narrow: one corpus, and it is Odoo

Four stacks become one. The TypeScript and JavaScript rules are removed, the
eight plain-Python rules are composed into the Odoo stack, and a file in any
other language is refused by name rather than reviewed against rules that
cannot match it.

WHY REMOVE RATHER THAN LABEL. Firing the other twenty-five rules at real code
decided it: JavaScript classified out at 21 true against 22 false, TypeScript
was measured at 3.8/kloc and never classified. A rule that costs nothing at
query time is not free -- it is a claim the README carries and a file `check`
accepts and then says nothing useful about. An empty finding list reads as a
clean bill of health, so `subject.Unreviewable` refuses the file instead.

WHY COMPOSE RATHER THAN DELETE. Selection was strict equality on `stack`, so an
Odoo module got the 19 ORM rules and none of the 8 Python ones -- and Odoo
modules are Python. `fieldtest --stack python` over OpenSPP found 32 hits
`--stack odoo` never reported. "ruff covers it" does not hold against
OpenSPP's own .ruff.toml, which selects B/C90/E501/I/UP and leaves S and DTZ
off, so six of the eight are genuinely unreported there.

MEASURED BEFORE SHIPPING, to the same bar as a new rule. 50 new findings across
OpenSPP and OCA, every one read in its own file: 26 true, 24 false, in
classification-python-2026-09.json. OpenSPP goes 162 -> 194 live findings
(0.71 -> 0.9/kloc), OCA 102 -> 120 (3.0 -> 3.5). Twenty of the 26 true are one
rule and one fact: an Odoo Datetime is naive UTC by contract, and a naive local
datetime reaching one is off by the server's offset. Three rules fired and were
never right, three never fired at all, and both lists are in the README rather
than quietly dropped.

Two defects the classification found and no test would have: scan_source
matches inside docstrings, and suppression reads any marker in a statement
without asking which rule it names. Named, not fixed here.

The id prefix now means provenance, not stack -- python.* rules carry stack
odoo -- so every committed classification, LIKELIHOOD grade and evidence bundle
still points at the same rule. cmd_validate checks the prefix against
corpus.ORIGINS instead.

prefer-sql-constraint had to be reworded: 27 rules competing where 19 were made
its old probe, the generic "stop anyone entering a negative quantity", stop
retrieving it. 27 of 27 retrievable, 25 in the top 3.

Also: the wordmark loses a row, five instead of six.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ARCHITECTURE.md

@@ -14,7 +14,7 @@ A decision record that only lists the final answer hides the most useful informa
   question
      │
      ▼
-  ┌──────────┐   embed on CPU, cosine over the stack's rules
+  ┌──────────┐   embed on CPU, cosine over the corpus
   │ retrieve │   + pinned rules that bypass retrieval
   └────┬─────┘
        ▼
@@ -2120,6 +2120,78 @@ nothing, which is the right place for a finding whose harm is real and latent.
 | Machine-checkable | 41 (93%) | 40 (93%) |
 | JavaScript findings, classified | 21 true / 24 false | **21 true / 22 false** |
 
+### 3.46 Narrowing to Odoo, and composing the Python rules into it
+
+**Decided 2026-09-16.** The corpus had four stacks. It has one, and the eight
+plain-Python rules are inside it rather than beside it.
+
+**Why narrow.** §3.44 fired the other twenty-five rules at real code for the first
+time, and the answer decided this. JavaScript classified out at **21 true against 22
+false**. TypeScript was measured at 3.8 per thousand lines and never classified, so
+its number said nothing. Against those, the Odoo half carries 87 true / 15 false on
+its two flagship rules across two ecosystems. The edge is Odoo ORM semantics;
+everywhere else this corpus competes with mature tools and loses.
+
+Removing them rather than labelling them experimental is the part worth arguing. A
+rule that costs nothing at query time is not free: it is a claim the README has to
+carry, a number somebody will quote, and a file `nexa check` will accept and then say
+nothing useful about. A `.ts` file now raises `subject.Unreviewable` and is refused by
+name, because **an empty finding list reads as a clean bill of health**, and silence
+about a file nobody checked is the one lie this design exists to prevent.
+
+**Why the Python rules were composed in instead.** Rules were selected by strict
+equality on `stack` (`corpus.py`), so an Odoo module got the 19 ORM rules and none of
+the 8 Python ones. Odoo modules are Python. `fieldtest --stack python` over OpenSPP
+found **32 hits `--stack odoo` never reported**.
+
+"ruff covers it" was the first answer and it does not hold. OpenSPP's own `.ruff.toml`
+selects `B, C90, E501, I, UP` plus defaults — `S` and `DTZ` are off — so six of the
+eight are genuinely unreported in that deployment, and a narrow selection is what most
+Odoo shops run.
+
+**What it cost, measured before shipping.** The composition was held to the bar in
+§3.43: 50 new findings across OpenSPP and OCA, every one read in its own file.
+**26 true, 24 false**, in `classification-python-2026-09.json`.
+
+| | | |
+|---|---|---|
+| OpenSPP live findings | 162 | **194** (0.71 → 0.9 per kloc) |
+| OCA live findings | 102 | **120** (3.0 → 3.5 per kloc) |
+| Corpus precision, composed-in half | — | 26 true / 24 false |
+
+Twenty of the twenty-six are one rule, `naive-and-aware-datetimes-do-not-compare`, and
+one fact: an Odoo `Datetime` is **naive UTC by contract**, so a naive local datetime
+reaching one is off by the server's offset. Latent on a UTC-clocked server, wrong on
+any other, and OpenSPP's history carries two fixes of exactly it.
+
+Three rules fired and were never right, and the most interesting is
+`decimal-for-money-not-float`: Odoo's `Monetary` field **is** a float, and the
+framework's answer to precision is `float_round`/`float_compare`, not `Decimal`. The
+rule fires on the idiom and names a fix that cannot be taken. Three findings do not
+settle a checker either way, so it is recorded rather than removed.
+
+**Two defects the classification found that no test would have.** `scan_source` strips
+`#` comments before matching and not string literals, so `eval()` named in a docstring
+reads as code. And suppression reads any marker within a simple statement without
+asking which rule it names, so a `# nosemgrep: odoo-sudo-without-context` silenced a
+datetime finding four lines above it — the mute button of §3.42 reached from the other
+side. Both are named in the README rather than quietly fixed.
+
+**What the id prefix means now.** `python.decimal-for-money-not-float` carries
+`stack: odoo`. The prefix is **provenance** — where the rule came from and which
+documentation `check_sources` verifies it against — and the stack is **selection**. The
+validator's old invariant was "id prefix equals stack"; it is now "id prefix is one of
+`corpus.ORIGINS`". Keeping the ids is what keeps every committed classification,
+`LIKELIHOOD` grade and evidence bundle pointing at the same rule: renaming the subject
+of a measurement is the quiet way a number stops meaning what it says.
+
+**One rule had to be reworded.** Retrieval is scoped to a stack, so merging them put
+27 rules in competition where 19 had been. `prefer-sql-constraint` ranked first for
+*"stop anyone entering a negative quantity on a sale order line"* against 19 and
+stopped being retrieved at all against 27 — that probe is the generic validation
+question every constraint rule here answers. Reworded to the one only it answers.
+**27 of 27 retrievable, 25 in the top 3.**
+
 ## 4. Performance traps, all found by measurement
 
 Within four instrumented runs the report showed the 7B at ~10 tok/s against a
@@ -2191,22 +2263,25 @@ in a corpus; it does not close the reasoning gap.
 
 ### Checking is partial, and the layers say where
 
-- 3 of 43 rules have no automated check at all. They return **no verdict**, never a
-  false pass, and `nexa coverage` prints the reason for each.
-- 32 of the 40 checked rules are decided by a **regex over generated code**. That
+- 1 of 27 rules has no automated check at all. It returns **no verdict**, never a
+  false pass, and `nexa coverage` prints the reason.
+- 16 of the 26 checked rules are decided by a **regex over generated code**. That
   catches textual signatures, not meaning. Code wrong in a way no pattern describes
-  passes silently. The other 8 are decided by an AST pass (§3.12).
-- Semantic analysis is **Python only**. The standard library has no TypeScript or
-  JavaScript parser, so TS/JS answers get delimiter balance and nothing deeper, and
-  the layer reports UNKNOWN rather than PASS for the rest.
+  passes silently. The other 10 are decided by an AST pass (§3.12). The regexes also
+  match inside **docstrings**, because `scan_source` strips `#` comments and not
+  string literals — two of the fifty findings in §3.46 were that.
+- Semantic analysis is **Python only**, which is the whole subject now. An answer may
+  still contain a JavaScript block, Odoo's web client being OWL; that block gets
+  delimiter balance and nothing deeper, and the layer reports UNKNOWN rather than
+  PASS for it.
 - The empirical layer resolves imports against this interpreter and assembles
   bytecode. It does not execute anything unless `NEXA_EMPIRICAL_EXEC=1`, and even then
   only for snippets importing nothing outside a short allowlist — which in practice
   means no Odoo answer is ever executed, because they all import `odoo`. A subprocess
   with a timeout reduces blast radius; it is **not a security boundary**.
 - The context layer is only as good as the file it was given. `nexa ask` has no file,
-  so it reports UNKNOWN; `nexa check <file>` reads the manifest, the model names and
-  the tsconfig, and can then say something real.
+  so it reports UNKNOWN; `nexa check <file>` reads the manifest, the model names,
+  `ir.model.access.csv` and the record rules in XML, and can then say something real.
 - Every Odoo rule declares `odoo_versions: >=16.0`, so the context layer has a
   question it can answer about a module on any series and reports per-rule when one
   does not apply. `corpus/check_sources.py` supports that range from the
@@ -2338,13 +2413,13 @@ unawares.
 
 ### Corpus provenance
 
-40 of 43 rules cite upstream documentation. The rest rest on general knowledge and
+25 of 27 rules cite upstream documentation. The rest rest on general knowledge and
 deserve more scepticism. Most of the rules were written by an assistant rather than
 harvested from production incidents, and rules drawn from real incidents are worth
 more. Three now are: `commit-inside-a-loop` and `sql-needs-query-parameters` came
 from an external ruleset disagreeing with this one (3.34), and
 `depends-must-not-name-unread-fields` from a fix commit in OpenSPP's history (3.35).
-Three of forty-three is not a change of method yet.
+Three of twenty-seven is not a change of method yet.
 
 This is the deepest unresolved problem in the design and no layer addresses it: the
 validator and the thing being validated are the same class of system. Provenance
@@ -2353,21 +2428,17 @@ tracks sources, versions and checker identities. It cannot establish that a rule
 
 ### Scope
 
-Odoo, Python, TypeScript and JavaScript. Odoo rules were checked against 18.0
-documentation and its source; behaviour differs across major versions.
+Odoo, and nothing else (§3.46). Odoo rules were checked against 18.0 documentation and
+its source; behaviour differs across major versions.
 
-Every stack now carries field evidence (§3.44), and the four sit at very different
-stages of it. The nineteen Odoo rules have two ecosystems behind them and a
-hand classification of both. The seven JavaScript rules have one ecosystem and a
-classification. The ten TypeScript rules are measured and not yet classified. The
-eight Python rules have fired three times in ten thousand lines, which is too few
-to say anything with. Until each has a second codebase, every one of those numbers
-is one sample.
+One stack, 27 rules: 19 about the ORM and 8 about the Python language, which apply
+because an Odoo module is a Python module. Both halves carry field evidence from two
+ecosystems and a hand classification of every finding, and they are **not the same
+quality** — 85% on the two flagship ORM rules, 52% on the composed-in Python half.
+Reporting one blended number would describe neither.
 
-The Python stack is eight rules and is deliberately narrow — the same subject as the
-rest of the corpus, which is validation and the places a check that looks like it
-holds does not. It is not a style guide and does not try to be. `nexa check` on a
-`.py` file now decides from the file itself which of the two Python corpora applies.
+A `.py` or `.xml` file is reviewed. Anything else is refused by name rather than
+reviewed against rules that cannot match it.
 
 ### Known imprecision, not yet fixed
 
@@ -2473,7 +2544,7 @@ nexa/
 │   ├── build_corpus.py    RULE SOURCE OF TRUTH + patterns + provenance
 │   ├── corpus_meta.json   generated; hash, build time, checked_against
 │   ├── selftest_patterns.py  negative test for both self-checks
-│   └── rules/*.json       generated; do not hand-edit
+│   └── rules/odoo.json    generated; the whole corpus, do not hand-edit
 ├── bin/
 │   ├── corpus.py          validate, index, ask, crosscheck, coverage
 │   ├── layers.py          the nine layers, and the rule that combines them
@@ -2494,7 +2565,7 @@ nexa/
 │   ├── local-ai.ps1       PowerShell helpers
 │   └── bench.ps1          raw throughput benchmark
 ├── modelfiles/
-│   ├── gen-*.Modelfile    generated; do not hand-edit
+│   ├── gen-odoo.Modelfile generated; do not hand-edit
 │   └── arch-advisor.Modelfile   hand-written 30B persona
 └── subjects/              the fixed file set `nexa eval --check` reviews
 ```

INSTALL.md

@@ -135,22 +135,14 @@ This generates the rule JSON, validates it against its schema, self-tests every
 violation pattern, measures pattern false positives, embeds the retrieval index, and
 writes the Modelfiles.
 
-It finishes by printing three `ollama create` commands. Run them to register the
-personas — each takes about two seconds, because only metadata is written. The weights
-are shared with `qwen2.5-coder:7b`, so the three personas cost no extra disk.
+It finishes by printing the `ollama create` command. Run it to register the persona —
+about two seconds, because only metadata is written. The weights are shared with
+`qwen2.5-coder:7b`, so it costs no extra disk.
 
 ```bash
 ollama create ai-odoo -f modelfiles/gen-odoo.Modelfile
 ```
 
-```bash
-ollama create ai-ts -f modelfiles/gen-typescript.Modelfile
-```
-
-```bash
-ollama create ai-js -f modelfiles/gen-javascript.Modelfile
-```
-
 Optional, for the 30B persona used by `nexa ask --deep`:
 
 ```bash
@@ -284,7 +276,7 @@ rule and the problem. Fix it in `corpus/build_corpus.py` and rebuild.
 ## Uninstall
 
 ```bash
-ollama rm ai-odoo ai-ts ai-js arch-advisor qwen2.5-coder:7b qwen3-coder:30b nomic-embed-text
+ollama rm ai-odoo arch-advisor qwen2.5-coder:7b qwen3-coder:30b nomic-embed-text
 ```
 
 Then delete the cloned directory. Nexa writes nothing outside its own folder except the

README.md

@@ -1,8 +1,7 @@
 ```
    ██   ██ ██████ ██   ██  █████ 
    ███  ██ ██      ██ ██  ██   ██
-   ████ ██ █████    ███   ██   ██
-   ██ ████ █████    ███   ███████
+   ██ █ ██ █████    ███   ███████
    ██  ███ ██      ██ ██  ██   ██
    ██   ██ ██████ ██   ██ ██   ██
    ▓▓▓▓▓▓▓▓▒▒▒▒▒▒▒▒▒▒░░░░░░░░░░░░
@@ -128,17 +127,125 @@ publishing a classification.
 
 ## What it is not
 
-**Not a general linter.** 43 rules. It will not replace `pylint-odoo`, and after the
+**Not a general linter.** 27 rules. It will not replace `pylint-odoo`, and after the
 wrapper above it does not have to.
 
-**Not a bug finder.** Against real Odoo bugfixes it catches 7 of 162 — about 4%. Most
-bugs are domain logic ("finished plans should not be the current plan") and no rule
+**Not a bug finder.** Against real Odoo bugfixes the ORM rules catch 7 of 162 — about
+4%. Most bugs are domain logic ("finished plans should not be the current plan") and no rule
 corpus finds those. Measured and published here because a precision number without a
 recall number beside it is the more flattering half of the picture.
 
-**The TypeScript and JavaScript rules are experimental.** They got their first field
-evidence in September 2026 and it was not good: JavaScript classified out at 21 true
-against 22 false. Use the Odoo half.
+**Odoo only, and that is the whole of it.** There was a TypeScript corpus and a
+JavaScript one. They got their first field evidence in September 2026 and it was not
+good — JavaScript classified out at 21 true against 22 false, TypeScript was never
+classified at all — so both were **removed** rather than left in with a warning on
+them. A `.ts` or `.js` file is now refused by name instead of reviewed against rules
+that would find nothing in it, because nothing found reads as nothing to find.
+
+**The plain-Python rules did not go the same way, and the reason is in
+[the composition](#one-corpus-and-why-the-python-rules-are-in-it).**
+
+---
+
+## One corpus, and why the Python rules are in it
+
+There is one stack. Every rule in it is a rule for reviewing Odoo code: 19 about the
+ORM, and 8 about the Python language, which apply because **an Odoo module is a Python
+module**. The `python.` prefix on those eight records where the rule comes from and
+which documentation it is checked against. It is not a second mode you can select.
+There is no second mode.
+
+They were unreachable until September 2026, and it was one line: selection was strict
+equality on the stack field, so an Odoo file got the 19 ORM rules and none of the
+other 8. `fieldtest --stack python` over OpenSPP found **32 hits that `--stack odoo`
+never reported**.
+
+The first instinct was the opposite one — drop the Python corpus, because ruff covers
+it. Checked against OpenSPP's actual `.ruff.toml`, that is wrong. They select `B`,
+`C90`, `E501`, `I`, `UP` and ruff's defaults. `S` and `DTZ` are not selected:
+
+| | ruff rule | selected there? |
+|---|---|---|
+| `assert-is-not-validation` | S101 | no |
+| `eval-and-pickle-execute-their-input` | S301/S307 | no |
+| `subprocess-shell-true-is-injection` | S602 | no |
+| `naive-and-aware-datetimes-do-not-compare` | DTZ | no |
+| `path-join-does-not-contain-a-path` | — | no such rule |
+| `decimal-for-money-not-float` | — | no such rule |
+| `mutable-default-argument` | B006 | **yes** |
+| `bare-except-catches-the-exit` | E722 | **yes** (default) |
+
+A narrow ruff selection is what most Odoo shops run, so six of the eight are genuinely
+unreported in that deployment. Against ruff this is not a competing tool; inside an
+Odoo review it is part of one.
+
+### What the composition actually found, all 50 read by hand
+
+Composing them moves every Odoo number, so the standard the rest of the corpus is held
+to applies here too: 50 findings across OpenSPP and OCA, each read in its own file.
+Every verdict is in `classification-python-2026-09.json`.
+
+| | true | false | |
+|---|---|---|---|
+| `naive-and-aware-datetimes-do-not-compare` | 20 | 12 | 62% |
+| `assert-is-not-validation` | 6 | 4 | 60% |
+| `decimal-for-money-not-float` | 0 | 3 | |
+| `path-join-does-not-contain-a-path` | 0 | 4 | |
+| `eval-and-pickle-execute-their-input` | 0 | 1 | |
+| `mutable-default-argument` | — | — | never fired |
+| `bare-except-catches-the-exit` | — | — | never fired |
+| `subprocess-shell-true-is-injection` | — | — | never fired |
+| | **26** | **24** | **52%** |
+
+**One rule carries it.** Twenty of the twenty-six true positives are the datetime rule,
+and they are one shape: an Odoo `Datetime` field is **naive UTC by contract**, and a
+naive *local* datetime reaches one. `membership.ended_date > datetime.now()` filters by
+the server's offset. An autovacuum cron builds its deadline from local now and compares
+it against `create_date`, deleting audit logs early or late. A linked-data proof appends
+a literal `Z` — which asserts UTC — to a local time. A fiscal-year cron compares an ORM
+`Date` against `datetime.now().date()`, so on any non-UTC server the year is created on
+the wrong side of midnight.
+
+Say what that makes them: on a server clocked to UTC every one is latent. On any other
+it is wrong by the offset. OpenSPP's own history carries two fixes of exactly this class
+— a newborn birthdate evaluated against the server's UTC date, and `Date.today()` storing
+midnight UTC on a `Datetime` field — which is why it is graded a defect rather than a
+theoretical one.
+
+The twelve false ones are near enough one shape too: a timestamp that is formatted and
+never compared — a `Generated:` line in a report, a backup filename, a `%Y-%m` period
+label. Telling those from the twenty needs to see what happens to the value afterwards,
+which a regex cannot.
+
+### What is wrong with the other half, named
+
+**Three rules fired and were never right.** `decimal-for-money-not-float` is 0 of 3, and
+this one has a *reason* behind it rather than a sample size: Odoo's `Monetary` field **is
+a float** — the ORM defines it that way — and the framework's answer to the precision
+problem is `float_round` and `float_compare` against the currency's rounding, not
+`Decimal`. Inside an Odoo module the rule fires on the idiom and names a fix that cannot
+be taken. That is an argument and not a measurement, and three findings settle nothing,
+so it is written down here rather than acted on.
+
+`path-join-does-not-contain-a-path` is 0 of 4 — all four join a configured directory to
+a name this module generated, and the pattern matches the *word* `filename` rather than
+anything about where the value came from. `eval-and-pickle-execute-their-input` is 0 of
+1. Four findings between them is not enough to conclude a checker is wrong.
+
+**Three more never fired at all**, and silence is not a pass: it says 260,000 lines
+contain none of what they look for, which is also what a broken checker says. Two of the
+three are the two ruff already covers, which is the more likely explanation.
+
+**A checker defect, found by classifying rather than by testing.** Two of the 50 are the
+same fault: `scan_source` strips `#` comments before matching and does **not** strip
+string literals, so `eval()` named in a docstring arguing *against* using it, and a
+`datetime.now()` inside a doctest example, both read as code.
+
+**A suppression that should not have fired.** One finding — a consent-receipt timestamp
+— sits inside a `return` statement that carries a `# nosemgrep: odoo-sudo-without-context`
+marker four lines below it. Suppression reads any marker within the statement without
+asking which rule it names. That is the mute button this project says it will not build,
+reached from the other direction, and it is counted apart here rather than dropped.
 
 ---
 
@@ -208,10 +315,6 @@ nexa help <command>       detail for one command
 nexa ask odoo "constrain invoice date to the fiscal year of its period"
 ```
 
-```bash
-nexa ask typescript "validate an Odoo res.partner JSON-RPC payload"
-```
-
 ```bash
 nexa ask odoo --deep "should this be a stored computed field or a related field?"
 ```
@@ -286,12 +389,25 @@ the same command.
 It prints **no verdict**, because nothing generated an answer to have a verdict
 about. A clean run says *no pattern fired* in those words, and exits 1 if one did.
 
