crosswalk: an outside opinion, and three rules with something behind them

Two gaps in `nexa check`, both of them about the corpus rather than the code:
it can only find what it has a rule for, and the worklist that was meant to
say where the missing rules are had been pointing at the wrong place.

AN OUTSIDE OPINION

crosscheck, adversarial, fieldtest and recall all ask whether what we wrote
behaves. None of them can ask whether it is the right set of things to have
written, because a rule nobody thought of is invisible to every check that
reads the rules.

OpenSPP runs semgrep against 44 hand-written Odoo rules of its own. `nexa
crosswalk` compares the two corpora without running semgrep -- not installed
here, and an offline tool will not grow a package index for one question.
Each of their patterns becomes the smallest snippet it would match and OUR
checkers run over that, so every pairing rests on a checker firing rather
than on two rule descriptions sounding alike.

their patterns turned into a probe 146 of 146
both corpora fire on the same construct 6 (10 now, see below)
theirs fires, nothing here does 38
ours no pattern of theirs could match 7 of 23 comparable

The six were eval, exec, pickle, os.popen, shell=True and domain injection
through eval -- every one reached by the two Python rules about executing
input, and not one by an Odoo rule.

There is a second axis that is about code rather than rule text. OpenSPP's
source carries 687 `# nosemgrep:` markers, each a finding that fired AND that
a person read and kept the code over. Of the 631 that name a rule, a checker
here fires on 20. `odoo-sudo-without-context` fires on every `.sudo()`; ours
fires on `.sudo().search(` and clears on a company_id filter. Both are
defensible and they are different rules about the same word, which is what
most of the disagreement turns out to be.

THE COLUMN THE HARVEST WAS MISSING

3.30's worklist said `21x api.depends (nothing caught here)` against a rule
about exactly that, which reads as a missing rule. Reading the diffs -- which
3.30 tells you to do and which nobody had -- most of those commits merely ADD
a compute, and the scope-token denominator counts them anyway. The
interesting one was hdx_cod_source.py, where the checker fired correctly on
the file before the fix and the fix went to a different line. Recall scored
that a miss, and the worklist then said "nothing caught here" about a rule
that was firing.

`measure` records `spoke` now -- rules with a finding in the file that is not
a catch -- and --harvest splits every cluster on it:

missed caught spoke silent
.sudo( 70 6 47 23
api.depends 23 0 16 7
api.constrains 16 0 12 4
ondelete 13 0 10 3
total in scope 154 6 92 62

Ninety-two of 154 misses are not blind spots. That wants a sharper rule, not
a new one, and a flat miss count had been hiding which of the two you have
since 3.25.

THREE RULES

odoo.sql-needs-query-parameters critical
odoo.commit-inside-a-loop-splits-the-transaction high
odoo.depends-must-not-name-unread-fields medium

The first two are the crosswalk gaps that were about correctness rather than
security. Both are AST passes for the same reason from opposite directions: a
commit is the same string wherever it sits, and a parameterised query carries
the same percent sign as an interpolated one. No regex sees either difference.

The commit rule fires once in 229,600 lines of OpenSPP, on a line already
carrying `# nosemgrep: odoo-commit-in-loop - batch consent expiry cron`. Two
analysers, one construct, one file, and a person who had already decided.

The third came from the diffs: two commits removed an @api.depends entry the
body never read. Its checker was narrowed three times against OpenSPP and
each narrowing is a class it now deliberately misses -- a record handed to a
call, a read outside the declarations, a compute counting rows on another
model. The last costs one of the two incidents it was written from, and that
is stated in the checker rather than glossed: once a compute reads another
model, a declared dependency is the author's best approximation rather than a
leftover. 42 findings before narrowing, 11 after, 10 of them true positives
classified by hand.

Field rate unchanged at 2.1 per 1000 lines on OpenSPP. Every version claim
documented in 16.0, 17.0 and 18.0 -- cr.commit is a contributing guideline
rather than an ORM reference topic, and the guidelines say the thing the rule
says. The crosswalk agreement is 10 now because the gap got closed, not
because anything was re-scored.

TWO SMALLER THINGS

`# nosec` joins the suppression markers. Bandit is an independent analyser and
the argument is the one that put nosemgrep on the list; two of the SQL rule's
six findings sat on lines carrying nothing else.

`python bin/recall.py --harvest --json` died part-way through the report on a
commit subject containing an arrow, taking the JSON artifact with it. The
artifact is written before the report now, and stdout is reconfigured rather
than left to raise.

STALE NUMBERS, AGAIN

Two survived the last sweep because they were not derived from anything:
"64/64 rewrites" was 87 before this change and is 98 after, and "0 of 12
satisfied patterns" was already 14.

409 tests. validate, crosscheck, adversarial, coverage, check-sources and the
retrieval eval all clean; 43 of 43 rules retrievable by their own probe.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ARCHITECTURE.md

@@ -131,7 +131,7 @@ is silently undone by the next build.
 more: the model cites a real rule and then breaks it. Observed exactly that — the 7B
 cited `odoo.onchange-is-not-validation` above an `@api.onchange`.
 
-**Consequence.** 32 of 40 rules are checkable by pattern. Five more are checkable by
+**Consequence.** 32 of 43 rules are checkable by pattern. Eight more are checkable by
 an AST pass (3.12) and the remaining three return no verdict rather than a false
 pass. Patterns match the code with comments stripped (3.13).
 
@@ -293,7 +293,7 @@ message — and narrowed the checker. The other was real: the `correct` sample o
 so a sample in this corpus did not follow another rule in this corpus. The sample was
 fixed, exactly as in §3.5.
 
-**Consequence.** Machine-checkable coverage is 37 of 40 (92%): 32 by pattern, 5 by
+**Consequence.** Machine-checkable coverage is 40 of 43 (93%): 32 by pattern, 8 by
 AST. `nexa coverage` reports the two mechanisms separately, because a rule that
 compares meaning and a rule that compares text are not the same kind of checked, and
 one percentage would hide which of the two a `critical` rule is resting on.
@@ -1175,6 +1175,137 @@ once instead of in whichever was remembered. That is the same argument 3.2 makes
 about the corpus and the Modelfiles, and it took writing a second feature to
 notice the drift had already happened.
 
+### 3.34 Somebody else's ruleset, which is the only outside opinion available
+
+Every measurement above tests whether what we wrote behaves. `crosscheck` fires the
+checkers at the corpus's own correct samples, `adversarial` rewrites those samples,
+`fieldtest` fires them at a stranger's tree, `recall` at a stranger's history. All
+four ask the same question from different angles.
+
+None of them can ask whether the corpus is the right set of rules to have written,
+and that question cannot be answered from inside it: a rule nobody thought of is
+invisible to every check that reads the rules. Coverage of the rules is not coverage
+of the subject, and nothing here could tell the difference.
+
+OpenSPP runs semgrep against a hand-written Odoo ruleset of its own, 44 rules in
+`.semgrep/odoo-security.yml`. Somebody else decided what was worth checking, on the
+same platform, without reading ours. `nexa crosswalk` compares the two.
+
+**Semgrep is never run.** It is not installed here and an offline tool will not grow
+a package index to answer one question. Instead each of their patterns is turned into
+the smallest snippet it would match -- `$CR.execute($QUERY % ...)` becomes
+`_cr.execute(_query % _h1)` -- and OUR checkers are run over that. Every pairing then
+rests on a checker firing rather than on two rule descriptions sounding alike, which
+is the failure mode any hand-written mapping between two rulesets would have.
+
+| | | first run | now |
+|---|---|---|---|
+| Their rules read | 44 | | |
+| Their patterns turned into a probe | 146 of 146 | | |
+| Both corpora fire on the same construct | | **6** | **10** |
+| Theirs fires, nothing here does | | 38 | 34 |
+| Ours no pattern of theirs could match | 7 of 23 comparable | | |
+
+The first six were `eval`, `exec`, `pickle`, `os.popen`, `shell=True` and domain
+injection through `eval` -- every one of them reached by the two Python rules about
+executing input, and none by an Odoo rule. The other four are the rules this run
+produced, which is the difference between a measurement and a worklist: the number
+moved because the gap it named got closed, not because anything was re-scored.
+
+On everything else the two corpora barely intersect, and the honest reading of that
+is not that either is wrong: theirs is about security and this one is about ORM
+correctness. A gap on a subject a corpus deliberately does not cover looks exactly
+like one it forgot, and the report says so rather than scoring it.
+
+**The evidence that is not about rule text.** OpenSPP's source carries 687
+`# nosemgrep:` markers. Each one is a finding that fired AND that a person read and
+decided to keep, which makes it the only record available here of what the other
+analyser does on real code. It is partial in a known direction: it records what was
+dismissed and says nothing about what was fixed.
+
+| | |
+|---|---|
+| Lines their analyser fired on | 631 (56 more markers name no rule) |
+| …where a checker here also fires | **20** |
+
+Twenty of 631. `odoo-sudo-without-context` fires on every `.sudo()`;
+`odoo.sudo-bypasses-record-rules` fires on `.sudo().search(` and clears on a
+`company_id` filter. Both decisions are defensible and they are different rules about
+the same word, which is what most of the disagreement turns out to be.
+
+**Two rules came out of it.** `odoo-commit-in-loop` and the SQL-injection family were
+subjects with a real correctness failure behind them and nothing here that fired.
+Both are now rules, and both are AST passes rather than patterns for the same reason
+from opposite directions: a commit is the same string wherever it sits, and a
+parameterised query carries the same percent sign as an interpolated one. A regex
+cannot see either difference.
+
+The commit rule found exactly one hit in 229,600 lines of OpenSPP, and that line
+already carried `# nosemgrep: odoo-commit-in-loop — batch consent expiry cron`. Two
+analysers, the same construct, the same file, and a person who had already decided.
+That is the strongest corroboration anything in this repository has.
+
+### 3.35 Reading the harvest, and a column it was missing
+
+3.30 turned the missed list into a worklist clustered by construct, and the ranking
+said `21x api.depends (nothing caught here)` against a rule about exactly that. The
+obvious reading is a missing rule, and the obvious reading was wrong.
+
+Reading the diffs -- which 3.30 says to do and which nobody had -- of the 23 fix
+commits whose diff touched `@api.depends`, most merely ADD a compute. The decorator is
+in the diff because a new one was written, not because a depends bug was fixed, and
+the scope-token denominator counts them anyway. Of the rest, the interesting case was
+`spp_area_hdx/models/hdx_cod_source.py`: the checker fired correctly on the file
+before the fix, and the fix went to a different line. Recall scored that a miss, and
+the worklist then said "nothing caught here" about a rule that was firing.
+
+**The column.** `measure` now records `spoke` -- rules with a finding in the file that
+is not a catch -- and `--harvest` splits every cluster on it:
+
+|  | missed | caught | spoke | silent |
+|---|---|---|---|---|
+| `.sudo(` | 70 | 6 | 47 | 23 |
+| `ValidationError` | 39 | 1 | 29 | 10 |
+| `Many2one` | 26 | 1 | 14 | 12 |
+| `api.depends` | 23 | 0 | 16 | **7** |
+| `api.constrains` | 16 | 0 | 12 | 4 |
+| `ondelete` | 13 | 0 | 10 | 3 |
+| **total in scope** | **154** | 6 | **92** | **62** |
+
+Ninety-two of the 154 misses are not blind spots. The corpus was looking straight at
+those files and pointing somewhere else, and that wants the opposite repair from a
+rule that does not exist: a sharper rule, not a new one. A flat miss count hides which
+of the two you have, and it had been hiding it since 3.25.
+
+**One rule came out of the diffs.** Two commits removed an `@api.depends` entry the
+body never read -- a leftover from an earlier body in both cases. The harm is mild and
+stated as mild: a dependency the body cannot use does not make the value stale, it
+makes it recompute on writes that could not have changed it. The reason it is worth a
+rule is the second commit, where `@api.depends("topic_ids")` sat on a compute that
+counted rows on another model. The decorator was the only statement anywhere of what
+the value was made from, and it said the dependency was accounted for while nothing
+was watching the value at all.
+
+The checker was narrowed three times against OpenSPP, and each narrowing is a class it
+now deliberately misses: a body that hands a record to a call, a body that reads a
+field the decorator does not declare, and a body that counts rows on another model.
+The last one costs the second incident -- it is exactly that shape and is no longer
+reported -- because once a compute reads another model, a declared dependency is the
+author's best available approximation rather than a leftover, and telling them to
+delete it removes the only recompute trigger the value has.
+
+| | |
+|---|---|
+| Findings on OpenSPP before narrowing | 42 |
+| …after | **11** (0.05 per 1000 lines) |
+| True positives among them, classified by hand | **10 of 11** |
+
+The one false positive is a compute whose docstring reads "Dummy compute to trigger
+dependent field recomputation" -- a deliberate canary, depending on fields it does not
+read on purpose. The checker cannot tell that from the two dead legacy computes it
+correctly found in the same run, and there is no reason it should: both are findings
+and only one of them is wanted.
+
 ## 4. Performance traps, all found by measurement
 
 Within four instrumented runs the report showed the 7B at ~10 tok/s against a
@@ -1246,11 +1377,11 @@ in a corpus; it does not close the reasoning gap.
 
 ### Checking is partial, and the layers say where
 
-- 3 of 40 rules have no automated check at all. They return **no verdict**, never a
+- 3 of 43 rules have no automated check at all. They return **no verdict**, never a
   false pass, and `nexa coverage` prints the reason for each.
-- 27 of the 29 checked rules are decided by a **regex over generated code**. That
+- 32 of the 40 checked rules are decided by a **regex over generated code**. That
   catches textual signatures, not meaning. Code wrong in a way no pattern describes
-  passes silently. Only 2 rules are decided by an AST pass (§3.12).
+  passes silently. The other 8 are decided by an AST pass (§3.12).
 - Semantic analysis is **Python only**. The standard library has no TypeScript or
   JavaScript parser, so TS/JS answers get delimiter balance and nothing deeper, and
   the layer reports UNKNOWN rather than PASS for the rest.
@@ -1322,9 +1453,13 @@ unawares.
 
 ### Corpus provenance
 
-37 of 40 rules cite upstream documentation. The rest rest on general knowledge and
-deserve more scepticism. The rules were written by an assistant, not harvested from
-production incidents; rules drawn from real incidents would be worth more.
+40 of 43 rules cite upstream documentation. The rest rest on general knowledge and
+deserve more scepticism. Most of the rules were written by an assistant rather than
+harvested from production incidents, and rules drawn from real incidents are worth
+more. Three now are: `commit-inside-a-loop` and `sql-needs-query-parameters` came
+from an external ruleset disagreeing with this one (3.34), and
+`depends-must-not-name-unread-fields` from a fix commit in OpenSPP's history (3.35).
+Three of forty-three is not a change of method yet.
 
