test(analysis): paired silent/firing fixtures for every analyzer rule (#81 P0)

[arena-ai-coding-agent]

What

Issue #81, P0 — "Give every analyzer rule a paired silent/firing fixture;
malformed or unsupported input must report 'no check performed' rather than
green."

crates/oikosbot-analysis/tests/pattern_fixtures.rs covers all seven rules in
patterns::detect_patterns. Each pair differs in exactly the feature that
triggers the rule under test:

Rule	Fires on	Silent on
nested-loops	loop depth 3	the same nest at depth 2
busy-wait	a loop that never blocks	the same loop with one sleep per iteration
string-concat-in-loop	out = out + "-"	out.push_str("-")
clone-in-loop	item.clone().len()	item.len()
unbuffered-io	File::open(path)?	BufReader::new(File::open(path)?)
large-allocation	with_capacity(2_000_000)	with_capacity(1024)
redundant-allocation	five .to_string() calls	four

Three pairs deliberately pin a boundary rather than the mere presence of a
pattern — depth 3, the 1 MB threshold, the five-call threshold — so a threshold
change breaks the test instead of silently redefining the rule.

Two design constraints worth flagging

Every fixture is a single function. AnalysisResult::rule_id reports the
most significant pattern in detect_patterns order, so a fixture that tripped
two rules would only prove the first one. The single-function constraint turns
each pair into a check that the rules do not fire spuriously on each other's
inputs as well.

The tests assert the published rule_id, not the private detectors, per
#81's "tests assert observable behaviour, not private implementation
details." No filesystem is needed: analyze_source takes the source directly.

"No check performed" is not a pass

• a source with no functions → zero findings
• malformed source → zero findings
• truncated source → zero findings
• unsupported extension (notes.txt) → an error naming the reason

None of these may come back as a green oikosbot/general.

Verification

No Rust toolchain exists in this sandbox (rustup and crates.io are both blocked
by the proxy allowlist), so all 17 sources in the test file were run through a
faithful port of detect_patterns — loop-depth counting, the busy-wait
substring exclusions, find_in_loop_body, the unbuffered-I/O parent check, the
large-allocation digit scan, and the redundant-allocation counter — against the
tree-sitter-rust grammar:

OK   NESTED_FIRE                findings=1 rule=oikosbot/nested-loops
OK   NESTED_SILENT              findings=1 rule=oikosbot/general
OK   BUSY_WAIT_FIRE             findings=1 rule=oikosbot/busy-wait
OK   BUSY_WAIT_SILENT           findings=1 rule=oikosbot/general
OK   CONCAT_FIRE                findings=1 rule=oikosbot/string-concat-in-loop
OK   CONCAT_SILENT              findings=1 rule=oikosbot/general
OK   CLONE_FIRE                 findings=1 rule=oikosbot/clone-in-loop
OK   CLONE_SILENT               findings=1 rule=oikosbot/general
OK   IO_FIRE                    findings=1 rule=oikosbot/unbuffered-io
OK   IO_SILENT                  findings=1 rule=oikosbot/general
OK   ALLOC_FIRE                 findings=1 rule=oikosbot/large-allocation
OK   ALLOC_SILENT               findings=1 rule=oikosbot/general
OK   REDUNDANT_FIRE             findings=1 rule=oikosbot/redundant-allocation
OK   REDUNDANT_SILENT           findings=1 rule=oikosbot/general
OK   source_without_functions   findings=0
OK   malformed                  findings=0
OK   truncated                  findings=0
FAILURES: 0

• tools/ci/linter-verify.sh → PASS on all four steps (SPDX headers,
  permissions declaration, actions lockfile coverage, lockcheck.sh).
• The new file parses clean under the tree-sitter-rust grammar (no ERROR nodes),
  and no line exceeds rustfmt's default 100-column width.
• Caveat: the port used the npm tree-sitter-rust grammar, while the workspace
  pins crate tree-sitter-rust 0.24.2. The fixtures only rely on node kinds
  stable across both (function_item, for_expression, while_expression,
  loop_expression, binary_expression, call_expression,
  method_call_expression), and every detection is text-based on the function
  or loop body, so the risk is low — but CI remains the authority.

Also in this commit: DEBT.adoc's licence-identifier count moves 159 → 160 for
the new file, so the register's own claim stays reproducible.

Additive only — no production code changes.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 41b478e1-9ffe-4063-93aa-fb8f89dbecfb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}