-For a `.py` file the extension only really says *not TypeScript*, so **the file
-decides** which corpus applies: an `odoo` import or a `__manifest__.py` above it means the Odoo rules,
-anything else means the plain-Python ones.
+**A `.py` or `.xml` file is reviewed against all 27 rules. Anything else is refused
+by name.**
+
+```
+$ nexa check web/src/partners.ts
+  ! nexa reviews Odoo code: .py and .xml files. .ts is not one, and there
+    are no rules in this corpus that would say anything about it.
+```
+
+There is no second corpus to route to, so a plain Python script inside an Odoo tree —
+`scripts/`, a migration helper — is reviewed like anything else. The nineteen ORM
+rules have nothing to match in it, the eight plain-Python ones do, and the report says
+which of the two it is rather than leaving the reader to infer it from a short list:
 
 ```
-checking upload_handler.py as python
+checking upload_handler.py as odoo
+  ! no Odoo imports here and no __manifest__.py above it -- the 19 ORM rules
+    have nothing to match, so this file is effectively reviewed against the
+    8 plain-Python ones
 
 Rules retrieved:
   0.698   [critical] python.assert-is-not-validation
@@ -300,10 +416,10 @@ Rules retrieved:
   0.643   [critical] python.subprocess-shell-true-is-injection
 ```
 
-`--stack` overrides the detection in either direction. Unlike `nexa ask`, this one has **surroundings to read**: the nearest
+Unlike `nexa ask`, this one has **surroundings to read**: the nearest
 `__manifest__.py` gives the Odoo series, the file gives its model names and existing
-imports, the nearest `tsconfig.json` says whether `strict` is on. Those facts go into
-the question *and* into the context layer.
+imports, `ir.model.access.csv` and the record rules in XML say what Python cannot.
+Those facts go into the question *and* into the context layer.
 
 Where they say the corpus was verified somewhere else, that is reported as a **gap**,
 not a finding — it is true of the corpus whatever the answer says, and a verdict that
@@ -418,9 +534,9 @@ field could not say so.
 Everything else is **derived** and must never be hand-edited:
 
 ```
-corpus/rules/*.json --+--> modelfiles/gen-*.Modelfile   (system prompts)
-                      +--> bin/index.sqlite             (retrieval)
-                      +--> every answer                 (grounding + checking)
+corpus/rules/odoo.json --+--> modelfiles/gen-odoo.Modelfile  (system prompt)
+                         +--> bin/index.sqlite               (retrieval)
+                         +--> every answer                   (grounding + checking)
 ```
 
 Same principle as `z.infer<typeof Schema>`: one definition, derived artifacts, no drift.
@@ -429,23 +545,21 @@ Same principle as `z.infer<typeof Schema>`: one definition, derived artifacts, n
 
 | | |
 |---|---|
-| Rules | 43 — 19 Odoo, 10 TypeScript, 8 Python, 6 JavaScript |
-| Critical | 17 |
-| Machine-checkable | 40 (93%) — 30 by pattern, 10 by AST |
-| Traceable to upstream docs | 41 (95%), each audited for topic fit |
+| Rules | 27 — 19 Odoo ORM, 8 plain-Python, one stack |
+| Critical | 12 |
+| Machine-checkable | 26 (96%) — 16 by pattern, 10 by AST |
+| Traceable to upstream docs | 25 (93%), each audited for topic fit |
 | Pattern false positives | 0 cross-hits across the corpus |
-| Recall under meaning-preserving rewrite | 99/99 |
-| Satisfied patterns bypassable by a comment | 0 of 13 |
-| Retrievable by their own probe | 43 of 43, at top 3 |
-| Hit rate on 33,960 lines of reviewed OCA code | 3.0 per 1000 lines |
-| Those 102 hits, classified by hand | **79 true positives**, 10 false, 13 undecidable from one file |
-| Hit rate on 226,937 lines of OpenSPP (Odoo 19) | 0.7 per 1000 lines, +68 another tool had already flagged, +71 advisory |
-| Every one of those findings, classified by hand | **138 true positives**, 124 false, 6 undecidable |
+| Recall under meaning-preserving rewrite | 79/79 |
+| Satisfied patterns bypassable by a comment | 0 of 7 |
+| Retrievable by their own probe | 27 of 27 at top 6, 25 of them at top 3 |
+| Hit rate on 33,960 lines of reviewed OCA code | 3.5 per 1000 lines |
+| Those 120 hits, classified by hand | **86 true positives**, 21 false, 13 undecidable from one file |
+| Hit rate on 226,937 lines of OpenSPP (Odoo 19) | 0.9 per 1000 lines, +69 another tool had already flagged, +71 advisory |
+| Every one of those findings, classified by hand | **157 true positives**, 137 false, 6 undecidable |
 | …the two `depends`/`constrains` rules alone | **87 true**, 15 false, 3 undecidable — 85% |
+| …the 8 composed-in Python rules alone | **26 true**, 24 false — 52%, and 20 of the 26 are one rule |
 | …`sudo-bypasses-record-rules` alone, before it was narrowed | 6 true, 97 false — 5.8%, and the reason it is now an AST pass |
-| Hit rate on 73,762 lines of TypeScript (hono, trpc) | 3.8 per 1000 lines — **measured, not yet classified** |
-| Hit rate on 9,304 lines of Odoo frontend JavaScript | 4.6 per 1000 lines — 21 true positives, 22 false |
-| Hit rate on 10,225 lines of Python (llm-router) | 0.3 per 1000 lines |
 | **Recall against real Odoo bugfixes** | **1 of 56 (OCA), 7 of 162 (OpenSPP). See below.** |
 | Verdict stability, 12 questions x 5 runs | 12/12 same verdict every run |
 | Escalation rescued a bad draft | 11 of 21, 95% CI 32–72% |
@@ -455,9 +569,15 @@ Same principle as `z.infer<typeof Schema>`: one definition, derived artifacts, n
 | `nexa check` verdict stability | 4 of 5 files on one run, 3 of 5 on the next |
 | `nexa check --no-model` | 0.26s, identical output every run |
 
-40 of 43 rules carry an automated check. The remaining three are decidable only with
-context a snippet does not contain, so they return **no verdict** — never a false pass
-— and `nexa coverage` names each one and why.
+26 of 27 rules carry an automated check. The one that does not —
+`schema-change-needs-migration`, whose violation lives in the diff between two module
+versions — returns **no verdict** rather than a false pass, and `nexa coverage` names
+it and says why.
+
+Two lines above are worth reading together. The Odoo half is 85% on its two flagship
+rules; the composed-in Python half is 52%. They are in the same corpus and they are
+not the same quality, and the table says so rather than reporting one blended number
+that describes neither.
 
 ---
 
@@ -549,6 +669,12 @@ false positive left, a `sql-needs-query-parameters` carrying a marker on the lin
 it that suppression now reads. **All 79 true positives survived both changes**, which is
 again the only thing that makes the rest of it safe.
 
+**Re-measured again on 2026-09-16, after the eight Python rules were composed in:
+120 hits, 3.5 per 1000 lines, 86 true, 21 false, 13 undecidable.** The 18 new ones are
+7 true and 11 false, read the same way and listed in
+`classification-python-2026-09.json`. The rate went up and the precision went down, and
+that is the trade the section above prices.
+
 ### The same treatment on a second ecosystem
 
 A precision number from one ecosystem is a precision number for that ecosystem. The two
@@ -614,6 +740,11 @@ model nobody declared is UNKNOWN, not "no rule".
 
 The last row is the only one that makes the others safe.
 
+That 162 is the Odoo rules alone. Composing the eight Python rules in took it to
+**194, 0.9 per 1000 lines** — the 32 new findings are 19 true and 13 false, and they
+are the subject of
+[the composition section](#what-the-composition-actually-found-all-50-read-by-hand).
+
 ### What is still wrong, named
 
 `float-comparison-needs-float-utils` is next at **2 true, 5 false**. All five compare an
@@ -625,6 +756,12 @@ means tracing the assignment, so it is written down here rather than quietly lef
 onchange that sets a field rather than enforcing anything — which the rule's existing
 narrowing was supposed to exclude and does not catch when the write is to a Many2one.
 
+The composed-in Python half has four more, each with a number on it:
+`decimal-for-money-not-float` firing on Odoo's own `Monetary` idiom, `path-join`
+matching a variable's name rather than its origin, patterns matching inside docstrings,
+and a suppression marker silencing a rule it was not written about. All four are in
+[the section above](#what-is-wrong-with-the-other-half-named).
+
 What the first run found:
 