 This is the deepest unresolved problem in the design and no layer addresses it: the
 validator and the thing being validated are the same class of system. Provenance
@@ -1430,6 +1565,7 @@ nexa/
 │   ├── adversarial.py     evasion / counterexample / contradiction probes
 │   ├── fieldtest.py       every checker against somebody else's source
 │   ├── recall.py          what the corpus misses, against real bugfixes
+│   ├── crosswalk.py       this corpus against somebody else's ruleset
 │   ├── eval.py            the distribution: ask, the pipeline, retrieval, check
 │   ├── endpoint.py        where Ollama is, and what to say when it is not
 │   ├── evidence.py        per-run bundles: the record behind a verdict

README.md

@@ -294,23 +294,23 @@ Same principle as `z.infer<typeof Schema>`: one definition, derived artifacts, n
 
 | | |
 |---|---|
-| Rules | 40 — 15 Odoo, 10 TypeScript, 8 Python, 7 JavaScript |
-| Critical | 16 |
-| Machine-checkable | 37 (92%) — 32 by pattern, 5 by AST |
-| Traceable to upstream docs | 37 (92%), each audited for topic fit |
+| Rules | 43 — 18 Odoo, 10 TypeScript, 8 Python, 7 JavaScript |
+| Critical | 17 |
+| Machine-checkable | 40 (93%) — 32 by pattern, 8 by AST |
+| Traceable to upstream docs | 40 (93%), each audited for topic fit |
 | Pattern false positives | 0 cross-hits across the corpus |
-| Recall under meaning-preserving rewrite | 64/64 |
-| Satisfied patterns bypassable by a comment | 0 of 12 |
-| Retrievable by their own probe | 40 of 40, at top 3 |
+| Recall under meaning-preserving rewrite | 98/98 |
+| Satisfied patterns bypassable by a comment | 0 of 14 |
+| Retrievable by their own probe | 43 of 43, at top 3 |
 | Hit rate on 34,550 lines of reviewed OCA code | 3.9 per 1000 lines |
-| Hit rate on 229,600 lines of OpenSPP (Odoo 19) | 2.1 per 1000 lines, +22 another tool had already flagged |
-| **Recall against real Odoo bugfixes** | **1 of 56 (OCA), 6 of 147 (OpenSPP). See below.** |
+| Hit rate on 229,600 lines of OpenSPP (Odoo 19) | 2.1 per 1000 lines, +24 another tool had already flagged |
+| **Recall against real Odoo bugfixes** | **1 of 56 (OCA), 6 of 160 (OpenSPP). See below.** |
 | Verdict stability, 12 questions x 5 runs | 12/12 same verdict every run |
 | Escalation rescued a bad draft | 12 of 22, 95% CI 35–73% |
 | **`nexa check`, 5 files x 5 runs** | **23 findings reported, in 5 of 5 files — every one the corpus can make** |
 | Rules the model added beyond the checkers | 1, across 25 reviews |
 
-37 of 40 rules carry an automated check. The remaining three are decidable only with
+40 of 43 rules carry an automated check. The remaining three are decidable only with
 context a snippet does not contain, so they return **no verdict** — never a false pass
 — and `nexa coverage` names each one and why.
 
@@ -481,31 +481,73 @@ What *is* adopted needed no measuring: a rule the checkers already fired on at l
 nexa recall ../OpenSPP2-19.0 --harvest
 ```
 
-clusters the fixes the corpus said nothing about by the construct each diff touched,
-so the reading order is the writing order. Against **OpenSPP 2 (Odoo 19), 1,391
-commits** — a second ecosystem on a newer series than the OCA repositories:
+clusters the fixes the corpus did not flag on the line of the fix by the construct
+each diff touched, so the reading order is the writing order. Against **OpenSPP 2
+(Odoo 19)** — a second ecosystem on a newer series than the OCA repositories:
 
 | | |
 |---|---|
-| Fix commits examined | 368 |
-| …touching a construct the corpus covers | 147 |
+| Fix commits examined | 406 |
+| …touching a construct the corpus covers | 160 |
 | Caught | 6 |
-| Recall against in-scope fixes | 3% |
+| Recall against in-scope fixes | 4% |
 
-Two repositories, two ecosystems, 2–3% both times. The floor is a floor — and the
+Two repositories, two ecosystems, 2–4% both times. The floor is a floor — and the
 clustering says where to dig:
 
