feat: 实现 S05 5.4 报告产物 freshness（5 测试全绿）

- 报告产物 freshness + 陈旧/伪造报告不能通过
- scope/rule 执行覆盖核对
- ReportFreshnessChecker + ReportMetadata + ReportStatus
- 5.4 已勾选，5/5 测试全绿

Author: loong10k

crates/codeguard-adapters/src/lib.rs

@@ -520,3 +520,4 @@ pub mod adapter_protocol;
 pub mod conformance_harness;
 pub mod tool_resolution;
 pub mod tools_install;
+pub mod report_freshness;

crates/codeguard-adapters/src/report_freshness.rs

@@ -0,0 +1,98 @@
+//! 报告产物 freshness：陈旧或伪造空成功报告不能通过
+//!
+//! 验收标准：scope/rule 执行覆盖核对
+
+use serde::{Deserialize, Serialize};
+
+/// 报告状态
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum ReportStatus {
+    /// 新鲜
+    Fresh,
+    /// 陈旧
+    Stale,
+    /// 伪造
+    Forged,
+}
+
+/// 报告元数据
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ReportMetadata {
+    /// 报告 ID
+    pub id: String,
+    /// 创建时间
+    pub created_at: u64,
+    /// 过期时间
+    pub expires_at: u64,
+    /// 覆盖的规则
+    pub rules_covered: Vec<String>,
+    /// 覆盖的范围
+    pub scope_covered: Vec<String>,
+}
+
+/// Freshness 检查结果
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct FreshnessResult {
+    /// 报告状态
+    pub status: ReportStatus,
+    /// 是否通过
+    pub passed: bool,
+    /// 原因
+    pub reason: Option<String>,
+}
+
+/// 报告 freshness 检查器
+pub struct ReportFreshnessChecker;
+
+impl ReportFreshnessChecker {
+    /// 检查报告 freshness
+    pub fn check(
+        metadata: &ReportMetadata,
+        current_time: u64,
+        expected_rules: &[String],
+        expected_scope: &[String],
+    ) -> FreshnessResult {
+        // 检查是否陈旧
+        if current_time > metadata.expires_at {
+            return FreshnessResult {
+                status: ReportStatus::Stale,
+                passed: false,
+                reason: Some("report_expired".into()),
+            };
+        }
+        
+        // 检查是否伪造空成功
+        if metadata.rules_covered.is_empty() && metadata.scope_covered.is_empty() {
+            return FreshnessResult {
+                status: ReportStatus::Forged,
+                passed: false,
+                reason: Some("empty_success_forged".into()),
+            };
+        }
+        
+        // 检查覆盖范围
+        let rules_covered = expected_rules.iter()
+            .all(|r| metadata.rules_covered.contains(r));
+        let scope_covered = expected_scope.iter()
+            .all(|s| metadata.scope_covered.contains(s));
+        
+        if !rules_covered || !scope_covered {
+            return FreshnessResult {
+                status: ReportStatus::Stale,
+                passed: false,
+                reason: Some("incomplete_coverage".into()),
+            };
+        }
+        
+        FreshnessResult {
+            status: ReportStatus::Fresh,
+            passed: true,
+            reason: None,
+        }
+    }
+    
+    /// 验证报告不伪造
+    pub fn validate_not_forged(metadata: &ReportMetadata) -> bool {
+        !metadata.rules_covered.is_empty() || !metadata.scope_covered.is_empty()
+    }
+}

crates/codeguard-adapters/tests/report_freshness_test.rs

@@ -0,0 +1,84 @@
+//! 报告 freshness 测试
+
+use codeguard_adapters::report_freshness::*;
+
+fn create_metadata() -> ReportMetadata {
+    ReportMetadata {
+        id: "report-1".into(),
+        created_at: 100,
+        expires_at: 200,
+        rules_covered: vec!["rule1".into(), "rule2".into()],
+        scope_covered: vec!["file1.rs".into()],
+    }
+}
+
+#[test]
+fn fresh_report_passes() {
+    let metadata = create_metadata();
+    let result = ReportFreshnessChecker::check(
+        &metadata,
+        150,
+        &["rule1".to_string(), "rule2".to_string()],
+        &["file1.rs".to_string()],
+    );
+    
+    assert!(result.passed);
+    assert_eq!(result.status, ReportStatus::Fresh);
+}
+
+#[test]
+fn stale_report_fails() {
+    let metadata = create_metadata();
+    let result = ReportFreshnessChecker::check(
+        &metadata,
+        250,
+        &["rule1".to_string()],
+        &["file1.rs".to_string()],
+    );
+    
+    assert!(!result.passed);
+    assert_eq!(result.status, ReportStatus::Stale);
+}
+
+#[test]
+fn forged_empty_report_fails() {
+    let metadata = ReportMetadata {
+        id: "report-1".into(),
+        created_at: 100,
+        expires_at: 200,
+        rules_covered: vec![],
+        scope_covered: vec![],
+    };
+    
+    let result = ReportFreshnessChecker::check(&metadata, 150, &[], &[]);
+    assert!(!result.passed);
+    assert_eq!(result.status, ReportStatus::Forged);
+}
+
+#[test]
+fn incomplete_coverage_fails() {
+    let metadata = create_metadata();
+    let result = ReportFreshnessChecker::check(
+        &metadata,
+        150,
+        &["rule1".to_string(), "rule2".to_string(), "rule3".to_string()],
+        &["file1.rs".to_string()],
+    );
+    
+    assert!(!result.passed);
+}
+
+#[test]
+fn validate_not_forged() {
+    let metadata = create_metadata();
+    assert!(ReportFreshnessChecker::validate_not_forged(&metadata));
+    
+    let empty = ReportMetadata {
+        id: "report-1".into(),
+        created_at: 100,
+        expires_at: 200,
+        rules_covered: vec![],
+        scope_covered: vec![],
+    };
+    assert!(!ReportFreshnessChecker::validate_not_forged(&empty));
+}