feat(audit): extract item-counting grammar to config (#6855 phase 1)

[chubes4]

Phase 1 of #6855. Replaces hardcoded count_rust_items/count_php_items/count_js_items/is_rust_item_declaration in structural.rs with a generic config-driven count_items primitive reading a new LanguageGrammar contract (item_declaration_prefixes / visibility_prefixes / modifier_prefixes / ignore_after_line_equals). Rust/PHP/JS item keywords move OUT of core into homeboy.json audit config. GodFile/HighItemCount counts are byte-identical (regression tests assert parity). Removes language literals from structural.rs. Verified cargo build --lib --tests + cargo test --lib structural unchanged.

[homeboy-ci]

Homeboy Results — homeboy

Lint

✅ lint — passed

ℹ️ Full options: homeboy docs commands/lint
ℹ️ Save lint baseline: homeboy lint homeboy --baseline
Deep dive: homeboy lint homeboy --changed-since fe22094

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-homeboy-lint-homeboy-Linux contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-homeboy-lint-homeboy-Linux contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/homeboy/actions/runs/28326148858

Test

⚠️ test — baseline red

ℹ️ No tests ran — the runner failed before producing results. See raw_output.stderr_tail / raw_output.stdout_tail for the underlying error (bootstrap failure, missing deps, DB connection, etc.).
ℹ️ To run specific tests: homeboy test homeboy -- --filter=TestName
ℹ️ Auto-fix lint issues: homeboy refactor homeboy --from lint --write
ℹ️ Collect coverage: homeboy test homeboy --coverage
ℹ️ Analyze failures: homeboy test homeboy --analyze
ℹ️ Pass args to test runner: homeboy test -- [args]
ℹ️ Full options: homeboy docs commands/test
Deep dive: homeboy test homeboy --changed-since fe22094

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-homeboy-test-homeboy-Linux contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-homeboy-test-homeboy-Linux contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/homeboy/actions/runs/28326148858

Audit

❌ audit — failed

• core_boundary_leak:core-agnostic-source — 70 finding(s)
• structural — 53 finding(s)
• intra-method-duplication — 46 finding(s)
• field_patterns — 35 finding(s)
• dead_code — 19 finding(s)
• near-duplication — 17 finding(s)
• test_quality — 13 finding(s)
• duplication — 9 finding(s)
• remote_execution_preflight — 8 finding(s)
• thin_command_adapter — 8 finding(s)
• Total: 304 finding(s)

Deep dive: homeboy audit homeboy --changed-since fe22094

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-homeboy-audit-homeboy-Linux contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-homeboy-audit-homeboy-Linux contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/homeboy/actions/runs/28326148858

Tooling versions

• Homeboy CLI: homeboy 0.268.0+656b8ad09816+bba770a4d
• Extension: rust from https://github.com/Extra-Chill/homeboy-extensions
• Extension revision: 8b68b5fc
• Action: unknown@unknown

[chubes4]

⚠️ Do not merge — Audit gate exposes a runtime regression

Lint ✅ and Test ✅ (the structural parity unit tests pass — count_items reproduces count_rust_items/count_php_items/count_js_items byte-for-byte). But the Audit gate fails with delta: +293, drift_increased: true — and crucially, this persists after rebasing onto current main (so it is NOT baseline drift / #6808).

The +293 new findings are spread across every detector category (158 CoreBoundaryLeak, 78 HighItemCount, 72 RepeatedFieldPattern, 28 GodFile, NamingMismatch/MissingMethod/DuplicateFunction in dozens of untouched files like http_api.rs, agent_task_dispatch.rs, project/types/*). That broad, cross-detector explosion is the signature of the audit config not being fully applied at runtime on this branch — e.g. exclude_path_contains/allowlists/detector configs effectively reverting to defaults, so every file (incl. generated/test) gets scanned and CoreBoundaryLeak/GodFile/HighItemCount fire everywhere.

What I ruled out

• Not baseline drift (persists post-rebase).
• Not the new #[serde(default)] language_grammars field breaking deserialization (all fields defaulted, no deny_unknown_fields).
• Not the component/mod.rs change (pure pub use reorder).
• Parity is correct (unit tests pass) — so count_items itself is fine.

Likely root cause (needs runtime trace)

Something in the wiring (descriptor_runtime.rs passing &config.language_grammars, or the AuditConfig::is_empty()/merge change) causes the live audit run to diverge from the unit-test path — most plausibly the structural/symbol-graph analysis no longer receives the loaded config the same way, collapsing item/structure understanding so cross-reference detectors mis-fire. The unit tests don't catch it because they construct config in-Rust and bypass the runtime config-load + multi-detector assembly.

Recommendation

Hold this PR. Phase 1's migration touched a primitive shared by more than just count_top_level_items (symbol-graph + structural share understanding of "what's an item"), so it needs the full audit run traced locally (or a test that loads the real homeboy.json audit config and asserts the live finding count is unchanged on a fixture tree) before re-attempting. Adding such a config-round-trip regression test should be part of Phase 1 so this class of break can't pass Lint+Test again.

[chubes4]

Status: held as draft. Root cause is a real-codebase-specific audit regression that synthetic-fixture harnesses can't reproduce (proven in #6855 / #6917). Blocked on #6920 (real-repo drift harness). Full consolidated trail: #6855. Migration code here is correct and salvageable once #6920 lands.

[chubes4]

Closing as superseded by #6915, which is the current grammar phase 1 draft.