feat(installsurface): VC-002L Python import-time analyzer (facts-only, unwired)

[MoSLoF]

Intent

Land the analyzer half of VC-002L (docs/VC-002L-python-import-time.md), closing the coverage gap named in D-165: a payload injected into an ordinary Python runtime module — the telnyx _client.py shape — runs on import and is invisible to every install-hook analyzer (setup.py / pyproject / .pth). Staged analyzer-first, exactly as VC-013 was.

Changes

• internal/installsurface/pyloadtime.go — AnalyzePythonLoadTime: scans a package's own modules for import-time-reachable code carrying an escalating capability.
  • Reachability: module-level statements + the bodies of functions called at module level (one level deep); excludes uncalled helpers, class bodies, and if __name__ == "__main__":. This is what catches the telnyx shape (payload in called functions) without flagging benign helpers.
  • Emit gate (loadTimeEscalates): fires only on a capability combination the VC-002 family acts on — decode+exec, credential+network, cradle, or a named-credential read — not bare exec/network (tighter than the spec's §5; bare signals deferred to §7 corpus eval).
  • Reuses scanCaps + the D-25/D-160 strip pipeline; bounded by maxLoadTimeRefs with disclosed truncation; zero-execution (D-04).
• internal/installsurface/pyloadtime_test.go — corpus test: 4 malicious (incl. telnyx called-function shape + the reachability pair), 7 benign false-positive controls, disclosed bound.
• docs/VC-002L-python-import-time.md — status → "analyzer prototype landed"; documents what's deferred and the block-class/advisory design decision.

Security semantics

No detection, scope, or gate change. The analyzer has no callers and is not in the check registry — it produces facts nothing acts on. Existing checks are untouched.

Adversarial / FP review

The benign corpus (env read, embedded-data decode with no exec, subprocess capability probe, plugin registry, uncalled malicious helper, __main__-guarded payload) all produce zero hooks. The reachability pair asserts the same body is detected when called and ignored when not.

Validation

go test ./... all pass · go vet clean · go build ok · new files gofmt-clean · confirmed unwired (no VC-002L in depsnort checks).

Remaining limitations / follow-on (the wiring phase)

sdist module enumeration (hostile-input change to sdist.go), adapter wiring, and a dedicated VC-002L check at an advisory ceiling + exclusion of module-load: hooks from the block-class family members. One-level reachability and scanCaps's split-string blind spot are documented lower bounds.

🤖 Generated with Claude Code