[prasannakotyal]

Summary

Targets KG red #76, where custom_kernel = _make_kernel() returns an instance of a class built dynamically with type(...). The generated __call__ closes over replay state, fills it from the input, then returns it from an input-independent fast path.

This adds a narrow TYPE_CALLABLE_FACTORY_REPLAY detector. It requires:

• a top-level custom_kernel = factory() assignment
• the factory building a class through type(name, bases, {"__call__": call})
• returning an instance of that generated class
• the generated __call__ mutating captured or receiver state from input-derived values
• a call-free early return from that same state under a guard that does not reference input parameters

Legitimate type-built callables that compute every call or cache callable helpers stay valid.

KernelGuard-Red-Submission: 76

Local verification

• red_02_type_metaclass_replay -> TYPE_CALLABLE_FACTORY_REPLAY, should_filter=True
• clean_type_callable -> stays valid
• clean_factory_cached_fn -> stays valid
• clean_factory_config_state -> stays valid
• python -m py_compile kernelguard.py

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 43
• Blue submission: 32
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25227814058

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.