 - **`onchange-is-not-validation`** fired on all 16 `@api.onchange` declarations that
@@ -829,9 +966,11 @@ python corpus/check_sources.py --source   # what the source defines
 ```
 
 Each Odoo rule declares the series it holds for. The first mode checks that claim
-against the documentation: 42 of 45 versioned rule-series cite a page that exists and
-names the API, 2 more are tutorials that moved while the API stayed, and **1** is not
-supported by any 16.0 page.
+against the documentation: 45 of the 48 versioned rule-series cite a page that exists
+and names the API, 2 more are tutorials that moved while the API stayed, and **1** is
+not supported by any 16.0 page. The 9 remaining cite something other than the Odoo
+docs — Postgres, the contributing guidelines — and are reported as unversioned rather
+than counted as passing.
 
 Documentation has a blind spot, and the corpus had fallen into it — a function Odoo
 shipped and never described reads as missing. So the second mode reads odoo/odoo
@@ -840,7 +979,7 @@ float_compare(` in `odoo/tools/float_utils.py`, not the word anywhere on a page.
 
 | | |
 |---|---|
-| Rule-series defined in source across 16.0, 17.0 and 18.0 | **54 of 54** |
+| Rule-series defined in source across 16.0, 17.0 and 18.0 | **57 of 57** |
 
 That closes it. No version claim in this corpus rests on an assertion, and the one
 documentation gap now carries a measurement instead of a belief: `float_compare`'s
@@ -863,16 +1002,20 @@ nexa eval --retrieval
 asks each rule its own probe and reports whether it comes back. No generation, so it
 needs only the embedding model and finishes in seconds.
 
-All 43 rules are retrievable at the operating `TOP_K` of 6, and at top 3. Two were
-not, and both failed the way a rule does: correctly worded, in the vocabulary of
+All 27 are retrievable at the operating `TOP_K` of 6, and 25 of them rank in the top
+3. That number got harder rather than easier when the corpus became one stack: with
+19 rules competing, `prefer-sql-constraint` came back first for *"stop anyone entering
+a negative quantity on a sale order line"*; with 27 it stopped coming back at all,
+because that is the generic validation question every constraint rule here answers.
+Reworded to the question only it answers — *"should this check be a database
+constraint or an api.constrains method"* — and measured again. It is the third rule to
+fail this way, and all three failed identically: correctly worded, in the vocabulary of
 somebody who already knows the answer. `no-monkey-patching` did not answer *"change
-what a core sale.order method does"*; `unknown-not-any-at-boundaries` did not answer
-*"what type should a webhook payload have"*. Reworded, measured again, both found.
+what a core sale.order method does"* either.
 
 The report states its own limits. Pinned rules are prepended regardless of score, so
-ranking against them measures the pin; JavaScript has 7 rules against a `TOP_K` of 6,
-so passing there is nearly free, and the header says so rather than printing 7/7 and
-letting it read as a result.
+ranking against them measures the pin rather than the wording, and the header says so
+instead of counting them.
 
 ### And what does `nexa check` actually report?
 

bin/adversarial.py

@@ -41,7 +41,10 @@ HERE = os.path.dirname(os.path.abspath(__file__))
 ROOT = os.path.dirname(HERE)
 RULES_DIR = os.path.join(ROOT, "corpus", "rules")
 
-COMMENT = {"odoo": "#", "python": "#", "typescript": "//", "javascript": "//"}
+# Keyed by stack, of which there is one. A dict rather than a constant because
+# the probes index it by the rule's stack and a KeyError is the right answer if
+# a rule ever carries one this does not know about.
+COMMENT = {"odoo": "#"}
 
 
 def load_rules():

bin/context.py

@@ -4,14 +4,15 @@
 WHY THIS EXISTS
 ---------------
 ARCHITECTURE records the context layer as absent by design, and names the reason
-honestly: typescript.safeparse-when-failure-is-expected cannot be decided from a
-snippet, because whether parse or safeParse is right depends on whether the
-caller can recover -- context a snippet does not contain.
+honestly: odoo.ondelete-is-a-decision cannot be decided from a snippet, because
+whether a dangling reference matters depends on whether anything ever reads the
+field back -- context a snippet does not contain.
 
 That reasoning is correct about snippets and wrong about files. When the input is
 a real path in a real tree, the context is sitting on disk: the module manifest
 says which Odoo version this has to run on, the file says which model it extends,
-the tsconfig says whether strict mode is on. None of it needs a model to guess.
+ir.model.access.csv says whether the model can be deleted at all. None of it
+needs a model to guess.
 
 So this module reads the surroundings, and the context layer reports UNKNOWN --
 never PASS -- whenever it was handed a snippet with no surroundings to read. An
@@ -53,29 +54,31 @@ _MODEL_RE = re.compile(r"^\s*_(?:name|inherit)\s*=\s*[\"']([a-z0-9_.]+)[\"']", r
 _ODOO_IMPORT_RE = re.compile(r"^\s*from\s+odoo[\w.]*\s+import\s+(.+)$", re.M)
 
 
-# One table, read by subject.route as well, so a file cannot be routed to one
-# stack by the command and contextualised against another here. They disagreed
-# for a while: .mts and .cts were TypeScript to this module and plain Python to
-# the router, so a .mts file was reviewed against the Python corpus while this
-# layer went looking for its tsconfig.
-EXTENSIONS = {
-    ".ts": "typescript", ".tsx": "typescript",
-    ".mts": "typescript", ".cts": "typescript",
-    ".js": "javascript", ".jsx": "javascript",
-    ".mjs": "javascript", ".cjs": "javascript",
-}
+# What this corpus is able to review, and nothing else. One table, read by
+# subject.route as well, so a file cannot be refused by the command and
+# contextualised here anyway.
+#
+# .py is where every rule but one lives; .xml carries the noupdate rule, whose
+# violation is a <record> in a data file. Anything else is refused by name
+# rather than reviewed: 27 Odoo rules run over a .ts file find nothing, and
+# nothing reads as a clean bill of health.
+REVIEWABLE = (".py", ".xml")
 
 
 def stack_for(path):
-    """The rule stack a file belongs to, as far as its extension can say.
-
-    A .py file is "python" here, and that is a statement about the extension
-    rather than about the file: whether it wants the Odoo rules or the plain
-    Python ones is decided by what is inside it and what sits above it, which is
-    subject.route's job. A caller that has read the file passes the answer back
-    in through from_file(stack=...).
+    """The rule stack a file belongs to. There is one, and this says whether
+    the file is in it.
+
+    Returns "odoo" for a file the corpus can review and None for one it cannot.
+    Both an Odoo module and a plain Python script return "odoo": the corpus
+    holds the ORM rules and the plain-Python rules together, so there is no
+    longer a second stack to send a script to, and a script inside an Odoo
+    repository -- scripts/, tools/, a migration helper -- is reviewed against
+    the eight language rules with the 19 ORM rules finding nothing in it.
     """
-    return EXTENSIONS.get(os.path.splitext(path)[1].lower(), "python")
+    if os.path.splitext(path)[1].lower() in REVIEWABLE:
+        return "odoo"
+    return None
 
 
 def _walk_up(start, names):
@@ -129,8 +132,6 @@ def from_file(path, stack=None):
         "manifest": None,
         "models": [],
         "odoo_imports": [],
-        "ts_strict": None,
-        "tsconfig": None,
         "is_test": False,
         # How much of the file the answer was about. Filled in by subject.plan,
         # which is the only thing that knows; None means nobody chose an
@@ -162,35 +163,9 @@ def from_file(path, stack=None):
         for line in _ODOO_IMPORT_RE.findall(body):
             imports.extend(part.strip() for part in line.split(",") if part.strip())
         ctx["odoo_imports"] = sorted(set(imports))
-    else:
-        tsconfig = _walk_up(path, ("tsconfig.json",))
-        if tsconfig:
-            ctx["tsconfig"] = tsconfig
-            ctx["ts_strict"] = _strict_from(tsconfig)
     return ctx
 
 
-def _strict_from(tsconfig):
-    """strict from a tsconfig, tolerating the comments TypeScript allows in it.
-
-    JSON with comments is not JSON, and tsconfig.json is full of them. Stripping
-    line comments first is enough in practice; a file that still will not parse
-    returns None, which reads as 'not determinable' rather than 'not strict'.
-    """
-    text = _read(tsconfig)
-    cleaned = re.sub(r"^\s*//.*$", "", text, flags=re.M)
-    cleaned = re.sub(r"/\*.*?\*/", "", cleaned, flags=re.S)
-    cleaned = re.sub(r",(\s*[}\]])", r"\1", cleaned)
-    try:
-        data = json.loads(cleaned)
-    except ValueError:
-        return None
-    options = data.get("compilerOptions")
-    if not isinstance(options, dict):
-        return None
-    return options.get("strict")
-
-
 def empty(stack):
     """The context for a bare question: nothing known, and said so.
 
@@ -206,8 +181,6 @@ def empty(stack):
         "manifest": None,
         "models": [],
         "odoo_imports": [],
-        "ts_strict": None,
-        "tsconfig": None,
         "is_test": False,
         # How much of the file the answer was about. Filled in by subject.plan,
         # which is the only thing that knows; None means nobody chose an
@@ -521,9 +494,6 @@ def describe(ctx):
         lines.append("Models in this file: {0}".format(", ".join(ctx["models"])))
     if ctx.get("odoo_imports"):
         lines.append("Already imported from odoo: {0}".format(", ".join(ctx["odoo_imports"])))
-    if ctx.get("ts_strict") is not None:
-        lines.append("TypeScript strict mode: {0}".format(
-            "on" if ctx["ts_strict"] else "OFF -- optional properties and null are not checked"))
     if ctx.get("is_test"):
         lines.append("This file is a test, so throwing on bad input is acceptable here.")
     return lines

bin/corpus.py

@@ -5,15 +5,20 @@ The corpus in ../corpus/rules/*.json is the SINGLE SOURCE OF TRUTH at query time
 System prompts and the retrieval index are both derived from it, so they cannot
 drift apart.
 
-It is not where rules are EDITED. `nexa build` regenerates every one of those files
-from corpus/build_corpus.py, so a rule added to the JSON by hand survives until the
-next build and then disappears without a word. Add rules there, in four places: the
-stack's list, ENRICH or SEMANTIC_CHECK, PROBES, and check_sources.SYMBOLS if the
-stack is Odoo. Each of the four fails loudly when it is the one you forgot.
+It is not where rules are EDITED. `nexa build` regenerates that file from
+corpus/build_corpus.py, so a rule added to the JSON by hand survives until the
+next build and then disappears without a word. Add rules there, in four places:
+ODOO (or PYTHON, for a rule about the language rather than the ORM), ENRICH or
+SEMANTIC_CHECK, PROBES, and check_sources.SYMBOLS. Each of the four fails
+loudly when it is the one you forgot.
+
+There is one stack, `odoo`, and every rule is selected for it. The `python.`
+prefix on eight of them is provenance, not a second stack: an Odoo module is a
+Python module, so the language rules apply to it.
 
     python corpus.py validate                 preflight the corpus against its schema
     python corpus.py prompt odoo              emit a SYSTEM block derived from the rules
-    python corpus.py modelfiles               regenerate all Modelfiles from the corpus
+    python corpus.py modelfiles               regenerate the Modelfile from the corpus
     python corpus.py index                    embed every rule for retrieval
     python corpus.py ask odoo "question"      answer, grounded in retrieved rules
     python corpus.py verify answer.txt        check every cited rule id actually exists
@@ -103,8 +108,12 @@ def rank_findings(hits):
         hit.line, hit.rule))
 
 
-STACK_MODEL = {"odoo": "ai-odoo", "python": "ai-py",
-               "typescript": "ai-ts", "javascript": "ai-ts"}
+STACK_MODEL = {"odoo": "ai-odoo"}
+
+# The id prefixes a rule may carry. Provenance: "odoo." is a rule about the ORM
+# and is sourced to the Odoo documentation, "python." one about the language,
+# sourced to docs.python.org. Both are selected for the one stack.
+ORIGINS = ("odoo", "python")
 # Splitting an answer into code and prose, and deciding what counts as a
 # citation, live in layers.py -- so the CLI, the pipeline and the layer engine
 # cannot drift apart on either question. Re-exported under the old names
@@ -245,8 +254,14 @@ def cmd_validate():
             errors.append("{0}: duplicate id (also in stack '{1}')".format(path, seen[rid]))
         seen[rid] = rule.get("stack")
 
-        if "stack" in rule and isinstance(rid, str) and not rid.startswith(rule["stack"] + "."):
-            errors.append("{0}: id prefix does not match stack '{1}'".format(path, rule["stack"]))
+        # The prefix names the rule's ORIGIN, not its stack -- there is one
+        # stack and eight of its rules come from the Python corpus. It is still
+        # checked, because an id is the thing every measurement and every
+        # citation is keyed on: a typo'd prefix silently orphans a rule from
+        # its own classification artifact.
+        if isinstance(rid, str) and rid.split(".")[0] not in ORIGINS:
+            errors.append("{0}: id prefix is not one of {1}".format(
+                path, ", ".join(sorted(ORIGINS))))
 
         # advisory is derived from likelihood by build_corpus.py. If the two
         # disagree, the JSON was hand-edited, and a rule claiming to gate while
@@ -352,23 +367,14 @@ def cmd_validate():
 # --------------------------------------------------------------------- prompt
 
 HEADER = {
+    # One stack, one header. It names the Python half explicitly because the
+    # corpus holds eight rules about the language rather than the ORM, and an
+    # answer that treats "Odoo engineer" as "ORM only" drops them.
     "odoo": (
-        "You are an Odoo engineer. You write Python using the Odoo ORM. You never write "
-        "TypeScript, JavaScript, Zod or Pydantic. Every answer is Odoo Python."
-    ),
-    "python": (
-        "You are a Python engineer specialising in input validation and the places a "
-        "check appears to hold and does not. You write plain Python and the standard "
-        "library. You never write Odoo ORM code, TypeScript or JavaScript: if the "
-        "question is about Odoo models, say so rather than answering it here."
-    ),
-    "typescript": (
-        "You are a TypeScript engineer specialising in runtime validation at system "
-        "boundaries. You never write Python or Odoo server code. Every answer is TypeScript."
-    ),
-    "javascript": (
-        "You are a JavaScript engineer specialising in runtime validation at system "
-        "boundaries. You never write Python or Odoo server code. Every answer is JavaScript."
+        "You are an Odoo engineer. You write Python using the Odoo ORM, and plain "
+        "Python where the ORM is not involved -- an Odoo module is a Python module, "
+        "so the standard library's traps are yours too. You never write TypeScript, "
+        "JavaScript, Zod or Pydantic. Every answer is Python."
     ),
 }
 
@@ -432,8 +438,7 @@ def cmd_prompt(stack):
 REGISTRY = "registry.ollama.ai/library/"
 
 DEEP_MODEL = "qwen3-coder:30b"
-BASE = {"odoo": "qwen2.5-coder:7b", "python": "qwen2.5-coder:7b",
-        "typescript": "qwen2.5-coder:7b", "javascript": "qwen2.5-coder:7b"}
+BASE = {"odoo": "qwen2.5-coder:7b"}
 PARAMS = """PARAMETER temperature 0.2
 PARAMETER top_p 0.85
 PARAMETER top_k 30
@@ -445,8 +450,7 @@ PARAMETER num_gpu 99"""
 def cmd_modelfiles():
     """Regenerate Modelfiles from the corpus. Never hand-edit the generated files."""
     made = []
-    for stack, model in (("odoo", "ai-odoo"), ("python", "ai-py"),
-                        ("typescript", "ai-ts"), ("javascript", "ai-js")):
+    for stack, model in (("odoo", "ai-odoo"),):
         body = render_prompt(stack).replace('"""', "'''")
         text = (
             "# GENERATED by bin/corpus.py modelfiles - do not hand-edit.\n"

bin/crosswalk.py

@@ -55,16 +55,13 @@ import layers       # noqa: E402
 
 CROSSWALK_VERSION = "1.0.0"
 
-# A semgrep rule says which languages it is about. Ours say which stack, and the
-# two do not line up one to one: a `languages: [python]` rule is answerable by
-# anything in the odoo or python stacks, because both of those are Python.
+# A semgrep rule says which languages it is about. Ours say which stack, of
+# which there is one, and it is Python: a `languages: [python]` rule is
+# answerable by this corpus and a `languages: [js]` rule is not, which is the
+# whole of the mapping now.
 LANG_STACKS = {
-    "python": ("odoo", "python"),
-    "py": ("odoo", "python"),
-    "js": ("javascript", "typescript"),
-    "javascript": ("javascript", "typescript"),
-    "ts": ("typescript", "javascript"),
-    "typescript": ("typescript", "javascript"),
+    "python": ("odoo",),
+    "py": ("odoo",),
 }
 
 # Directories that are never the code under review. The same list fieldtest
@@ -426,10 +423,10 @@ def crosswalk(external, our_rules):
 def covered_stacks(external):
     """The stacks their ruleset is even about.
 
-    A Python-only ruleset having nothing to say about a TypeScript rule of ours
-    is not a finding, it is the languages line at the bottom of every one of
-    their rules. Comparing across it would pad the gap with entries whose answer
-    was known before the tool ran.
+    A JavaScript-only ruleset having nothing to say about any rule of ours is
+    not a finding, it is the languages line at the bottom of every one of their
+    rules. Comparing across it would pad the gap with entries whose answer was
+    known before the tool ran.
     """
     stacks = set()
     for ext in external:

bin/eval.py

@@ -68,12 +68,12 @@ DEFAULT_QUESTIONS = [
     ("odoo", "compute a stored total from the order lines"),
     ("odoo", "make the partner code unique across the table"),
     ("odoo", "compare two prices for equality"),
-    ("typescript", "type the result of a res.partner search_read call over JSON-RPC"),
-    ("typescript", "validate an env var holding a database URL at startup"),
-    ("typescript", "read the parent company name off a many2one field"),
-    ("javascript", "look up a value in a config object using a key from the request query string"),
-    ("javascript", "parse a JSON body from an incoming request"),
-    ("javascript", "read a page number out of the query string"),
+    # The plain-Python half of the corpus, reached through Odoo-shaped
+    # questions because that is where these rules are now selected from: an
+    # eval that never asks one measures 19 of the 27 rules.
+    ("odoo", "check an amount is positive before posting a payment"),
+    ("odoo", "store a total in a monetary field without losing a penny"),
+    ("odoo", "compare a date typed by a user against the current time"),
 ]
 
 
@@ -179,9 +179,9 @@ def retrievability(stack=None, k=None):
     This is the measurement `nexa report rules` cannot make. Telemetry can only
     say what WAS retrieved by the questions somebody happened to ask, and a rule
     absent from that list may simply never have had a relevant question put to
-    it. Fifteen recorded queries, twelve of them Odoo, against a TOP_K of 6 and
-    ten TypeScript rules, is a sample in which four TypeScript rules could not
-    have appeared however well they were written.
+    it. Nine recorded queries against a TOP_K of 6 and 27 rules is a sample in
+    which most of the corpus could not have appeared however well it was
+    written -- arithmetic, not evidence about the rules.
 
     A probe is a question aimed at one rule. If the rule does not come back for
     it, retrieval has genuinely missed it, and the rule is unreachable no matter
@@ -366,9 +366,9 @@ def summarise(rows, runs, pipeline_mode):
 
         retrieved = collections.Counter(
             rid for r in rows for rid in r["retrieved"])
-        # Scoped to the stacks that actually ran. Reporting every Odoo rule as
-        # "never retrieved" after a JavaScript-only eval is true and useless,
-        # and it buries the rules that really were missed.
+        # Scoped to the stacks that actually ran. There is one, so this is a
+        # formality now -- kept because the scoping is what stops a partial run
+        # reporting rules it never had the chance to retrieve.
         stacks = {r["stack"] for r in rows}
         every = {r["id"] for r in corpus.load_rules() if r["stack"] in stacks}
         never = sorted(every - set(retrieved))
@@ -395,22 +395,17 @@ DEFAULT_SUBJECTS = [
     os.path.join(SUBJECTS, "odoo_module", "models", "fsm_job.py"),
     os.path.join(SUBJECTS, "odoo_module", "models", "fsm_visit.py"),
     os.path.join(SUBJECTS, "etl", "load_prices.py"),
-    os.path.join(SUBJECTS, "web", "src", "partners.ts"),
-    os.path.join(SUBJECTS, "web", "src", "board.js"),
 ]
 
-CHECKABLE = (".py", ".ts", ".tsx", ".js", ".jsx", ".mjs")
+# The extensions `check` will review, and the same list context.REVIEWABLE
+# holds. A file this expands to that the router then refuses would be an
+# eval that counts a file nobody checked.
+CHECKABLE = (".py", ".xml")
 SKIP_DIRS = frozenset([".git", "node_modules", "__pycache__", ".venv", "venv",
                        "dist", "build", ".tox", "static"])
 
 _PY_NAME = re.compile(r"^(?:class|def)\s+(\w+)", re.M)
 _PY_METHOD = re.compile(r"^\s+def\s+(\w+)", re.M)
-# Column zero on purpose. Indented const and let are locals inside a handler,
-# and counting `page` or `size` as something the file declares would score any
-# answer that mentions pagination as a review of this file.
-_WEB_NAME = re.compile(
-    r"^(?:export\s+(?:default\s+)?)?(?:async\s+)?"
-    r"(?:function|class|interface|type|enum|const|let|var)\s+(\w+)", re.M)
 
 
 def declared_names(body, stack):
@@ -419,17 +414,12 @@ def declared_names(body, stack):
     Not a quality measure. An answer that never mentions a single function in
     the file it was handed is not reviewing that file, whatever its verdict
     says, and there is no way to see that from the verdict alone.
+
+    `stack` is still taken, and still the one stack: the signature is what the
+    caller has, and a function that silently ignores an argument is worse than
+    one that names why it has it.
     """
-    if stack in ("odoo", "python"):
-        names = set(_PY_NAME.findall(body)) | set(_PY_METHOD.findall(body))
-    else:
-        names = set()
-        for line in body.splitlines():
-            if "require(" in line or line.startswith("import "):
-                continue      # a binding for somebody else's name, not this file's
-            found = _WEB_NAME.match(line)
-            if found:
-                names.add(found.group(1))
+    names = set(_PY_NAME.findall(body)) | set(_PY_METHOD.findall(body))
     # Dunders are noise, and a name too short to be a coincidence-free match
     # against English prose cannot carry this measurement.
     return sorted(n for n in names if len(n) > 3 and not n.startswith("__"))
@@ -811,10 +801,10 @@ def summarise_check(rows, runs, skipped=0):
 
     print("CONTEXT -- the layer `ask` can never run")
     print("  ask has no file, so this layer always reports UNKNOWN. With a file it")
-    print("  reads the manifest and the tsconfig -- but reading is not checking. A")
-    print("  verdict needs a question it can answer: a series the corpus was checked")
-    print("  against, strict on, or a rule carrying odoo_versions. Anything else is")
-    print("  read, stated as a gap, and left UNKNOWN.")
+    print("  reads the manifest -- but reading is not checking. A verdict needs a")
+    print("  question it can answer: a series the corpus was checked against, or a")
+    print("  rule carrying odoo_versions. Anything else is read, stated as a gap,")
+    print("  and left UNKNOWN.")
     reached, read = 0, 0
     for path, row in files.items():
         verdicts = {r["context_verdict"] for r in rows if r["path"] == path}
@@ -913,7 +903,7 @@ def main(argv):
