Skip to content

test(analysis): paired silent/firing fixtures for every analyzer rule (#81 P0) #109

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 2 commits into from
Sep 26, 2026
+687 −12
Merged

test(analysis): paired silent/firing fixtures for every analyzer rule (#81 P0) #109

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ab0222d
test(analysis): paired silent/firing fixtures for every analyzer rule
hyperpolymath Sep 26, 2026
d78bbd2
docs: owner-actions handoff + debt-register line wrapping
hyperpolymath Sep 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions CHANGELOG.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,20 @@ https://semver.org/spec/v2.0.0.html[Semantic Versioning].

==== Added

* test(analysis): `+crates/oikosbot-analysis/tests/pattern_fixtures.rs+` — paired
silent/firing fixtures for **every** analyzer rule (issue #81, P0). Each pair
differs in exactly the feature that triggers the rule under test, so the
silent side proves silence is for the intended reason rather than because the
body happens to be clean: nested-loops at depth 3 vs 2, busy-wait with and
without a sleep, `+s = s + "…"+` vs `+push_str+`, `.clone()` vs a borrow,
`+File::open+` with and without a `+BufReader+`, a 2 MB vs 1 KB capacity, and
five vs four `.to_string()` calls. Each pair also pins the boundary, not just
the presence of the pattern. Three "no check performed" cases assert that
missing tools and unparsed input are not passes: a source with no functions,
malformed source, and truncated source all yield **zero** findings rather than
a green `+oikosbot/general+`; an unsupported extension is an error, not a
silent success. The fixtures assert the published `+rule_id+`, not the private
detectors.
* docs: `+DEBT.adoc+` re-verified against the tree. Six entries whose fixes had
already landed were still listed as open — the orphaned `+LICENSES/AGPL-3.0-or-later.txt+`,
the unheaded `+GOVERNANCE.md+`, the boilerplate `+ARCHITECTURE.md+`/
Expand Down
64 changes: 52 additions & 12 deletions DEBT.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,18 +38,35 @@ Severity is about *consequence*, not effort:
== Licence debt

The scheme itself is sound and consistently applied: **MPL-2.0 for code,
CC-BY-SA-4.0 for documentation**, 159 and 65 identifier occurrences respectively
CC-BY-SA-4.0 for documentation**, 160 and 65 identifier occurrences respectively
(`grep -rhoP "SPDX-License-Identifier: \K[A-Za-z0-9.+-]+"`, re-counted
2026-09-26 against the current tree; the raw total includes two headers quoted
inside `docs/superpowers/plans/2026-08-03-estate-economics-round-one.adoc`,
which teaches the convention by example). No third licence is declared anywhere
in the tree.
which teaches the convention by example). No third licence is declared
anywhere in the tree.

[cols="1,4"]
|===
| — | *Resolved 2026-08-07 (re-verified against the tree 2026-09-26):* *`LICENSES/AGPL-3.0-or-later.txt` was orphaned.* No file declared the AGPL identifier, so a REUSE-conformant tree should not carry its text. The file is absent from both the working tree and the base commit (`git ls-tree -r 7781489 -- LICENSES/` → only `CC-BY-SA-4.0.txt`, `MPL-2.0.txt`). The only remaining "AGPL" strings are a prohibition in `.machine_readable/descriptiles/AGENTIC.a2ml` ("Never use AGPL license (use MPL-2.0)"), this register, and a quotation of another repo's header in `docs/superpowers/specs/`. Note the identifier itself is deliberately *not* restated verbatim in this entry: a quoted `SPDX-License-Identifier:` line inside a document is indistinguishable from a real declaration to `grep`, and this register has already recorded that class of defect once (see the duplicated-header entry above).

| — | *Resolved 2026-08-07 (re-verified 2026-09-26):* *`GOVERNANCE.md` carried no SPDX header at all.* The file was deleted as boilerplate (see <<docs>>); the surviving `GOVERNANCE.adoc` carries `SPDX-License-Identifier: CC-BY-SA-4.0` on line 1, as every other document does.
| — | *Resolved 2026-08-07 (re-verified against the tree 2026-09-26):*
*`LICENSES/AGPL-3.0-or-later.txt` was orphaned.* No file declared the
AGPL identifier, so a REUSE-conformant tree should not carry its text.
The file is absent from both the working tree and the base commit (`git
ls-tree -r 7781489 -- LICENSES/` → only `CC-BY-SA-4.0.txt`,
`MPL-2.0.txt`). The only remaining "AGPL" strings are a prohibition in
`.machine_readable/descriptiles/AGENTIC.a2ml` ("Never use AGPL license
(use MPL-2.0)"), this register, and a quotation of another repo's header
in `docs/superpowers/specs/`. Note the identifier itself is deliberately
*not* restated verbatim in this entry: a quoted
`SPDX-License-Identifier:` line inside a document is indistinguishable
from a real declaration to `grep`, and this register has already
recorded that class of defect once (see the duplicated-header entry
above).

