute(command, allowedHosts)
	verdict, _ := result["runtime_verdict"].(string)
	if verdict == "BLOCKED" {
		writeAudit(result)
		panic(result["enforcement_action"])
	}
	if verdict == "HUMAN_CONFIRMATION_REQUIRED" {
		requireConfirmation(command)
	}
	return result
}

func deploy() {
	runGuarded("ls -la")
}

func main() {
	deploy()
}

--- INPUT — live/scan2.go ---
// Live run 2: unguarded Go file. Shell calls without a guard.

package main

import (
	"os"
	"os/exec"
	"syscall"
)

func deploy() {
	exec.Command("ls", "-la").Run()
	exec.Command("pwd").Run()
	syscall.Exec("/bin/sh", []string{"sh", "-c", "echo hello"}, os.Environ())
}

func main() {
	deploy()
}

--- AUDIT OUTPUT ---

{
  "audit_status": "CRITICAL",
  "findings": [
    {
      "id": "f1",
      "file": "live/scan2.go",
      "line": 11,
      "severity": "HIGH",
      "signature": "UNGUARDED_SHELL_CALL",

  "message": "exec.Command is not wrapped by a guard function",
  "snippet": "exec.Command(\"ls\", \"-la\").Run()"

    },
    {
      "id": "f2",
      "file": "live/scan2.go",
      "line": 12,
      "severity": "HIGH",
      "signature": "UNGUARDED_SHELL_CALL",

  "message": "exec.Command is not wrapped by a guard function",
  "snippet": "exec.Command(\"pwd\").Run()"

    },
    {
      "id": "f3",
      "file": "live/scan2.go",
      "line": 11,
      "severity": "MEDIUM",
      "signature": "MISSING_ENV_ISOLATION",

  "message": "exec.Command call has no cmd.Env assignment — child inherits all secrets",
  "snippet": "exec.Command(\"ls\", \"-la\").Run()"

    },
    {
      "id": "f4",
      "file": "live/scan2.go",
      "line": 13,
      "severity": "HIGH",
      "signature": "GUARD_BYPASS_VIA_SYSCALL",

  "message": "Direct low-level syscall.Exec call bypasses high-level framework security guard layers",
  "snippet": "syscall.Exec(\"/bin/sh\", []string{\"sh\", \"-c\", \"echo hello\"}, os.Environ())"

    }
  ],
  "metadata": {
    "version": "1.2.0",
    "timestamp": "2026-10-16T12:05:00Z",
    "files_scanned": 2,
    "calls_found": 4
  }
}

--- VALIDATOR ---
PASS: live/live_run_report.json
Live run: PASS — 2 files evaluated, 4 structural runtime exposures quarantined.