     parser.add_argument("--runs", type=int, default=3,
                         help="repetitions per question (default 3)")
     parser.add_argument("--stack",
-                        help="odoo, python, typescript or javascript")
+                        help="odoo, the only stack")
     parser.add_argument("--pipeline", action="store_true",
                         help="measure through run(), for escalation numbers")
     parser.add_argument("--retrieval", action="store_true",

bin/fieldtest.py

@@ -49,59 +49,23 @@ import external as ext  # noqa: E402
 import layers       # noqa: E402
 import semantics    # noqa: E402
 
-# Directories that are never the code under review.
-#
-# `static` is not in the shared list, because whether it is source depends on
-# the stack asking. Reviewing Python it holds assets and vendored bundles.
-# Reviewing JavaScript on an Odoo tree it holds ALL of it: every line of
-# first-party JS an Odoo module ships lives under static/src. Skipping it
-# unconditionally made `fieldtest --stack javascript` answer "0 files. Wrong
-# folder, or the wrong --stack" on any Odoo checkout, which is a large part of
-# why those seven rules have never been measured against real code.
+# Directories that are never the code under review. `static` is in the list:
+# on an Odoo tree it holds assets, vendored bundles and the web client's own
+# JavaScript, and none of the 27 rules has anything to say about any of it.
 SKIP_DIRS = frozenset([".git", ".hg", "node_modules", "__pycache__",
-                       ".tox", ".venv", "venv", "dist", "build", "migrations"])
-PYTHON_SKIP_DIRS = SKIP_DIRS | {"static"}
+                       ".tox", ".venv", "venv", "dist", "build", "migrations",
+                       "static"])
 
 
-def skip_dirs(stack):
-    return PYTHON_SKIP_DIRS if stack in ("odoo", "python") else SKIP_DIRS
-
-
-# A bundle is not the code under review either, and unlike a directory it has to
-# be recognised from the file itself. Both markers are ordinary JavaScript
-# convention rather than anything Odoo-specific: the name says so, or one line
-# is longer than any line a person types. Measured on OpenSPP -- its five
-# vendored libraries under static/lib carry single lines of 32,071, 95,621,
-# 198,502 and 375,248 characters, while its 59 first-party files under
-# static/src top out at 87.
-BUNDLE_SUFFIXES = (".min.js", ".min.ts", ".bundle.js", ".bundle.ts")
-BUNDLE_LINE = 1000
-
-
-def _is_bundle(path, name):
-    """Generated or vendored JavaScript, whatever directory it sits in."""
-    if name.endswith(BUNDLE_SUFFIXES):
-        return True
-    try:
-        with io.open(path, encoding="utf-8", errors="ignore") as handle:
-            return any(len(line) > BUNDLE_LINE for line in handle)
-    except OSError:
-        return False
-
-EXTENSIONS = {"odoo": (".py",),
-              "python": (".py",),
-              "typescript": (".ts", ".tsx"),
-              "javascript": (".js", ".jsx", ".mjs")}
+EXTENSIONS = {"odoo": (".py",)}
 
 
 def sources(roots, stack, include_tests):
     """Every file under roots that belongs to this stack."""
     wanted = EXTENSIONS[stack]
-    skip = skip_dirs(stack)
-    js = stack in ("javascript", "typescript")
     for root in roots:
         for dirpath, dirnames, filenames in os.walk(root):
-            dirnames[:] = [d for d in dirnames if d not in skip]
+            dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS]
             if not include_tests and _is_test_path(dirpath):
                 continue
             for name in sorted(filenames):
@@ -109,10 +73,7 @@ def sources(roots, stack, include_tests):
                     continue
                 if not include_tests and _is_test_file(name):
                     continue
-                path = os.path.join(dirpath, name)
-                if js and _is_bundle(path, name):
-                    continue
-                yield path
+                yield os.path.join(dirpath, name)
 
 
 # The extensions the TRIGGERS are read from, which is a wider set than the ones
@@ -133,11 +94,10 @@ def trigger_sources(roots, include_tests=False):
     """
     for root in roots:
         for dirpath, dirnames, filenames in os.walk(root):
-            # PYTHON_SKIP_DIRS, not the shared list: the facts are read off the
-            # Python side of the module, and an Odoo tree keeps owl templates
-            # under static/src/xml. Those are not record rules and must not be
-            # read as though they were.
-            dirnames[:] = [d for d in dirnames if d not in PYTHON_SKIP_DIRS]
+            # static/ is skipped here too, and for a reason of its own: an
+            # Odoo tree keeps owl templates under static/src/xml, and those are
+            # not record rules and must not be read as though they were.
+            dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS]
             if not include_tests and _is_test_path(dirpath):
                 continue
             for name in sorted(filenames):
@@ -150,16 +110,15 @@ def _is_test_path(path):
     return any(p in ("tests", "test", "__tests__", "spec") for p in parts)
 
 
-# A test named by its FILE rather than by the directory holding it. Python and
-# Odoo put tests in a tests/ package, which _is_test_path reads; the JavaScript
-# convention is a suffix on a file sitting beside the thing it tests. Anchored
-# rather than a bare substring, because `latest_version.py` contains "test_".
-TEST_FILE = re.compile(r"(^test_|_test\.|\.test\.|\.spec\.)", re.I)
+# A test named by its FILE rather than by the directory holding it. Odoo puts
+# tests in a tests/ package, which _is_test_path reads; a test named test_x.py
+# outside one still has to be recognised. Anchored rather than a bare
+# substring, because `latest_version.py` contains "test_".
+TEST_FILE = re.compile(r"(^test_|_test\.)", re.I)
 
 
 def _is_test_file(name):
-    """src/hono.test.ts is a test. 45 of the 355 hits in the first TypeScript
-    field test sat in files like it, none of them shipped code."""
+    """test_partner.py is a test; latest_version.py is not."""
     return bool(TEST_FILE.search(name))
 
 
@@ -412,7 +371,7 @@ def main(argv):
     parser = argparse.ArgumentParser(prog="nexa fieldtest", add_help=True)
     parser.add_argument("folders", nargs="*", help="trees of real source to read")
     parser.add_argument("--stack", default="odoo",
-                        help="odoo (default), python, typescript or javascript")
+                        help="odoo, the only stack (default)")
     parser.add_argument("--examples", type=int, default=3,
                         help="example hits to print per rule (default 3)")
     parser.add_argument("--json", help="write every hit here as well")

bin/layers.py

@@ -56,8 +56,10 @@ META = os.path.join(ROOT, "corpus", "corpus_meta.json")
 PASS, WARN, FAIL, UNKNOWN = "PASS", "WARN", "FAIL", "UNKNOWN"
 _RANK = {PASS: 0, UNKNOWN: 1, WARN: 2, FAIL: 3}
 
+# The two id prefixes the corpus uses. Both are the one stack; the prefix says
+# where the rule came from, and corpus.ORIGINS is the list this mirrors.
 CITATION_RE = re.compile(
-    r"\b(odoo|python|typescript|javascript)\.[a-z0-9]+(?:-[a-z0-9]+)*\b")
+    r"\b(odoo|python)\.[a-z0-9]+(?:-[a-z0-9]+)*\b")
 
 # The labels corpus.build_messages requires the answer to carry. Structural
 # validation of the ANSWER, as distinct from schema validation of the corpus --
@@ -74,6 +76,10 @@ LEAKED_TEMPLATE = (
 )
 
 PY_LANGS = ("python", "py", "python3", "odoo")
+# Not a stack, and not reviewed. Odoo ships an OWL front end, so an answer can
+# legitimately contain a JavaScript block -- it is recognised here so the
+# syntactic layer can say it went unchecked, which is the only thing this
+# corpus has to say about JavaScript.
 JS_LANGS = ("ts", "tsx", "typescript", "js", "jsx", "javascript", "mjs", "node")
 
 _ESSENTIAL = ("syntactic", "structural", "domain")
@@ -212,8 +218,11 @@ def cited_ids(text):
 
 
 def comment_kind(stack):
-    """Which comment syntax a stack's generated code uses."""
-    return "python" if stack in ("odoo", "python") else "js"
+    """Which comment syntax a stack's generated code uses. One stack, one
+    answer -- kept as a function because semantics.strip_comments takes the
+    kind as an argument, and inlining the constant at each call site is how
+    the two would come to disagree."""
+    return "python"
 
 
 def matchable(code, stack):
@@ -504,7 +513,8 @@ def _lang_of(lang, stack):
         return "js"
     if lang:
         return "other"
-    return "python" if stack in ("odoo", "python") else "js"
+    # Untagged, and there is one stack: Python.
+    return "python"
 
 
 # -------------------------------------------------------------- 1 syntactic
@@ -512,10 +522,11 @@ def _lang_of(lang, stack):
 def layer_syntactic(text, stack):
     """Does the generated code parse at all?
 
-    Python gets a real parse and compile. TS/JS gets delimiter balance, because
-    there is no JavaScript grammar in the standard library -- so the TS/JS
-    not_checked entry is permanent and says so rather than implying a parse
-    happened.
+    Python gets a real parse and compile. A JavaScript block -- which an Odoo
+    answer can legitimately contain, the web client being OWL -- gets delimiter
+    balance, because there is no JavaScript grammar in the standard library.
+    That not_checked entry is permanent and says so rather than implying a
+    parse happened.
     """
     blocks, unterminated = code_blocks(text)
     findings, checked, gaps = [], [], []
@@ -670,7 +681,7 @@ def layer_semantic(text, stack, rules):
         for r in semantic_rules:
             gaps.append((r["id"], "no Python block in the answer to analyse"))
         gaps.append(("the answer", "semantic analysis is Python-only: the standard "
-                                   "library has no TypeScript or JavaScript parser"))
+                                   "library has no JavaScript parser"))
         return LayerResult("semantic", UNKNOWN, findings, checked, gaps)
 
     # The checkers see the repaired source, so an indented method fragment is
@@ -814,8 +825,8 @@ def layer_context(rules, ctx):
 
     if not ctx or ctx.get("source") == "none":
         gaps.append(("the environment",
-                     "no file was supplied, so the module, Odoo series and tsconfig "
-                     "are unknown; run 'nexa check <file>' for a contextual verdict"))
+                     "no file was supplied, so the module and Odoo series are "
+                     "unknown; run 'nexa check <file>' for a contextual verdict"))
         return LayerResult("context", UNKNOWN, findings, checked, gaps)
 
     series = ctx.get("odoo_series")
@@ -842,6 +853,10 @@ def layer_context(rules, ctx):
             checked.append("Odoo series {0} from {1}".format(
                 series, os.path.basename(ctx.get("manifest") or "manifest")))
         else:
+            # True of an Odoo module whose manifest has no version, and of a
+            # plain script in the repository that was never going to have one.
+            # Said either way: nothing on disk states the series, so every
+            # version-specific rule below is unverified here.
             gaps.append(("Odoo series", "no __manifest__.py with a version was found "
                                         "above this file"))
 
@@ -855,29 +870,6 @@ def layer_context(rules, ctx):
                                         "rule applies to Odoo {0}, this module is {1}".format(
                                             declared, series), rule=r["id"]))
 
-    if ctx.get("ts_strict") is False:
-        # Demoted with the series mismatch above, for the same reason: it fires
-        # on the project rather than on the answer, and it fires on every run in
-        # any project that has not finished turning strict on. Making it a
-        # finding again would mean checking whether this answer leans on the
-        # type system at all -- its declared enforcement layer -- rather than
-        # assuming every answer does.
-        gaps.append(("type-based guarantees",
-                     "tsconfig has strict off, so the compile-time half of any "
-                     "type-based guarantee in this answer is not enforced here"))
-    elif ctx.get("ts_strict") is True:
-        checked.append("tsconfig strict")
-    elif ctx.get("stack") in ("typescript", "javascript"):
-        gaps.append(("tsconfig strict", "no tsconfig.json was found above this file"))
-    elif ctx.get("stack") == "python":
-        # Neither branch above applies to a plain Python script, and this used to
-        # fall through the odoo one and report a missing __manifest__.py -- a
-        # true sentence about a file that was never going to have one, and the
-        # only thing this layer said about every Python file it was given.
-        gaps.append(("the environment",
-                     "a plain Python file has no manifest and no tsconfig, so "
-                     "nothing on disk says which framework or interpreter version "
-                     "this has to run under"))
 
     unversioned = [r["id"] for r in rules if not r.get("odoo_versions")
                    and r.get("stack") == "odoo"]

bin/recall.py

@@ -68,27 +68,32 @@ import layers       # noqa: E402
 import semantics    # noqa: E402
 import subject      # noqa: E402
 
-EXTENSIONS = {"odoo": (".py",), "python": (".py",),
-              "typescript": (".ts", ".tsx"),
-              "javascript": (".js", ".jsx", ".mjs")}
+EXTENSIONS = {"odoo": (".py",)}
 
 # A commit is IN SCOPE when its diff touches one of these. Hand-written, and
 # therefore the weakest link in the measurement -- which is why it is printed
 # in the report rather than buried here. Derived from what the rules are about,
 # not from their patterns: using the patterns would make the denominator depend
 # on the thing being measured, and inflate the answer.
+# One list, because there is one stack, and the constructs the composed-in
+# Python rules are about are now inside it. Leaving them out would shrink the
+# denominator against rules that are being counted in the numerator, which is
+# the direction that flatters the tool.
+#
+# One substitution, stated because it is a judgment: the plain-Python list used
+# to carry "def " for mutable-default-argument. On an Odoo tree that matches
+# nearly every diff, and a denominator that large says nothing about anything.
+# The construct the rule is actually about is a mutable default, so that is
+# what is listed.
 SCOPE_TOKENS = {
     "odoo": ("api.constrains", "api.depends", "api.onchange", "_sql_constraints",
              "ondelete", "check_company", ".sudo(", "Many2one", "Many2many",
              "float_compare", "float_is_zero", "_check_recursion", "_has_cycle",
-             "ValidationError", "store=True", "noupdate"),
-    "python": ("assert ", "except:", "eval(", "exec(", "pickle.load", "shell=True",
-               "os.system(", "os.path.join(", "float(", "Decimal", "datetime.now(",
-               "utcnow(", "def "),
-    "typescript": ("z.object", "z.string", "z.number", "parse(", "safeParse",
-                   "as ", ": any", "process.env", "z.union", "nullable("),
-    "javascript": ("JSON.parse", "parseInt", "parseFloat", "forEach", "new Date(",
-                   "||", "hasOwnProperty", "req.body", "req.query"),
+             "ValidationError", "store=True", "noupdate",
+             # the plain-Python half
+             "assert ", "except:", "eval(", "exec(", "pickle.load", "shell=True",
+             "os.system(", "os.path.join(", "float(", "Decimal", "datetime.now(",
+             "utcnow(", "=[]", "={}", "=set()"),
 }
 
 # Commit subjects that mean "this fixed something". OCA's own convention is a
@@ -616,7 +621,7 @@ def main(argv):
     parser = argparse.ArgumentParser(prog="nexa recall", add_help=True)
     parser.add_argument("repos", nargs="*", help="git checkouts WITH history")
     parser.add_argument("--stack", default="odoo",
-                        help="odoo (default), python, typescript or javascript")
+                        help="odoo, the only stack (default)")
     parser.add_argument("--limit", type=int, default=0,
                         help="stop after this many fix commits per repo")
     parser.add_argument("--misses", type=int, default=25,

bin/report.py

@@ -149,7 +149,7 @@ def cmd_rules(events):
         if known is None:
             print("  never retrieved: corpus/rules could not be read")
         else:
-            missing = sorted(known - set(retrieved))
+            missing = sorted(set(known) - set(retrieved))
             if not missing:
                 print("  never retrieved: none, every rule has surfaced at least once")
             else:
@@ -164,7 +164,8 @@ def _explain_absence(retrieves, missing, known):
     """Say how much of that list the sample size explains by itself.
 
     One query retrieves at most TOP_K rules, so a stack with more rules than
-    queries x TOP_K has rules that COULD NOT have appeared. Reporting those
+    queries x TOP_K has rules that COULD NOT have appeared. `known` is
+    {id: stack} from _corpus_rule_ids. Reporting those
     beside rules that genuinely lost their own ranking, under one heading that
     calls both dead weight, is how a measurement turns into a wrong conclusion:
     four of the seven names this used to print were on it for arithmetic.
@@ -174,7 +175,7 @@ def _explain_absence(retrieves, missing, known):
     for r in retrieves:
         if r.get("stack"):
             per_stack[r["stack"]] += 1
-    sizes = collections.Counter(rid.split(".")[0] for rid in known)
+    sizes = collections.Counter(known.values())
 
     print()
     print("  queries recorded, by stack:")
@@ -215,7 +216,13 @@ def _top_k():
 
 
 def _corpus_rule_ids():
-    """Every rule id in the corpus, or None if it cannot be read.
+    """{rule id: its stack} for the whole corpus, or None if it cannot be read.
+
+    The stack comes off the rule and not off the id prefix. Those were the same
+    thing until the plain-Python rules were composed into the Odoo stack, and
+    splitting on the dot afterwards invented a "python" stack with eight rules
+    and no queries -- then reported all eight as unreachable by arithmetic,
+    which is a conclusion about a stack that does not exist.
 
     Telemetry can only say what WAS retrieved. "Never retrieved" is a statement
     about the corpus, so the corpus has to be opened to make it -- which is why
@@ -225,7 +232,7 @@ def _corpus_rule_ids():
     rules_dir = os.path.join(os.path.dirname(HERE), "corpus", "rules")
     if not os.path.isdir(rules_dir):
         return None
-    ids = set()
+    ids = {}
     try:
         for name in sorted(os.listdir(rules_dir)):
             if not name.endswith(".json"):
@@ -233,7 +240,7 @@ def _corpus_rule_ids():
             with io.open(os.path.join(rules_dir, name), encoding="utf-8") as fh:
                 data = json.load(fh)
             for rule in (data if isinstance(data, list) else data.get("rules", [])):
-                ids.add(rule["id"])
+                ids[rule["id"]] = rule["stack"]
     except (OSError, ValueError, KeyError, TypeError):
         return None
     return ids or None

bin/subject.py

@@ -39,7 +39,17 @@ sys.path.insert(0, HERE)
 
 import context     # noqa: E402
 
-STACKS = ("odoo", "python", "typescript", "javascript")
+STACKS = ("odoo",)
+
+
+class Unreviewable(Exception):
+    """The file is in a language this corpus has no rules for.
+
+    Refusing is the point. Running 27 Odoo rules over a .ts file produces an
+    empty finding list, and an empty finding list is read as "nothing wrong
+    here" -- so silence about a file nobody checked would be the one lie the
+    tool is built not to tell.
+    """
 
 # How much of a file `nexa check` sends. The 7B runs at num_ctx 8192, which has
 # to hold the retrieved rules, the system prompt and the answer as well, so the
@@ -72,27 +82,34 @@ REVIEW_QUESTION = (
 def route(path, body, ctx, forced=None):
     """(stack, how it was decided). The stack decision on its own, for testing.
 
-    For a .py file the extension only says "not TypeScript". WHICH Python corpus
-    applies is decided by the file: an odoo import, or a __manifest__.py
-    somewhere above it, means the Odoo rules; anything else is plain Python and
-    gets the python stack, which exists precisely so that answer is not fifteen
-    findings about a framework the file does not use.
-
-    Before the python stack existed this refused instead, with exit 2. That was
-    honest and it was not useful, which is why the stack is here.
+    There is one stack, so this is no longer a choice between corpora -- it is
+    the decision whether the corpus applies to this file at all. A .py or .xml
+    file is reviewed; anything else raises Unreviewable.
+
+    It used to pick between an odoo and a python corpus by reading the file for
+    an odoo import or walking up for a __manifest__.py. That choice is gone,
+    because the two corpora are one: the plain-Python rules are composed into
+    the Odoo stack, so a script in an Odoo repository gets them without being
+    routed away from the ORM rules first. What the file looks like is still
+    read -- plan() states it in the report -- it just no longer decides which
+    rules run.
     """
     if forced:
+        if forced not in STACKS:
+            raise Unreviewable(
+                "unknown stack '{0}'. There is one: {1}".format(
+                    forced, ", ".join(STACKS)))
         return forced, "--stack"
-    # One extension table, context.py's, so this cannot decide .mts is Python
-    # while the layer that reads the surroundings decides it is TypeScript.
+    # One extension table, context.py's, so this cannot refuse a file the layer
+    # that reads the surroundings would have contextualised.
     by_extension = context.stack_for(path)
-    if by_extension != "python":
-        return by_extension, "extension"
-    if any(s in body for s in ODOO_SIGNALS):
-        return "odoo", "odoo imports in the file"
-    if ctx.get("manifest"):
-        return "odoo", "__manifest__.py above it"
-    return "python", "a .py file with no Odoo in it"
+    if by_extension is None:
+        raise Unreviewable(
+            "nexa reviews Odoo code: {0} files. {1} is not one, and there are "
+            "no rules in this corpus that would say anything about it.".format(
+                " and ".join(context.REVIEWABLE),
+                os.path.splitext(path)[1] or "that extension"))
+    return by_extension, "extension"
 
 
 # A line that starts a new top-level thing in TS/JS. Column zero, because an
@@ -370,9 +387,10 @@ def plan(path, forced=None):
     with io.open(path, encoding="utf-8", errors="ignore") as fh:
         body = fh.read()
 
-    # Gathered first, because routing a .py file needs to know whether there is
-    # a __manifest__.py above it, and labelled afterwards: the extension cannot
-    # tell an Odoo module from a plain Python script and this can.
+    # Gathered first, and labelled afterwards: the extension cannot tell an Odoo
+    # module from a plain Python script and this can. It no longer decides which
+    # rules run -- there is one corpus -- but it still decides what the report
+    # says about the file, and the context layer needs it either way.
     ctx = context.from_file(path)
     stack, routed_by = route(path, body, ctx, forced)
     ctx["stack"] = stack
@@ -385,11 +403,10 @@ def plan(path, forced=None):
     # its content does not support is still worth checking -- somebody asked --
     # but the reader has to be told which of the two it is.
     notes = []
-    if stack == "odoo" and not looks_odoo:
-        notes.append("no Odoo imports here and no __manifest__.py above it -- reviewing "
-                     "against the Odoo corpus because --stack odoo was given")
-    if stack == "python" and odoo_signals:
-        notes.append("this imports odoo -- run with --stack odoo for the ORM rules")
+    if not looks_odoo:
+        notes.append("no Odoo imports here and no __manifest__.py above it -- the 19 "
+                     "ORM rules have nothing to match, so this file is effectively "