 ```
-65x  .sudo(              (5 caught)
-21x  api.depends         (nothing caught here)
-15x  api.constrains      (nothing caught here)
-13x  ondelete            (nothing caught here)
+        missed  caught  spoke  silent
+.sudo(      70       6     47      23
+api.depends 23       0     16       7
+api.constrains 16    0     12       4
+ondelete    13       0     10       3
 ```
 
-Twenty-one fixes touched `@api.depends` and the corpus caught none, while carrying a
-rule about exactly that construct. That is not a gap in coverage — the rule exists —
-it is a gap between what the rule describes and what actually goes wrong, which is
-more useful to know and much harder to guess.
+**`spoke` is the column that changed the reading.** A miss is not automatically a
+blind spot: a checker firing somewhere else in the same file means the rule exists
+and is aimed wrong, which wants a sharper rule rather than a new one. Ninety-two of
+the 154 misses are that. The first version of this table reported `21x api.depends
+(nothing caught here)`, which reads as a missing rule — and the checker was in fact
+firing on sixteen of those files while the fixes went elsewhere.
+
+Reading the diffs behind the seven that really were silent produced one rule,
+`odoo.depends-must-not-name-unread-fields`. Two of the remaining rules in this corpus
+came from the crosswalk below.
+
+### An outside opinion, which is the one thing the corpus cannot give itself
+
+```bash
+nexa crosswalk ../OpenSPP2-19.0/.semgrep/odoo-security.yml --checkout ../OpenSPP2-19.0
+```
+
+Every other number here tests whether what we wrote behaves. None of them can ask
+whether it is the right set of rules to have written, because a rule nobody thought of
+is invisible to every check that reads the rules. OpenSPP runs semgrep against 44
+hand-written Odoo rules of its own — somebody else's judgement, on the same platform,
+formed without reading ours.
+
+Semgrep is never run: each of their patterns is turned into the smallest snippet it
+would match and *our* checkers run over that, so a pairing rests on a checker firing
+rather than on two rule descriptions sounding alike.
+
+| | first run | now |
+|---|---|---|
+| Their patterns turned into a probe | 146 of 146 | 146 of 146 |
+| Both corpora fire on the same construct | 6 | 10 |
+| Theirs fires, nothing here does | 38 | 34 |
+| Lines their analyser fired on (`# nosemgrep:` markers) | 631 | 631 |
+| …where a checker here also fires | 20 | 20 |
+
+The agreement moved from 6 to 10 because the gap it named got closed, not because
+anything was re-scored — the first six were all reached by the two Python rules about
+executing input, and not one by an Odoo rule.
+
+Most of that gap is a different subject, not a missing rule: theirs is about security
+and this one is about ORM correctness. Two entries were neither, and are now rules —
+`odoo.commit-inside-a-loop-splits-the-transaction` and
+`odoo.sql-needs-query-parameters`. The commit rule fires once in 229,600 lines of
+OpenSPP, on a line already carrying `# nosemgrep: odoo-commit-in-loop`: two analysers,
+one construct, and a person who had already decided.
 
 ### Every version claim is checked or stated
 
@@ -535,7 +577,7 @@ nexa eval --retrieval
 asks each rule its own probe and reports whether it comes back. No generation, so it
 needs only the embedding model and finishes in seconds.
 
-All 40 rules are retrievable at the operating `TOP_K` of 6, and at top 3. Two were
+All 43 rules are retrievable at the operating `TOP_K` of 6, and at top 3. Two were
 not, and both failed the way a rule does: correctly worded, in the vocabulary of
 somebody who already knows the answer. `no-monkey-patching` did not answer *"change
 what a core sale.order method does"*; `unknown-not-any-at-boundaries` did not answer

bin/crosswalk.py

@@ -0,0 +1,767 @@
+#!/usr/bin/env python3
+"""Compare this corpus against somebody else's ruleset for the same stack.
+
+WHY THIS EXISTS
+---------------
+Every measurement in this repository is taken against code. `crosscheck` fires
+the checkers at the corpus's own correct samples, `adversarial` rewrites those
+samples, `fieldtest` fires them at a stranger's tree, `recall` fires them at a
+stranger's history. All four ask the same question from different angles: does
+what we wrote behave.
+
+None of them asks whether what we wrote is the right set of things to have
+written. That question cannot be answered from inside the corpus, because the
+corpus is the thing under test -- a rule nobody thought of is invisible to every
+check that reads the rules.
+
+An external ruleset for the same stack is the one artefact that can answer it.
+Somebody else decided what was worth checking, on the same platform, without
+reading ours. Where the two agree, two independent judgements landed on the same
+construct. Where theirs has a rule and ours has nothing, that is a subject we
+did not think of, named by somebody who did.
+
+    python crosswalk.py <ruleset.yml> [--checkout DIR] [--json OUT]
+
+WHAT IT DOES NOT DO
+-------------------
+It does not run the other analyser. Semgrep is not installed here and adding it
+would make an offline tool need a package index. Instead the ruleset's own
+patterns are turned into the smallest snippet each one would match, and OUR
+checkers are run over that. That direction works because our checkers are what
+we have; the other direction is answered separately and more weakly, and the
+report says which claim rests on which.
+
+It is also not a score. A rule of theirs that nothing here fires on is a
+candidate, not a defect: this corpus is about ORM correctness and a security
+ruleset is about security, and the answer to most of that gap is "different
+subject" rather than "missing rule". Reading it is the work.
+
+Stdlib only. No model, no network.
+"""
+import argparse
+import ast
+import collections
+import io
+import json
+import os
+import re
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+
+import corpus       # noqa: E402
+import layers       # noqa: E402
+
+CROSSWALK_VERSION = "1.0.0"
+
+# A semgrep rule says which languages it is about. Ours say which stack, and the
+# two do not line up one to one: a `languages: [python]` rule is answerable by
+# anything in the odoo or python stacks, because both of those are Python.
+LANG_STACKS = {
+    "python": ("odoo", "python"),
+    "py": ("odoo", "python"),
+    "js": ("javascript", "typescript"),
+    "javascript": ("javascript", "typescript"),
+    "ts": ("typescript", "javascript"),
+    "typescript": ("typescript", "javascript"),
+}
+
+# Directories that are never the code under review. The same list fieldtest
+# walks, for the same reason.
+SKIP_DIRS = frozenset([".git", ".hg", "node_modules", "static", "__pycache__",
+                       ".tox", ".venv", "venv", "dist", "build", "migrations"])
+
+# Only the suppression markers that NAME a rule are read here. `# noqa` says a
+# person silenced something; `# nosemgrep: odoo-sudo-without-context` says which
+# finding they silenced, and the name is the part that can be compared with
+# anything.
+SUPPRESSION_RE = re.compile(r"#\s*nosemgrep\s*:?\s*([A-Za-z0-9_.\-, ]*)")
+
+
+# ------------------------------------------------------------------- reading
+
+class ExternalRule(object):
+    """One rule read out of somebody else's ruleset."""
+
+    __slots__ = ("rid", "severity", "languages", "category", "cwe",
+                 "patterns", "message")
+
+    def __init__(self, rid):
+        self.rid = rid
+        self.severity = ""
+        self.languages = []
+        self.category = ""
+        self.cwe = ""
+        self.patterns = []
+        self.message = ""
+
+    def as_dict(self):
+        return {"id": self.rid, "severity": self.severity,
+                "languages": self.languages, "category": self.category,
+                "cwe": self.cwe, "patterns": self.patterns}
+
+
+# `pattern-not` and friends are recognised and deliberately not read: they say
+# what a rule EXCLUDES, and probing one would test the opposite of the rule.
+_SKIPPED_KEYS = ("pattern-not-inside", "pattern-not", "pattern-regex",
+                 "metavariable-regex", "metavariable-pattern",
+                 "focus-metavariable")
+_PATTERN_LINE = re.compile(r"^(\s*)(?:-\s+)?(?:pattern|pattern-inside):\s*(.*)$")
+_KEYED_ITEM = re.compile(r"^\s*-\s*[\w-]+:")
+
+
+def read_ruleset(path):
+    """Read a semgrep rule file, for the subset of YAML these files use.
+
+    A real YAML parser is not in the standard library and this tool will not
+    grow a dependency for one file format. What is here reads the shape semgrep
+    rule files actually have -- a `rules:` list of mappings, scalar values, a
+    flow sequence for `languages`, and `|` block scalars for `message` and for
+    multi-line patterns -- and reports what it skipped rather than pretending
+    the file held only what it understood.
+
+    Returns (rules, skipped), where skipped is a list of (rule id, key) pairs
+    for constructs recognised and deliberately left alone.
+    """
+    with io.open(path, encoding="utf-8-sig") as handle:
+        lines = handle.read().splitlines()
+
+    rules, skipped = [], []
+    current = None
+    i = 0
+    while i < len(lines):
+        line = lines[i]
+        stripped = line.strip()
+        if not stripped or stripped.startswith("#"):
+            i += 1
+            continue
+
+        found = re.match(r"^\s*-\s+id:\s*(\S+)", line)
+        if found:
+            current = ExternalRule(found.group(1).strip("\"'"))
+            rules.append(current)
+            i += 1
+            continue
+        if current is None:
+            i += 1
+            continue
+
+        skip = next((key for key in _SKIPPED_KEYS
+                     if stripped.startswith(key + ":")), None)
+        if skip:
+            skipped.append((current.rid, skip))
+            if stripped.endswith("|"):
+                _, i = _block_scalar(lines, i + 1, _indent(line))
+            else:
+                i += 1
+            continue
+
+        found = _PATTERN_LINE.match(line)
+        if found:
+            value = found.group(2).strip()
+            if value == "|":
+                block, i = _block_scalar(lines, i + 1, len(found.group(1)))
+                if block:
+                    current.patterns.append(block)
+                continue
+            if value:
+                current.patterns.append(value)
+            i += 1
+            continue
+
+        # A bare alternative under `pattern-either:`, which is how some rulesets
+        # write the second and later branches. Excluded when the item is itself
+        # a key, because those have been handled above or are none of our
+        # business.
+        found = re.match(r"^\s*-\s+(\S.*)$", line)
+        if found and current.patterns and not _KEYED_ITEM.match(line):
+            body = found.group(1).strip()
+            if body and not body.startswith("#"):
+                current.patterns.append(body)
+            i += 1
+            continue
+
+        found = re.match(r"^\s*severity:\s*(\S+)", line)
+        if found:
+            current.severity = found.group(1).strip("\"'")
+            i += 1
+            continue
+        found = re.match(r"^\s*languages:\s*\[(.*)\]", line)
+        if found:
+            current.languages = [part.strip().strip("\"'")
+                                 for part in found.group(1).split(",")
+                                 if part.strip()]
+            i += 1
+            continue
+        found = re.match(r"^\s*(cwe|category):\s*(.+)$", line)
+        if found:
+            setattr(current, found.group(1), found.group(2).strip().strip("\"'"))
+            i += 1
+            continue
+        found = re.match(r"^(\s*)message:\s*\|\s*$", line)
+        if found:
+            block, i = _block_scalar(lines, i + 1, len(found.group(1)))
+            current.message = block
+            continue
+        i += 1
+    return rules, skipped
+
+
+def _indent(line):
+    return len(line) - len(line.lstrip())
+
+
+def _block_scalar(lines, start, parent_indent):
+    """The body of a `key: |` block, and the index of the line after it."""
+    body, i = [], start
+    while i < len(lines):
+        line = lines[i]
+        if line.strip() and _indent(line) <= parent_indent:
+            break
+        body.append(line)
+        i += 1
+    while body and not body[-1].strip():
+        body.pop()
+    if not body:
+        return "", i
+    margin = min(_indent(row) for row in body if row.strip())
+    return "\n".join(row[margin:] for row in body), i
+
+
+# ------------------------------------------------------------------- probing
+
+_META = re.compile(r"\$([A-Z][A-Z0-9_]*)")
+_FSTRING = re.compile(r'f"([^"]*)"')
+_BARE_STRING = re.compile(r'"\.\.\."')
+
+
+def probe(pattern):
+    """The smallest snippet a pattern would match, or None.
+
+    A semgrep pattern is code with holes in it: `$CR.execute($QUERY % ...)` is
+    Python with a receiver, an argument and a tail left open. Filling the holes
+    with names gives a snippet that is exactly what the rule is about and
+    nothing else, which is the fairest input our checkers can be handed -- no
+    surrounding code to fire on by accident, and no chance of crediting a rule
+    for something a neighbouring line triggered.
+
+    None means the pattern did not survive being filled in. Every one of those
+    is reported rather than quietly dropped: a pattern that cannot be probed is
+    a subject this tool has no answer about, which is a different thing from a
+    subject where the answer is no.
+    """
+    text = pattern.strip()
+    if not text or text.startswith("#"):
+        return None
+
+    # Some rulesets quote the whole pattern. Those quotes are YAML's, not the
+    # pattern's, and leaving them on turns code into a string literal.
+    if len(text) > 1 and text[0] == text[-1] and text[0] in "\"'":
+        inner = text[1:-1]
+        if "..." in inner or "$" in inner or "(" in inner:
+            text = inner
+
+    text = _META.sub(lambda m: "_" + m.group(1).lower(), text)
+
+    # f-strings first: an ellipsis inside one is arbitrary TEXT, and the
+    # argument-list rules below would turn it into a name.
+    text = _FSTRING.sub(_fill_fstring, text)
+    text = _BARE_STRING.sub('"s"', text)
+
+    out = []
+    for row in text.split("\n"):
+        body = row.strip()
+        if body == "...":
+            out.append(row[:len(row) - len(body)] + "pass")
+            continue
+        row = re.sub(r"\bfor\s+\.\.\.\s+in\s+\.\.\.\s*:", "for _i in _seq:", row)
+        row = re.sub(r"\bwhile\s+\.\.\.\s*:", "while _c:", row)
+        out.append(_fill_ellipsis(row))
+    text = "\n".join(out)
+
+    if "..." in text:
+        return None
+    # ast.parse and not compile(): `return {...}` and `await x()` are whole
+    # patterns in real rulesets and are fragments rather than modules. The
+    # parser accepts both -- they fail later, at compile -- and a fragment is
+    # exactly what a pattern is, so the parser is the right gate here.
+    try:
+        ast.parse(text)
+    except (SyntaxError, ValueError):
+        return None
+    return text
+
+
+def _fill_fstring(match):
+    """`f"... FROM {$TABLE} ..."` is a template with text on either side of a
+    hole. The ellipses stand for arbitrary text, so any text will do, as long as
+    it is text a tokeniser will accept inside a string."""
+    body = match.group(1).replace("...", "a")
+    if "{" not in body:
+        body = "{_x}" + body
+    return 'f"' + body + '"'
+
+
+def _fill_ellipsis(row):
+    """Replace the argument-list and collection ellipses with names.
+
+    Position decides what a `...` can legally become, and three positions differ:
+
+        inside a dict display          **name, because a bare name is not an entry
+        after a keyword argument       **name, because `f(x, k=1, y)` is a syntax
+                                       error and `subprocess.run(..., shell=True,
+                                       ...)` is a pattern several rulesets carry
+        anywhere else                  a plain name
+
+    Getting one wrong produces a snippet that does not parse, and the rule it
+    came from is then reported as unanswered when it could have been answered.
+    """
+    out, brackets = [], []
+    i, hole = 0, 0
+    while i < len(row):
+        char = row[i]
+        if char in "([{":
+            brackets.append([char, False])
+            out.append(char)
+        elif char in ")]}":
+            if brackets:
+                brackets.pop()
+            out.append(char)
+        elif char == "=" and brackets and not _is_comparison(row, i):
+            brackets[-1][1] = True
+            out.append(char)
+        elif row.startswith("...", i):
+            hole += 1
+            kind, keyworded = brackets[-1] if brackets else ("", False)
+            if kind == "{" or (kind == "(" and keyworded):
+                out.append("**_d{0}".format(hole))
+            else:
+                out.append("_h{0}".format(hole))
+            i += 3
+            continue
+        else:
+            out.append(char)
+        i += 1
+    return "".join(out)
+
+
+def _is_comparison(row, i):
+    """`==`, `!=`, `<=`, `>=` are not keyword arguments."""
+    return row[i - 1:i] in ("=", "!", "<", ">") or row[i + 1:i + 2] == "="
+
+
+# ------------------------------------------------------------------ matching
+
+# Names that say nothing about what a pattern is about: structural Python every
+# snippet has, and the filler this module puts in itself.
+_STOP = frozenset(["self", "in", "is", "if", "or", "and", "not", "as",
+                   "_i", "_seq", "_c", "_x"])
+
+
+def literal_names(pattern):
+    """Every identifier a pattern requires the source to contain, literally.