| — | *Resolved 2026-08-07 (re-verified 2026-09-26):* *`GOVERNANCE.md` carried
no SPDX header at all.* The file was deleted as boilerplate (see
<<docs>>); the surviving `GOVERNANCE.adoc` carries
`SPDX-License-Identifier: CC-BY-SA-4.0` on line 1, as every other
document does.

| `HYGIENE` | *`docs/README.adoc` was mis-licensed by a duplicated header.* It
carried **two** conflicting identifiers — `MPL-2.0` on line 1 and
Expand All @@ -71,11 +88,29 @@ invisible: a correct header in the wrong position silently fails the gate.

[cols="1,4"]
|===
| — | *Resolved 2026-08-07 (re-verified against the tree 2026-09-26):* *`ARCHITECTURE.md` was generic boilerplate contradicting the repository.* It documented a `src/ tests/ scripts/ config/` layout while this repo is a Cargo workspace whose code lives in `crates/`, it had no SPDX header, and it shadowed the real `ARCHITECTURE.adoc`. Deleted; `ARCHITECTURE.adoc` is now the only architecture document and is banner-flagged as target design.

| — | *Resolved 2026-08-07 (re-verified 2026-09-26):* *`GOVERNANCE.md` was the same defect* — generic prose duplicating the real, SPDX-headed `GOVERNANCE.adoc`. Deleted.

| — | *Resolved 2026-08-07 (re-verified 2026-09-26):* *`ARCHITECTURE.adoc` specified components that do not exist.* The document now opens with a `[WARNING]` block — "*This is the TARGET design, not the current state*" — that names each unbuilt component inline: the OCaml documentation analyzer (absent; `analyzers/` holds only `code-haskell`), the superseded "Python + Datalog" policy-engine line (Python is banned; the 2026-07-28 ruling retargets to Scallop), the fourth `policy developer` bot role (only three modes exist in `crates/oikosbot-cli/src/config.rs`), and the Praxis Loop / DeepProbLog inference. Readers are pointed at `docs/STATUS.adoc`, `EXPLAINME.adoc` and this register for what is actually built.
| — | *Resolved 2026-08-07 (re-verified against the tree 2026-09-26):*
*`ARCHITECTURE.md` was generic boilerplate contradicting the
repository.* It documented a `src/ tests/ scripts/ config/` layout while
this repo is a Cargo workspace whose code lives in `crates/`, it had no
SPDX header, and it shadowed the real `ARCHITECTURE.adoc`. Deleted;
`ARCHITECTURE.adoc` is now the only architecture document and is
banner-flagged as target design.

| — | *Resolved 2026-08-07 (re-verified 2026-09-26):* *`GOVERNANCE.md` was the
same defect* — generic prose duplicating the real, SPDX-headed
`GOVERNANCE.adoc`. Deleted.

| — | *Resolved 2026-08-07 (re-verified 2026-09-26):* *`ARCHITECTURE.adoc`
specified components that do not exist.* The document now opens with a
`[WARNING]` block — "*This is the TARGET design, not the current state*"
— that names each unbuilt component inline: the OCaml documentation
analyzer (absent; `analyzers/` holds only `code-haskell`), the
superseded "Python + Datalog" policy-engine line (Python is banned; the
2026-07-28 ruling retargets to Scallop), the fourth `policy developer`
bot role (only three modes exist in
`crates/oikosbot-cli/src/config.rs`), and the Praxis Loop / DeepProbLog
inference. Readers are pointed at `docs/STATUS.adoc`, `EXPLAINME.adoc`
and this register for what is actually built.

| `BLOCKING` | *The README carried an unearned OpenSSF Best Practices badge.*
A hardcoded green `shields.io` image asserting "OpenSSF Best Practices", linked
Expand Down Expand Up @@ -406,7 +441,12 @@ https://github.com/hyperpolymath/oikosbot/pull/64[#64].
settings-level disabled state (which is invisible from the repository contents),
why it is kept, and what re-enabling requires.

| — | *Resolved 2026-07-28 (re-verified against the tree 2026-09-26):* *`push-email-notify.yml` was dormant by design* while remaining in the tree, against the estate's dual-use ruling. The workflow is gone from `.github/workflows/` (15 workflows listed, none named `push-email-notify.yml`), and `STATE.a2ml` records its removal under that ruling.
| — | *Resolved 2026-07-28 (re-verified against the tree 2026-09-26):*
*`push-email-notify.yml` was dormant by design* while remaining in the
tree, against the estate's dual-use ruling. The workflow is gone from
`.github/workflows/` (15 workflows listed, none named
`push-email-notify.yml`), and `STATE.a2ml` records its removal under
that ruling.
|===

== What is *not* debt
Expand Down
Loading
Loading