+                     "reviewed against the 8 plain-Python ones")
 
     # The surroundings go into the question, not just into the context layer. A
     # model told the module targets Odoo 17.0 answers differently from one left to

classification-js-2026-09.json

@@ -1,408 +0,0 @@
-{
-  "generated_utc": "2026-09-16",
-  "stack": "javascript",
-  "roots": [
-    "OpenSPP2-19.0",
-    "server-tools",
-    "account-financial-tools"
-  ],
-  "files": 62,
-  "lines": 9304,
-  "totals": {
-    "false": 22,
-    "true": 21
-  },
-  "classes": {
-    "string-default": 21,
-    "boolean-logic": 1
-  },
-  "hits": [
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_branding_kit/static/src/js/user_menu.js",
-      "line": 11,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "const docUrl = session.spp_documentation_url || \"https://docs.openspp.org\";"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_branding_kit/static/src/js/user_menu.js",
-      "line": 12,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "const supportUrl = session.spp_support_url || \"https://openspp.org\";"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_branding_kit/static/src/js/webclient.js",
-      "line": 9,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "const systemName = session.spp_system_name || \"OpenSPP Platform\";"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_cel_widget/static/src/js/cel_editor.js",
-      "line": 128,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "return this._currentProfile || this.props.profile || \"registry_individuals\";"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_cel_widget/static/src/js/cel_editor.js",
-      "line": 243,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "minHeight: this.props.minHeight || \"80px\","
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_cel_widget/static/src/js/cel_editor.js",
-      "line": 467,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "return firstError?.message || \"Invalid expression\";"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_cel_widget/static/src/js/cel_symbol_service.js",
-      "line": 78,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "message: error.message || \"Validation failed\","
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_cel_widget/static/src/js/cel_language/autocomplete.js",
-      "line": 198,
-      "verdict": "false",
-      "class": "boolean-logic",
-      "why": "genuine boolean logic, which the rule explicitly reserves || for",
-      "evidence": "if (!prefix || \"andornot\".includes(prefix)) {"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_cel_widget/static/src/js/cel_language/lint.js",
-      "line": 105,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "message: error.message || \"Unknown error\","
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_change_request_v2/static/src/components/review_panel/review_panel.js",
-      "line": 143,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "currentTier: pendingReview.current_tier || 1,"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_change_request_v2/static/src/components/review_panel/review_panel.js",
-      "line": 144,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "totalTiers: pendingReview.tier_review_ids?.length || 1,"
-    },
-    {
-      "rule": "javascript.number-parsing-is-lossy",
-      "path": "OpenSPP2-19.0/spp_change_request_v2/static/src/js/cr_review_documents.js",
-      "line": 37,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "const docId = parseInt(el.dataset.docId, 10);"
-    },
-    {
-      "rule": "javascript.number-parsing-is-lossy",
-      "path": "OpenSPP2-19.0/spp_change_request_v2/static/src/js/cr_search_results_field.js",
-      "line": 36,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "const partnerId = parseInt(row.dataset.partnerId, 10);"
-    },
-    {
-      "rule": "javascript.number-parsing-is-lossy",
-      "path": "OpenSPP2-19.0/spp_change_request_v2/static/src/js/cr_search_results_field.js",
-      "line": 47,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "const page = parseInt(link.dataset.page);"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_change_request_v2/static/src/js/create_change_request.js",
-      "line": 27,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "name: params.name || \"Change Request Details\","
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_change_request_v2/static/src/js/create_change_request.js",
-      "line": 51,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "name: params.name || \"Change Request\","
-    },
-    {
-      "rule": "javascript.number-parsing-is-lossy",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_arch_parser.esm.js",
-      "line": 73,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "limit: limit ? parseInt(limit, 10) : null,"
-    },
-    {
-      "rule": "javascript.number-parsing-is-lossy",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_arch_parser.esm.js",
-      "line": 74,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "countLimit: countLimit ? parseInt(countLimit, 10) : null,"
-    },
-    {
-      "rule": "javascript.json-parse-returns-any",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js",
-      "line": 397,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "defaultCenter = JSON.parse(editInfo.default_center);"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js",
-      "line": 606,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "return layer.begin_color || \"#3388ff\";"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js",
-      "line": 611,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "const maxValue = config.max_value || 100;"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js",
-      "line": 649,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "return layer.begin_color || \"#3388ff\";"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js",
-      "line": 665,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "const classCount = config.class_count || 5;"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js",
-      "line": 702,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "fillColor = layer.begin_color || \"#3388ff\";"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js",
-      "line": 913,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "fillColor = layer.begin_color || \"#3388ff\";"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js",
-      "line": 1040,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "const maxValue = config.max_value || 100;"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js",
-      "line": 1087,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "const classCount = config.class_count || 5;"
-    },
-    {
-      "rule": "javascript.json-parse-returns-any",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/widgets/gis_edit_map/field_gis_edit_map.esm.js",
-      "line": 46,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "const default_center = JSON.parse(editInfo.default_center);"
-    },
-    {
-      "rule": "javascript.json-parse-returns-any",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/widgets/gis_edit_map/field_gis_edit_map.esm.js",
-      "line": 96,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "const obj = JSON.parse(this.props.record.data[this.props.name]);"
-    },
-    {
-      "rule": "javascript.json-parse-returns-any",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/widgets/gis_edit_map/field_gis_edit_map.esm.js",
-      "line": 140,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "const obj = JSON.parse(record.data[fieldName]);"
-    },
-    {
-      "rule": "javascript.json-parse-returns-any",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/widgets/gis_edit_map/field_gis_edit_map.esm.js",
-      "line": 220,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "const geom = JSON.parse(this.props.record.data[this.props.name]);"
-    },
-    {
-      "rule": "javascript.number-parsing-is-lossy",
-      "path": "OpenSPP2-19.0/spp_import_match/static/src/import_match_selector/import_match_selector.js",
-      "line": 85,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "const matchId = parseInt(ev.target.value, 10) || false;"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_pii_encryption/static/src/js/masked_field.js",
-      "line": 117,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "return result || \"••••••••\";"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_programs/static/src/js/create_program.js",
-      "line": 18,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "const programName = action.params?.name || \"Program\";"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_registry/static/src/js/custom_client_action.js",
-      "line": 15,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "type: params.type || \"info\","
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_registry_search/static/src/js/registry_search_portal.js",
-      "line": 89,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "this.state.searchMode = config.search_mode || \"unified\";"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_registry_search/static/src/js/registry_search_portal.js",
-      "line": 90,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "this.state.searchField = config.target_field || \"name\";"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_registry_search/static/src/js/registry_search_portal.js",
-      "line": 91,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "this.resultLimit = config.result_limit || 50;"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_registry_search/static/src/js/registry_search_portal.js",
-      "line": 92,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "this.minSearchChars = config.min_chars || 3;"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_studio/static/src/js/logic_editor/variable_picker.js",
-      "line": 289,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "const scope = this.state.scopeFilter || \"all\";"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_studio/static/src/js/logic_editor/variable_picker.js",
-      "line": 295,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "const applies = v.applies_to || \"both\";"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "path": "OpenSPP2-19.0/spp_studio/static/src/js/logic_editor/variable_picker.js",
-      "line": 313,
-      "verdict": "false",
-      "class": "string-default",
-      "why": "the default replaces only a blank, and every left side here is a URL, colour, label, mode or error message -- blank is the absence of configuration there, not a value somebody meant to store",
-      "evidence": "const applies = variable.applies_to || \"both\";"
-    },
-    {
-      "rule": "javascript.json-parse-returns-any",
-      "path": "server-tools/base_exception/static/src/js/base_exception.esm.js",
-      "line": 25,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "const excData = JSON.parse(originalError.data.message);"
-    }
-  ]
-}

classification-python-2026-09.json

@@ -0,0 +1,571 @@
+{
+  "generated_utc": "2026-09-16T07:59:24.115329+00:00",
+  "stack": "odoo",
+  "subject": "the 8 python.* rules composed into the Odoo stack",
+  "checkouts": {
+    "OpenSPP2-19.0": "cfa0dc8e",
+    "server-tools": "60cd54e5e",
+    "account-financial-tools": "e4c1b86aa"
+  },
+  "lines": {
+    "OpenSPP2-19.0": 226937,
+    "OCA": 33960
+  },
+  "totals": {
+    "true": 26,
+    "false": 24
+  },
+  "by_rule": {
+    "python.assert-is-not-validation": {
+      "true": 6,
+      "false": 4
+    },
+    "python.decimal-for-money-not-float": {
+      "true": 0,
+      "false": 3
+    },
+    "python.eval-and-pickle-execute-their-input": {
+      "true": 0,
+      "false": 1
+    },
+    "python.naive-and-aware-datetimes-do-not-compare": {
+      "true": 20,
+      "false": 12
+    },
+    "python.path-join-does-not-contain-a-path": {
+      "true": 0,
+      "false": 4
+    }
+  },
+  "classes": {
+    "validates-caller-data": 6,
+    "internal-invariant": 3,
+    "odoo-monetary-is-float": 3,
+    "matched-inside-a-docstring": 2,
+    "display-only": 8,
+    "naive-utc-across-an-api-boundary": 2,
+    "local-now-against-an-orm-datetime": 5,
+    "local-now-into-an-orm-datetime": 9,
+    "local-date-as-an-api-default": 2,
+    "self-consistent-utc": 2,
+    "local-time-labelled-as-utc": 1,
+    "no-user-supplied-component": 4,
+    "re-enforced-on-the-next-line": 1,
+    "local-date-against-an-orm-date": 1,
+    "self-consistent-local": 1
+  },
+  "hits": [
+    {
+      "rule": "python.assert-is-not-validation",
+      "tree": "OpenSPP2-19.0",
+      "path": "endpoint_route_handler/registry.py",
+      "line": 314,
+      "verdict": "true",
+      "class": "validates-caller-data",
+      "why": "options come back off a jsonb row in from_row(), so this asserts about stored data rather than a program invariant; under -O a malformed handler dict is accepted silently",
+      "evidence": "assert \"klass_dotted_path\" in value[\"handler\"]"
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "tree": "OpenSPP2-19.0",
+      "path": "endpoint_route_handler/registry.py",
+      "line": 315,
+      "verdict": "true",
+      "class": "validates-caller-data",
+      "why": "same setter, same stored data, second key",
+      "evidence": "assert \"method_name\" in value[\"handler\"]"
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_registry/models/reg_relationship.py",
+      "line": 165,
+      "verdict": "false",
+      "class": "internal-invariant",
+      "why": "_check_partner is called from two @api.constrains with the literal 'source' and 'destination'; the assert is impossible unless the module itself is broken, which is what assert is for",
+      "evidence": "assert side in [\"source\", \"destination\"]"
+    },
+    {
+      "rule": "python.decimal-for-money-not-float",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_programs/models/cel/entitlement_amount_cel.py",
+      "line": 300,
+      "verdict": "false",
+      "class": "odoo-monetary-is-float",
+      "why": "self.amount is a Monetary field, which the ORM defines AS a float; the rule's remedy (Decimal) is not the Odoo idiom and float_round/float_compare are",
+      "evidence": "\"base_amount\": float(self.amount or 0.0),"
+    },
+    {
+      "rule": "python.decimal-for-money-not-float",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_programs/models/cel/entitlement_amount_cel.py",
+      "line": 316,
+      "verdict": "false",
+      "class": "odoo-monetary-is-float",
+      "why": "the CEL result is coerced for a Monetary field; same reason",
+      "evidence": "amount = float(result)"
+    },
+    {
+      "rule": "python.eval-and-pickle-execute-their-input",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_cel_domain/models/cel_service.py",
+      "line": 417,
+      "verdict": "false",
+      "class": "matched-inside-a-docstring",
+      "why": "the text is prose in a method docstring -- 'more robust and secure than regex-based conversion to Python eval()' -- and there is no eval call here at all",
+      "evidence": "and secure than regex-based conversion to Python eval()."
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "scripts/compliance/checker.py",
+      "line": 745,
+      "verdict": "false",
+      "class": "display-only",
+      "why": "a Generated: line in a markdown report; formatted once, never compared",
+      "evidence": "f\"**Generated:** {__import__('datetime').datetime.now().isoformat()}\","
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "scripts/compliance/checker.py",
+      "line": 813,
+      "verdict": "false",
+      "class": "display-only",
+      "why": "the same timestamp in the JSON version of that report",
+      "evidence": "\"generated\": __import__(\"datetime\").datetime.now().isoformat(),"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_analytics/models/service_aggregation.py",
+      "line": 97,
+      "verdict": "false",
+      "class": "display-only",
+      "why": "computed_at in a result dict that is returned, not stored or compared",
+      "evidence": "\"computed_at\": datetime.now().isoformat(),"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_api_v2/routers/consent.py",
+      "line": 178,
+      "verdict": "true",
+      "class": "naive-utc-across-an-api-boundary",
+      "why": "datetime.utcnow() is naive, is returned in a ConsentRevokeResponse, and serialises with no offset, so the consumer cannot tell the zone; deprecated in 3.12 for this reason",
+      "evidence": "revoked_at=datetime.utcnow(),"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_api_v2/routers/consent.py",
+      "line": 270,
+      "verdict": "true",
+      "class": "naive-utc-across-an-api-boundary",
+      "why": "the consent receipt timestamp, same construct. SUPPRESSED, and wrongly: the marker inside that return statement reads 'nosemgrep: odoo-sudo-without-context' and is about a different rule",
+      "evidence": "timestamp=datetime.utcnow(),",
+      "suppressed": true
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_api_v2/routers/oauth.py",
+      "line": 217,
+      "verdict": "true",
+      "class": "naive-utc-across-an-api-boundary",
+      "why": "utcnow() feeds a JWT exp and iat; the lifetime is correct only because every value in the payload comes from the same naive call, and a later switch to datetime.now() would shift every token by the server's offset with nothing failing",
+      "evidence": "now = datetime.utcnow()"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_api_v2/services/group_service.py",
+      "line": 142,
+      "verdict": "true",
+      "class": "local-now-against-an-orm-datetime",
+      "why": "m.ended_date > now, where ended_date is an Odoo Datetime (naive UTC) and now is naive LOCAL -- membership filtering is off by the server's offset",
+      "evidence": "now = datetime.now()"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_api_v2/services/group_service.py",
+      "line": 748,
+      "verdict": "true",
+      "class": "local-now-into-an-orm-datetime",
+      "why": "datetime.now() is written straight into ended_date",
+      "evidence": "ended_datetime = datetime.now()"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_api_v2/services/group_service.py",
+      "line": 886,
+      "verdict": "true",
+      "class": "local-now-into-an-orm-datetime",
+      "why": "same write, in the group-merge path",
+      "evidence": "now = datetime.now()"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_api_v2/services/group_service.py",
+      "line": 1100,
+      "verdict": "true",
+      "class": "local-now-into-an-orm-datetime",
+      "why": "same write, moving members to a new group",
+      "evidence": "now = datetime.now()"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_attendance/controllers/controllers.py",
+      "line": 198,
+      "verdict": "true",
+      "class": "local-date-as-an-api-default",
+      "why": "the local date is the default for submitted_datetime on a controller endpoint; within the offset of midnight the attendance record carries the wrong day, which is the class OpenSPP has already fixed twice",
+      "evidence": "current_date = datetime.now().strftime(\"%Y-%m-%d\")"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_attendance/controllers/controllers.py",
+      "line": 351,
+      "verdict": "true",
+      "class": "local-date-as-an-api-default",
+      "why": "the same default on the second endpoint",
+      "evidence": "current_date = datetime.now().strftime(\"%Y-%m-%d\")"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_audit/models/spp_audit_backend.py",
+      "line": 198,
+      "verdict": "false",
+      "class": "self-consistent-utc",
+      "why": "utcnow() names an audit file and the rotation check compares it against a value from the same call; nothing aware is ever involved",
+      "evidence": "today = datetime.utcnow().strftime(\"%Y-%m-%d\")"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_audit/models/spp_audit_backend.py",
+      "line": 216,
+      "verdict": "false",
+      "class": "self-consistent-utc",
+      "why": "the same value, in the rotation check itself",
+      "evidence": "today = datetime.utcnow().strftime(\"%Y-%m-%d\")"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_cel_domain/services/cel_functions.py",
+      "line": 92,
+      "verdict": "true",
+      "class": "local-now-against-an-orm-datetime",
+      "why": "now() is exposed to CEL expressions that compare it against record datetimes read from the ORM, which are naive UTC",
+      "evidence": "return datetime.now()"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_cel_domain/services/cel_parser.py",
+      "line": 757,
+      "verdict": "false",
+      "class": "matched-inside-a-docstring",
+      "why": "a doctest example inside the docstring of hours_since, not code",
+      "evidence": ">>> two_hours_ago = datetime.now() - timedelta(hours=2)"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_cel_domain/services/cel_parser.py",
+      "line": 766,
+      "verdict": "true",
+      "class": "local-now-against-an-orm-datetime",
+      "why": "datetime.now() - datetime_value, where datetime_value arrives from an ORM field; hours_since is wrong by the offset and is used in eligibility expressions",
+      "evidence": "delta = datetime.now() - datetime_value"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_dci_server/middleware/rate_limit.py",
+      "line": 52,
+      "verdict": "true",
+      "class": "local-now-against-an-orm-datetime",
+      "why": "the rate limiter compares now against sender.last_request_minute, an ORM Datetime",
+      "evidence": "now = datetime.now()"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_encryption/models/encryption_provider.py",
+      "line": 110,
+      "verdict": "true",
+      "class": "local-time-labelled-as-utc",
+      "why": "f\"{datetime.now().isoformat(...)}Z\" appends a literal Z, which asserts UTC, to a LOCAL time, inside the created field of a linked-data cryptographic proof",
+      "evidence": "curr_datetime = f\"{datetime.now().isoformat(timespec='milliseconds')}Z\""
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_farmer_registry_demo/models/seeded_farm_generator.py",
+      "line": 1127,
+      "verdict": "true",
+      "class": "local-now-into-an-orm-datetime",
+      "why": "written by raw SQL into spp_program_membership.enrollment_date, which the ORM will read back as UTC",
+      "evidence": "enrollment_dt = datetime.datetime.now()"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_grm_demo/models/generate_tickets.py",
+      "line": 922,
+      "verdict": "true",
+      "class": "local-now-into-an-orm-datetime",
+      "why": "_random_date_in_range builds demo ticket dates from local now and they are stored on records",
+      "evidence": "now = datetime.now()"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_mis_demo_v2/models/mis_demo_generator.py",
+      "line": 3388,
+      "verdict": "false",
+      "class": "display-only",
+      "why": "strftime('%Y-%m') builds a period label",
+      "evidence": "current_period = datetime.datetime.now().strftime(\"%Y-%m\")"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_mis_demo_v2/models/mis_demo_generator.py",
+      "line": 3390,
+      "verdict": "false",
+      "class": "display-only",
+      "why": "the same label for the previous three months",
+      "evidence": "(datetime.datetime.now() - datetime.timedelta(days=30 * i)).strftime(\"%Y-%m\")"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_mis_demo_v2/models/mis_demo_generator.py",
+      "line": 3740,
+      "verdict": "true",
+      "class": "local-now-into-an-orm-datetime",
+      "why": "now and expires_at go onto a credential record and the expiry is compared against the current time later",
+      "evidence": "now = datetime.datetime.now()"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_mis_demo_v2/models/seeded_volume_generator.py",
+      "line": 406,
+      "verdict": "true",
+      "class": "local-now-into-an-orm-datetime",
+      "why": "the same raw-SQL enrollment_date write in the volume generator",