+
+    A semgrep pattern matches an AST, and the names in it that are NOT
+    metavariables have to be present in the code for a match to happen. Source
+    containing none of them cannot match the rule, whatever else is in it.
+
+    That is a necessary condition and not a sufficient one, which makes it
+    useful in exactly one direction: it can rule a match OUT and never in. The
+    one hole in it is semgrep's import equivalences -- `from subprocess import
+    call` lets `subprocess.call(...)` match a line where the word `subprocess`
+    never appears. Wherever this is used, the report says so.
+    """
+    text = _META.sub(" ", pattern)
+    names = re.findall(r"[A-Za-z_][A-Za-z0-9_]*", text)
+    return set(name for name in names if len(name) > 1 and name not in _STOP)
+
+
+def fires_on(snippet, rules_by_stack, stacks):
+    """Which of our rules fire on one snippet, across the stacks that apply."""
+    hit = set()
+    for stack in stacks:
+        rules = rules_by_stack.get(stack)
+        if not rules:
+            continue
+        for found in layers.scan_source(snippet, rules, stack, errors=[]):
+            hit.add(found.rule)
+    return hit
+
+
+def crosswalk(external, our_rules):
+    """Pair their rules with ours by running their patterns past our checkers."""
+    by_stack = collections.defaultdict(list)
+    for rule in our_rules:
+        by_stack[rule["stack"]].append(rule)
+
+    rows = []
+    for ext in external:
+        stacks = set()
+        for lang in ext.languages or ["python"]:
+            stacks.update(LANG_STACKS.get(lang.lower(), ()))
+        probes, unprobed = [], []
+        for pattern in ext.patterns:
+            snippet = probe(pattern)
+            if snippet is None:
+                unprobed.append(pattern)
+            else:
+                probes.append(snippet)
+        ours = set()
+        for snippet in probes:
+            ours |= fires_on(snippet, by_stack, sorted(stacks))
+        rows.append({
+            "their_rule": ext.rid,
+            "severity": ext.severity,
+            "category": ext.category or ext.cwe or "(none)",
+            "languages": ext.languages,
+            "patterns": len(ext.patterns),
+            "probed": len(probes),
+            "unprobed": unprobed,
+            "our_rules": sorted(ours),
+        })
+    return rows
+
+
+def covered_stacks(external):
+    """The stacks their ruleset is even about.
+
+    A Python-only ruleset having nothing to say about a TypeScript rule of ours
+    is not a finding, it is the languages line at the bottom of every one of
+    their rules. Comparing across it would pad the gap with entries whose answer
+    was known before the tool ran.
+    """
+    stacks = set()
+    for ext in external:
+        for lang in ext.languages or ["python"]:
+            stacks.update(LANG_STACKS.get(lang.lower(), ()))
+    return stacks
+
+
+def unreachable_here(our_rules, external):
+    """Our rules that no pattern of theirs could match.
+
+    See literal_names: a pattern cannot match source missing one of its literal
+    names, so a rule whose own wrong sample is missing a name from every pattern
+    they have is a subject their ruleset does not reach.
+
+    Restricted to the stacks their ruleset covers, so the answer is about what
+    they chose not to check rather than about which languages they parse.
+    """
+    stacks = covered_stacks(external)
+    required = []
+    for ext in external:
+        for pattern in ext.patterns:
+            names = literal_names(pattern)
+            if names:
+                required.append(names)
+    out = []
+    for rule in our_rules:
+        if stacks and rule["stack"] not in stacks:
+            continue
+        sample = "{0}\n{1}".format(rule.get("wrong", ""), rule.get("rule", ""))
+        words = set(re.findall(r"[A-Za-z_][A-Za-z0-9_]*", sample))
+        if not any(names <= words for names in required):
+            out.append(rule["id"])
+    return out
+
+
+# ---------------------------------------------------------------- field data
+
+def suppressions(root):
+    """Every `# nosemgrep: <id>` in a tree, by rule id, with file and line.
+
+    The only evidence available here about what the other analyser does on real
+    code, and better evidence than it looks: a suppression is a finding that
+    fired AND that a person read and decided to keep. It is partial in a known
+    direction -- it records what fired and was dismissed, and says nothing about
+    what fired and was fixed.
+    """
+    found = collections.defaultdict(list)
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [name for name in dirnames if name not in SKIP_DIRS]
+        for name in sorted(filenames):
+            if not name.endswith(".py"):
+                continue
+            path = os.path.join(dirpath, name)
+            try:
+                with io.open(path, encoding="utf-8", errors="replace") as handle:
+                    body = handle.read()
+            except OSError:
+                continue
+            if "nosemgrep" not in body:
+                continue
+            rel = os.path.relpath(path, root).replace(os.sep, "/")
+            for number, line in enumerate(body.splitlines(), 1):
+                match = SUPPRESSION_RE.search(line)
+                if not match:
+                    continue
+                named = False
+                for part in match.group(1).split(","):
+                    rid = _clean_rule_id(part)
+                    if rid:
+                        found[rid].append((rel, number))
+                        named = True
+                if not named:
+                    found["(unnamed)"].append((rel, number))
+    return found
+
+
+def _clean_rule_id(text):
+    """A rule id out of a suppression comment, or "" if it does not hold one.
+
+    Real markers carry prose after the id -- `# nosemgrep: odoo-sudo-without-
+    context - policy lookup only` -- and some carry a `semgrep.` prefix. Both
+    are stripped; anything that is not then a plain rule id is not counted as
+    one, because a marker that names nothing cannot be compared with anything.
+    """
+    rid = text.strip().split()[0] if text.strip() else ""
+    rid = rid.split("#")[0].split("--")[0].strip().rstrip(".:")
+    if rid.startswith("semgrep."):
+        rid = rid[len("semgrep."):]
+    return rid if re.match(r"^[a-z][a-z0-9]*(?:-[a-z0-9]+)+$", rid) else ""
+
+
+def echoed_on_the_same_line(root, marks, our_rules, stack, limit=400):
+    """Of the lines their analyser fired on, how many do ours fire on too?
+
+    The strongest comparison this tool can make without running semgrep: the
+    same file, the same line number, two analysers. A line both flag is the one
+    case here where agreement is a fact about code rather than about rule text.
+    """
+    by_file = collections.defaultdict(set)
+    for rid, places in marks.items():
+        if rid == "(unnamed)":
+            continue
+        for rel, line in places:
+            by_file[rel].add((line, rid))
+
+    rules = [rule for rule in our_rules if rule["stack"] == stack]
+    both, theirs_only = [], 0
+    unread = max(0, len(by_file) - limit)
+    for rel in sorted(by_file)[:limit]:
+        try:
+            with io.open(os.path.join(root, rel), encoding="utf-8",
+                         errors="replace") as handle:
+                body = handle.read()
+        except OSError:
+            continue
+        ours = collections.defaultdict(set)
+        for found in layers.scan_source(body, rules, stack, errors=[]):
+            ours[found.line].add(found.rule)
+        for line, rid in sorted(by_file[rel]):
+            if ours.get(line):
+                both.append((rel, line, rid, sorted(ours[line])))
+            else:
+                theirs_only += 1
+    return both, theirs_only, unread
+
+
+# ------------------------------------------------------------------- report
+
+def report(rows, external, our_rules, skipped, marks, echo, examples=8):
+    agreed = [row for row in rows if row["our_rules"]]
+    alone = [row for row in rows if not row["our_rules"] and row["probed"]]
+    blind = [row for row in rows if not row["probed"]]
+
+    print("CROSSWALK  {0} rules here against {1} of theirs".format(
+        len(our_rules), len(rows)))
+    print()
+    print("  Every other measurement in this repository tests whether what we")
+    print("  wrote behaves. None of them can test whether it is the right set of")
+    print("  things to have written, because a rule nobody thought of is invisible")
+    print("  to every check that reads the rules. Somebody else's ruleset for the")
+    print("  same stack is the one artefact that can say.")
+    print()
+    patterns = sum(row["patterns"] for row in rows)
+    probed = sum(row["probed"] for row in rows)
+    print("  Their patterns are turned into the smallest snippet each would match")
+    print("  and OUR checkers are run over it: {0} of {1} patterns produced one.".format(
+        probed, patterns))
+    print()
+    print("  {0:<46} {1:>5}".format("both corpora fire on the same construct",
+                                    len(agreed)))
+    print("  {0:<46} {1:>5}".format("theirs fires, nothing here does", len(alone)))
+    print("  {0:<46} {1:>5}".format("no probe could be built, so no answer",
+                                    len(blind)))
+    print()
+
+    if agreed:
+        print("  WHERE THE TWO AGREE  ({0})".format(len(agreed)))
+        print("  Two rulesets written independently landed on the same construct.")
+        print("  This is the only external corroboration in the repository.")
+        print()
+        for row in sorted(agreed, key=lambda r: r["their_rule"]):
+            print("    {0}".format(row["their_rule"]))
+            for rid in row["our_rules"]:
+                print("        {0}".format(rid))
+        print()
+
+    if alone:
+        print("  THEIRS, AND NOTHING HERE FIRES  ({0})".format(len(alone)))
+        print("  A candidate list, not a defect list. This corpus is about ORM")
+        print("  correctness and theirs is about security, so most of this gap is")
+        print("  a different subject rather than a missing rule. The entries worth")
+        print("  arguing over are the ones whose subject IS correctness.")
+        print()
+        by_category = collections.defaultdict(list)
+        for row in alone:
+            by_category[row["category"]].append(row)
+        for category in sorted(by_category):
+            print("    {0}".format(category))
+            for row in sorted(by_category[category], key=lambda r: r["their_rule"]):
+                print("      {0:<40} {1}".format(row["their_rule"], row["severity"]))
+        print()
+
+    if blind:
+        print("  NO PROBE, SO NO ANSWER  ({0})".format(len(blind)))
+        print("  Their pattern did not survive being filled in. These are")
+        print("  unmeasured, which is a different thing from uncovered.")
+        for row in sorted(blind, key=lambda r: r["their_rule"])[:examples]:
+            print("    {0}".format(row["their_rule"]))
+        if len(blind) > examples:
+            print("    ... {0} more".format(len(blind) - examples))
+        print()
+
+    if skipped:
+        print("  KEYS READ AND NOT USED")
+        for key, count in collections.Counter(
+                key for _, key in skipped).most_common():
+            print("    {0:>4}x  {1}".format(count, key))
+        print("    pattern-not says what a rule EXCLUDES, and probing one would")
+        print("    test the opposite of the rule.")
+        print()
+
+    outside = unreachable_here(our_rules, external)
+    if outside:
+        stacks = covered_stacks(external)
+        comparable = [rule for rule in our_rules if rule["stack"] in stacks]
+        print("  OURS, WITH NO PATTERN OF THEIRS THAT COULD MATCH  ({0} of {1})".format(
+            len(outside), len(comparable)))
+        print("  Counted over the stack(s) their ruleset is about: {0}.".format(
+            ", ".join(sorted(stacks))))
+        print("  A pattern cannot match source that is missing one of its literal")
+        print("  names. For these rules no pattern of theirs has all its names")
+        print("  present in our own wrong sample, so none of their rules is about")
+        print("  them. Strong, and not a proof: semgrep's import equivalences can")
+        print("  match a name the line does not spell out.")
+        print()
+        for rid in outside[:examples * 2]:
+            print("    {0}".format(rid))
+        if len(outside) > examples * 2:
+            print("    ... {0} more".format(len(outside) - examples * 2))
+        print()
+
+    if marks:
+        total = sum(len(places) for places in marks.values())
+        print("  WHAT THEIR ANALYSER ACTUALLY FIRED ON  ({0} suppressed findings)".format(
+            total))
+        print("  Read out of `# nosemgrep:` markers in the checkout. Each one is a")
+        print("  finding that fired AND that a person read and kept the code over.")
+        print("  Partial in a known direction: it records what was dismissed and")
+        print("  says nothing about what was fixed.")
+        print()
+        known = set(row["their_rule"] for row in rows)
+        for rid, places in sorted(marks.items(),
+                                  key=lambda kv: (-len(kv[1]), kv[0])):
+            if rid == "(unnamed)":
+                tag = "   (marker names no rule, so nothing to compare)"
+            elif rid in known:
+                tag = ""
+            else:
+                tag = "   (not in this ruleset)"
+            print("    {0:>5}x  {1}{2}".format(len(places), rid, tag))
+        print()
+
+    if echo is not None:
+        both, theirs_only, unread = echo
+        print("  THE SAME LINE, TWO ANALYSERS")
+        print("  The strongest comparison available without running theirs: same")
+        print("  file, same line, both corpora with something to say.")
+        print()
+        print("    {0:<46} {1:>5}".format("lines theirs fired on",
+                                          len(both) + theirs_only))
+        print("    {0:<46} {1:>5}".format("...where a checker here also fires",
+                                          len(both)))
+        if unread:
+            print("    {0:<46} {1:>5}".format("files past the read limit, unmeasured",
+                                              unread))
+        print()
+        for rel, line, rid, ours in both[:examples]:
+            print("      {0}:{1}".format(rel, line))
+            print("        theirs  {0}".format(rid))
+            print("        ours    {0}".format(", ".join(ours)))
+        if len(both) > examples:
+            print("      ... {0} more".format(len(both) - examples))
+        print()
+
+    print("  WHAT THIS DOES NOT MEASURE")
+    print("  Their analyser was never run. A probe is the construct their pattern")
+    print("  describes, not the code their analyser would flag in a real file, and")
+    print("  the two differ wherever a pattern leans on context a probe strips")
+    print("  away. Nothing here is a score either: a gap on a subject this corpus")
+    print("  deliberately does not cover reads exactly like one it forgot.")
+    return 0
+
+
+def main(argv):
+    parser = argparse.ArgumentParser(prog="nexa crosswalk", add_help=True)
+    parser.add_argument("ruleset", nargs="?",
+                        help="an external analyser's rule file (semgrep YAML)")
+    parser.add_argument("--checkout",
+                        help="a source tree the other analyser runs on, read for "
+                             "its suppression markers")
+    parser.add_argument("--stack", default="odoo",
+                        help="the stack whose checkers run on the checkout")
+    parser.add_argument("--examples", type=int, default=8,
+                        help="entries to print per list (default 8)")
+    parser.add_argument("--json", help="write the raw rows here as well")
+    args = parser.parse_args(argv)
+
+    if not args.ruleset:
+        print(__doc__)
+        return 2
+    if not os.path.isfile(args.ruleset):
+        print("No such rule file: {0}".format(args.ruleset))
+        return 2
+
+    external, skipped = read_ruleset(args.ruleset)
+    if not external:
+        print("No rules found in {0}.".format(args.ruleset))
+        print("This reads semgrep rule files: a `rules:` list of `- id:` mappings.")
+        return 2
+
+    our_rules = corpus.load_rules()
+    rows = crosswalk(external, our_rules)
+
+    marks, echo = {}, None
+    if args.checkout:
+        if not os.path.isdir(args.checkout):
+            print("No such checkout: {0}".format(args.checkout))
+            return 2
+        sys.stderr.write("\r  reading {0} ...".format(
+            os.path.basename(os.path.abspath(args.checkout))))
+        sys.stderr.flush()
+        marks = suppressions(args.checkout)
+        if marks:
+            echo = echoed_on_the_same_line(args.checkout, marks, our_rules,
+                                           args.stack)
+        sys.stderr.write("\r" + " " * 60 + "\r")
+
+    code = report(rows, external, our_rules, skipped, marks, echo, args.examples)
+    if args.json:
+        payload = {"crosswalk_version": CROSSWALK_VERSION,
+                   "ruleset": os.path.basename(args.ruleset),
+                   "their_rules": [rule.as_dict() for rule in external],
+                   "rows": rows,
+                   "suppressions": dict(marks),
+                   "same_line": echo[0] if echo else []}
+        with io.open(args.json, "w", encoding="utf-8") as handle:
+            handle.write(json.dumps(payload, indent=2, ensure_ascii=False))
+        print()
+        print("  raw rows written to {0}".format(args.json))
