Hlola futhi Uthuthukise Ikhodi Ekhiqizwe yi-AI nge-Iron Laws

Iyini i-Iron Laws?

I-Iron Laws, eyaziwa nangokuthi 오철칙, iyithuluzi lokuhlola elingaguquki elenzelwe ukuthola izinkinga zokuphepha nokugcinwa kalula ezivame ukutholakala kumaphrojekthi akhiqizwe yi-AI. Isebenzisa izifundo ezithathwe ekuhlolweni kokuhlanganiswa kwezinhlelo emabhizinisini nasemkhakheni kahulumeni, bese ichaza lokho ekutholayo ngolimi olulula ukuqondwa.

Ithuluzi libheka okungaphezu kokuthi uhlelo lusebenza nje kuphela. Lihlola izinkinga ezifana nezimfihlo ezibhalwe ngokuqinile kukhodi, ukuphathwa okungaphephile kokokufaka, amaphutha agwinyiwe, ama-API okuphatha angenakho ukuqinisekiswa kobunikazi, ukungabikho kwezilawuli zokufinyelela ze-Supabase noma i-Firebase, amafayela e-.env afakwe ekomitini, imisebenzi ephindiwe, ukuncika okuyindilinga, kanye nokweqa ukuphepha kwezinhlobo.

I-Iron Laws iphinde ikhiqize imiyalelo ehlelekile yokulungisa enganamathiselwa kumsizi wokubhala ikhodi we-AI. Lokhu kwakha inqubo ephindaphindekayo:

Yakha nge-AI → hlola nge-iron-laws → iron-laws fix-prompt
→ cela i-AI ukuthi ilungise lokho okutholakele → hlola futhi

I-Iron Laws iwusizo lokubuyekeza ngesikhathi sokuthuthukisa, hhayi umkhiqizo osemthethweni wokunikeza isitifiketi noma ubufakazi bokuthi uhlelo luvikelekile. Yisebenzise kanye nezivivinyo, ukubuyekezwa kwekhodi, namanye amathuluzi okuphepha.

Izici Ezisemqoka

Ukuhlola ukuphepha nekhwalithi

Le phrojekthi inemithetho engu-90 ehlanganisa izindawo eziningana:

• Imithetho eyisethenjwa: Ukumbozwa kwazo zonke izinto ezingu-49 zesigaba sokuqalisa ezivela kumhlahlandlela waseKorea woMnyango Wezangaphakathi Nokuphepha wokuphepha ekuthuthukisweni kwesoftware, okuhlanganisa i-injection, i-XSS, i-SSRF, i-XXE, ukubethela okubuthakathaka, ukukhubaza ukuqinisekiswa kwezitifiketi, ukuguqulwa kwedatha kube izinto ngendlela engaphephile, ukuphathwa kwamaphutha, nokuphepha kwememori.
• Ukulungiswa kwekhodi ye-AI: Ukucushwa okubhalwe ngokuqinile, amanani ayisipele ayizimfihlo, ukuvezwa kwezimfihlo ku-frontend, i-CORS engaphephile, ukungabikho kwemithetho yokufinyelela, izilungiselelo eziyingozi ze-Docker noma ze-CI, amaphutha okuthayipha kokuncika, ukuncika okungaboshiwe enguqulweni, ukuloga kolwazi olubucayi, i-IDOR, nezimfanelo zamakhukhi.
• Ukuhlolwa kwesakhiwo: Imisebenzi namafayela amakhulu ngokweqile, ukuncika okungafanele phakathi kwezingqimba, ukufinyelela okuqondile kusizindalwazi kusuka kubaphathi bezicelo, ukuncika okuyindilinga, imisebenzi ephindiwe, ama-string constants aphindaphindiwe, kanye nokungabikho kwezivivinyo.
• Ukuhlolwa kokuphepha kwezinhlobo: I-TypeScript any ne-@ts-ignore, i-Python type: ignore nama-cast, izinhlobo ezingavuthiwe ze-Java, i-C# dynamic, kanye nokweqa isistimu yezinhlobo kwezinye izilimi ezisekelwayo.

Okutholakele okufundeka kalula nemihlahlandlela yokulungisa

Konke okutholakele kuhlanganisa incazelo yenkinga, ukuthi kungani iyingozi, nokuthi ingalungiswa kanjani. Lapho umthetho uhambisana nento yomhlahlandlela oshicilelwe, umbiko uhlanganisa inombolo yaleyo nto nokuhambisana kwayo ne-CWE. Imithetho yekhwalithi eqondene nephrojekthi ikhonjiswa ngokusobala njengemithetho ye-Iron Laws, hhayi njengezidingo zangaphandle.