+      "evidence": "enrollment_dt = datetime.datetime.now()"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_programs/models/managers/program_manager.py",
+      "line": 141,
+      "verdict": "true",
+      "class": "local-now-into-an-orm-datetime",
+      "why": "datetime.now() becomes a cycle start date on spp.cycle",
+      "evidence": "new_cycle = cm.new_cycle(\"Cycle 1\", datetime.now(), 1)"
+    },
+    {
+      "rule": "python.path-join-does-not-contain-a-path",
+      "tree": "OpenSPP2-19.0",
+      "path": "spp_drims_sl_demo/wizard/drims_demo_generator.py",
+      "line": 486,
+      "verdict": "false",
+      "class": "no-user-supplied-component",
+      "why": "file_config['filename'] comes from a list of literals declared in the same function; there is nothing here a caller can point out of the directory",
+      "evidence": "file_path = os.path.join(data_path, file_config[\"filename\"])"
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "tree": "OCA",
+      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py",
+      "line": 265,
+      "verdict": "true",
+      "class": "validates-caller-data",
+      "why": "confirm_order() is a public method reachable over XML-RPC; under -O the operation-type guard is gone and the wrong record is confirmed",
+      "evidence": "assert self.operation_type == \"order\", \"Wrong operation type\""
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "tree": "OCA",
+      "path": "account-financial-tools/account_cash_deposit/wizards/account_cash_order_reception.py",
+      "line": 27,
+      "verdict": "true",
+      "class": "validates-caller-data",
+      "why": "the assert is about self._context, which the client supplies; under -O default_get proceeds with whatever active_model it was given",
+      "evidence": "assert self._context.get(\"active_model\") == \"account.cash.deposit\""
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "tree": "OCA",
+      "path": "account-financial-tools/account_dashboard_banner/models/account_dashboard_banner_cell.py",
+      "line": 289,
+      "verdict": "false",
+      "class": "internal-invariant",
+      "why": "sign is set by this module a few lines up and can only be 1 or -1 unless the module is broken",
+      "evidence": "assert sign in (1, -1)"
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "tree": "OCA",
+      "path": "account-financial-tools/account_move_template/wizard/account_move_template_run.py",
+      "line": 117,
+      "verdict": "true",
+      "class": "validates-caller-data",
+      "why": "self.overwrite is a text field a user types; the assert is the type check on literal_eval's result, and the except clause catches AssertionError explicitly -- this IS the validation, and under -O it disappears and .keys() raises AttributeError instead of the ValidationError the code means to raise",
+      "evidence": "assert isinstance(overwrite_vals, dict)"
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "tree": "OCA",
+      "path": "server-tools/base_time_parameter/models/base.py",
+      "line": 19,
+      "verdict": "true",
+      "class": "validates-caller-data",
+      "why": "get_time_parameter is public and date arrives from the caller, possibly resolved off a field by name; under -O a wrong type reaches the search",
+      "evidence": "assert type(date) is datetime.date or date is None, \"Wrong date\""
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "tree": "OCA",
+      "path": "server-tools/jsonifier/models/ir_exports_resolver.py",
+      "line": 42,
+      "verdict": "false",
+      "class": "re-enforced-on-the-next-line",
+      "why": "the assert guards a zip(..., strict=True) one line below, which raises ValueError on the same mismatch; removing the assert changes the exception type and nothing else",
+      "evidence": "assert len(param) == len(records)"
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "tree": "OCA",
+      "path": "server-tools/jsonifier/models/utils.py",
+      "line": 3,
+      "verdict": "false",
+      "class": "internal-invariant",
+      "why": "a module-private helper's contract with its only callers",
+      "evidence": "assert isinstance(parser, list)"
+    },
+    {
+      "rule": "python.decimal-for-money-not-float",
+      "tree": "OCA",
+      "path": "account-financial-tools/account_payroll_sheet_import/wizard/payroll_import_wizard.py",
+      "line": 110,
+      "verdict": "false",
+      "class": "odoo-monetary-is-float",
+      "why": "a spreadsheet cell becomes an accounting amount on a Monetary field, which the ORM defines as float",
+      "evidence": "amount = float(raw_value)"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OCA",
+      "path": "account-financial-tools/account_fiscal_year_auto_create/models/account_fiscal_year.py",
+      "line": 23,
+      "verdict": "true",
+      "class": "local-date-against-an-orm-date",
+      "why": "last_fiscal_year.date_to < datetime.now().date() in a cron: the ORM Date is UTC-based and now().date() is the server's LOCAL date, so the fiscal year is created on the wrong side of midnight on any non-UTC server. fields.Date.context_today is the idiom",
+      "evidence": "last_fiscal_year.date_to < datetime.now().date() + relativedelta(days=1)"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OCA",
+      "path": "account-financial-tools/purchase_unreconciled/models/account_move_line.py",
+      "line": 45,
+      "verdict": "true",
+      "class": "local-now-into-an-orm-datetime",
+      "why": "the default accounting date for an automatic writeoff move",
+      "evidence": "move_date = writeoff_vals.get(\"date\", datetime.now())"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OCA",
+      "path": "server-tools/auditlog/models/autovacuum.py",
+      "line": 25,
+      "verdict": "true",
+      "class": "local-now-against-an-orm-datetime",
+      "why": "deadline is built from local now and compared against create_date, which is UTC; the autovacuum cron deletes logs early or late by the server's offset",
+      "evidence": "deadline = datetime.now() - timedelta(days=days)"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OCA",
+      "path": "server-tools/auto_backup/models/db_backup.py",
+      "line": 146,
+      "verdict": "false",
+      "class": "display-only",
+      "why": "the timestamp names a backup file",
+      "evidence": "filename = self.filename(datetime.now(), ext=rec.backup_format)"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OCA",
+      "path": "server-tools/auto_backup/models/db_backup.py",
+      "line": 171,
+      "verdict": "false",
+      "class": "display-only",
+      "why": "the same, on the sftp path",
+      "evidence": "filename = self.filename(datetime.now(), ext=rec.backup_format)"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OCA",
+      "path": "server-tools/auto_backup/models/db_backup.py",
+      "line": 218,
+      "verdict": "false",
+      "class": "self-consistent-local",
+      "why": "cleanup() builds the oldest filename from the same local clock the filenames were written with, so the two agree",
+      "evidence": "now = datetime.now()"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "tree": "OCA",
+      "path": "server-tools/excel_import_export/models/xlsx_export.py",
+      "line": 268,
+      "verdict": "false",
+      "class": "display-only",
+      "why": "a temp filename uniquifier",
+      "evidence": "stamp = dt.utcnow().strftime(\"%H%M%S%f\")[:-3]"
+    },
+    {
+      "rule": "python.path-join-does-not-contain-a-path",
+      "tree": "OCA",
+      "path": "server-tools/auto_backup/models/db_backup.py",
+      "line": 154,
+      "verdict": "false",
+      "class": "no-user-supplied-component",
+      "why": "rec.folder is configuration and filename is generated from a timestamp; neither is a path a caller can traverse with",
+      "evidence": "with open(os.path.join(rec.folder, filename), \"wb\") as destiny:"
+    },
+    {
+      "rule": "python.path-join-does-not-contain-a-path",
+      "tree": "OCA",
+      "path": "server-tools/auto_backup/models/db_backup.py",
+      "line": 186,
+      "verdict": "false",
+      "class": "no-user-supplied-component",
+      "why": "the same join on the sftp path",
+      "evidence": "os.path.join(rec.folder, filename), \"wb\""
+    },
+    {
+      "rule": "python.path-join-does-not-contain-a-path",
+      "tree": "OCA",
+      "path": "server-tools/upgrade_analysis/models/upgrade_analysis.py",
+      "line": 106,
+      "verdict": "false",
+      "class": "no-user-supplied-component",
+      "why": "full_path is built from get_module_path and filename is internal",
+      "evidence": "logfile = os.path.join(full_path, filename)"
+    }
+  ],
+  "note": "Every finding the composition ADDS to an Odoo review, read by hand in its own file. These 8 rules were previously unreachable from the odoo stack: selection was strict equality on the stack field, so an Odoo module got the 19 ORM rules and none of these.\n\nThe verdict test for the datetime rule, which is 32 of the 50: an Odoo Datetime field is naive UTC by contract, so a naive LOCAL datetime that reaches one -- written to it, compared against it, or handed to something that does -- is a true positive, and one that is only formatted for display or used to name a file is not. Note what that makes these: latent on a server clocked to UTC, wrong by the offset on any other. OpenSPP's own history carries two fixes of exactly this class, which is why it is graded true rather than theoretical.\n\nThree rules fired and were never right: decimal-for-money-not-float (0 of 3), path-join-does-not-contain-a-path (0 of 4), and eval-and-pickle-execute-their-input (0 of 1). The first has a reason rather than a sample size behind it -- Odoo's Monetary field IS a float, so the rule's remedy is not the Odoo idiom -- and the other two have four findings between them, which is not enough to conclude anything about a checker. All three are named in the README rather than quietly dropped.\n\nThree more never fired at all on either tree: mutable-default-argument, bare-except-catches-the-exit and subprocess-shell-true-is-injection. Silence is not a pass.\n\nTwo of the 50 are the same checker defect: the pattern scanner strips # comments before matching and does not strip docstrings, so `eval()` named in prose and a `datetime.now()` inside a doctest both read as code. That is a fault in scan_source, not in either rule.\n\nOne finding is suppressed and should not be. The consent-receipt timestamp sits inside a return statement that carries a `# nosemgrep: odoo-sudo-without-context` marker four lines below it, and suppression reads any marker in the statement without asking which rule it names. It is counted apart here, as fieldtest counts it."
+}

corpus/build_corpus.py

@@ -1,8 +1,15 @@
-"""Generates the validation rule corpus JSON files from the definitions below.
+"""Generates the validation rule corpus JSON from the definitions below.
 
 The corpus is the single source of truth. System prompts and the RAG index are
 both DERIVED from it (corpus.py prompt / corpus.py index) so they cannot drift.
 
+ONE corpus, one stack, and everything in it is for reviewing Odoo code. Two
+lists feed it: ODOO, the ORM rules, and PYTHON, plain-Python rules that apply
+because an Odoo module is a Python module. Both are written to odoo.json and
+both carry stack "odoo". The `python.` id prefix is provenance -- where the
+rule came from and which documentation check_sources verifies it against --
+and not a second mode anybody can select. There is no second mode.
+
 Edit the rules here, then:  python build_corpus.py && python ../bin/corpus.py validate
 """
 import io
@@ -21,15 +28,16 @@ import evidence          # noqa: E402  -- one hashing implementation, not two
 # must be one list, not one here and another in the validator.
 from corpus import ADVISORY_LIKELIHOODS, LIKELIHOOD_DEFAULT  # noqa: E402
 
-# The upstream documentation version each stack's rules were read against.
+# The upstream documentation version each set of rules was read against. Two
+# entries under one stack: the ORM rules are read against an Odoo series, the
+# composed-in Python rules against a language version.
+#
 # Recorded rather than assumed: a rule verified on 18.0 is not thereby
 # verified on 16.0, and the context layer needs to be able to say so when it
 # meets a module pinned to another series.
 CHECKED_AGAINST = {
     "odoo": "18.0",
     "python": "3.12",
-    "typescript": "5.x",
-    "javascript": "ES2023",
 }
 
 ODOO = [
@@ -443,273 +451,6 @@ except UserError as exc:
 },
 ]
 
-TYPESCRIPT = [
-{
- "id": "typescript.types-are-erased-at-runtime",
- "severity": "critical",
- "title": "Static types guarantee nothing about external data",
- "rule": "Every value crossing a boundary must be parsed by a runtime schema. A type assertion on external data is a lie the compiler cannot catch.",
- "why": "Interfaces and type annotations are erased during compilation. Casting an API response with 'as User' produces zero runtime checks, so a changed or malformed payload propagates as undefined deep inside unrelated code, far from its origin.",
- "enforcement_layer": "runtime-parse",
- "bypassed_by": ["type assertions (as T)", "any", "unchecked JSON.parse"],
- "wrong": """const user = await res.json() as User;""",
- "correct": """const UserSchema = z.object({ id: z.number(), name: z.string() });
-type User = z.infer<typeof UserSchema>;
-
-const user = UserSchema.parse(await res.json());""",
- "tags": ["zod", "boundary", "type-erasure"],
-},
-{
- "id": "typescript.derive-type-from-schema",
- "severity": "high",
- "title": "Derive the type from the schema, never maintain both",
- "rule": "Write the schema first and derive the static type with z.infer. Never hand-write an interface alongside a schema for the same data.",
- "why": "Two hand-maintained definitions drift. The compiler cannot detect the drift because each is internally consistent, so the type says one thing while the parser enforces another and the mismatch only appears at runtime.",
- "enforcement_layer": "compile-time",
- "bypassed_by": [],
- "wrong": """interface Order { id: number; total: number; }
-const OrderSchema = z.object({ id: z.number(), total: z.number(), currency: z.string() });""",
- "correct": """const OrderSchema = z.object({
-  id: z.number(),
-  total: z.number(),
-  currency: z.string(),
-});
-type Order = z.infer<typeof OrderSchema>;""",
- "tags": ["zod", "single-source-of-truth", "drift"],
-},
-{
- "id": "typescript.odoo-returns-false-for-every-empty-field",
- "severity": "critical",
- "title": "Odoo JSON-RPC returns false for every empty field",
- "rule": "Model every optional Odoo scalar as a union with literal false, normalised through one shared helper. This applies to Char, Text, Date, Datetime, Binary and Many2one alike, not only to relations.",
- "why": "Odoo returns boolean false for any empty value, never null, never an empty string. Typing an optional email as string().nullable() throws at the parse boundary the first time a partner has no email, which is ordinary production data rather than an edge case.",
- "enforcement_layer": "runtime-parse",
- "bypassed_by": [],
- "wrong": """const PartnerSchema = z.object({
-  email: z.string().nullable(),
-  parent_id: z.array(z.number()),
-});""",
- "correct": """const odooNullable = <T extends z.ZodTypeAny>(inner: T) =>
-  z.union([inner, z.literal(false)]).transform((v) => (v === false ? null : v));
-
-const PartnerSchema = z.object({
-  id: z.number().int(),
-  name: z.string(),
-  email: odooNullable(z.string().email()),
-  parent_id: odooNullable(z.tuple([z.number().int(), z.string()])),
-});""",
- "tags": ["odoo", "json-rpc", "boundary", "zod"],
- # .nullable() on an Odoo scalar means the author forgot that empty comes back as false.
- "violation_pattern": r"z\.(?:string|number|date|coerce)[^\n]*\.nullable\(\)",
- "satisfied_pattern": r"odooNullable|z\.literal\(false\)",
-},
-{
- "id": "typescript.odoo-many2one-is-a-tuple",
- "severity": "high",
- "title": "A set Many2one is a two-element tuple, not an array of ids",
- "rule": "Model a populated Many2one as z.tuple([z.number(), z.string()]) holding id and display_name. Model an empty one as false.",
- "why": "Odoo read() returns [id, display_name] for a set Many2one. Typing it as an array of numbers parses the id but discards display_name and fails the moment the schema meets real data, because element one is a string.",
- "enforcement_layer": "runtime-parse",
- "bypassed_by": [],
- "wrong": """parent_id: z.array(z.number())""",
- "correct": """parent_id: odooNullable(z.tuple([z.number().int(), z.string()]))""",
- "tags": ["odoo", "json-rpc", "many2one"],
-},
-{
- "id": "typescript.odoo-read-returns-an-array",
- "severity": "medium",
- "title": "Odoo read returns an array even for one id",
- "rule": "Parse the response of read() with z.array(Schema) and index into it, rather than parsing it as a single object.",
- "why": "read() always returns a list of dictionaries. Parsing it directly against an object schema fails, and defensively coercing with Array.isArray hides whether the call actually returned the record or an empty list for a missing id.",
- "enforcement_layer": "runtime-parse",
- "bypassed_by": [],
- "wrong": """const partner = PartnerSchema.parse(await callOdoo('res.partner', 'read', [id]));""",
- "correct": """const rows = z.array(PartnerSchema).parse(
-  await callOdoo('res.partner', 'read', [id]),
-);
-if (rows.length === 0) throw new Error(`res.partner ${id} not found or not readable`);
-const partner = rows[0];""",
- "tags": ["odoo", "json-rpc", "read"],
-},
-{
- "id": "typescript.unknown-not-any-at-boundaries",
- "severity": "high",
- "title": "Use unknown at boundaries, never any",
- "rule": "Type every value that arrives unparsed as unknown: the body of an incoming webhook, a request payload, a handler parameter, the result of JSON.parse, anything from an untyped import. Reserve any for nothing.",
- "why": "any silently disables checking for every expression derived from it, so one any on a webhook handler's payload removes type safety from the whole call chain downstream, and the compiler reports nothing. unknown refuses every use until the value has been parsed or narrowed, which is the behaviour that was wanted from the annotation in the first place.",
- "enforcement_layer": "compile-time",
- "bypassed_by": ["explicit any", "implicit any from untyped imports"],
- "wrong": """function handle(payload: any) { return payload.order.total; }""",
- "correct": """function handle(payload: unknown) {
-  const { order } = WebhookSchema.parse(payload);
-  return order.total;
-}""",
- "tags": ["any", "unknown", "boundary", "webhook", "payload", "request-body",
-          "handler", "external-input"],
-},
-{
- "id": "typescript.safeparse-when-failure-is-expected",
- "severity": "medium",
- "title": "Choose parse or safeParse deliberately",
- "rule": "Use safeParse where a malformed value is expected and recoverable; use parse only where throwing is the correct response. State which and why.",
- "why": "parse throws a ZodError that an unprepared caller turns into a 500 and an opaque stack trace. safeParse returns a discriminated result carrying the field-level issues, which is what a user-facing error or a per-row import skip actually needs.",
- "enforcement_layer": "runtime-parse",
- "bypassed_by": [],
- "wrong": """const row = RowSchema.parse(csvRow); // aborts the whole import on row 4000""",
- "correct": """const result = RowSchema.safeParse(csvRow);
-if (!result.success) {
-  errors.push({ line, issues: result.error.issues });
-  continue;
-}
-const row = result.data;""",
- "tags": ["zod", "error-handling"],
-},
-{
- "id": "typescript.validate-env-at-startup",
- "severity": "high",
- "title": "Parse environment variables once at startup",
- "rule": "Validate the whole environment against a schema at process start and export the parsed object. Never read process.env deep inside application code.",
- "why": "process.env values are string or undefined and are unchecked. A missing variable read lazily inside a rarely-exercised branch fails in production at the worst moment, whereas a startup parse turns the same fault into a deployment that refuses to boot.",
- "enforcement_layer": "startup",
- "bypassed_by": [],
- "wrong": """const url = process.env.ODOO_URL; // string | undefined, used 40 files away""",
- "correct": """const EnvSchema = z.object({
-  ODOO_URL: z.string().url(),
-  ODOO_DB: z.string().min(1),
-  PORT: z.coerce.number().int().positive().default(3000),
-});
-export const env = EnvSchema.parse(process.env);""",
- "tags": ["config", "startup", "fail-fast"],
-},
-{
- "id": "typescript.discriminated-union-for-variants",
- "severity": "medium",
- "title": "Use discriminatedUnion for tagged variant payloads",
- "rule": "When a payload has a literal tag field selecting its shape, use z.discriminatedUnion on that field rather than z.union.",
- "why": "A plain union tries every member and reports the failure of all of them, producing an unreadable error and slower parsing. discriminatedUnion selects the branch by tag, reports issues only for the intended shape, and narrows correctly in TypeScript afterwards.",
- "enforcement_layer": "runtime-parse",
- "bypassed_by": [],
- "wrong": """z.union([PaymentSucceeded, PaymentFailed, PaymentPending])""",
- "correct": """z.discriminatedUnion('status', [
-  z.object({ status: z.literal('succeeded'), chargeId: z.string() }),
-  z.object({ status: z.literal('failed'), reason: z.string() }),
-  z.object({ status: z.literal('pending') }),
-])""",
- "tags": ["zod", "unions", "narrowing"],
-},
-{
- "id": "typescript.brand-validated-primitives",
- "severity": "medium",
- "title": "Brand validated primitives so they cannot be swapped for raw ones",
- "rule": "Give checked primitives a branded type so a validated value is not assignable from an arbitrary string or number.",
- "why": "Without branding, every string is assignable to every string-typed parameter, so a raw user input can be passed where a validated email or a trusted id is required and the compiler accepts it. Branding makes that a compile error.",
- "enforcement_layer": "compile-time",
- "bypassed_by": ["casting through as"],
- "wrong": """function send(to: string) { /* any string at all */ }""",
- "correct": """const Email = z.string().email().brand<'Email'>();
-type Email = z.infer<typeof Email>;
-
-function send(to: Email) { /* only a parsed Email */ }""",
- "tags": ["branding", "nominal-typing"],
-},
-]
-
-JAVASCRIPT = [
-{
- "id": "javascript.json-parse-returns-any",
- "severity": "critical",
- "title": "JSON.parse output is unchecked",
- "rule": "Never use the result of JSON.parse directly. Pass it through a schema or an explicit shape check first.",
- "why": "JSON.parse succeeds for any syntactically valid JSON, including null, a bare number, or an object missing every field you expect. Property access then yields undefined, which propagates through arithmetic as NaN and through templates as the literal string undefined.",
- "enforcement_layer": "runtime-parse",
- "bypassed_by": [],
- "wrong": """const cfg = JSON.parse(raw);
-startServer(cfg.port);""",
- "correct": """const cfg = ConfigSchema.parse(JSON.parse(raw));
-startServer(cfg.port);""",
- "tags": ["json", "boundary"],
-},
-{
- "id": "javascript.loose-equality-and-falsy-defaults",
- "severity": "high",
- "title": "Falsy defaults discard legitimate zero and empty string",
- "rule": "Use the nullish coalescing operator for defaults and strict equality for comparisons. Reserve the logical OR operator for genuine boolean logic.",
- "why": "The OR operator treats 0, empty string and false as absent, so a quantity of 0 or an intentionally blank note is silently replaced by the default. This is the most common way a validated value is destroyed after it has passed validation.",
- "enforcement_layer": "runtime-parse",
- "bypassed_by": [],
- "wrong": """const qty = input.qty || 1;        // qty of 0 becomes 1
-if (status == null) { }            // also matches undefined by design, but == elsewhere surprises""",
- "correct": """const qty = input.qty ?? 1;        // only null or undefined fall back