+    return code
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

bin/layers.py

@@ -262,9 +262,9 @@ def check_compliance(text, rules):
 # there is deliberately no nexa-specific marker on this list. A mute button for
 # our own findings would be the first mechanism here capable of hiding one, and
 # the whole design is an argument against having any.
-SUPPRESSION_MARKERS = ("noqa", "nosemgrep", "pylint: disable", "pylint:disable",
-                       "type: ignore", "eslint-disable", "@ts-ignore",
-                       "@ts-expect-error")
+SUPPRESSION_MARKERS = ("noqa", "nosemgrep", "nosec", "pylint: disable",
+                       "pylint:disable", "type: ignore", "eslint-disable",
+                       "@ts-ignore", "@ts-expect-error")
 
 
 class SourceHit(object):

bin/recall.py

@@ -204,7 +204,7 @@ def measure(repo, stack, limit, rules):
     commits = fix_commits(repo, stack, limit)
     rows = []
     for sha, subject in commits:
-        caught, vanished = set(), set()
+        caught, vanished, spoke = set(), set(), set()
         touched = 0
         for path in changed_files(repo, sha, stack):
             before = git(repo, "show", "{0}^:{1}".format(sha, path))
@@ -215,6 +215,7 @@ def measure(repo, stack, limit, rules):
             was = findings(before, rules, stack)
             now = findings(after, rules, stack)
             changed = touched_lines(repo, sha, path)
+            spoke.update(key[0] for key in was)
             for key, lines in was.items():
                 if len(lines) <= len(now.get(key, [])):
                     continue                  # still there, as often as before
@@ -240,6 +241,13 @@ def measure(repo, stack, limit, rules):
             # the gap between this and "caught" is the measure of how much a
             # looser criterion would have flattered the result.
             "vanished_elsewhere": sorted(vanished - caught),
+            # Rules with a finding in the file BEFORE the fix that is not a
+            # catch: still there afterwards, or gone from a line the fix never
+            # touched. On a missed commit this separates the corpus being blind
+            # to the file from the corpus looking straight at it and pointing
+            # somewhere else, and those want opposite repairs -- a rule that
+            # does not exist, against a rule that does and is aimed wrong.
+            "spoke": sorted(spoke - caught),
         })
     return rows
 
@@ -299,9 +307,16 @@ def report(rows, stack, repos, misses_shown):
 
     missed = [r for r in scoped if not r["caught"]]
     if missed:
+        spoke = [r for r in missed if r.get("spoke")]
         print("  MISSED, IN SCOPE ({0} of {1})".format(len(missed), len(scoped)))
-        print("  Each of these is a bug somebody fixed that the corpus had")
-        print("  nothing to say about. This is the candidate-rule list.")
+        print("  Each of these is a bug somebody fixed that the corpus did not")
+        print("  flag on the line of the fix. This is the candidate-rule list.")
+        print()
+        print("  {0} of them are not blind spots: a checker fired somewhere else".format(
+            len(spoke)))
+        print("  in one of the files and the fix went to a different line. The rule")
+        print("  exists and is aimed wrong, which is not the same repair as a rule")
+        print("  that does not exist. --harvest splits the list on that.")
         print()
         for row in missed[:misses_shown]:
             print("    {0}  {1}".format(row["sha"], row["subject"]))
@@ -359,11 +374,12 @@ def harvest(rows, stack, shown=6, words=12):
 
     print("HARVEST  {0}".format(stack))
     print()
-    print("  {0} fix commit(s) the corpus had nothing to say about, clustered by".format(
+    print("  {0} fix commit(s) the corpus did not flag on the line of the fix,".format(
         len(missed)))
-    print("  the construct each diff touched. Every one is an incident: a bug")
-    print("  somebody found, fixed and pushed. A rule written from one of these")
-    print("  has a reason behind it that a rule written from an opinion does not.")
+    print("  clustered by the construct each diff touched. Every one is an")
+    print("  incident: a bug somebody found, fixed and pushed. A rule written from")
+    print("  one of these has a reason behind it that a rule written from an")
+    print("  opinion does not.")
     print()
 
     by_token = collections.defaultdict(list)
@@ -376,12 +392,20 @@ def harvest(rows, stack, shown=6, words=12):
             caught_by_token[token] += 1
 
     print("  CONSTRUCTS, BY HOW MANY MISSED FIXES TOUCHED THEM")
+    print()
+    print("    caught  the corpus flagged the line the fix changed")
+    print("    spoke   a checker fired somewhere in one of these files and the")
+    print("            fix went elsewhere. Not a catch, and not blindness either:")
+    print("            the rule exists and is aimed wrong, which is a different")
+    print("            repair from the rule that does not exist. A flat miss")
+    print("            count hides which of the two you are looking at.")
+    print()
     ranked = sorted(by_token.items(), key=lambda kv: (-len(kv[1]), kv[0]))
     for token, hits in ranked:
         got = caught_by_token[token]
-        print("    {0:>4}x  {1:<24} {2}".format(
-            len(hits), token,
-            "({0} caught)".format(got) if got else "(nothing caught here)"))
+        said = sum(1 for row in hits if row.get("spoke"))
+        print("    {0:>4}x  {1:<20} {2:>3} caught   {3:>3} spoke   {4:>3} silent".format(
+            len(hits), token, got, said, len(hits) - said))
     print()
 
     scopes = set()
@@ -409,10 +433,14 @@ def harvest(rows, stack, shown=6, words=12):
 
     print("  THE LIST")
     for token, hits in ranked:
+        said = sum(1 for row in hits if row.get("spoke"))
         print()
-        print("    {0}  --  {1} missed".format(token, len(hits)))
+        print("    {0}  --  {1} missed, {2} of them with a checker firing "
+              "elsewhere in the file".format(token, len(hits), said))
         for row in hits[:shown]:
             print("      {0}  {1}".format(row["sha"], row["subject"][:88]))
+            for rid in row.get("spoke", []):
+                print("        spoke: {0}".format(rid))
         if len(hits) > shown:
             print("      ... {0} more".format(len(hits) - shown))
     print()
@@ -422,7 +450,26 @@ def harvest(rows, stack, shown=6, words=12):
     return 1
 
 
+def _survive_the_console():
+    """A commit subject is somebody else's text and may hold any character.
+
+    Printing one to a Windows console on a legacy code page raises
+    UnicodeEncodeError part-way through the report, which loses the rest of the
+    report AND the --json artifact written after it -- measured, on a subject
+    containing an arrow. `nexa recall` never meets this because the parent sets
+    PYTHONIOENCODING; `python recall.py`, which the docstring above tells people
+    to run, does.
+    """
+    for attempt in ({"encoding": "utf-8"}, {"errors": "replace"}):
+        try:
+            sys.stdout.reconfigure(**attempt)
+            return
+        except (AttributeError, OSError, ValueError):
+            continue
+
+
 def main(argv):
+    _survive_the_console()
     parser = argparse.ArgumentParser(prog="nexa recall", add_help=True)
     parser.add_argument("repos", nargs="*", help="git checkouts WITH history")
     parser.add_argument("--stack", default="odoo",
@@ -462,11 +509,17 @@ def main(argv):
         rows.extend(measure(repo, args.stack, args.limit, rules))
     sys.stderr.write("\r" + " " * 60 + "\r")
 
-    code = (harvest(rows, args.stack, args.examples) if args.harvest
-            else report(rows, args.stack, args.repos, args.misses))
+    # Before the report, not after it. The measurement is the expensive half --
+    # minutes of git and checker runs -- and printing it is the fragile half.
+    # Written first, a report that cannot reach the screen still leaves the
+    # thing the numbers are re-derivable from.
     if args.json:
         with io.open(args.json, "w", encoding="utf-8") as fh:
             fh.write(json.dumps(rows, indent=2, ensure_ascii=False))
+
+    code = (harvest(rows, args.stack, args.examples) if args.harvest
+            else report(rows, args.stack, args.repos, args.misses))
+    if args.json:
         print("  raw rows written to {0}".format(args.json))
     return code
 

bin/semantics.py

@@ -811,9 +811,380 @@ def _comodel_of(call):
     return None
 
 
+# ------------------------------------------------------- the cursor checkers
+
+# The names an Odoo database cursor is reached by. self.env.cr and self._cr are
+# the two the framework provides; `cr` alone is the argument name every
+# migration script and post-init hook uses. Anything else called .execute() or
+# .commit() is somebody else's object and none of our business.
+CURSOR_NAMES = frozenset(["cr", "_cr", "cursor", "_cursor"])
+
+
+def _cursor_call(node, method):
+    """True when this Call is <something>.cr.<method>(...).
+
+    The attribute immediately before the method name is what decides it, so
+    self.env.cr.execute, self._cr.execute and a bare cr.execute all match while
+    connection.execute and session.commit do not.
+    """
+    if not isinstance(node, ast.Call):
+        return False
+    func = node.func
+    if not isinstance(func, ast.Attribute) or func.attr != method:
+        return False
+    owner = func.value
+    if isinstance(owner, ast.Attribute):
+        return owner.attr in CURSOR_NAMES
+    if isinstance(owner, ast.Name):
+        return owner.id in CURSOR_NAMES
+    return False
+
+
+def commit_inside_a_loop(code):
+    """odoo.commit-inside-a-loop-leaves-half-written-data
+
+    A commit ends the transaction the ORM is working inside. Done once per
+    iteration, the loop stops being one unit of work: iteration seven raising
+    leaves iterations one to six already written, the caller's except clause
+    has nothing left to roll back, and the user sees an error over data that
+    stayed.
+
+    Only loops, not every commit. A commit in a cron batch or a migration
+    script is a deliberate decision about batch size, and a rule that fired on
+    all of them would be argued with rather than read. Inside a loop over a
+    recordset it is almost never deliberate -- it is somebody flushing as they
+    go -- and that is the shape this reports.
+
+    The receiver decides, not the method name: `.commit()` on anything that is
+    not a cursor belongs to some other library.
+    """
+    tree, _ = parse_python(code)
+    if tree is None:
+        return []
+    findings = []
+    for loop in ast.walk(tree):
+        if not isinstance(loop, (ast.For, ast.AsyncFor, ast.While)):
+            continue
+        # The loop's own body, not its else clause: an else runs once, after
+        # the loop, and a commit there is a commit after a loop.
+        for statement in loop.body:
+            for node in ast.walk(statement):
+                if _cursor_call(node, "commit"):
+                    findings.append((
+                        node.lineno,
+                        "cr.commit() inside a loop -- an exception on a later "
+                        "iteration leaves the earlier ones written, and the "
+                        "caller cannot roll the batch back"))
+    return sorted(set(findings))
+
+
+def sql_built_by_string_formatting(code):
+    """odoo.sql-needs-query-parameters
+
+    cr.execute("... id = %s", (rec.id,)) is correct and contains a percent
+    sign. cr.execute("... id = %s" % rec.id) is the bug and contains the same
+    percent sign. A regex cannot tell them apart, which is why this is an AST
+    pass: the difference is whether the substitution happens in Python before
+    the cursor sees the string, and that is a BinOp rather than a character.
+
+    Four spellings, all of them the same mistake:
+
+        "..." % value            BinOp with Mod
+        "...".format(value)      a call to .format on a string
+        f"...{value}..."         JoinedStr
+        "..." + value            BinOp with Add, one side a string
+
+    Only the FIRST argument is examined. The second is the parameter tuple and
+    building that with formatting is somebody's business, not a SQL injection.
+    """
+    tree, _ = parse_python(code)
+    if tree is None:
+        return []
+    findings = []
+    for node in ast.walk(tree):
+        if not _cursor_call(node, "execute") or not node.args:
+            continue
+        how = _how_the_query_was_built(node.args[0])
+        if how:
+            findings.append((
+                node.args[0].lineno,
+                "the query handed to cr.execute() is built by {0} -- pass the "
+                "values as the second argument so the driver quotes them".format(how)))
+    return sorted(set(findings))
+
+
+def _how_the_query_was_built(node):
+    """The name of the string operation that produced this query, or ""."""
+    if isinstance(node, ast.JoinedStr):
+        return "an f-string"
+    if isinstance(node, ast.BinOp):
+        if isinstance(node.op, ast.Mod):
+            return "percent formatting"
+        if isinstance(node.op, ast.Add) and (_is_a_string(node.left)
+                                             or _is_a_string(node.right)):
+            return "string concatenation"
+    if isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute) \
+            and node.func.attr == "format" and not _is_composed_sql(node.func.value):
+        return "str.format()"
+    return ""
+
+
+def _is_composed_sql(node):
+    """psycopg2's sql.SQL("... {}").format(sql.Identifier(name)) is the CORRECT
+    way to parameterise a table or column name, and it spells .format().
+
+    Found by running this over 229,600 lines of OpenSPP: the one finding that
+    was wrong rather than merely suppressed was this construct, on a DROP INDEX
+    whose identifier the surrounding code had already validated. A checker that
+    tells an author to stop using the safe API is worse than one that says
+    nothing.
+    """
+    if not isinstance(node, ast.Call):
+        return False
+    func = node.func
+    if isinstance(func, ast.Attribute):
+        return func.attr in ("SQL", "Identifier", "Composed", "Literal")
+    return isinstance(func, ast.Name) and func.id in ("SQL", "Identifier")
+
+
+def _is_a_string(node):
+    return ((isinstance(node, ast.Constant) and isinstance(node.value, str))
+            or isinstance(node, ast.JoinedStr))
+
+
+def depends_names_unread_fields(code):
+    """odoo.depends-must-not-name-unread-fields
+
+    The other direction of depends_covers_compute_reads, and a milder problem:
+    a declared dependency the body never reads does not make the value stale,
+    it makes the value recompute on writes that cannot change it.
+
+    Harvested from OpenSPP's history rather than reasoned about. Two fix
+    commits, both of them a leftover:
+
+        @api.depends("partner_id", "pathway_id", "assessment_date")
+        def _compute_name(self):        # reads partner_id and pathway_id only
+
+        @api.depends("topic_ids")
+        def _compute_session_count(self):   # counts rows on another model
+
+    The second is why this is worth reporting at all. The decorator is the only
+    statement anywhere of what a stored value depends on, and a reader trusts
+    it. Left naming a field an older body used to read, it hides that this
+    compute has no expressible dependency at all -- it queries a different
+    model -- and the staleness that follows looks accounted for.
+
+    Deliberately permissive, because a wrong entry costs a recompute and a
+    false finding costs trust:
+
+      A string literal anywhere in the body counts as a read. filtered("x"),
+      mapped("a.b") and sorted(key=...) name fields without an attribute access
+      ever appearing.
+
+      A declared path is covered by any read that shares a prefix with it in
+      either direction, so declaring line_ids while reading line_ids.price is
+      fine and so is the reverse.
+
+      A body that calls a method on self, or hands a record to any call, is
+      left alone entirely. The read is then inside the callee, this pass cannot
+      follow it, and the honest answer is not to guess. Measured on OpenSPP,
+      this is the largest false-positive class: a compute that declares five
+      fields and passes the record to a resolver that reads all five.
+
+      A body that reads a field the decorator does not declare is left alone
+      too. The two are already out of step, and that disagreement belongs to
+      depends_covers_compute_reads -- reporting it twice from opposite
+      directions is two findings about one confusion. It is also how a compute
+      reading another stored compute looks from here, and those declare the
+      upstream source on purpose.
+    """
+    tree, _ = parse_python(code)
+    if tree is None:
+        return []
+    findings = []
+    for fn in _functions(tree):
+        declared = _decorator_args(fn, "api", "depends")
+        if not declared:
+            continue
+        if _calls_a_method_on_self(fn) or _hands_a_record_to_a_call(fn) \
+                or _queries_another_model(fn):
+            continue
+        aliases = _aliases(fn)
+        read = set(".".join(path) for path, _ in _field_reads(fn, aliases))
+        produced = set(_assigned_attrs(fn))
+        if _reads_outside_the_declarations(read - produced, declared):
+            continue
+        read |= produced
+        read |= _string_literals(fn)
+        unread = [entry for entry in declared
+                  if not _covered_by_a_read(entry, read)]
+        if unread:
