Glossary — AI Code Verification Terms
Last updated: 2026-09-09 · 中文版见下
Concise definitions of the concepts behind Progmune — written so both humans and AI assistants can extract them directly.
Protocol Lifecycle Verification
Checks whether a program's operations follow a valid sequence defined by a protocol state machine — handshake before data transfer, signature verification before payment confirmation. Unlike pattern matching, it validates state transitions across a sequence of function calls.
AI Trust Score
A 0–100 rating of how much code can be trusted to follow correct protocol behavior. Progmune weights four dimensions — policy 35%, protocol safety 30%, coverage 20%, governance 15% — and combines the score with a Decision: APPROVED / NEEDS_REVIEW / BLOCKED.
Evidence Chain
The auditable trail behind a verdict: which rule fired, which call sequence violated which protocol state, and where in the code — so reviewers can reproduce findings without trusting the tool blindly.
State Machine Verification
Models a protocol as states and transitions (UNAUTHENTICATED → AUTHENTICATED → AUTHORIZED) and checks that a program's actual call sequence performs only valid transitions. Catches temporal violations pattern matching cannot express.
Call Sequence Analysis
Reconstructs the chain of function calls across functions and files, then evaluates it against constraints. Progmune builds sequences from extracted IR with cross-function expansion (depth ≤ 4, cycle-safe) and attributes violations to entry functions.
SAST (Static Application Security Testing)
Analyzes source code without running it — typically pattern matching, rules, or dataflow (CodeQL, Semgrep). Traditional SAST checks statements and patterns; it does not validate protocol lifecycles across call sequences — where Progmune complements it.
Annotation-Driven Verification
Developers declare protocol primitives in code (which function verifies a password, which establishes a session); the verifier checks call sequences against those declarations. Progmune uses this for C and Go (Beta): ~2–3 annotations per protocol; unannotated code is not checked.
Auxiliary Checker
A tool that produces advisory evidence for human review rather than acting as an automated deployment gate. Progmune positions itself this way: results are evidence; hard-gating requires third-party evaluation, independent review, and enterprise POCs.
中文版
协议生命周期验证（Protocol Lifecycle Verification）
检查程序的操作是否遵循协议状态机定义的合法序列——传输前完成握手、支付确认前完成验签。与模式匹配不同，它验证的是跨函数调用序列的状态迁移。
AI 信任评分（AI Trust Score）
0–100 的评分，衡量一段代码可以被信任为「遵循正确协议行为」的程度。Progmune 按四维加权——策略 35%、协议安全 30%、覆盖 20%、治理 15%——并与 Decision（APPROVED / NEEDS_REVIEW / BLOCKED）合并输出。
证据链（Evidence Chain）
裁决背后的可审计轨迹：哪条规则触发、哪条调用序列违反了哪个协议状态、位于代码何处——评审者无需盲信工具即可复现发现。
状态机验证（State Machine Verification）
把协议建模为状态与迁移（UNAUTHENTICATED → AUTHENTICATED → AUTHORIZED），检查程序的实际调用序列是否只执行合法迁移。能抓住模式匹配无法表达的时序违规。
调用序列分析（Call Sequence Analysis）
重建跨函数、跨文件的函数调用链并对照约束评估。Progmune 从提取的 IR 构建调用序列，跨函数展开（深度 ≤4、环安全），违规归因到入口函数。
SAST（静态应用安全测试）
不运行代码就分析源码找漏洞——通常靠模式匹配、规则或数据流（CodeQL、Semgrep）。传统 SAST 检查语句与模式；它不验证跨调用序列的协议生命周期——这正是 Progmune 与之互补的地方。
注解驱动验证（Annotation-Driven Verification）
开发者在代码中声明协议原语（哪个函数验证密码、哪个建立会话），验证器据此检查调用序列。Progmune 在 C 和 Go 上采用此模式（Beta）：每协议约 2–3 条注解；未注解代码不检测。
辅助检查器（Auxiliary Checker）
产出供人工审查的参考证据、而非充当自动化部署门禁的工具。Progmune 如此定位自身：结果是证据；硬门禁化需第三方评测、独立审查与企业 POC。