-if (status === null || status === undefined) { }""",
- "tags": ["coercion", "defaults", "silent-failure"],
-},
-{
- "id": "javascript.number-parsing-is-lossy",
- "severity": "high",
- "title": "Coercing user input to a number accepts nonsense",
- "rule": "Validate numeric input with an explicit check for finiteness rather than relying on Number, parseInt or the unary plus.",
- "why": "parseInt('12abc') returns 12, Number('') returns 0, and Number(' ') returns 0 as well. Each converts invalid input into a plausible number that passes every downstream check and corrupts totals rather than raising an error.",
- "enforcement_layer": "runtime-parse",
- "bypassed_by": [],
- "wrong": """const qty = parseInt(req.body.qty);""",
- "correct": """const qty = Number(req.body.qty);
-if (!Number.isFinite(qty) || !Number.isInteger(qty) || qty <= 0) {
-  throw new Error(`qty must be a positive integer, received: ${req.body.qty}`);
-}""",
- "tags": ["numbers", "coercion", "input"],
-},
-{
- "id": "javascript.async-errors-need-explicit-handling",
- "severity": "critical",
- "title": "A rejected promise in a callback is not caught by the surrounding try",
- "rule": "Await every promise you create, or attach a catch to it. Never pass an async function where a synchronous callback is expected.",
- "why": "An async callback passed to forEach or to an event emitter returns a promise nobody holds. A rejection inside it escapes the enclosing try/catch entirely and becomes an unhandled rejection, which terminates the process on modern Node and silently skips work before that.",
- "enforcement_layer": "runtime-parse",
- "bypassed_by": [],
- "wrong": """rows.forEach(async (row) => {
-  await save(row);        // rejections escape, loop does not wait
-});""",
- "correct": """await Promise.all(rows.map((row) => save(row)));
-// or, when order and back-pressure matter:
-for (const row of rows) {
-  await save(row);
-}""",
- "tags": ["async", "promises", "error-handling"],
-},
-{
- "id": "javascript.object-injection-via-user-keys",
- "severity": "critical",
- "title": "Never index an object with an unvalidated user-supplied key",
- "rule": "Check a user-supplied key against an allowlist, or use a Map, before using it to read or write a property.",
- "why": "A key of __proto__ or constructor reaches the prototype chain. Writing through it pollutes every object in the process, which turns a validation gap into remote code execution in the worst case and into corrupted defaults everywhere in the mildest.",
- "enforcement_layer": "runtime-parse",
- "bypassed_by": [],
- "wrong": """target[req.body.key] = req.body.value;""",
- "correct": """const ALLOWED = new Set(['name', 'email', 'phone']);
-if (!ALLOWED.has(req.body.key)) {
-  throw new Error(`Unsupported field: ${req.body.key}`);
-}
-target[req.body.key] = req.body.value;""",
- "tags": ["security", "prototype-pollution", "input"],
-},
-{
- "id": "javascript.date-parsing-is-implementation-defined",
- "severity": "medium",
- "title": "The Date constructor accepts ambiguous strings",
- "rule": "Parse dates from an explicit ISO-8601 string and reject anything that produces an invalid date. Never feed arbitrary user text to new Date.",
- "why": "new Date('01/02/2026') is January the second in one locale's reading and the second of January in another, and non-ISO formats are implementation-defined across engines. new Date('nonsense') returns an Invalid Date object rather than throwing, so the failure travels onward as NaN.",
- "enforcement_layer": "runtime-parse",
- "bypassed_by": [],
- "wrong": """const when = new Date(req.body.date);""",
- "correct": """const when = new Date(req.body.date);
-if (Number.isNaN(when.getTime())) {
-  throw new Error(`Invalid date: ${req.body.date}`);
-}""",
- "tags": ["dates", "coercion", "locale"],
-},
-]
-
-
 PYTHON = [
 {
  "id": "python.assert-is-not-validation",
@@ -869,8 +610,6 @@ ODOO_ONCHANGE = "https://www.odoo.com/documentation/18.0/developer/tutorials/ser
 # page does, and says the thing the rule says.
 ODOO_GUIDELINES = "https://www.odoo.com/documentation/18.0/contributing/development/coding_guidelines.html"
 PG_CREATE_TABLE = "https://www.postgresql.org/docs/current/ddl-constraints.html"
-# The Zod API reference, not the homepage. Four rules cited zod.dev/, which
-# supports nothing: a landing page is not provenance.
 PY_DOCS = "https://docs.python.org/3"
 PY_ASSERT = PY_DOCS + "/reference/simple_stmts.html#the-assert-statement"
 PY_DEFAULTS = PY_DOCS + "/tutorial/controlflow.html#default-argument-values"
@@ -881,11 +620,6 @@ PY_OSPATH = PY_DOCS + "/library/os.path.html#os.path.join"
 PY_DECIMAL = PY_DOCS + "/library/decimal.html"
 PY_DATETIME = PY_DOCS + "/library/datetime.html"
 
-ZOD = "https://zod.dev/api"
-TS_HANDBOOK = "https://www.typescriptlang.org/docs/handbook/2/everyday-types.html"
-NODE_PROCESS = "https://nodejs.org/api/process.html"
-MDN = "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference"
-
 ENRICH = {
     # ---- Odoo -------------------------------------------------------------
     # Both decorators are specified on the ORM reference page, which is where the
@@ -1038,53 +772,34 @@ ENRICH = {
         "source": ODOO_ORM,
     },
 
-    # ---- TypeScript -------------------------------------------------------
-    "typescript.types-are-erased-at-runtime": {
-        "violation_pattern": r"\.json\(\)\s+as\s+\w+|as\s+unknown\s+as\s+\w+",
-        # Type erasure is a TypeScript fact. Zod is one answer to it, not the
-        # thing that documents it.
-        "source": TS_HANDBOOK,
-    },
-    "typescript.derive-type-from-schema": {
-        "violation_pattern": r"interface\s+\w+\s*\{[\s\S]*?\}[\s\S]*?z\.object\(",
-        "source": ZOD,
-    },
-    "typescript.odoo-returns-false-for-every-empty-field": {
-        "violation_pattern": r"z\.(?:string|number|date|coerce)[^\n]*\.nullable\(\)",
-        "satisfied_pattern": r"odooNullable|z\.literal\(false\)",
-        # What comes back over JSON-RPC is the External API's subject, not the
-        # ORM reference's.
-        "source": ODOO_EXTERNAL_API,
-    },
-    "typescript.odoo-many2one-is-a-tuple": {
-        "violation_pattern": r"_id\s*:\s*(?:\w+\()?z\.array\(\s*z\.number",
-        "source": ODOO_EXTERNAL_API,
-    },
-    "typescript.odoo-read-returns-an-array": {
-        # Must be an Odoo read() call specifically. Without this the pattern fired
-        # on any Schema.parse(await ...), including correct non-Odoo fetch parsing.
-        "violation_pattern": r"\w+Schema\.(?:safe)?[Pp]arse\(\s*await[^)]*(?:callOdoo|jsonrpc|'read'|\"read\")",
-        "satisfied_pattern": r"z\.array\(",
-        "source": ODOO_EXTERNAL_API,
-    },
-    "typescript.unknown-not-any-at-boundaries": {
-        "violation_pattern": r":\s*any\b",
-        "source": "https://www.typescriptlang.org/docs/handbook/2/everyday-types.html",
-    },
-    "typescript.validate-env-at-startup": {
-        "violation_pattern": r"process\.env\.[A-Z][A-Z0-9_]*",
-        # The claim is about process.env being string | undefined, which is
-        # Node's documentation, not Zod's.
-        "source": NODE_PROCESS,
-    },
-    "typescript.discriminated-union-for-variants": {
-        "violation_pattern": r"z\.union\(\[\s*[A-Z]",
-        "satisfied_pattern": r"z\.discriminatedUnion",
-        "source": ZOD,
-    },
-
     # ---- Python -----------------------------------------------------------
+    #
+    # These eight are selected for the Odoo stack, and were measured there for
+    # the first time on 2026-09-16: 50 findings across OpenSPP (226,937 lines)
+    # and OCA (33,960), every one read in its own file. 26 true, 24 false.
+    # Verdicts and reasons are in classification-python-2026-09.json; the
+    # per-rule result is written under each rule below, including the three
+    # that fired and were never right and the three that never fired at all.
+    #
+    # One test decides most of it, so it is stated once. An Odoo Datetime field
+    # is naive UTC by contract. A naive LOCAL datetime that reaches one --
+    # written to it, compared against it, or handed to something that does --
+    # is the defect. One that is only formatted for display or used to name a
+    # file is not, and eight of the twelve false positives are that.
     "python.assert-is-not-validation": {
+        # 6 true, 4 false on the two trees. True where the asserted value comes
+        # from outside the module -- a jsonb row, self._context, a public
+        # method's argument, a user-typed field parsed with literal_eval. False
+        # in three shapes, and they are worth naming because a narrowing would
+        # have to recognise them: an invariant the module's own callers cannot
+        # break (a helper called with two literals), a private helper's contract
+        # with its only caller, and an assert whose condition the NEXT line
+        # re-enforces anyway (a zip with strict=True).
+        #
+        # Not narrowed on that. Telling the three apart from the six needs to
+        # know where a value came from, which is the same assignment-tracing
+        # pass float-comparison is waiting on, and guessing at it from the
+        # variable's name is what made the sudo rule 5.8%.
         # Lookbehind, not a consumed newline. The match's start is what
         # scan_source turns into a line number, so a pattern that begins
         # by eating the PRECEDING newline reported the line above the
@@ -1093,24 +808,48 @@ ENRICH = {
         "source": PY_ASSERT,
     },
     "python.mutable-default-argument": {
+        # Fired on neither tree. Silence is not a pass: it says these 260,000
+        # lines contain no mutable default, which is also what a broken checker
+        # says. ruff's B006 is selected in OpenSPP's own .ruff.toml, which is
+        # the more likely explanation.
         "violation_pattern": r"def\s+\w+\([^)]*=\s*(?:\[\]|\{\}|set\(\))",
         "source": PY_DEFAULTS,
     },
     "python.bare-except-catches-the-exit": {
+        # Fired on neither tree, and E722 is on by default in ruff, so a repo
+        # running ruff at all has none of these left to find.
+        #
         # A bare except and nothing else: `except (KeyError,) as exc:` has text
         # between the keyword and the colon and is not matched.
         "violation_pattern": r"except\s*:",
         "source": PY_ERRORS,
     },
     "python.eval-and-pickle-execute-their-input": {
+        # 0 true, 1 false. The one finding is the word eval() written in a
+        # method's DOCSTRING, in a sentence arguing against using it. That is
+        # not this rule's fault: scan_source strips # comments before matching
+        # and does not strip string literals, so prose in a docstring is
+        # matched as code. One sample decides nothing about the rule, and the
+        # checker defect it exposes is named in the README.
         "violation_pattern": r"\beval\(|\bexec\(|pickle\.loads?\(",
         "source": PY_PICKLE,
     },
     "python.subprocess-shell-true-is-injection": {
+        # Fired on neither tree. Worth keeping on that evidence rather than in
+        # spite of it: ruff's S602 covers it and neither repo selects S, so the
+        # silence here is a fact about the code and not about the coverage.
         "violation_pattern": r"shell\s*=\s*True|os\.system\(|os\.popen\(",
         "source": PY_SUBPROCESS,
     },
     "python.path-join-does-not-contain-a-path": {
+        # 0 true, 4 false. All four join a configured directory to a name this
+        # module generated -- a timestamped backup filename, a literal from a
+        # list declared in the same function, a module path from
+        # get_module_path. The name-matching is what fires: `filename` is in
+        # the alternation and says nothing about where the value came from.
+        # Four findings is not enough to conclude a checker is wrong, so it is
+        # reported here rather than acted on.
+        #
         # Word-anchored. Unanchored, `form` matched inside `.format(`, so
         # every os.path.join(..., "x {0}".format(y)) in a codebase was a hit.
         "violation_pattern": (r"os\.path\.join\([^)]*"
@@ -1123,6 +862,15 @@ ENRICH = {
         "source": PY_OSPATH,
     },
     "python.decimal-for-money-not-float": {
+        # 0 true, 3 false, and this one has a reason behind it rather than a
+        # sample size. Odoo's Monetary field IS a float -- the ORM defines it
+        # that way -- and the framework's answer to the precision problem is
+        # float_round and float_compare against the currency's rounding, not
+        # Decimal. So inside an Odoo module the rule fires on the idiom and its
+        # remedy cannot be taken. That is an argument, not a measurement, and
+        # three findings do not settle it either way; it is written down in the
+        # README as the composition's open question rather than acted on here.
+        #
         # Money, not arithmetic. A bare \bfloat\( caught `float(successes) /
         # total` inside a Wilson score interval, which is exactly what binary
         # floating point is for. The name has to say it is an amount.
@@ -1134,51 +882,27 @@ ENRICH = {
         "source": PY_DECIMAL,
     },
     "python.naive-and-aware-datetimes-do-not-compare": {
+        # 20 true, 12 false -- 32 of the 50 findings the composition adds, and
+        # the reason the composition is worth having at all. The true ones are
+        # a naive LOCAL datetime reaching an ORM Datetime: written to
+        # ended_date, compared against create_date in an autovacuum cron,
+        # subtracted from a field value in an eligibility expression, or
+        # labelled with a literal "Z" inside a cryptographic proof. On a server
+        # clocked to UTC every one of them is latent; on any other it is wrong
+        # by the offset, and OpenSPP's own history carries two fixes of exactly
+        # this class.
+        #
+        # The twelve false ones are one shape, near enough: a timestamp that is
+        # formatted and never compared -- a Generated: line in a report, a
+        # backup filename, a period label. A narrowing would have to see what
+        # happens to the value afterwards, which the regex cannot; two more are
+        # the docstring defect named above.
+        #
         # Empty parentheses specifically: datetime.now(timezone.utc) is the fix.
         "violation_pattern": r"datetime\.now\(\s*\)|utcnow\(\s*\)",
         "source": PY_DATETIME,
     },
 
-    # ---- JavaScript -------------------------------------------------------
-    "javascript.json-parse-returns-any": {
-        "violation_pattern": r"=\s*JSON\.parse\(",
-        "source": MDN + "/Global_Objects/JSON/parse",
-    },
-    "javascript.loose-equality-and-falsy-defaults": {
-        # A default that is ITSELF falsy destroys nothing: `x || 0` is 0
-        # when x is 0, and `x || ""` is "" when x is blank. The rule is
-        # about a legitimate value being REPLACED, and here there is no
-        # replacement to make. 31 of this rule's 69 hits on 9,641 lines of
-        # Odoo JS were that -- the largest single class, found the first
-        # time these seven rules were ever fired at code nobody wrote for
-        # them.
-        "violation_pattern": r"\w\s*\|\|\s*(?!0(?!\d|\.)|\"\"|'')(?:\d|['\"])",
-        "source": MDN + "/Operators/Nullish_coalescing",
-    },
-    "javascript.async-errors-need-explicit-handling": {
-        "violation_pattern": r"\.forEach\(\s*async",
-        "source": MDN + "/Statements/async_function",
-    },
-    "javascript.number-parsing-is-lossy": {
-        "violation_pattern": r"parseInt\(|parseFloat\(",
-        "satisfied_pattern": r"Number\.isFinite|Number\.isInteger",
-        "source": MDN + "/Global_Objects/parseInt",
-    },
-    "javascript.object-injection-via-user-keys": {
-        "violation_pattern": r"\w+\[\s*(?:req\.(?:body|query|params)|input|payload)\.\w+\s*\]\s*=",
-        # hasOwnProperty was dropped from this alternation deliberately. Bare
-        # obj.hasOwnProperty(key) is the prototype-unsafe spelling -- the method
-        # can be shadowed by the very key being probed -- and the token also
-        # matched any passing MENTION of it, including an answer arguing
-        # against its use. The two safe spellings are named explicitly instead.
-        "satisfied_pattern": r"ALLOWED|allowlist|\.has\(|Object\.hasOwn\(|Object\.prototype\.hasOwnProperty\.call|Object\.create\(null\)",
-        "source": MDN + "/Global_Objects/Object/proto",
-    },
-    "javascript.date-parsing-is-implementation-defined": {
-        "violation_pattern": r"new Date\(\s*(?:req|input|body|payload|row)\.",
-        "satisfied_pattern": r"Number\.isNaN|isNaN\(",
-        "source": MDN + "/Global_Objects/Date/Date",
-    },
 }
 
 # ----------------------------------------------------------------- LIKELIHOOD
@@ -1273,8 +997,15 @@ PROBES = {
         "comparing a price or a quantity to zero gives the wrong answer sometimes",
     "odoo.constrains-iterate-recordset":
         "expected singleton error when a batch import writes several records at once",
+    # Reworded 2026-09-16, and re-measured. The old probe was "stop anyone
+    # entering a negative quantity on a sale order line", which is the generic
+    # validation question every constraint rule in the corpus answers -- with
+    # 19 rules in the stack it still came back first, and with 27 it stopped
+    # coming back at all. The rule's own subject is narrower than that: a
+    # Python check that two concurrent transactions both pass. Nothing else
+    # here is about a race.
     "odoo.prefer-sql-constraint":
-        "stop anyone entering a negative quantity on a sale order line",
+        "should this check be a database constraint or an api.constrains method",
     "odoo.check-constraint-cannot-cross-tables":
         "my CHECK constraint will not install because it reads the product stock",
     "odoo.check-company-on-relations":
@@ -1302,28 +1033,6 @@ PROBES = {
     "odoo.except-order-follows-the-hierarchy":
         "my except AccessError block never runs and the API returns 409",
 
-    # ---- TypeScript -------------------------------------------------------
-    "typescript.types-are-erased-at-runtime":
-        "cast the JSON from an API response to my interface",
-    "typescript.derive-type-from-schema":
-        "keep my interface and my validation schema from drifting apart",
-    "typescript.odoo-returns-false-for-every-empty-field":
-        "parsing fails because Odoo sent false for a partner with no email",
-    "typescript.odoo-many2one-is-a-tuple":
-        "read the parent company name off a many2one field from Odoo",
-    "typescript.odoo-read-returns-an-array":
-        "parse the result of an Odoo read call for a single id",
-    "typescript.unknown-not-any-at-boundaries":
-        "what type should the payload of an incoming webhook handler have",
-    "typescript.safeparse-when-failure-is-expected":
-        "skip the bad rows in a CSV import instead of aborting the whole file",
-    "typescript.validate-env-at-startup":
-        "make sure the required environment variables are set before the app runs",
-    "typescript.discriminated-union-for-variants":
-        "parse a webhook whose body shape depends on a status field",
-    "typescript.brand-validated-primitives":
-        "stop a raw string being passed where a checked email address is required",
-
     # ---- Python -----------------------------------------------------------
     "python.assert-is-not-validation":
         "check that an amount is positive before using it",
@@ -1342,19 +1051,6 @@ PROBES = {
     "python.naive-and-aware-datetimes-do-not-compare":
         "TypeError comparing offset-naive and offset-aware datetimes",
 
-    # ---- JavaScript -------------------------------------------------------
-    "javascript.json-parse-returns-any":
-        "use the parsed JSON body of an incoming request",
-    "javascript.loose-equality-and-falsy-defaults":
-        "a quantity of zero keeps being replaced by the default value",
-    "javascript.number-parsing-is-lossy":
-        "turn a page number from the query string into a number",
-    "javascript.async-errors-need-explicit-handling":
-        "await inside forEach does not wait and the errors disappear",
-    "javascript.object-injection-via-user-keys":
-        "set a property on an object using a key taken from the request body",
-    "javascript.date-parsing-is-implementation-defined":
-        "turn a date string typed by a user into a Date object",
 }
 
 
@@ -1381,23 +1077,10 @@ SEMANTIC_CHECK = {
 }
 
 
-# Rules with no violation_pattern still have provenance worth recording.
-EXTRA_SOURCES = {
-    "typescript.safeparse-when-failure-is-expected": ZOD,
-    "typescript.brand-validated-primitives": ZOD,
-}
-
-
 NO_PATTERN_REASON = {
     "odoo.schema-change-needs-migration":
         "The violation lives in the diff between two module versions plus the presence of a "
         "migrations/ directory. Nothing in a single generated snippet reveals it.",
-    "typescript.safeparse-when-failure-is-expected":
-        "Whether parse or safeParse is correct depends on whether the caller can recover, "
-        "which is context the snippet does not contain. Any pattern here would be noise.",
-    "typescript.brand-validated-primitives":
-        "Absence of branding is not detectable: plain string parameters are correct in most "
-        "code. Flagging them all would bury the real findings.",
 }
 
 
@@ -1406,12 +1089,18 @@ def main():
     os.makedirs(out, exist_ok=True)
     total = 0
     unknown = (set(ENRICH) | set(NO_PATTERN_REASON) | set(SEMANTIC_CHECK)
-               | set(PROBES) | set(EXTRA_SOURCES) | set(LIKELIHOOD))
+               | set(PROBES) | set(LIKELIHOOD))
     unprobed = []
     covered = 0
     semantic = 0
-    for stack, rules in (("odoo", ODOO), ("python", PYTHON),
-                        ("typescript", TYPESCRIPT), ("javascript", JAVASCRIPT)):
+    # One stack, and everything in it is written for reviewing Odoo code. The
+    # `python.` rules are in it because an Odoo module IS Python: selection was
+    # strict equality on this field, so an Odoo file got the 19 ORM rules and
+    # none of the 8 Python ones, and `fieldtest --stack python` over OpenSPP
+    # found 32 hits `--stack odoo` never reported. The id prefix stays as it
+    # is -- it names where the rule came from and which documentation it is
+    # sourced to, which is not the same question as which stack selects it.
+    for stack, rules in (("odoo", ODOO + PYTHON),):
         for r in rules:
             r["stack"] = stack
             r.setdefault("bypassed_by", [])
@@ -1422,8 +1111,6 @@ def main():
             # deriving it costs a line.
             r["likelihood"] = LIKELIHOOD.get(r["id"], LIKELIHOOD_DEFAULT)
             r["advisory"] = r["likelihood"] in ADVISORY_LIKELIHOODS
-            if r["id"] in EXTRA_SOURCES:
-                r["source"] = EXTRA_SOURCES[r["id"]]
             if r["id"] in PROBES:
                 r["probe"] = PROBES[r["id"]]
             else:
@@ -1448,6 +1135,8 @@ def main():
             json.dump(rules, fh, indent=2, ensure_ascii=False)
         crit = sum(1 for r in rules if r["severity"] == "critical")
         print("  {0:<12} {1:>2} rules ({2} critical) -> {3}.json".format(stack, len(rules), crit, stack))
+        print("  {0:<12} {1:>2} Odoo ORM rules + {2} plain-Python rules composed in"
+              .format("", len(ODOO), len(PYTHON)))
         total += len(rules)
     checked = covered + semantic
     print("\n  {0} rules total, {1} machine-checkable ({2}%)".format(

corpus/check_sources.py

@@ -84,9 +84,20 @@ REFERENCE = "https://www.odoo.com/documentation/{0}/developer/reference/backend/
 
 
 def load():
+    """The rules that make a claim about an Odoo series.
+
+    odoo.json holds the whole corpus, which since the composition includes
+    eight plain-Python rules. Those carry no `odoo_versions` and cite
+    docs.python.org, so there is no series claim here to check and no Odoo API
+    to look for -- running them through this would report eight rules as
+    "unversioned" every time, which is a true sentence that makes the real