+            # One finding per method, not per entry. Three leftovers on one
+            # decorator is one thing to fix, and three lines all pointing at
+            # the same def read as three problems.
+            findings.append((
+                fn.lineno,
+                "{0}() declares {1} in @api.depends and never reads {2} -- the "
+                "value recomputes on writes that cannot change it, and the "
+                "decorator stops describing the method".format(
+                    fn.name, ", ".join(repr(str(e)) for e in unread),
+                    "them" if len(unread) > 1 else "it")))
+    return sorted(set(findings))
+
+
+def _reads_outside_the_declarations(read, declared):
+    """Does the body read a field no declared entry covers?
+
+    Prefix-wise in both directions, so reading partner_id.name against a
+    declared partner_id is inside the declarations and reading
+    intervention_count against a declared intervention_ids is outside them.
+    """
+    for path in read:
+        if not any(path == entry or path.startswith(entry + ".")
+                   or entry.startswith(path + ".") for entry in declared):
+            return True
+    return False
+
+
+def _hands_a_record_to_a_call(fn):
+    """Does any call in the body receive a record as an argument?
+
+    resolve(scope) can read every field on scope, so a dependency declared for
+    its benefit is correct and invisible here. A domain built from rec.id is
+    not this: an id is an integer, and no callee reads a field through one.
+    """
+    aliases = _aliases(fn)
+    for node in _walk_body(fn):
+        if not isinstance(node, ast.Call):
+            continue
+        for argument in list(node.args) + [kw.value for kw in node.keywords]:
+            if _is_record_valued(argument, aliases):
+                return True
+    return False
+
+
+QUERY_METHODS = frozenset(["search", "search_count", "search_read", "read_group",
+                           "_read_group", "execute", "_search"])
+
+
+def _queries_another_model(fn):
+    """Does the body count or fetch rows from somewhere other than self?
+
+    The largest class of false finding here by a wide margin: 17 of the 31 this
+    reported on OpenSPP. A compute whose value comes from rows in ANOTHER model
+    has no dependency @api.depends can express -- the ORM cannot watch a table
+    this record has no field for -- so whatever the author declared is their
+    best available approximation, usually the inverse One2many, and it often
+    works. Telling them to delete it removes the only recompute trigger the
+    value has.
+
+    The cost of the exclusion is real and stated rather than hidden: one of the
+    two harvested incidents this checker was written from is exactly this shape
+    -- @api.depends("topic_ids") on a compute that counted rows on another
+    model -- and is no longer reported. Reading it, the author's fix was to
+    decide there was no correct dependency at all, which is a judgement this
+    pass has no way to make for them.
+    """
+    for node in _walk_body(fn):
+        if isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute) \
+                and node.func.attr in QUERY_METHODS:
+            return True
+    return False
+
+
+def _is_record_valued(node, aliases):
+    """Is this argument a record, or a field of one, rather than a plain value?
+
+    Collection literals are looked inside, because a domain is a list of tuples
+    and a vals dict is a dict of them. Attribute chains are NOT walked into:
+    the Name at the base of rec.id is not itself an argument, and counting it
+    made a search domain look like a record being handed over.
+    """
+    if isinstance(node, ast.Name):
+        return node.id in aliases
+    if isinstance(node, ast.Attribute):
+        path = _attr_path(node, aliases)
+        return bool(path) and path[0] not in ORM_ATTRS \
+            and not path[0].startswith("_")
+    if isinstance(node, (ast.List, ast.Tuple, ast.Set)):
+        return any(_is_record_valued(item, aliases) for item in node.elts)
+    if isinstance(node, ast.Dict):
+        return any(_is_record_valued(item, aliases)
+                   for item in list(node.keys) + list(node.values) if item)
+    return False
+
+
+def _covered_by_a_read(entry, read):
+    """A declared path is covered by any read sharing a prefix with it."""
+    for path in read:
+        if path == entry or path.startswith(entry + ".") \
+                or entry.startswith(path + "."):
+            return True
+    return False
+
+
+def _walk_body(fn):
+    """Every node in the function's BODY, decorators excluded.
+
+    ast.walk(fn) includes the decorator list, and @api.depends("x") holds the
+    string "x". Counted as evidence the body mentions x, every declared entry
+    proves itself and the checker silently finds nothing -- which is exactly
+    what it did on the incident it was written from.
+    """
+    for statement in fn.body:
+        for node in ast.walk(statement):
+            yield node
+
+
+def _string_literals(fn):
+    """Every string in the body, plus each dotted path inside one.
+
+    filtered("is_late") and mapped("line_ids.price") name fields without an
+    attribute access ever appearing, and a declared dependency on either is
+    correct. Splitting the dotted ones lets a declared prefix match too.
+    """
+    out = set()
+    for node in _walk_body(fn):
+        if isinstance(node, ast.Constant) and isinstance(node.value, str):
+            text = node.value.strip()
+            if text:
+                out.add(text)
+                out.update(re.findall(r"[A-Za-z_][A-Za-z0-9_.]*", text))
+    return out
+
+
+def _calls_a_method_on_self(fn):
+    """Does this body call a method ON the record -- rec._helper(), self._go()?
+
+    The read is then inside the helper, where this pass cannot follow it, and a
+    dependency declared for the helper's benefit is correct. Reporting it would
+    be telling the author to delete a line that is doing its job.
+
+    Length one, deliberately. rec._helper() resolves to the path ('_helper',)
+    and can read anything; rec.line_ids.filtered(...) resolves to ('line_ids',
+    'filtered') and is an ORM call on one field, which reaches no other. Taking
+    both lost the incident this checker was written from, where the body's only
+    call was .replace() on a string.
+    """
+    aliases = _aliases(fn)
+    for node in _walk_body(fn):
+        if not isinstance(node, ast.Call):
+            continue
+        func = node.func
+        if not isinstance(func, ast.Attribute):
+            continue
+        path = _attr_path(func, aliases)
+        if path is not None and len(path) == 1:
+            return True
+    return False
+
+
 CHECKS = {
     "check_company_missing_on_company_owned_relation":
         check_company_missing_on_company_owned_relation,
+    "commit_inside_a_loop": commit_inside_a_loop,
+    "depends_names_unread_fields": depends_names_unread_fields,
+    "sql_built_by_string_formatting": sql_built_by_string_formatting,
     "constrains_lists_every_field_read": constrains_lists_every_field_read,
     "depends_covers_compute_reads": depends_covers_compute_reads,
     "ondelete_leaves_a_dangling_read": ondelete_leaves_a_dangling_read,

corpus/build_corpus.py

@@ -354,6 +354,64 @@ SaleOrder._compute_amount = my_replacement""",
 </odoo>""",
  "tags": ["xml", "data", "upgrade"],
 },
+{
+ "id": "odoo.commit-inside-a-loop-splits-the-transaction",
+ "odoo_versions": ">=16.0",
+ "severity": "high",
+ "title": "Never commit inside a loop over records",
+ "rule": "Let the caller own the transaction. Do not call cr.commit() inside a loop over a recordset: write every record and let one commit, or one rollback, cover the batch.",
+ "why": "A commit ends the transaction the ORM is working inside, and Odoo's own guidelines say a manual one causes 'partial commits, and thus partial and unclean rollbacks'. Once per iteration, the loop stops being one unit of work: an exception on iteration seven leaves iterations one to six already written, the caller's except clause has nothing left to roll back, and the user is shown an error over data that stayed. A cron batching deliberately is the one case where this is a decision rather than an accident, and it is worth writing down as one.",
+ "enforcement_layer": "build-step",
+ "bypassed_by": [],
+ "wrong": """def _expire_consents(self):
+    for rec in self:
+        rec.state = 'expired'
+        self.env.cr.commit()""",
+ "correct": """def _expire_consents(self):
+    for rec in self:
+        rec.state = 'expired'
+    # No commit. The caller owns the transaction, so a failure anywhere in
+    # the batch rolls the whole batch back.""",
+ "tags": ["transaction", "commit", "partial-write", "atomicity", "batch"],
+},
+{
+ "id": "odoo.sql-needs-query-parameters",
+ "odoo_versions": ">=16.0",
+ "severity": "critical",
+ "title": "Pass values to cr.execute as parameters, never formatted into the query",
+ "rule": "Build every query as a constant string with %s placeholders and hand the values to cr.execute as its second argument. Never use %, .format(), an f-string or + to put a value into SQL.",
+ "why": "The driver quotes and types a parameter; Python formatting does neither. A value containing an apostrophe ends the string literal and what follows is executed as SQL, which is how an ordinary surname becomes an injection. It is also wrong before anybody is malicious: None formats as the text None rather than NULL, a date formats as a Python repr, and a number formatted into a text column compares as text. The query runs, returns rows, and is quietly the wrong query.",
+ "enforcement_layer": "build-step",
+ "bypassed_by": [],
+ "wrong": """self.env.cr.execute(
+    "SELECT id FROM res_partner WHERE company_id = %s" % company.id
+)""",
+ "correct": """self.env.cr.execute(
+    "SELECT id FROM res_partner WHERE company_id = %s", (company.id,)
+)""",
+ "tags": ["sql", "injection", "cr-execute", "query-parameters", "security"],
+},
+{
+ "id": "odoo.depends-must-not-name-unread-fields",
+ "odoo_versions": ">=16.0",
+ "severity": "medium",
+ "title": "Every api.depends entry should be a field the compute actually reads",
+ "rule": "Remove @api.depends entries the method body never reads. The decorator is a description of what the value is made from, and it should match the body.",
+ "why": "A dependency the body cannot use does not make the value stale, it makes the value recompute on writes that could not have changed it, and on a stored compute that is a database write per record per unrelated edit. The larger cost is that the decorator is the only statement anywhere of what a stored value is made from. Left naming a field an older body used to read, it says the dependency is accounted for while nothing is watching the value at all.",
+ "enforcement_layer": "python-constraint",
+ "bypassed_by": [],
+ "wrong": """@api.depends('deployment_date', 'actual_return_date', 'status')
+def _compute_days_deployed(self):
+    for rec in self:
+        end = rec.actual_return_date or fields.Date.today()
+        rec.days_deployed = (end - rec.deployment_date).days""",
+ "correct": """@api.depends('deployment_date', 'actual_return_date')
+def _compute_days_deployed(self):
+    for rec in self:
+        end = rec.actual_return_date or fields.Date.today()
+        rec.days_deployed = (end - rec.deployment_date).days""",
+ "tags": ["compute", "depends", "recompute", "stale-data", "decorator"],
+},
 ]
 
 TYPESCRIPT = [
@@ -798,6 +856,10 @@ ODOO_SECURITY = "https://www.odoo.com/documentation/18.0/developer/reference/bac
 ODOO_EXTERNAL_API = "https://www.odoo.com/documentation/18.0/developer/reference/external_api.html"
 ODOO_CONSTRAINTS = "https://www.odoo.com/documentation/18.0/developer/tutorials/server_framework_101/10_constraints.html"
 ODOO_ONCHANGE = "https://www.odoo.com/documentation/18.0/developer/tutorials/server_framework_101/08_compute_onchange.html"
+# Transaction handling is a contributing guideline rather than an ORM reference
+# topic: the ORM page does not use the word commit in any series. The guidelines
+# page does, and says the thing the rule says.
+ODOO_GUIDELINES = "https://www.odoo.com/documentation/18.0/contributing/development/coding_guidelines.html"
 PG_CREATE_TABLE = "https://www.postgresql.org/docs/current/ddl-constraints.html"
 # The Zod API reference, not the homepage. Four rules cited zod.dev/, which
 # supports nothing: a landing page is not provenance.
@@ -925,6 +987,22 @@ ENRICH = {
         # noupdate is a data-file attribute. The ORM reference never mentions it.
         "source": ODOO_DATA,
     },
+    "odoo.commit-inside-a-loop-splits-the-transaction": {
+        # No violation_pattern on purpose. `cr.commit()` is one string whether
+        # it sits in a loop or after one, and the difference between those is
+        # the entire rule.
+        "source": ODOO_GUIDELINES,
+    },
+    "odoo.sql-needs-query-parameters": {
+        # Also deliberately AST-only, and this one is the clearest case in the
+        # corpus for it: the CORRECT form contains a percent sign too. A regex
+        # that fires on `%` in a query fires on every parameterised query in
+        # the codebase, and one that does not fire on `%` cannot see the bug.
+        "source": ODOO_ORM,
+    },
+    "odoo.depends-must-not-name-unread-fields": {
+        "source": ODOO_ORM,
+    },
 
     # ---- TypeScript -------------------------------------------------------
     "typescript.types-are-erased-at-runtime": {
@@ -1110,6 +1188,12 @@ PROBES = {
         "change what a core sale.order method does without editing the sale module",
     "odoo.noupdate-on-user-editable-data":
         "the customer's configuration resets itself every time we upgrade the module",
+    "odoo.commit-inside-a-loop-splits-the-transaction":
+        "half my records were updated and the rest were not after the job raised",
+    "odoo.sql-needs-query-parameters":
+        "a raw query breaks when a partner name contains an apostrophe",
+    "odoo.depends-must-not-name-unread-fields":
+        "my api.depends lists a field the compute never uses",
 
     # ---- TypeScript -------------------------------------------------------
     "typescript.types-are-erased-at-runtime":
@@ -1180,6 +1264,15 @@ SEMANTIC_CHECK = {
     "odoo.stored-compute-needs-complete-depends": "depends_covers_compute_reads",
     "odoo.ondelete-is-a-decision": "ondelete_leaves_a_dangling_read",
     "odoo.check-company-on-relations": "check_company_missing_on_company_owned_relation",
+    # The three below are AST passes for the same reason from a different
+    # angle: the violation and the correct form are the same text, and only
+    # the structure around it differs. A commit is a commit wherever it sits;
+    # a parameterised query carries the same percent sign as an interpolated
+    # one; and an unread dependency is a string that looks exactly like a read
+    # one until you compare it against the body.
+    "odoo.commit-inside-a-loop-splits-the-transaction": "commit_inside_a_loop",
+    "odoo.sql-needs-query-parameters": "sql_built_by_string_formatting",
+    "odoo.depends-must-not-name-unread-fields": "depends_names_unread_fields",
 }
 
 

corpus/check_sources.py

@@ -55,6 +55,12 @@ SYMBOLS = {
     "odoo.sudo-bypasses-record-rules": "sudo",
     "odoo.no-monkey-patching": "_inherit",
     "odoo.noupdate-on-user-editable-data": "noupdate",
+    # "cr.commit", not "commit": the guidelines page says "commit" eighteen
+    # times and seventeen of them are about git. The dotted spelling appears
+    # once, in the paragraph this rule is built on.
+    "odoo.commit-inside-a-loop-splits-the-transaction": "cr.commit",
+    "odoo.sql-needs-query-parameters": "execute",
+    "odoo.depends-must-not-name-unread-fields": "depends",
 }
 
 # Where an API lives when the rule cites a tutorial page. The tutorials were

corpus/corpus_meta.json

@@ -1,14 +1,14 @@
 {
-  "built_utc": "2026-09-14T11:36:07.296075+00:00",
-  "rules": 40,
-  "machine_checkable": 37,
+  "built_utc": "2026-09-14T15:27:55.137727+00:00",
+  "rules": 43,
+  "machine_checkable": 40,
   "by_pattern": 32,
-  "by_semantic_check": 5,
+  "by_semantic_check": 8,
   "checked_against": {
     "odoo": "18.0",
     "python": "3.12",
     "typescript": "5.x",
     "javascript": "ES2023"
   },
-  "corpus_sha256": "5016b0775f8538fa66ed9fe8c248f61f00903fbd535305b6bb03e4add95f13aa"
+  "corpus_sha256": "82ea99467831cb210b5385d96cdd2629a4fa5c85e1a256ed57184ea71f469e51"
 }

corpus/rules/odoo.json

@@ -350,5 +350,74 @@
     "satisfied_pattern": "noupdate",
     "source": "https://www.odoo.com/documentation/18.0/developer/reference/backend/data.html",
     "probe": "the customer's configuration resets itself every time we upgrade the module"
+  },
+  {
+    "id": "odoo.commit-inside-a-loop-splits-the-transaction",
+    "odoo_versions": ">=16.0",
+    "severity": "high",
+    "title": "Never commit inside a loop over records",
+    "rule": "Let the caller own the transaction. Do not call cr.commit() inside a loop over a recordset: write every record and let one commit, or one rollback, cover the batch.",
+    "why": "A commit ends the transaction the ORM is working inside, and Odoo's own guidelines say a manual one causes 'partial commits, and thus partial and unclean rollbacks'. Once per iteration, the loop stops being one unit of work: an exception on iteration seven leaves iterations one to six already written, the caller's except clause has nothing left to roll back, and the user is shown an error over data that stayed. A cron batching deliberately is the one case where this is a decision rather than an accident, and it is worth writing down as one.",
+    "enforcement_layer": "build-step",
+    "bypassed_by": [],