Imiyalelo yokulungisa elungele i-AI

Umyalo we-fix-prompt uhlela lokho okutholakele ngokobukhulu benkinga futhi ukuguqule kube imiyalelo yethuluzi le-AI lokubhala ikhodi. I-prompt iphinde iqinise izimiso ezifana nokungagwinyi amaphutha, ukungafaki izimfihlo kukhodi yomthombo, ukungakweqi ukuhlolwa kwezinhlobo, nokungakhi okunye ukusetshenziswa okuphindiwe.

Ukuhlaziya kwasendaweni

Abahlaziyi abadingekayo bafakiwe ephaketheni, ngakho ukuhlola kungasebenza ngaphandle kokufinyelela kunethiwekhi ngemva kokufakwa.

Ukusekelwa Kwezilimi Namafayela

Izinga lokusekelwa liyahlukahluka kuye ngolimi nohlobo lwefayela:

• Ukusekelwa okujulile: I-Python, i-JavaScript, i-TypeScript, i-Java, ne-C# zithola ukuhlaziya kwe-syntax, ukulandelela okokufaka, nokumbozwa kwemithetho okubanzi kakhulu.
• Ukusekelwa okuyisisekelo: I-Go ne-PHP zithola ukuhlaziya kwe-syntax kanye nokuhlolwa okubalulekile kwe-injection, ukuphathwa kwamaphutha, nokubethela.
• Ukusekelwa okulinganiselwe: I-Rust ne-C/C++ zithola ukuhlolwa kokuphathwa kwamaphutha, ukusetshenziswa kwememori, ama-format string, ama-API, kanye nokweqa izinhlobo.
• Amafayela okucushwa nawencazelo: I-SQL, i-YAML, i-JSON, .env, i-Dockerfile, i-Compose, i-GitHub Actions, i-MyBatis XML, namathempulethi e-HTML kuyahlolwa ukuze kutholakale izinkinga ezifanele zezimfihlo, zokulawula ukufinyelela, zokuphakela, nezokubalekisa izinhlamvu.

Ngaphakathi kwemisebenzi, i-Iron Laws ihlaziya ukuhamba kolwazi phakathi kwamagatsha, amaluphu, namaphutha. Ilandela ukubizwa kwemisebenzi ewusizo ekwifayela elifanayo kuze kufike kumazinga amane okujula. I-Python futhi inokulandelela kokuwela amafayela okusezigabeni zokuhlolwa ngokusebenzisa ama-import, ngaphansi kwemikhawulo yokuhlaziya. Ukuhamba kolwazi okuwela amafayela kwezinye izilimi kungase kungatholakali noma kubikwe njengokudinga ukubuyekezwa.

Ukufakwa

I-Iron Laws idinga i-Python 3.12 noma entsha. Indlela enconyiwe ukuyifaka njengethuluzi elizimele usebenzisa i-uv:

uv tool install git+https://github.com/JinHo-von-Choi/iron-laws.git

Ungayifaka futhi usebenzisa i-pip:

pip install git+https://github.com/JinHo-von-Choi/iron-laws.git

Ngemva kokuyifaka, qinisekisa ukuthi umyalo uyatholakala ngokufaka kuhlu imithetho efakiwe:

iron-laws rules

Ukuhlola isimo sokuqaliswa nokuqinisekiswa ngolimi nangomthetho, sebenzisa:

iron-laws support

Lo mehluko ubalulekile ngoba ukuba khona komhlaziyi akusho ngempela ukuthi wonke umthetho uqinisekisiwe ngalolo limi.

Qalisa Ukuhlola Kwakho Kokuqala

Skena iphrojekthi yamanje

Vula i-terminal enkombeni yephrojekthi bese usebenzisa:

iron-laws check .

Ngokuzenzakalelayo, umyalo uyehluleka lapho uthola okutholakele okusezingeni le-HIGH noma ngaphezulu. Amakhodi okuphuma yiwona alandelayo:

• 0: Ukuhlola kuphumelele ngaphansi kwenqubomgomo yobukhulu benkinga ekhethiwe.
• 1: Okungenani into eyodwa etholakele ifinyelele noma yeqa ubukhulu bokwehluleka obumisiwe.
• 2: Okokufaka noma ukucushwa bekungavumelekile, awekho amafayela ahloliwe, noma ukuhlola akukwazanga ukuqedwa ngenxa yezinkinga ezifana namaphutha emithetho noma ukwehluleka ukufunda amafayela.

