MoonTrustFlow

MoonTrustFlow is a MoonBit Policy-as-Code toolkit for trusted data-flow governance. It turns a compact .mtf rule file into deterministic findings that can be reused in code review, CI audit, architecture governance, and security acceptance work.

This project is intentionally scoped as the policy and path-analysis middle layer. It does not claim to be a full compiler frontend or a production-ready whole-program analyzer. Instead, it focuses on the part many MoonBit projects still lack today: a small, reviewable, explainable trust-flow engine that can later accept AST, call-graph, or architecture-adapter inputs.

Why It Matters

MoonBit ecosystem projects need reusable governance tooling, not only runtime libraries.
Security and compliance reviews often need deterministic source-to-sink evidence instead of prose.
A compact rule language is easier to audit, version, and discuss in pull requests than ad hoc scripts.

Current Capabilities

Parse .mtf models with stable line and column diagnostics.
Model source, sink, sanitizer, boundary, node, and edge.
Evaluate deny, require through=, and exact-path allow policies.
Report complex scenarios including multi-sink, branching, and cycle-pruned paths.
Emit both plain-text and JSON findings.
Emit SARIF 2.1.0 findings for GitHub code-scanning and security review pipelines.
Produce graph exports, node-impact rankings, policy audits, risk assessments, and deployment contracts.
Compare findings against a versioned baseline to distinguish new, resolved, and regressed risks.
Analyze multiple models in one deterministic batch report.
Drive real fixture analysis through repository scripts without changing the core package target surface.
Import a lightweight call-graph JSON description into .mtf for adapter-oriented experiments.
Run a repeatable performance smoke test over generated larger trust-flow graphs.

Public API

parse_model(input : String) -> Result[Model, TrustFlowError]
analyze(model : Model) -> Array[Finding]
analyze_text(input : String) -> Result[Array[Finding], TrustFlowError]
format_finding(finding : Finding) -> String
format_report(findings : Array[Finding]) -> String
format_report_json(findings : Array[Finding]) -> String
format_error(err : TrustFlowError) -> String

Core public types include NodeKind, RuleKind, Node, Edge, Policy, Model, Finding, and TrustFlowError.

Example Model

source request_body "external input"
boundary api_gateway "trusted service boundary"
sanitizer escape_html "html output encoding"
sink render_html "html response renderer"

edge request_body -> api_gateway "ingress"
edge api_gateway -> render_html "response output"
edge api_gateway -> escape_html "encode"
edge escape_html -> render_html "safe render"

deny request_body -> render_html severity=high "raw input must not render directly"
require request_body -> render_html through=escape_html severity=medium "html output must be encoded"
allow request_body -> api_gateway -> escape_html -> render_html "encoded response path"

Quick Start

Install the package from Mooncakes:

moon add lllg123/moontrustflow

Validate the repository locally:

# MoonBit 0.10.3+16975d007
moon check --target all --deny-warn
moon test --deny-warn
moon fmt
moon info
moon run cmd/main

moon test --target all --deny-warn additionally exercises the native backend and therefore requires a system C compiler. The three-platform CI workflow installs the required compiler toolchains explicitly.

Analyze a real .mtf fixture through the repository wrapper:

powershell -ExecutionPolicy Bypass -File scripts\analyze_model.ps1 -Path fixtures\models\webapp_taint.mtf -Json

Cross-platform wrapper:

python scripts/analyze_model.py fixtures/models/webapp_taint.mtf --json

The wrapper reads the file, exports MOONTRUSTFLOW_MODEL_TEXT, and then reuses moon run cmd/main for deterministic JSON or text output.

Import a simple call-graph fixture into .mtf:

python scripts/import_callgraph.py fixtures/adapters/service_callgraph.json

Run a lightweight performance smoke test:

python scripts/benchmark_analysis.py --hops 64

Run the full representative fixture and boundary corpus:

python scripts/verify_fixture_corpus.py

The corpus covers web-service security, message pipelines, call-graph adapters, branching, cycles, disconnected paths, quoted text, comments, and empty input. Expected node/edge/policy/finding summaries are versioned in fixtures/benchmarks/manifest.json.