+    "wrong": "def _expire_consents(self):\n    for rec in self:\n        rec.state = 'expired'\n        self.env.cr.commit()",
+    "correct": "def _expire_consents(self):\n    for rec in self:\n        rec.state = 'expired'\n    # No commit. The caller owns the transaction, so a failure anywhere in\n    # the batch rolls the whole batch back.",
+    "tags": [
+      "transaction",
+      "commit",
+      "partial-write",
+      "atomicity",
+      "batch"
+    ],
+    "stack": "odoo",
+    "source": "https://www.odoo.com/documentation/18.0/contributing/development/coding_guidelines.html",
+    "probe": "half my records were updated and the rest were not after the job raised",
+    "semantic_check": "commit_inside_a_loop"
+  },
+  {
+    "id": "odoo.sql-needs-query-parameters",
+    "odoo_versions": ">=16.0",
+    "severity": "critical",
+    "title": "Pass values to cr.execute as parameters, never formatted into the query",
+    "rule": "Build every query as a constant string with %s placeholders and hand the values to cr.execute as its second argument. Never use %, .format(), an f-string or + to put a value into SQL.",
+    "why": "The driver quotes and types a parameter; Python formatting does neither. A value containing an apostrophe ends the string literal and what follows is executed as SQL, which is how an ordinary surname becomes an injection. It is also wrong before anybody is malicious: None formats as the text None rather than NULL, a date formats as a Python repr, and a number formatted into a text column compares as text. The query runs, returns rows, and is quietly the wrong query.",
+    "enforcement_layer": "build-step",
+    "bypassed_by": [],
+    "wrong": "self.env.cr.execute(\n    \"SELECT id FROM res_partner WHERE company_id = %s\" % company.id\n)",
+    "correct": "self.env.cr.execute(\n    \"SELECT id FROM res_partner WHERE company_id = %s\", (company.id,)\n)",
+    "tags": [
+      "sql",
+      "injection",
+      "cr-execute",
+      "query-parameters",
+      "security"
+    ],
+    "stack": "odoo",
+    "source": "https://www.odoo.com/documentation/18.0/developer/reference/backend/orm.html",
+    "probe": "a raw query breaks when a partner name contains an apostrophe",
+    "semantic_check": "sql_built_by_string_formatting"
+  },
+  {
+    "id": "odoo.depends-must-not-name-unread-fields",
+    "odoo_versions": ">=16.0",
+    "severity": "medium",
+    "title": "Every api.depends entry should be a field the compute actually reads",
+    "rule": "Remove @api.depends entries the method body never reads. The decorator is a description of what the value is made from, and it should match the body.",
+    "why": "A dependency the body cannot use does not make the value stale, it makes the value recompute on writes that could not have changed it, and on a stored compute that is a database write per record per unrelated edit. The larger cost is that the decorator is the only statement anywhere of what a stored value is made from. Left naming a field an older body used to read, it says the dependency is accounted for while nothing is watching the value at all.",
+    "enforcement_layer": "python-constraint",
+    "bypassed_by": [],
+    "wrong": "@api.depends('deployment_date', 'actual_return_date', 'status')\ndef _compute_days_deployed(self):\n    for rec in self:\n        end = rec.actual_return_date or fields.Date.today()\n        rec.days_deployed = (end - rec.deployment_date).days",
+    "correct": "@api.depends('deployment_date', 'actual_return_date')\ndef _compute_days_deployed(self):\n    for rec in self:\n        end = rec.actual_return_date or fields.Date.today()\n        rec.days_deployed = (end - rec.deployment_date).days",
+    "tags": [
+      "compute",
+      "depends",
+      "recompute",
+      "stale-data",
+      "decorator"
+    ],
+    "stack": "odoo",
+    "source": "https://www.odoo.com/documentation/18.0/developer/reference/backend/orm.html",
+    "probe": "my api.depends lists a field the compute never uses",
+    "semantic_check": "depends_names_unread_fields"
   }
 ]

modelfiles/gen-odoo.Modelfile

@@ -116,6 +116,18 @@ garnish on top of the real rule. Agreeing here ships bad data to production.
     def migrate(cr, version):
         cr.execute("UPDATE my_model SET ref = 'LEGACY-' || id WHERE ref IS NULL")
 
+[odoo.sql-needs-query-parameters] (critical) Pass values to cr.execute as parameters, never formatted into the query
+  Rule: Build every query as a constant string with %s placeholders and hand the values to cr.execute as its second argument. Never use %, .format(), an f-string or + to put a value into SQL.
+  Why: The driver quotes and types a parameter; Python formatting does neither. A value containing an apostrophe ends the string literal and what follows is executed as SQL, which is how an ordinary surname becomes an injection. It is also wrong before anybody is malicious: None formats as the text None rather than NULL, a date formats as a Python repr, and a number formatted into a text column compares as text. The query runs, returns rows, and is quietly the wrong query.
+  Wrong:
+    self.env.cr.execute(
+        "SELECT id FROM res_partner WHERE company_id = %s" % company.id
+    )
+  Correct:
+    self.env.cr.execute(
+        "SELECT id FROM res_partner WHERE company_id = %s", (company.id,)
+    )
+
 [odoo.stored-compute-needs-complete-depends] (critical) Stored computed fields need a complete api.depends
   Rule: Every field read inside a stored compute must appear in @api.depends, including fields reached through a relation.
   Why: A stored computed field with an incomplete depends is written once and never recomputed. The value goes stale silently, survives restarts, and diverges from reality. Nothing errors, so it surfaces only when a report disagrees with the source data.
@@ -141,6 +153,21 @@ garnish on top of the real rule. Agreeing here ships bad data to production.
         ('company_id', 'in', [False] + self.env.company.ids),
     ])
 
+[odoo.commit-inside-a-loop-splits-the-transaction] (high) Never commit inside a loop over records
+  Rule: Let the caller own the transaction. Do not call cr.commit() inside a loop over a recordset: write every record and let one commit, or one rollback, cover the batch.
+  Why: A commit ends the transaction the ORM is working inside, and Odoo's own guidelines say a manual one causes 'partial commits, and thus partial and unclean rollbacks'. Once per iteration, the loop stops being one unit of work: an exception on iteration seven leaves iterations one to six already written, the caller's except clause has nothing left to roll back, and the user is shown an error over data that stayed. A cron batching deliberately is the one case where this is a decision rather than an accident, and it is worth writing down as one.
+  Wrong:
+    def _expire_consents(self):
+        for rec in self:
+            rec.state = 'expired'
+            self.env.cr.commit()
+  Correct:
+    def _expire_consents(self):
+        for rec in self:
+            rec.state = 'expired'
+        # No commit. The caller owns the transaction, so a failure anywhere in
+        # the batch rolls the whole batch back.
+
 [odoo.constrains-iterate-recordset] (high) Constraints receive a recordset, never a single record
   Rule: Always iterate with 'for rec in self:' inside @api.constrains and @api.depends methods.
   Why: Batch create and multi-record write pass a multi-record recordset. Reading self.field on more than one record raises a singleton error, so a bulk import fails only for some batches and looks intermittent.
@@ -235,6 +262,22 @@ garnish on top of the real rule. Agreeing here ships bad data to production.
         if self._has_cycle():
             raise ValidationError('You cannot create recursive hierarchies.')
 
+[odoo.depends-must-not-name-unread-fields] (medium) Every api.depends entry should be a field the compute actually reads
+  Rule: Remove @api.depends entries the method body never reads. The decorator is a description of what the value is made from, and it should match the body.
+  Why: A dependency the body cannot use does not make the value stale, it makes the value recompute on writes that could not have changed it, and on a stored compute that is a database write per record per unrelated edit. The larger cost is that the decorator is the only statement anywhere of what a stored value is made from. Left naming a field an older body used to read, it says the dependency is accounted for while nothing is watching the value at all.
+  Wrong:
+    @api.depends('deployment_date', 'actual_return_date', 'status')
+    def _compute_days_deployed(self):
+        for rec in self:
+            end = rec.actual_return_date or fields.Date.today()
+            rec.days_deployed = (end - rec.deployment_date).days
+  Correct:
+    @api.depends('deployment_date', 'actual_return_date')
+    def _compute_days_deployed(self):
+        for rec in self:
+            end = rec.actual_return_date or fields.Date.today()
+            rec.days_deployed = (end - rec.deployment_date).days
+
 [odoo.noupdate-on-user-editable-data] (medium) XML data users may edit needs noupdate
   Rule: Wrap XML data records that users are expected to modify in a data element with noupdate set to 1.
   Why: Without noupdate, every module upgrade overwrites the record with the version in XML, discarding the customer's configuration. It surfaces weeks later as 'our settings reset themselves'.

nexa.py

@@ -297,6 +297,42 @@ COMMANDS = {
         "\n"
         "No model, no network.",
     ),
+    "crosswalk": (
+        "Compare the corpus against somebody else's ruleset",
+        "nexa crosswalk <ruleset.yml> [--checkout DIR] [--stack odoo]",
+        "crosscheck, adversarial, fieldtest and recall all ask whether what we\n"
+        "wrote behaves. None of them can ask whether it is the right set of\n"
+        "things to have written: a rule nobody thought of is invisible to every\n"
+        "check that reads the rules.\n"
+        "\n"
+        "An external ruleset for the same stack is the one artefact that can\n"
+        "say. Somebody else decided what was worth checking, on the same\n"
+        "platform, without reading ours. Where the two agree, two independent\n"
+        "judgements landed on the same construct, and that is the only external\n"
+        "corroboration in this repository.\n"
+        "\n"
+        "Their analyser is never run -- semgrep is not installed here and an\n"
+        "offline tool will not grow a package index. Each of their patterns is\n"
+        "turned into the smallest snippet it would match and OUR checkers run\n"
+        "over that, so every claim rests on a checker firing rather than on two\n"
+        "rule descriptions sounding alike.\n"
+        "\n"
+        "  --checkout  a tree their analyser runs on. Its `# nosemgrep:` markers\n"
+        "              say which of their rules fired on real code and were read\n"
+        "              and kept by a person, and the report says how many of\n"
+        "              those same lines a checker here also fires on.\n"
+        "\n"
+        "  --json      every row, their rule ids included.\n"
+        "\n"
+        "Not a score. This corpus is about ORM correctness and a security\n"
+        "ruleset is about security, so most of the gap is a different subject\n"
+        "rather than a missing rule, and reading it is the work.\n"
+        "\n"
+        "  nexa crosswalk ../their-repo/.semgrep/odoo-security.yml\n"
+        "  nexa crosswalk rules.yml --checkout ../their-repo\n"
+        "\n"
+        "No model, no network.",
+    ),
     "coverage": (
         "Show what is machine-checkable and what is not",
         "nexa coverage",
@@ -429,7 +465,7 @@ COMMANDS = {
 GROUPS = [
     ("ASK", ["ask", "run", "check"]),
     ("CORPUS", ["rules", "build", "validate", "crosscheck", "coverage",
-                "adversarial", "fieldtest", "recall"]),
+                "adversarial", "fieldtest", "recall", "crosswalk"]),
     ("SYSTEM", ["doctor", "models", "report", "evidence", "index", "advise",
                 "eval"]),
 ]
@@ -630,6 +666,10 @@ def main(argv):
         if not rest:
             return usage_error("recall")
         return run_module("recall.py", rest, styled=True)
+    if cmd == "crosswalk":
+        if not rest:
+            return usage_error("crosswalk")
+        return run_module("crosswalk.py", rest, styled=True)
     if cmd == "evidence":
         return run_module("evidence.py", rest, styled=True)
     if cmd == "report":

tests/test_crosswalk.py

@@ -0,0 +1,396 @@
+"""nexa crosswalk: comparing this corpus against somebody else's ruleset.
+
+The fixtures are small semgrep rule files written here, not a copy of anybody's
+real one. What is under test is the machinery -- what gets read out of the YAML,
+what a pattern turns into, and which claims the report is entitled to make --
+and all of that has to be decidable without a network or a semgrep install.
+
+The load-bearing claim of the whole tool is that a pairing rests on a checker
+FIRING on a snippet, never on two rule descriptions sounding alike. Several of
+these tests exist to pin that, from both directions.
+"""
+import io
+import os
+
+import pytest
+
+import crosswalk
+
+
+def ruleset(tmp_path, body, name="rules.yml"):
+    path = tmp_path / name
+    path.write_text(body, encoding="utf-8")
+    return str(path)
+
+
+SIMPLE = """rules:
+  - id: their-eval
+    patterns:
+      - pattern-either:
+          - pattern: eval(...)
+          - pattern: exec(...)
+    message: |
+      Do not evaluate strings.
+      Second line of the message.
+    severity: ERROR
+    languages: [python]
+    metadata:
+      cwe: "CWE-95"
+      category: security
+
+  - id: their-loop-commit
+    patterns:
+      - pattern-either:
+          - pattern: |
+              for ... in ...:
+                  ...
+                  $CR.commit()
+                  ...
+    message: |
+      Committing in a loop leaves partial state.
+    severity: WARNING
+    languages: [python]
+    metadata:
+      category: reliability
+
+  - id: their-weak-random
+    patterns:
+      - pattern-either:
+          - pattern: random.random()
+          - pattern: random.choice(...)
+    message: |
+      Do not use the random module for security decisions.
+    severity: ERROR
+    languages: [python]
+    metadata:
+      cwe: "CWE-330"
+"""
+
+
+# ------------------------------------------------------------------- reading
+
+def test_rules_and_their_metadata_are_read(tmp_path):
+    rules, _ = crosswalk.read_ruleset(ruleset(tmp_path, SIMPLE))
+    assert [rule.rid for rule in rules] == ["their-eval", "their-loop-commit",
+                                            "their-weak-random"]
+    first = rules[0]
+    assert first.severity == "ERROR"
+    assert first.languages == ["python"]
+    assert first.cwe == "CWE-95"
+    assert first.category == "security"
+    assert first.patterns == ["eval(...)", "exec(...)"]
+
+
+def test_a_block_scalar_pattern_keeps_its_lines(tmp_path):
+    rules, _ = crosswalk.read_ruleset(ruleset(tmp_path, SIMPLE))
+    pattern = rules[1].patterns[0]
+    assert pattern.startswith("for ... in ...:")
+    assert "$CR.commit()" in pattern
+    assert pattern.count("\n") == 3
+
+
+def test_a_block_message_does_not_leak_into_the_patterns(tmp_path):
+    """A `message: |` body is prose sitting at the same indent as a pattern
+    alternative. Reading it as one would pair rules on English."""
+    rules, _ = crosswalk.read_ruleset(ruleset(tmp_path, SIMPLE))
+    for rule in rules:
+        for pattern in rule.patterns:
+            assert "Do not evaluate" not in pattern
+            assert "partial state" not in pattern
+    assert "Second line of the message." in rules[0].message
+
+
+def test_pattern_not_is_recognised_and_refused(tmp_path):
+    """It says what a rule EXCLUDES. Probing it would test the opposite of the
+    rule, so it is reported as skipped rather than silently read or ignored."""
+    body = """rules:
+  - id: their-savepoint
+    pattern: |
+      $S = self.env.cr.savepoint()
+      ...
+    pattern-not: |
+      $S = self.env.cr.savepoint()
+      ...
+      $S.close()
+    severity: INFO
+    languages: [python]
+"""
+    rules, skipped = crosswalk.read_ruleset(ruleset(tmp_path, body))
+    assert skipped == [("their-savepoint", "pattern-not")]
+    assert len(rules[0].patterns) == 1
+    assert "close()" not in rules[0].patterns[0]
+
+
+def test_a_file_with_no_rules_is_not_read_as_an_empty_corpus(tmp_path, capsys):
+    path = ruleset(tmp_path, "# just a comment\n")
+    assert crosswalk.main([path]) == 2
+    assert "No rules found" in capsys.readouterr().out
+
+
+def test_a_missing_file_is_a_bad_argument(capsys):
+    assert crosswalk.main(["no-such-file.yml"]) == 2
+    assert "No such rule file" in capsys.readouterr().out
+
+
+# ------------------------------------------------------------------- probing
+
+@pytest.mark.parametrize("pattern, wanted", [
+    ("eval(...)", "eval(_h1)"),
+    ("$CR.execute($QUERY % ...)", "_cr.execute(_query % _h1)"),
+    ("self.env[$MODEL].sudo()", "self.env[_model].sudo()"),
+    ("compile(..., ..., \"exec\")", "compile(_h1, _h2, \"exec\")"),
+])
+def test_holes_are_filled_with_names(pattern, wanted):
+    assert crosswalk.probe(pattern) == wanted
+
+
+def test_an_ellipsis_in_a_dict_becomes_a_splat():
+    """`{..., 'id': $R.id, ...}` is a dict display, and a bare name is not a
+    dict entry. Filling it wrong produces a snippet that does not parse, which
+    would be reported as no-answer on a rule we could have answered."""
+    assert crosswalk.probe("$R.write({..., 'state': 'done', ...})") == \
+        "_r.write({**_d1, 'state': 'done', **_d2})"
+
+