Ukuhlolwa okungaphelele akutholi ibanga eliqinisekisiwe noma umphumela wokuphasa. Izizathu zako zirekhodwa ngaphansi kwe-diagnostics. Ithagethi engenalutho nayo ayithathwa njengokuskena okuyimpumelelo ngaphandle kokuthi kunikezwe ngokusobala i---allow-empty.

Qonda umthetho ngamunye

Sebenzisa i-explain uma udinga incazelo yomthetho ngolimi olulula:

iron-laws explain IL-501

Ungahlola futhi ukuthi yiziphi izinto zokusebenzisa ezingu-49 ezibhekisiwe ezimboziwe:

iron-laws coverage

Yakha umbiko

Ukuze wakhe umbiko we-Markdown oqukethe isimo sokuhlolwa kwazo zonke izinto ezingu-49 ezibhekisiwe, sebenzisa:

iron-laws audit . --format markdown -o report.md

Ukuze wakhe ifayela le-SARIF le-GitHub Code Scanning noma olunye uhlelo oluhambisanayo, sebenzisa:

iron-laws audit . --format sarif -o iron-laws.sarif

Yakha Imiyalelo Yomsizi Wokubhala Ikhodi we-AI

Ngemva kokubuyekeza okutholakele, yakha umbuzo wokulungisa olungele i-AI:

iron-laws fix-prompt .

Namathisela imiyalelo ekhiqiziwe kumsizi wakho wokubhala ikhodi, buyekeza izinguquko eziphakanyisiwe, bese uphinda ukuhlola:

iron-laws check .

Umyalo we-fix-prompt ubuyisa ikhodi yokuphuma ethi 0 noma ngabe kukhona okutholakele, ngoba inhloso yawo ukwakha imiyalelo. Ungawusebenzisi njengesango lokuthunyelwa. Sebenzisa i-check noma i-audit ukuze uphoqelele imithetho.

Amanani ezimfihlo abonwayo afihlwa njenge-**** emibikweni nakumiyalelo ekhiqiziwe. Nokho, izimfihlo ezingabonwa azikwazi ukufihlwa ngokuzenzakalela, ngakho buyekeza umbhalo okhiqiziwe ngaphambi kokuwuthumela kusevisi ye-AI yangaphandle.

Hlela Izinqubomgomo Zephrojekthi

Yakha ifayela lokuqala lokumisa ngo:

iron-laws init

Iphrojekthi isebenzisa i-.iron-laws.yml. Ukumisa okujwayelekile kungaba:

fail_on: HIGH
excludes: [".git", "node_modules", "dist"]
disabled_rules: ["ARC-206"]
limits:
  max_function_lines: 80
  max_file_lines: 600
  max_parameters: 7
  max_nesting: 5
  duplicate_similarity: 0.9

Isilungiselelo se-fail_on samukela i-CRITICAL, HIGH, MEDIUM, noma i-LOW. Ukuhleleka okusebenzayo kokubaluleka yi---fail-on yomugqa womyalo, bese kuba ifayela lokumisa, bese kuba inani elizenzakalelayo elithi HIGH. Imibiko iqopha ukuthi yimuphi umthombo onikeze umkhawulo osebenzayo.

Ngokuzenzakalela, i-Iron Laws isebenzisa ukumisa okukuhla oluhlolwayo. Sebenzisa i---config ukukhetha ifayela elithile noma i---search-parents ukubheka kumafolda angabazali. Okhiye abangaziwa nezilungiselelo ezingavumelekile azizitshwanga buthule; zikhiqiza ikhodi yokuphuma ethi 2.

Phatha Okuhlukile Okuhlosiwe

Umphumela omuhle ongamanga noma okuhlukile okuhlosiwe kungacindezelwa kuphela uma ukucindezela kuqukethe isizathu. Amazwana angenaso isizathu ayazitshwa.

Ukucindezela okukodwa okutholakele ku-Python:

except ImportError:  # iron-laws: ignore[IL-301] Optional dependency disables this feature
    yaml = None

Ukucindezela umthetho wefayela lonke, faka umyalelo we-ignore-file phakathi kwemigqa yokuqala engu-30:

# iron-laws: ignore-file[IL-102] Pattern definitions intentionally identify weak algorithms

Ukucindezela kungafaka usuku lokuphelelwa isikhathi:

# iron-laws: ignore[IL-101] until=2026-12-31 Temporary exception with documented reason

Ukucindezela okuphelelwe isikhathi kuyayeka ukusebenza futhi kuvela emibikweni. I-Iron Laws iphinde ibike ukucindezela okungasetshenziswanga nezinkomba zama-ID emithetho engaziwa.

