[MakerFlyFly]

Summary

• A denied group:artifact followed by :version or Maven type/version fields currently returns no Category-X hit. Permit that colon suffix for coordinate terms so release-prepare Step 2b emits the existing hard stop for these occurrences.
• Add regression coverage for Gradle strings, lock entries, dependency trees, normalization, manifest controls, token boundaries and the complete CLI result. Bare-artifact semantics and the CLI/JSON contract remain unchanged.

Type of change

• Python package (tools/*/ with pyproject.toml)

Test plan

• New regressions against the original matcher: 6 expected failures; fixed Windows Category-X tests: 12 passed.
• Linux Docker, Python 3.12.12: complete release-management suite, 718 passed.
• Package ruff check src tests, ruff format --check src tests, and mypy pass; mypy checked 64 source files.
• prek run --all-files --skip workspace-pytest passes, including lychee, workspace lint/type checks, validators and spec checks. The first run normalized the three changed files to LF; the rerun passed.
• prek run workspace-pytest --from-ref 30ee18c2a7d46a42ce94278beb197fa106e94763 --to-ref HEAD passes. The actual commit also ran its normal hooks successfully.
• Magpie pre-first-pr-check: categories A-E pass, readiness ready, zero blocking items.

RFC-AI-0004 compliance

• Vendor neutrality — the token matcher remains local and backend-independent; new dependency examples are synthetic.

Linked issues

Closes #29.

Notes for reviewers

• This Draft PR targets the contributor's fork main for human audit before any upstream submission. The diff contains one commit and three files; no unrelated upstream commits are included.
• Scope: allow a following colon only when the matching term itself contains a colon. Keep the left boundary and package-name suffix protection. This does not add file discovery or license classification.
• Windows full-suite verification with UTF-8 and Git Bash produced 716 passes and two existing platform-related failures (archive tree comparison and a shell round-trip case). Both failures were independently reproduced on the unchanged baseline. Complete package acceptance uses the passing Linux run.
• The installed Magpie configuration-preflight module is missing for the new worktree; this was recorded separately. The branch's actual pre-first-pr-check completed successfully.

---

Gen-AI disclosure: Codex (GPT-6) assisted with reproduction, implementation, tests and this description. The commit carries a Generated-by: trailer. Human contributor review is pending; this fork Draft PR and its linked issue are the audit copies.