feat(m3): add evidence collectors and ENV007–ENV012 rules

.github/workflows/ci.yml

@@ -42,6 +42,9 @@ jobs:
       - name: Vet
         run: go vet ./...
 
+      - name: Check generated rule documentation
+        run: go run ./cmd/rulegen --check
+
       - name: Test
         run: go test -race -count=1 -timeout=120s ./...
 

CHANGELOG.md

@@ -9,6 +9,22 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
 ### Added
 
+- M3 rules ENV007–ENV012: known Docker API incompatibility, explicitly required dependency absence,
+  package-manager/lockfile disagreements, effective Git identity/explicit autocrlf policy,
+  canonical virtualenv/interpreter mismatch and opt-in proxy refusal/no-route evidence.
+- Local Docker context/API metadata, strict version-1 `envdoctor.requirements.json`, supported
+  tool/OpenSSL metadata checks and explicit `--package-manager` runner evidence.
+- Redacted proxy configuration with bounded `--probe-network` DNS/TCP checks, offline by default.
+- Offline `explain`, `rules --json`, a shared rule registry, generated pages for all twelve rules,
+  `make docs`/`make check-docs` and CI documentation drift enforcement.
+- 118 additional golden cases, preserving the original 54 for 172 total; collector, schema, purity,
+  CLI, cancellation and socket lifecycle regressions.
+- Accepted [ADR 0005](docs/adr/0005-m3-evidence-and-rule-registry.md),
+  [M3 acceptance requirements](docs/phases/M3.md), [validation evidence](docs/testing/m3-validation.md)
+  and [development-tool audit](docs/DEVELOPMENT-TOOLS.md). M3 is complete on the feature branch;
+  [CI 43723839978](https://github.com/Shellghostt/EnvDoctor/actions/runs/43723839978) passed native
+  Windows/Ubuntu/macOS race, tests and builds, plus lint and the vulnerability scan.
+
 - M2 runtime, requested TCP-port and Git collectors, plus the local Docker probe needed by ENV006.
 - Rules ENV001–ENV006 with deterministic evidence, manual suggestions and rule documentation.
 - 54 three-OS golden cases and built-CLI checks for JSON, findings and exit codes.
@@ -19,6 +35,11 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
 ### Changed
 
+- Optional M3 snapshot evidence extends schema v1 compatibly; project and rule-registry JSON have
+  separate version-1 schemas. Explicit typed partial collector evidence retains degraded notices
+  and disables dependent rules.
+- `make build` disables CGO only for static builds and uses `.exe` on Windows; race tests retain CGO.
+- Home/credential-URL redaction covers new evidence, paths within URLs, and collector/CLI errors.
 - `golang.org/x/sys` updated to v0.48.0 to remove the vulnerable v0.30.0 dependency.
 - Feature and fix branches trigger the three-OS CI matrix. Snapshot schema permits absent platform facts
   after a failed collector; offline errors retain degraded notices and exit code 3.
@@ -33,6 +54,11 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
 ### Fixed
 
+- Bounded subprocess output no longer exposes `bytes.Buffer.ReadFrom`, which could bypass the
+  writer's limit for stdout/stderr.
+- Protected WindowsApps/MSIX paths and application aliases remain unresolved metadata; new
+  unknown-resolution snapshots do not cause speculative M2 runtime conflicts.
+- Git autocrlf boolean aliases use portable typed config queries; `input` is handled directly.
 - M1 runner deadline now bounds a collector that ignores cancellation.
 - Home redaction includes quoted PATH entries and paths embedded in collector/timing errors.
 - Broken symlinks do not shadow usable runtimes; Python venvs stay distinct from their system symlink
@@ -46,7 +72,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
 ### Planned
 
-- M3: rules ENV007–ENV012, full Docker/dependency inspection and the `explain` command.
+- M4 reports and bundles; later rules ENV013–ENV018, confirmed fixes and signed releases.
 
 ## [0.1.0] - 2026-11-13
 

CONTRIBUTING.md

@@ -9,6 +9,10 @@ Thanks for taking the time. This document is deliberately short and specific.
 2. [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) - how the pieces fit together.
 3. [docs/adr/](docs/adr/) - decisions that have already been argued about. Do not relitigate them
    without a new ADR.
+4. [docs/phases/M3.md](docs/phases/M3.md) and [ADR 0005](docs/adr/0005-m3-evidence-and-rule-registry.md) -
+   implemented M3 evidence contracts and verified three-OS CI gate.
+5. [docs/DEVELOPMENT-TOOLS.md](docs/DEVELOPMENT-TOOLS.md) - CodeGraph freshness, static-analysis coverage
+   and profiling appropriate to this repository's runtime.
 
 ## Ground rules
 
@@ -27,10 +31,31 @@ make test        # unit tests
 make lint        # formatting and static analysis
 ```
 
-`go test -count=1 -timeout=120s ./...` also builds the CLI and runs all 54 golden cases through it.
+Pin `GOTOOLCHAIN=go1.26.11` for the recorded gates. `go test -count=1 -timeout=120s ./...` also builds
+the CLI and runs all 172 golden cases through it, including the unchanged 54 M2 cases.
 Each new rule needs positive, negative and edge snapshots for Windows, Linux and macOS. Expected
 findings are reviewed evidence, not output regenerated from the implementation. See
-[the validation record](docs/testing/m1-m2-validation.md) for Windows and Linux race commands.
+[M3 validation](docs/testing/m3-validation.md) for native Windows and Linux race commands and limits.
+Windows race tests need a 64-bit MinGW-w64-compatible GCC configured in Go's CC/CXX; ordinary static
+builds use `make build`, which disables CGO only for that target.
+
+## Rule metadata and documentation
+
+`internal/diagnostic/registry.go` owns each builtin rule's metadata and pure evaluator. Findings,
+`explain`, `rules --json` and generated `docs/rules/ENV*.md` pages share that registry.
+Update the registry, add reviewed fixtures, then run:
+
+```bash
+make docs
+make check-docs
+make test
+make race
+make lint
+```
+
+Do not edit generated rule pages directly. Tests and CI reject drift. Optional evidence additions must
+preserve snapshot-v1 compatibility; project and registry contracts have their own committed schemas.
+Unknown or failed evidence cannot become a speculative finding, and no metadata command runs collectors.
 
 ## Code navigation
 

Makefile

@@ -1,13 +1,17 @@
-BINARY := envdoctor
-VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+ifeq ($(OS),Windows_NT)
+EXE_EXT := .exe
+endif
+BINARY := envdoctor$(EXE_EXT)
+VERSION ?= $(shell git describe --tags --always --dirty)
 LDFLAGS := -s -w -X main.version=$(VERSION)
 
-.PHONY: bootstrap build test race lint fmt vet run docker clean
+.PHONY: bootstrap build test race lint fmt vet docs check-docs run docker clean
 
 bootstrap:
 	go mod download
 	go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0
 
+build: export CGO_ENABLED := 0
 build:
 	go build -trimpath -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/envdoctor
 
@@ -27,6 +31,12 @@ fmt:
 vet:
 	go vet ./...
 
+docs:
+	go run ./cmd/rulegen
+
+check-docs:
+	go run ./cmd/rulegen --check
+
 run: build
 	./bin/$(BINARY)