Yamukela I-Iron Laws Kuphrojekthi Ekhona

Yakha isisekelo

Uma inqolobane ekhona isivele inokutholakele okwamukelwe, kubhale njengokusalela kwesikweletu sobuchwepheshe esivunyelwe:

iron-laws baseline create .

Bese uhlola kuphela okutholakele okusha ngokuqhathanisa nesisekelo esilondoloziwe:

iron-laws check . --baseline .iron-laws-baseline.json

Hlola amafayela ashintshiwe

Ukuze uthole impendulo yesicelo sokuhlanganisa egxile kumafayela ashintshiwe, qhathanisa negatsha eliyinhloko:

iron-laws check . --changed-since origin/main

I-README incoma ukuhlanganisa ukuhlolwa kwamafayela ashintshiwe nokuskena okugcwele nokwenziwa ngezikhathi ezithile ukuze izinkinga zayo yonke inqolobane zinganakwa.

Qopha impendulo yokubuyekeza

Okutholakele okumakwe njengokudinga ukubuyekezwa kungahlukaniswa futhi kunikezwe izindleko zokubuyekeza:

iron-laws feedback add IL-501 src/a.py:3 --verdict false-positive --minutes 10

Qinisekisa Ama-Patch Akhiqizwe yi-AI

I-Iron Laws inohlelo oluthuthukisiwe lokugcina ubufakazi balokho okuqinisekisiwe nalokho okungaqinisekiswanga ngemva kokuba i-AI iguqule ikhodi.

Hlola inkontileka yobufakazi

Inkontileka yobufakazi ihlukanisa ukuskena okuqediwe nokuskena okukhiqize ubufakazi obudingekayo ngempela:

iron-laws check . --contract .iron-laws-contract.yml

Imithombo yokufaka engakaxazululwa ayiguqulwa ngokuzenzakalela ibe yimiphumela ehlanzekile. Ukumbozwa kwamanje kwenkontileka yobufakazi kufaka phakathi ukwenziwa kwemiyalo ye-Python, ukufinyelela ezindleleni, nemindeni yokwakha i-SQL.

Yakha irisidi yokuqinisekisa i-patch

Ukuze uhlole i-patch ephakanyisiwe futhi ulondoloze irisidi yokuqinisekisa, sebenzisa umyalo ofana nalo:

iron-laws verify-patch . --patch fix.diff \
  --finding IL-504@app.py:6 \
  --runner docker \
  --image IMAGE_NAME \
  -o receipt.json

Isiqinisekisi siqhathanisa eyokuqala naleyo ezofakwa sisebenzisa inqubomgomo efanayo. Sibika ngokwehlukana izinguquko ezisolisayo ezifana nokususwa kwezivivinyo, ukweqa okwengeziwe, amazwana amasha okuziba, noma izinqubomgomo ezenziwe buthaka. Ukunyamalala kwesexwayiso akubhekwa, ngokwakho, njengobufakazi bokulungisa okuvumelekile.

Ukuhlolwa kwenziwa kuphela endaweni ehlukanisiwe elahlwayo engenazo iziqinisekiso zokungena. Uma ukuhlukaniswa kungenakutholwa, i-Iron Laws ayikwenzi ukuhlolwa buthule ku-host; ishiya umphumela ungacacile.

Phakamisa ukuhlolwa kokuhlehla okuhlukanisayo

Ungakhiqiza imininingwane yokuhlolwa kokuhlehla okuphakanyisiwe kokutholakele:

iron-laws regression propose . --finding IL-504@app.py -o spec.yml

Indlela yokuqinisekisa ehlosiwe ihlola ukuthi eyokuqala iyehluleka ngenxa yesici, lowo okhethiwe uyaphumelela, bese i-mutant lapho ukulungiswa kubuyiselwe khona iphinde yehluleke. I-README ichaza ukuphinda lolu chungechunge izikhathi ezintathu. Ukuhlolwa okukhiqiziwe kuhlala kuyisiphakamiso kuze kuqinisekiswe.