+def test_an_ellipsis_inside_an_fstring_is_text_not_an_argument():
+    probe = crosswalk.probe('$CR.execute(f"... FROM {$TABLE} ...")')
+    assert probe == '_cr.execute(f"a FROM {_table} a")'
+
+
+def test_a_statement_ellipsis_becomes_a_statement():
+    probe = crosswalk.probe("for ... in ...:\n    ...\n    $CR.commit()\n    ...")
+    assert probe == "for _i in _seq:\n    pass\n    _cr.commit()\n    pass"
+
+
+def test_an_ellipsis_after_a_keyword_argument_becomes_a_splat():
+    """`f(x, shell=True, y)` is a syntax error, so filling the trailing hole
+    with a plain name loses the rule rather than answering it. Three of the
+    forty-four rules crosswalk was first run against are this shape."""
+    assert crosswalk.probe("subprocess.run(..., shell=True, ...)") == \
+        "subprocess.run(_h1, shell=True, **_d2)"
+
+
+def test_a_yaml_quoted_pattern_loses_the_quotes_not_the_code():
+    """A ruleset that writes `- pattern: "return {...}"` means code. Left
+    quoted, it probes as a string literal and pairs with nothing."""
+    probe = crosswalk.probe("\"return {..., 'id': $RECORD.id, ...}\"")
+    assert probe == "return {**_d1, 'id': _record.id, **_d2}"
+
+
+def test_a_fragment_is_probed_as_a_fragment():
+    """A pattern is a fragment, not a module. `return {...}` and `await x()`
+    are whole patterns in real rulesets, and gating on compile() rather than on
+    the parser would report no answer on rules we can answer."""
+    assert crosswalk.probe("await $X.save()") == "await _x.save()"
+    assert crosswalk.probe("yield $X") == "yield _x"
+
+
+def test_a_pattern_that_cannot_be_filled_in_returns_none():
+    assert crosswalk.probe("$X ... $Y ...:::") is None
+    assert crosswalk.probe("") is None
+    assert crosswalk.probe("# a comment") is None
+
+
+def test_every_probe_parses_as_python(tmp_path):
+    """The one invariant the whole comparison rests on: a probe that does not
+    parse cannot be handed to a checker, and a probe that parses into something
+    other than the construct would pair rules on an accident."""
+    import ast
+    rules, _ = crosswalk.read_ruleset(ruleset(tmp_path, SIMPLE))
+    for rule in rules:
+        for pattern in rule.patterns:
+            probe = crosswalk.probe(pattern)
+            assert probe is not None, pattern
+            ast.parse(probe)
+
+
+# ------------------------------------------------------------------ matching
+
+def test_a_pairing_rests_on_a_checker_firing(tmp_path, all_rules):
+    """`eval(...)` and python.eval-and-pickle-execute-their-input are paired
+    because the checker fires on the snippet, not because both mention eval."""
+    rules, _ = crosswalk.read_ruleset(ruleset(tmp_path, SIMPLE))
+    rows = crosswalk.crosswalk(rules, all_rules)
+    by_id = {row["their_rule"]: row for row in rows}
+    assert "python.eval-and-pickle-execute-their-input" in \
+        by_id["their-eval"]["our_rules"]
+
+
+def test_a_construct_no_checker_has_pairs_with_nothing(tmp_path, all_rules):
+    """Weak randomness in a security decision is a real defect and this corpus
+    has nothing about it: it is about ORM correctness, not cryptography. The
+    report has to say so rather than reach for something close."""
+    rules, _ = crosswalk.read_ruleset(ruleset(tmp_path, SIMPLE))
+    rows = crosswalk.crosswalk(rules, all_rules)
+    by_id = {row["their_rule"]: row for row in rows}
+    assert by_id["their-weak-random"]["our_rules"] == []
+    assert by_id["their-weak-random"]["probed"] == 2, "probed, and still no pair"
+
+
+def test_a_gap_this_tool_found_and_closed_now_pairs(all_rules, tmp_path):
+    """The first crosswalk run reported `odoo-commit-in-loop` under "theirs
+    fires, nothing here does". That gap is why odoo.commit-inside-a-loop
+    exists, and this is the assertion that it stays closed: a corpus can lose
+    a rule as easily as it gained one.
+    """
+    rules, _ = crosswalk.read_ruleset(ruleset(tmp_path, SIMPLE))
+    rows = crosswalk.crosswalk(rules, all_rules)
+    by_id = {row["their_rule"]: row for row in rows}
+    assert by_id["their-loop-commit"]["our_rules"] == \
+        ["odoo.commit-inside-a-loop-splits-the-transaction"]
+
+
+def test_probed_and_unprobed_are_counted_apart(tmp_path, all_rules):
+    """A pattern that could not be filled in is a subject with no answer, which
+    is a different thing from a subject where the answer is no."""
+    body = SIMPLE + """
+  - id: their-unprobeable
+    patterns:
+      - pattern: $X ...:::
+    severity: INFO
+    languages: [python]
+"""
+    rules, _ = crosswalk.read_ruleset(ruleset(tmp_path, body))
+    rows = crosswalk.crosswalk(rules, all_rules)
+    row = [r for r in rows if r["their_rule"] == "their-unprobeable"][0]
+    assert row["probed"] == 0
+    assert row["unprobed"] == ["$X ...:::"]
+
+
+def test_literal_names_drop_the_metavariables():
+    assert crosswalk.literal_names("$CR.execute($QUERY % ...)") == {"execute"}
+    assert crosswalk.literal_names("pickle.loads(...)") == {"pickle", "loads"}
+
+
+def test_the_reverse_direction_is_restricted_to_their_languages(tmp_path,
+                                                                all_rules):
+    """A Python-only ruleset having nothing to say about a TypeScript rule is
+    the languages line at the bottom of their file, not a finding."""
+    rules, _ = crosswalk.read_ruleset(ruleset(tmp_path, SIMPLE))
+    assert crosswalk.covered_stacks(rules) == {"odoo", "python"}
+    outside = crosswalk.unreachable_here(all_rules, rules)
+    assert outside, "a two-rule ruleset reaches almost nothing"
+    assert not [rid for rid in outside
+                if rid.startswith(("typescript.", "javascript."))]
+
+
+def test_a_rule_their_patterns_name_is_not_reported_as_unreachable(tmp_path,
+                                                                   all_rules):
+    """python.eval-and-pickle-execute-their-input's own wrong sample contains
+    `eval`, so `eval(...)` could match it. Claiming otherwise would be a false
+    negative in the one direction this test can be sound about."""
+    rules, _ = crosswalk.read_ruleset(ruleset(tmp_path, SIMPLE))
+    outside = crosswalk.unreachable_here(all_rules, rules)
+    assert "python.eval-and-pickle-execute-their-input" not in outside
+
+
+# ---------------------------------------------------------------- field data
+
+MARKED = '''from odoo import models
+
+
+class Thing(models.Model):
+    def go(self):
+        return self.env["res.users"].sudo().search([])  # nosemgrep: odoo-sudo-without-context
+
+    def other(self):
+        return self.env["x"].sudo()  # nosemgrep: semgrep.odoo-sudo-without-context -- reviewed
+
+    def third(self):
+        return 1  # nosemgrep
+'''
+
+
+def test_suppression_markers_are_read_with_their_rule_ids(tmp_path):
+    (tmp_path / "mod").mkdir()
+    (tmp_path / "mod" / "a.py").write_text(MARKED, encoding="utf-8")
+    marks = crosswalk.suppressions(str(tmp_path))
+    assert len(marks["odoo-sudo-without-context"]) == 2
+    assert marks["odoo-sudo-without-context"][0] == ("mod/a.py", 6)
+
+
+def test_a_marker_naming_nothing_is_not_counted_as_a_rule(tmp_path):
+    """`# nosemgrep` on its own says a person silenced something and not which
+    finding. There is nothing there to compare with anything."""
+    (tmp_path / "a.py").write_text(MARKED, encoding="utf-8")
+    marks = crosswalk.suppressions(str(tmp_path))
+    assert len(marks["(unnamed)"]) == 1
+    assert not [rid for rid in marks if rid.startswith("semgrep.")]
+
+
+@pytest.mark.parametrize("comment, wanted", [
+    ("odoo-sudo-without-context", "odoo-sudo-without-context"),
+    ("semgrep.odoo-sudo-without-context", "odoo-sudo-without-context"),
+    ("odoo-sudo-without-context - policy lookup only", "odoo-sudo-without-context"),
+    ("odoo-sudo-without-context.", "odoo-sudo-without-context"),
+    ("not user input", ""),
+    ("", ""),
+])
+def test_rule_ids_are_recovered_from_prose(comment, wanted):
+    assert crosswalk._clean_rule_id(comment) == wanted
+
+
+def test_the_same_line_comparison_is_a_fact_about_code(tmp_path, all_rules):
+    """The strongest claim the tool makes: same file, same line, two analysers.
+    It has to come from running our checkers over the real file, not from the
+    rule ids matching up."""
+    (tmp_path / "a.py").write_text(MARKED, encoding="utf-8")
+    marks = crosswalk.suppressions(str(tmp_path))
+    both, theirs_only, unread = crosswalk.echoed_on_the_same_line(
+        str(tmp_path), marks, all_rules, "odoo")
+    assert unread == 0
+    assert ("a.py", 6, "odoo-sudo-without-context",
+            ["odoo.sudo-bypasses-record-rules"]) in both
+    assert theirs_only == 1, "line 9 is a bare .sudo(), which ours does not flag"
+
+
+def test_files_past_the_read_limit_are_reported_not_dropped(tmp_path, all_rules):
+    for n in range(3):
+        (tmp_path / "f{0}.py".format(n)).write_text(MARKED, encoding="utf-8")
+    marks = crosswalk.suppressions(str(tmp_path))
+    _, _, unread = crosswalk.echoed_on_the_same_line(
+        str(tmp_path), marks, all_rules, "odoo", limit=1)
+    assert unread == 2
+
+
+# ------------------------------------------------------------------- report
+
+def test_the_report_states_what_it_did_not_measure(tmp_path, capsys):
+    path = ruleset(tmp_path, SIMPLE)
+    assert crosswalk.main([path]) == 0
+    out = capsys.readouterr().out
+    assert "WHAT THIS DOES NOT MEASURE" in out
+    assert "Their analyser was never run" in out
+    assert "Nothing here is a score" in out
+
+
+def test_the_report_separates_no_answer_from_no_coverage(tmp_path, capsys):
+    body = SIMPLE + """
+  - id: their-unprobeable
+    patterns:
+      - pattern: $X ...:::
+    severity: INFO
+    languages: [python]
+"""
+    crosswalk.main([ruleset(tmp_path, body)])
+    out = capsys.readouterr().out
+    assert "theirs fires, nothing here does" in out
+    assert "no probe could be built, so no answer" in out
+    assert "unmeasured, which is a different thing from uncovered" in out
+
+
+def test_the_json_artifact_carries_the_rows(tmp_path):
+    path = ruleset(tmp_path, SIMPLE)
+    out = tmp_path / "crosswalk.json"
+    assert crosswalk.main([path, "--json", str(out)]) == 0
+    import json
+    payload = json.loads(io.open(str(out), encoding="utf-8").read())
+    assert payload["ruleset"] == "rules.yml"
+    assert len(payload["rows"]) == 3
+    assert payload["their_rules"][0]["id"] == "their-eval"
+
+
+def test_a_checkout_that_is_not_there_is_a_bad_argument(tmp_path, capsys):
+    path = ruleset(tmp_path, SIMPLE)
+    assert crosswalk.main([path, "--checkout", os.path.join(str(tmp_path), "nope")]) == 2
+    assert "No such checkout" in capsys.readouterr().out

tests/test_layers.py

@@ -289,3 +289,26 @@ def test_a_missing_layer_still_reads_as_one(odoo_rules):
     unknown = [layers.LayerResult("domain", layers.UNKNOWN, [], [], [])]
     decision = layers.decide(unknown)
     assert decision.insufficient == ["the domain layer could not run"]
+
+
+def test_bandit_marker_is_read_like_the_others():
+    """`# nosec B608` is bandit's, and the argument for reading it is the one
+    that put nosemgrep on the list: an independent analyser raised something
+    and a person decided to keep the code.
+
+    Measured while adding odoo.sql-needs-query-parameters: two of its six
+    findings on OpenSPP sat on lines carrying nothing but `# nosec B608`, and
+    were being re-raised as news on every run.
+    """
+    import corpus
+    rules = [r for r in corpus.load_rules()
+             if r["id"] == "odoo.sql-needs-query-parameters"]
+    body = (
+        "def run(self, table):\n"
+        "    self.env.cr.execute(\n"
+        "        f\"SELECT COUNT(*) FROM {table}\",  # nosec B608\n"
+        "    )\n"
+    )
+    hits = layers.scan_source(body, rules, "odoo", errors=[])
+    assert len(hits) == 1
+    assert hits[0].suppressed, "a bandit marker is somebody's decision too"

tests/test_recall.py

@@ -208,10 +208,11 @@ def test_the_report_states_what_it_did_not_measure(repo, capsys, rules):
 
 # -------------------------------------------------------------- the harvest
 
-def missed_row(sha, subject, tokens, caught=()):
+def missed_row(sha, subject, tokens, caught=(), spoke=()):
     return {"repo": "r", "sha": sha, "subject": subject, "files": 1,
             "scope_tokens": list(tokens), "in_scope": True,
-            "caught": list(caught), "vanished_elsewhere": []}
+            "caught": list(caught), "vanished_elsewhere": [],
+            "spoke": list(spoke)}
 
 
 def test_harvest_clusters_the_misses_by_construct(capsys):
@@ -226,7 +227,7 @@ def test_harvest_clusters_the_misses_by_construct(capsys):
             missed_row("a3", "fix(z): wrong company", ["check_company"])]
     recall.harvest(rows, "odoo")
     out = capsys.readouterr().out
-    assert "3 fix commit(s) the corpus had nothing to say about" in out
+    assert "3 fix commit(s) the corpus did not flag on the line of the fix" in out
     assert "2x  api.depends" in out
     assert "1x  check_company" in out
     assert out.index("api.depends") < out.index("check_company"), "ranked by count"
@@ -243,8 +244,10 @@ def test_harvest_says_where_the_corpus_does_work(capsys):
              "caught": ["odoo.sudo-bypasses-record-rules"], "vanished_elsewhere": []}]
     recall.harvest(rows, "odoo")
     out = capsys.readouterr().out
-    assert "(1 caught)" in out
-    assert "(nothing caught here)" in out
+    sudo = [row for row in out.splitlines() if ".sudo(" in row][0]
+    stale = [row for row in out.splitlines() if "api.depends" in row][0]
+    assert "1 caught" in sudo
+    assert "0 caught" in stale
 
 
 def test_harvest_drops_the_module_names_and_the_process_words(capsys):
@@ -269,3 +272,88 @@ def test_harvest_says_so_when_nothing_was_missed(capsys):
              "caught": ["odoo.sudo-bypasses-record-rules"], "vanished_elsewhere": []}]
     assert recall.harvest(rows, "odoo") == 0
     assert "Nothing missed in scope" in capsys.readouterr().out
+
+
+# ------------------------------------------------- silent, or aimed elsewhere
+
+# A stored compute reading a field its @api.depends does not declare, in a file
+# that ALSO has a dangling Many2one read. depends_covers_compute_reads fires on
+# the compute; ondelete_leaves_a_dangling_read fires on the relation. A fix to
+# one leaves the other in place.
+TWO_DEFECTS = '''from odoo import api, fields, models
+
+
+class Thing(models.Model):
+    _name = "my.thing"
+
+    task_id = fields.Many2one("my.task")
+    total = fields.Float(compute="_compute_total", store=True)
+
+    @api.depends("line_ids")
+    def _compute_total(self):
+        for rec in self:
+            rec.total = sum(line.price for line in rec.line_ids)
+
+    def _label(self):
+        for rec in self:
+            rec.name = rec.task_id.filepath
+'''
+
+# The Many2one gets its ondelete. The incomplete depends is untouched, so the
+# corpus was looking straight at this file and pointing at the other defect.
+ONE_FIXED = TWO_DEFECTS.replace('fields.Many2one("my.task")',
+                                'fields.Many2one("my.task", ondelete="restrict")')
+
+
+def test_a_finding_the_fix_ignored_is_recorded_as_spoken(repo, rules):
+    """Not a catch, and not blindness either. The corpus had a finding in this
+    file before the fix and still has it after, which is the corpus being aimed
+    at a different line rather than having nothing to say."""
+    commit(repo, "models/a.py", TWO_DEFECTS, "[ADD] a")
+    commit(repo, "models/a.py", ONE_FIXED, "[FIX] ondelete on task_id")
+    rows = recall.measure(str(repo), "odoo", 0, rules)
+    assert rows[0]["caught"] == ["odoo.ondelete-is-a-decision"]
+    assert "odoo.stored-compute-needs-complete-depends" in rows[0]["spoke"]
+
+
+def test_a_catch_is_not_also_counted_as_spoken(repo, rules):
+    """`spoke` is what the fix did NOT address. A rule in both columns would
+    make the split useless for deciding which repair a construct needs."""
+    commit(repo, "models/a.py", DANGLING, "[ADD] a")
+    commit(repo, "models/a.py", FIXED, "[FIX] ondelete on task_id")
+    rows = recall.measure(str(repo), "odoo", 0, rules)
+    assert rows[0]["caught"] == ["odoo.ondelete-is-a-decision"]
+    assert rows[0]["spoke"] == []
+
+
+def test_a_clean_file_leaves_spoke_empty(repo, rules):
+    commit(repo, "models/a.py", "VALUE = 1\n", "[ADD] a")
+    commit(repo, "models/a.py", "VALUE = 2\n# api.depends\n", "[FIX] the value")
+    rows = recall.measure(str(repo), "odoo", 0, rules)
+    assert rows[0]["spoke"] == []
+
+
+def test_harvest_splits_the_misses_into_silent_and_aimed_elsewhere(capsys):
+    """Twenty-three missed fixes against @api.depends reads as a missing rule.
+    Nine of them having a checker fire elsewhere in the file reads as a rule
+    that exists and is pointed the wrong way, and those want opposite repairs.
+    """
+    rows = [missed_row("a1", "fix(x): stale total", ["api.depends"],
+                       spoke=["odoo.stored-compute-needs-complete-depends"]),
+            missed_row("a2", "fix(y): stale price", ["api.depends"]),
+            missed_row("a3", "fix(z): wrong company", ["check_company"])]
+    recall.harvest(rows, "odoo")
+    out = capsys.readouterr().out
+    assert "2x  api.depends" in out
+    assert "1 spoke" in out
+    assert "1 silent" in out
+    assert "spoke: odoo.stored-compute-needs-complete-depends" in out
+
+
+def test_the_report_says_how_many_misses_were_not_blind_spots(capsys):
+    rows = [missed_row("a1", "fix(x): stale total", ["api.depends"],
+                       spoke=["odoo.stored-compute-needs-complete-depends"]),
+            missed_row("a2", "fix(y): stale price", ["api.depends"])]
+    recall.report(rows, "odoo", ["r"], 25)
+    out = capsys.readouterr().out
+    assert "1 of them are not blind spots" in out