feat(pypi): wire VC-002L import-time detection at advisory (D-166)

[MoSLoF]

Intent

Meet the rest of the VC-002L spec (D-165): the Python import-time module surface is now enumerated, analyzed, and reported as an advisory finding — closing the telnyx/_client.py class of gap end to end (payload in an ordinary runtime module that runs on import).

Changes (four layers, each tested)

1. Module enumeration — internal/ecosystem/pypi/sdist.go: retains runtime .py modules from both the sdist tar and the wheel zip, under new count/byte caps (maxModuleFiles / maxModuleTotalBytes) and an isRuntimeModule filter (excludes setup.py, conftest.py, test/docs/build trees, packaging metadata). Exceeding a cap → ModulesTruncated (partial disclosed coverage), never a silent drop. Cache semantics v3 → v4 so a stale record carrying no modules can't read as a clean import surface.
2. Adapter — installsurface.go: runs AnalyzePythonLoadTime over the retained modules for every dependency (sdist + wheel-only paths); discloses the unexamined import surface as GapTruncated coverage gaps.
3. Analyzer — pyloadtime.go: hook name module-load: → import-time: (to stay separable from npm's module-load:); module cap raised for whole-package scanning.
4. Check + advisory ceiling — new VC-002L check (registered, medium/advisory). The ceiling is structural: the block-class VC-002 family (collectHooks) excludes import-time: hooks, so a credential+network import-time hook cannot reach VC-002d and block. Scoped to the import-time: name — npm's module-load: hooks are untouched, so VC-002j (OPU-31) still gates.

Security semantics

Advisory-only, and structurally enforced (family exclusion, not just a gate constant) per D-165. No change to any existing detection: npm load-time gating, the VC-002 family, and all other checks are untouched. Coverage stays honest — truncated module trees and the deferred wheel/root cases are disclosed gaps or documented deferrals, never clean results.

Adversarial / FP review

• Family-exclusion test: VC-002d does not fire on an import-time exfil hook; VC-002L surfaces it advisory.
• Scoping test: npm module-load: still gates via VC-002d (exclusion didn't over-reach).
• Analyzer's 7 benign FP controls (env read, embedded-data decode, subprocess probe, plugin registry, uncalled helper, __main__ guard) still clean.

Validation

go test ./... all pass · go vet clean · go build ok · new/modified Go files gofmt-clean. depsnort checks shows VC-002L … medium … advisory.

Remaining limitations (deferred)

Root-local import surface; payload-in-wheel-not-sdist for dual-shipping packages; raising the emit threshold past capability-combinations (spec §7 corpus eval). Promotion above advisory is gated on that evaluation.

🤖 Generated with Claude Code