Rekhoda ukugunyazwa komuntu

Gcina ukugunyazwa kanye nesizathu sako:

iron-laws approvals add . \
  --finding IL-504@app.py \
  --reason "Documented review reason" \
  --store approvals.jsonl

Sebenzisa ukugunyazwa okuvumelekile ngesikhathi sokuskena:

iron-laws check . --approvals approvals.jsonl

Ukugunyazwa kuhlala kusebenza kuphela uma izizindlo zakho zisasebenza. Izinguquko kubabizi, ekugelezeni kwedatha, kuma-sanitizer, kububanzi bokufinyelela, noma encazelweni yomthetho zingadinga ukubuyekezwa kabusha. Ikhodi esengozini ephindwe kwenye indawo ayitholi ngokuzenzakalelayo ukugunyazwa okukhona.

Hlanganisa ne-GitHub Actions

Le workflow elandelayo ifaka i-Iron Laws, ilayishe umbiko we-SARIF, bese iphoqelela isango lokuthunyelwa elinobukhulu obuphezulu:

name: Iron Laws
on: [push, pull_request]
jobs:
  audit:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v3
      - run: uv tool install git+https://github.com/JinHo-von-Choi/iron-laws.git
      - run: iron-laws audit . --format sarif -o iron-laws.sarif || true
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: iron-laws.sarif
      - run: iron-laws check . --fail-on HIGH

Isinyathelo sokukhiqiza umbiko sisebenzisa || true ukuze ifayela le-SARIF likwazi ukulayishwa nalapho kukhona okutholakele. Umyalo wokugcina we-check yiwona onikeza isango langempela lokuphumelela noma ukwehluleka.

Imikhawulo Esebenzayo

• Umphumela ohlanzekile usho ukuthi akukho nkinga etholakele ngaphakathi kwemithetho esetshenzisiwe nobubanzi bokuhlaziya obusekelwayo. Akufakazeli ukuthi uhlelo lokusebenza alunabungozi.
• Ukulandelela okokufaka okuwela amafayela amaningi kusezigabeni zokuhlolwa kwe-Python futhi kunomkhawulo kwezinye izilimi. Okunye ukugeleza kungaphuthelwa noma kubikwe njengokudinga ukubuyekezwa ngesandla.
• Ama-sanitizer abonwa kuphela kumongo awuvikelayo, njenge-HTML, i-SQL, imiyalo ye-shell, noma izindlela zamafayela.
• Ngokusho kwe-README, ukuqinisekiswa kwama-patch, ukuhlolwa kokuhlehla, nokulandelelwa kokugunyazwa akukakatholi ukuhlolwa okuzimele noma ukusetshenziswa kokuhlola emhlabeni wangempela.
• Imiphumela ye-OWASP Benchmark ecashunwe iphrojekthi ikhombisa ukuthuthuka ezigabeni eziningana, kodwa ama-false positive asekhona, kuhlanganise nezimo ze-SQL ezihlanziwe ngokuphepha nezokufakwa kwemiyalo.
• Ngaphandle kokubheka i-package repository, ithuluzi alikwazi ukukhomba ngokuthembekile zonke izixhomekeko eziqanjiwe. Kunalokho libika amagama afana namaphakheji adumile.
• Amafayela acindezelwe nakhiqiziwe ayagxunywa, nezizathu zirekhodwa ngaphansi kwe-skipped_files.

Ukuze uthole imininingwane eyengeziwe, bheka imibhalo ye-repository mayelana nokuqinisekiswa kwama-patch, nezilinganiso zokunemba, nokusekelwa kwezilimi nemithetho, kanye namafomethi emibiko.

Isiphetho

I-Iron Laws inikeza indlela ehlelekile yokubuyekeza isofthiwe ekhiqizwe yi-AI ngaphambi kokuba izinkinga ezifihlekile zokuphepha nokugcinwa kwayo zibe yizehlakalo zokukhiqiza. Qala ngo-iron-laws check ., hlola izincazelo, khiqiza umyalo wokulungisa, buyekeza izinguquko ze-AI, bese uskena futhi. Njengoba iphrojekthi ikhula, engeza ukucushwa, ama-baseline, ukubika kwe-SARIF, amarisidi ama-patch, nokugunyazwa kwabantu ukuze wenze inqubo iphindaphindeke futhi ihlolwe.

Le phrojekthi itholakala ngaphansi kwe-MIT License. Imiphumela yayo kufanele isekele, ingathathi indawo, yokuhlolwa, ukubuyekezwa kwekhodi ngesandla, kanye nokuhlolwa okubanzi kwezokuphepha.