CLI Behavior

moon run cmd/main always works with the embedded sample model.

MoonTrustFlow policy evaluation
source=embedded-sample
nodes=4, edges=4, policies=3, findings=2

Add --json or -j to emit structured output:

moon run cmd/main -- --json

The CLI also exposes application-facing review modes:

moon run cmd/main -- --sarif       # SARIF 2.1.0 for security tooling
moon run cmd/main -- --assessment  # risk score, graph metrics, and remediation issues
moon run cmd/main -- --graph       # human-readable graph and boundary summary
moon run cmd/main -- --contract    # deployment-time model contract gate

For real files, use the wrapper script shown above. This keeps the core package cross-target friendly while still providing a practical repository CLI for actual .mtf inputs.

Adapter Fixture

fixtures/adapters/service_callgraph.json demonstrates a minimal adapter schema:

nodes: typed graph nodes that become source, sink, sanitizer, boundary, or node
edges: graph edges with optional labels
policies: allow, deny, and require rules with optional through and severity

The generated fixtures/models/service_callgraph_imported.mtf gives us a reviewable text artifact that can still be fed into the normal MoonTrustFlow analysis flow.

Engineering Status

Main implementation language: MoonBit
License: Apache-2.0
Application-valued MoonBit implementation scale on 2026-08-16: 3048 production lines across .mbt files, excluding tests and generated interfaces
Test implementation scale: 449 lines, with 26 tests passing on each Wasm, Wasm-GC, and JS target
Fixture coverage includes branching, cycle-pruning, multi-sink, and reviewed-exception scenarios
The deterministic fixture corpus contains 9 representative models with expected summaries and boundary cases
Application modules include risk metrics, policy audits, graph queries/exports, SARIF, batch analysis, baselines, quality gates, and model contracts
Mooncakes module: lllg123/moontrustflow
CI workflow: .github/workflows/ci.yml
Contribution and license notices: CONTRIBUTING.md, LICENSE, and NOTICE
GitHub contributor API checked on 2026-08-14: only lllg123 is currently exposed as a public GitHub contributor login for the GitHub mirror
Remote HEAD audit on 2026-08-14: GitHub defaults to main, while GitLink defaults to master

OSC2026 Notes

The official OSC2026 pages and committee notices are the source of truth for current dates, submission logistics, and acceptance arrangements. This repository records the durable engineering requirements rather than freezing a potentially outdated schedule snapshot:

public development traces and complete commit history
clear project scope, documentation, usage instructions, and limitations
reproducible build/run commands and runnable tests
maintainable structure, boundary coverage, and ecosystem value
OSI-approved licensing and third-party attribution compliance

MoonTrustFlow is still below that reference LOC band, so this repository now responds by making the implemented scope more concrete:

split MoonBit modules instead of one large file
richer fixtures and edge-case tests
JSON output in addition to text output
cross-platform wrapper scripts, call-graph import, and benchmark smoke checks
contributor identity and acceptance self-check scripts
CI aligned to the MoonBit 0.10.3-compatible command set, including strict warning checks and native compiler setup

Important toolchain note: on MoonBit 0.10.3, cmd/main/moon.pkg must use options("is-main": true). The newer pkgtype(kind: "executable") syntax is introduced in 0.10.4 and is intentionally not used here.

On MoonBit 0.10.3, moon fmt --deny-warn and moon info --deny-warn are not accepted commands. This repo therefore uses the community-compatible validation pattern:

moon fmt + git diff --exit-code
moon info + git diff --exit-code

Repository Links

GitLink: https://www.gitlink.org.cn/lllglllg/MoonTrustFlow
GitHub: https://github.com/lllg123/MoonTrustFlow-MoonBit
Mooncakes: https://mooncakes.io/modules/lllg123/moontrustflow

Competition Materials

License

Apache-2.0. See LICENSE and NOTICE for the license and attribution boundary.