+    count harder to read. They are excluded by their origin prefix, the same
+    thing corpus.ORIGINS names.
+    """
     with io.open(RULES, encoding="utf-8-sig") as fh:
         data = json.load(fh)
-    return data if isinstance(data, list) else data.get("rules", data)
+    rules = data if isinstance(data, list) else data.get("rules", data)
+    return [r for r in rules if r["id"].startswith("odoo.")]
 
 
 def fetch(url, cache):

corpus/corpus_meta.json

@@ -1,14 +1,12 @@
 {
-  "built_utc": "2026-09-16T07:06:37.091305+00:00",
-  "rules": 43,
-  "machine_checkable": 40,
-  "by_pattern": 30,
+  "built_utc": "2026-09-16T08:00:31.662425+00:00",
+  "rules": 27,
+  "machine_checkable": 26,
+  "by_pattern": 16,
   "by_semantic_check": 10,
   "checked_against": {
     "odoo": "18.0",
-    "python": "3.12",
-    "typescript": "5.x",
-    "javascript": "ES2023"
+    "python": "3.12"
   },
-  "corpus_sha256": "a7e3adddd78657b2c19cab0616f95a93de4784d5a422089c3eae4552b0750f35"
+  "corpus_sha256": "68dd1fc12d9d546627767f840e3acffb1d0c78fd2ff5571d259261f5312ece03"
 }

corpus/rule.schema.json

@@ -19,17 +19,15 @@
   "properties": {
     "id": {
       "type": "string",
-      "pattern": "^[a-z0-9]+(-[a-z0-9]+)*\\.[a-z0-9]+(-[a-z0-9]+)*$",
-      "description": "Stable citable identifier '<stack>.<slug>'. Models cite this; verify-citations checks it exists."
+      "pattern": "^(odoo|python)\\.[a-z0-9]+(-[a-z0-9]+)*$",
+      "description": "Stable citable identifier '<origin>.<slug>'. The prefix names where the rule came from -- odoo. for the ORM rules, python. for the plain-Python rules composed into the same stack -- and is not the stack, of which there is one. Models cite this; verify-citations checks it exists."
     },
     "stack": {
       "type": "string",
       "enum": [
-        "odoo",
-        "python",
-        "typescript",
-        "javascript"
-      ]
+        "odoo"
+      ],
+      "description": "The one stack. It stays a field because prompts, the RAG index and every measurement are keyed on it. It is not the id prefix: python.decimal-for-money-not-float carries stack odoo, because it is selected when reviewing Odoo code while being sourced to docs.python.org."
     },
     "severity": {
       "type": "string",

corpus/rules/javascript.json

@@ -1,136 +0,0 @@
-[
-  {
-    "id": "javascript.json-parse-returns-any",
-    "severity": "critical",
-    "title": "JSON.parse output is unchecked",
-    "rule": "Never use the result of JSON.parse directly. Pass it through a schema or an explicit shape check first.",
-    "why": "JSON.parse succeeds for any syntactically valid JSON, including null, a bare number, or an object missing every field you expect. Property access then yields undefined, which propagates through arithmetic as NaN and through templates as the literal string undefined.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [],
-    "wrong": "const cfg = JSON.parse(raw);\nstartServer(cfg.port);",
-    "correct": "const cfg = ConfigSchema.parse(JSON.parse(raw));\nstartServer(cfg.port);",
-    "tags": [
-      "json",
-      "boundary"
-    ],
-    "stack": "javascript",
-    "violation_pattern": "=\\s*JSON\\.parse\\(",
-    "source": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/parse",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "use the parsed JSON body of an incoming request"
-  },
-  {
-    "id": "javascript.loose-equality-and-falsy-defaults",
-    "severity": "high",
-    "title": "Falsy defaults discard legitimate zero and empty string",
-    "rule": "Use the nullish coalescing operator for defaults and strict equality for comparisons. Reserve the logical OR operator for genuine boolean logic.",
-    "why": "The OR operator treats 0, empty string and false as absent, so a quantity of 0 or an intentionally blank note is silently replaced by the default. This is the most common way a validated value is destroyed after it has passed validation.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [],
-    "wrong": "const qty = input.qty || 1;        // qty of 0 becomes 1\nif (status == null) { }            // also matches undefined by design, but == elsewhere surprises",
-    "correct": "const qty = input.qty ?? 1;        // only null or undefined fall back\nif (status === null || status === undefined) { }",
-    "tags": [
-      "coercion",
-      "defaults",
-      "silent-failure"
-    ],
-    "stack": "javascript",
-    "violation_pattern": "\\w\\s*\\|\\|\\s*(?!0(?!\\d|\\.)|\\\"\\\"|'')(?:\\d|['\\\"])",
-    "source": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Nullish_coalescing",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "a quantity of zero keeps being replaced by the default value"
-  },
-  {
-    "id": "javascript.number-parsing-is-lossy",
-    "severity": "high",
-    "title": "Coercing user input to a number accepts nonsense",
-    "rule": "Validate numeric input with an explicit check for finiteness rather than relying on Number, parseInt or the unary plus.",
-    "why": "parseInt('12abc') returns 12, Number('') returns 0, and Number(' ') returns 0 as well. Each converts invalid input into a plausible number that passes every downstream check and corrupts totals rather than raising an error.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [],
-    "wrong": "const qty = parseInt(req.body.qty);",
-    "correct": "const qty = Number(req.body.qty);\nif (!Number.isFinite(qty) || !Number.isInteger(qty) || qty <= 0) {\n  throw new Error(`qty must be a positive integer, received: ${req.body.qty}`);\n}",
-    "tags": [
-      "numbers",
-      "coercion",
-      "input"
-    ],
-    "stack": "javascript",
-    "violation_pattern": "parseInt\\(|parseFloat\\(",
-    "satisfied_pattern": "Number\\.isFinite|Number\\.isInteger",
-    "source": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/parseInt",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "turn a page number from the query string into a number"
-  },
-  {
-    "id": "javascript.async-errors-need-explicit-handling",
-    "severity": "critical",
-    "title": "A rejected promise in a callback is not caught by the surrounding try",
-    "rule": "Await every promise you create, or attach a catch to it. Never pass an async function where a synchronous callback is expected.",
-    "why": "An async callback passed to forEach or to an event emitter returns a promise nobody holds. A rejection inside it escapes the enclosing try/catch entirely and becomes an unhandled rejection, which terminates the process on modern Node and silently skips work before that.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [],
-    "wrong": "rows.forEach(async (row) => {\n  await save(row);        // rejections escape, loop does not wait\n});",
-    "correct": "await Promise.all(rows.map((row) => save(row)));\n// or, when order and back-pressure matter:\nfor (const row of rows) {\n  await save(row);\n}",
-    "tags": [
-      "async",
-      "promises",
-      "error-handling"
-    ],
-    "stack": "javascript",
-    "violation_pattern": "\\.forEach\\(\\s*async",
-    "source": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/async_function",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "await inside forEach does not wait and the errors disappear"
-  },
-  {
-    "id": "javascript.object-injection-via-user-keys",
-    "severity": "critical",
-    "title": "Never index an object with an unvalidated user-supplied key",
-    "rule": "Check a user-supplied key against an allowlist, or use a Map, before using it to read or write a property.",
-    "why": "A key of __proto__ or constructor reaches the prototype chain. Writing through it pollutes every object in the process, which turns a validation gap into remote code execution in the worst case and into corrupted defaults everywhere in the mildest.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [],
-    "wrong": "target[req.body.key] = req.body.value;",
-    "correct": "const ALLOWED = new Set(['name', 'email', 'phone']);\nif (!ALLOWED.has(req.body.key)) {\n  throw new Error(`Unsupported field: ${req.body.key}`);\n}\ntarget[req.body.key] = req.body.value;",
-    "tags": [
-      "security",
-      "prototype-pollution",
-      "input"
-    ],
-    "stack": "javascript",
-    "violation_pattern": "\\w+\\[\\s*(?:req\\.(?:body|query|params)|input|payload)\\.\\w+\\s*\\]\\s*=",
-    "satisfied_pattern": "ALLOWED|allowlist|\\.has\\(|Object\\.hasOwn\\(|Object\\.prototype\\.hasOwnProperty\\.call|Object\\.create\\(null\\)",
-    "source": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/proto",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "set a property on an object using a key taken from the request body"
-  },
-  {
-    "id": "javascript.date-parsing-is-implementation-defined",
-    "severity": "medium",
-    "title": "The Date constructor accepts ambiguous strings",
-    "rule": "Parse dates from an explicit ISO-8601 string and reject anything that produces an invalid date. Never feed arbitrary user text to new Date.",
-    "why": "new Date('01/02/2026') is January the second in one locale's reading and the second of January in another, and non-ISO formats are implementation-defined across engines. new Date('nonsense') returns an Invalid Date object rather than throwing, so the failure travels onward as NaN.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [],
-    "wrong": "const when = new Date(req.body.date);",
-    "correct": "const when = new Date(req.body.date);\nif (Number.isNaN(when.getTime())) {\n  throw new Error(`Invalid date: ${req.body.date}`);\n}",
-    "tags": [
-      "dates",
-      "coercion",
-      "locale"
-    ],
-    "stack": "javascript",
-    "violation_pattern": "new Date\\(\\s*(?:req|input|body|payload|row)\\.",
-    "satisfied_pattern": "Number\\.isNaN|isNaN\\(",
-    "source": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/Date",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "turn a date string typed by a user into a Date object"
-  }
-]

corpus/rules/odoo.json

@@ -159,7 +159,7 @@
     "source": "https://www.odoo.com/documentation/18.0/developer/tutorials/server_framework_101/10_constraints.html",
     "likelihood": "preference",
     "advisory": true,
-    "probe": "stop anyone entering a negative quantity on a sale order line"
+    "probe": "should this check be a database constraint or an api.constrains method"
   },
   {
     "id": "odoo.check-constraint-cannot-cross-tables",
@@ -479,5 +479,200 @@
     "likelihood": "unproven",
     "advisory": true,
     "probe": "my except AccessError block never runs and the API returns 409"
+  },
+  {
+    "id": "python.assert-is-not-validation",
+    "severity": "critical",
+    "title": "assert disappears under -O, so it cannot enforce anything",
+    "rule": "Never use assert to validate input or enforce an invariant. Raise an explicit exception. Reserve assert for conditions that are impossible unless the program is already broken.",
+    "why": "Python removes every assert statement when the interpreter runs with -O or PYTHONOPTIMIZE set, which is the default in a good many production images. The check is not weakened, it is absent -- so invalid input passes in exactly the environment where it matters, and passes in development, where the flag is off.",
+    "enforcement_layer": "runtime-parse",
+    "bypassed_by": [
+      "python -O",
+      "PYTHONOPTIMIZE=1",
+      "a .pyc built with optimisation"
+    ],
+    "wrong": "def withdraw(account, amount):\n    assert amount > 0, 'amount must be positive'\n    account.balance -= amount",
+    "correct": "def withdraw(account, amount):\n    if amount <= 0:\n        raise ValueError('amount must be positive, got {0!r}'.format(amount))\n    account.balance -= amount",
+    "tags": [
+      "assert",
+      "input-validation",
+      "optimisation",
+      "silent-failure"
+    ],
+    "stack": "odoo",
+    "violation_pattern": "(?<=\\n)[ \\t]*assert\\s+",
+    "source": "https://docs.python.org/3/reference/simple_stmts.html#the-assert-statement",
+    "likelihood": "unmeasured",
+    "advisory": false,
+    "probe": "check that an amount is positive before using it"
+  },
+  {
+    "id": "python.mutable-default-argument",
+    "severity": "high",
+    "title": "A default argument is evaluated once, not once per call",
+    "rule": "Never use a list, dict, set or any other mutable object as a default argument. Default to None and build the object inside the function.",
+    "why": "The default expression runs once, when the def statement executes, and every call that omits the argument shares that one object. One request's appended item is visible to the next, so state leaks between callers that never met and the symptom grows with uptime rather than with load.",
+    "enforcement_layer": "runtime-parse",
+    "bypassed_by": [],
+    "wrong": "def collect(item, seen=[]):\n    seen.append(item)\n    return seen",
+    "correct": "def collect(item, seen=None):\n    if seen is None:\n        seen = []\n    seen.append(item)\n    return seen",
+    "tags": [
+      "defaults",
+      "shared-state",
+      "silent-failure"
+    ],
+    "stack": "odoo",
+    "violation_pattern": "def\\s+\\w+\\([^)]*=\\s*(?:\\[\\]|\\{\\}|set\\(\\))",
+    "source": "https://docs.python.org/3/tutorial/controlflow.html#default-argument-values",
+    "likelihood": "unmeasured",
+    "advisory": false,
+    "probe": "a list keeps items from the previous call to the same function"
+  },
+  {
+    "id": "python.bare-except-catches-the-exit",
+    "severity": "high",
+    "title": "A bare except swallows Ctrl-C and sys.exit too",
+    "rule": "Catch the exceptions you can actually handle. Never write a bare except, and use except Exception only at a boundary that logs and re-raises.",
+    "why": "A bare except catches KeyboardInterrupt and SystemExit as well, so Ctrl-C stops working and sys.exit() is ignored. It also hides a typo exactly as readily as the error it was written for, and the failure then surfaces much later as wrong data rather than as a traceback pointing at its cause.",
+    "enforcement_layer": "runtime-parse",
+    "bypassed_by": [],
+    "wrong": "try:\n    qty = int(row['qty'])\nexcept:\n    qty = 0",
+    "correct": "try:\n    qty = int(row['qty'])\nexcept (KeyError, TypeError, ValueError) as exc:\n    raise ValueError('bad qty in row {0!r}'.format(row)) from exc",
+    "tags": [
+      "exceptions",
+      "error-handling",
+      "silent-failure"
+    ],
+    "stack": "odoo",
+    "violation_pattern": "except\\s*:",
+    "source": "https://docs.python.org/3/tutorial/errors.html",
+    "likelihood": "unmeasured",
+    "advisory": false,
+    "probe": "ctrl-c stops working and the script will not exit"
+  },
+  {
+    "id": "python.eval-and-pickle-execute-their-input",
+    "severity": "critical",
+    "title": "eval, exec and pickle run whatever they are handed",
+    "rule": "Never pass a value that came from outside the process to eval, exec, or pickle.loads. Use json.loads, ast.literal_eval, or a schema.",
+    "why": "eval and exec execute arbitrary code, and unpickling constructs arbitrary objects by calling arbitrary callables named in the byte stream. A payload reaching any of the three is remote code execution rather than a validation gap, and nothing checked afterwards undoes it. Python's own pickle documentation opens with this warning.",
+    "enforcement_layer": "runtime-parse",
+    "bypassed_by": [],
+    "wrong": "config = eval(request.body)",
+    "correct": "import json\n\nconfig = json.loads(request.body)\nif not isinstance(config, dict):\n    raise ValueError('config must be a JSON object')",
+    "tags": [
+      "security",
+      "deserialisation",
+      "remote-code-execution",
+      "input"
+    ],
+    "stack": "odoo",
+    "violation_pattern": "\\beval\\(|\\bexec\\(|pickle\\.loads?\\(",
+    "source": "https://docs.python.org/3/library/pickle.html",
+    "likelihood": "unmeasured",
+    "advisory": false,
+    "probe": "turn a config string sent by a client into a Python object"
+  },
+  {
+    "id": "python.subprocess-shell-true-is-injection",
+    "severity": "critical",
+    "title": "shell=True hands your string to the shell",
+    "rule": "Pass subprocess a list of arguments and leave shell at its default. Never build a command string out of a value you did not write.",
+    "why": "With shell=True the string is interpreted by the shell, so a semicolon, a backtick or a $( ) in the middle of a filename becomes a second command running with your privileges. The argument-list form has no shell to interpret anything, which removes the class rather than filtering it.",
+    "enforcement_layer": "runtime-parse",
+    "bypassed_by": [
+      "os.system",
+      "os.popen",
+      "shlex.split on an already-joined string"
+    ],
+    "wrong": "subprocess.run('convert {0} out.png'.format(path), shell=True)",
+    "correct": "subprocess.run(['convert', path, 'out.png'], check=True)",
+    "tags": [
+      "security",
+      "injection",
+      "subprocess",
+      "input"
+    ],
+    "stack": "odoo",
+    "violation_pattern": "shell\\s*=\\s*True|os\\.system\\(|os\\.popen\\(",
+    "source": "https://docs.python.org/3/library/subprocess.html#security-considerations",
+    "likelihood": "unmeasured",
+    "advisory": false,
+    "probe": "run a command line built from a filename the user gave me"
+  },
+  {
+    "id": "python.path-join-does-not-contain-a-path",
+    "severity": "high",
+    "title": "os.path.join discards everything before an absolute component",
+    "rule": "Never join a caller-supplied fragment onto a base directory and assume the result is inside it. Resolve both and compare before opening anything.",
+    "why": "os.path.join('/srv/uploads', '/etc/passwd') returns '/etc/passwd'. An absolute second argument discards the first entirely, and a fragment of '..' walks out more slowly. Either turns an upload handler into arbitrary filesystem access, and the join itself raises nothing.",
+    "enforcement_layer": "runtime-parse",
+    "bypassed_by": [
+      "symlinks inside the base directory"
+    ],
+    "wrong": "full = os.path.join(UPLOAD_DIR, request.args['name'])\nreturn open(full, 'rb').read()",
+    "correct": "base = os.path.realpath(UPLOAD_DIR)\nfull = os.path.realpath(os.path.join(base, request.args['name']))\nif os.path.commonpath([base, full]) != base:\n    raise ValueError('path escapes the upload directory')\nreturn open(full, 'rb').read()",
+    "tags": [
+      "security",
+      "paths",
+      "traversal",
+      "input"
+    ],
+    "stack": "odoo",
+    "violation_pattern": "os\\.path\\.join\\([^)]*\\b(?:request|args|params|payload|form|user_input|uploaded|filename)\\b",
+    "satisfied_pattern": "commonpath|commonprefix|relpath|is_relative_to",
+    "source": "https://docs.python.org/3/library/os.path.html#os.path.join",
+    "likelihood": "unmeasured",
+    "advisory": false,
+    "probe": "open a file the user named inside my uploads directory"
+  },
+  {
+    "id": "python.decimal-for-money-not-float",
+    "severity": "high",
+    "title": "Binary floats cannot hold a decimal amount",
+    "rule": "Use decimal.Decimal for money, built from the original string. Never route the value through float on the way, including inside Decimal().",
+    "why": "0.1 + 0.2 is not 0.3 in binary floating point, so a total drifts by fractions of a unit and a reconciliation over a large batch fails for no visible reason. Decimal(0.1) carries the same error, because the float was already wrong before Decimal was given it; Decimal('0.1') is exact.",
+    "enforcement_layer": "runtime-parse",
+    "bypassed_by": [
+      "json.loads, which parses every JSON number as a float"
+    ],
+    "wrong": "price = float(payload['price'])\ntotal = price * qty",
+    "correct": "from decimal import Decimal\n\nprice = Decimal(payload['price'])      # from the string, never through float\ntotal = price * qty",
+    "tags": [
+      "money",
+      "precision",
+      "floats",
+      "decimal"
+    ],
+    "stack": "odoo",
+    "violation_pattern": "(?:price|amount|total|cost|balance|fee|tax|subtotal|payment|salary)\\w*\\s*=\\s*float\\(|float\\(\\s*[^)]*\\b(?:price|amount|cost|balance|fee|tax|subtotal|payment|salary)\\b",
+    "satisfied_pattern": "Decimal",
+    "source": "https://docs.python.org/3/library/decimal.html",
+    "likelihood": "unmeasured",
+    "advisory": false,
+    "probe": "totals are off by a fraction of a penny after adding prices up"
+  },
+  {
+    "id": "python.naive-and-aware-datetimes-do-not-compare",
+    "severity": "medium",
+    "title": "A naive datetime cannot be compared with an aware one",
+    "rule": "Work in timezone-aware UTC from the moment a value enters the process. Never call datetime.now() or utcnow() without a tzinfo.",
+    "why": "Comparing a naive datetime with an aware one raises TypeError. datetime.now() is naive, and anything parsed from an ISO string carrying an offset is aware, so the two meet for the first time in whichever branch is exercised least -- usually expiry, usually in production.",
+    "enforcement_layer": "runtime-parse",
+    "bypassed_by": [],
+    "wrong": "if expires_at < datetime.datetime.now():\n    raise ValueError('token expired')",
+    "correct": "from datetime import datetime, timezone\n\nif expires_at < datetime.now(timezone.utc):\n    raise ValueError('token expired')",
+    "tags": [
+      "datetime",
+      "timezone",
+      "comparison"
+    ],
+    "stack": "odoo",
+    "violation_pattern": "datetime\\.now\\(\\s*\\)|utcnow\\(\\s*\\)",
+    "source": "https://docs.python.org/3/library/datetime.html",
+    "likelihood": "unmeasured",
+    "advisory": false,
+    "probe": "TypeError comparing offset-naive and offset-aware datetimes"
   }
 ]

corpus/rules/python.json

@@ -1,197 +0,0 @@
-[
-  {
-    "id": "python.assert-is-not-validation",
-    "severity": "critical",
-    "title": "assert disappears under -O, so it cannot enforce anything",
-    "rule": "Never use assert to validate input or enforce an invariant. Raise an explicit exception. Reserve assert for conditions that are impossible unless the program is already broken.",
-    "why": "Python removes every assert statement when the interpreter runs with -O or PYTHONOPTIMIZE set, which is the default in a good many production images. The check is not weakened, it is absent -- so invalid input passes in exactly the environment where it matters, and passes in development, where the flag is off.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [
-      "python -O",
-      "PYTHONOPTIMIZE=1",
-      "a .pyc built with optimisation"
-    ],
-    "wrong": "def withdraw(account, amount):\n    assert amount > 0, 'amount must be positive'\n    account.balance -= amount",
-    "correct": "def withdraw(account, amount):\n    if amount <= 0:\n        raise ValueError('amount must be positive, got {0!r}'.format(amount))\n    account.balance -= amount",
-    "tags": [
-      "assert",
-      "input-validation",
-      "optimisation",
-      "silent-failure"
-    ],
-    "stack": "python",
-    "violation_pattern": "(?<=\\n)[ \\t]*assert\\s+",
-    "source": "https://docs.python.org/3/reference/simple_stmts.html#the-assert-statement",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "check that an amount is positive before using it"
-  },
-  {
-    "id": "python.mutable-default-argument",
-    "severity": "high",
-    "title": "A default argument is evaluated once, not once per call",
-    "rule": "Never use a list, dict, set or any other mutable object as a default argument. Default to None and build the object inside the function.",
-    "why": "The default expression runs once, when the def statement executes, and every call that omits the argument shares that one object. One request's appended item is visible to the next, so state leaks between callers that never met and the symptom grows with uptime rather than with load.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [],
-    "wrong": "def collect(item, seen=[]):\n    seen.append(item)\n    return seen",
-    "correct": "def collect(item, seen=None):\n    if seen is None:\n        seen = []\n    seen.append(item)\n    return seen",
-    "tags": [
-      "defaults",
-      "shared-state",
-      "silent-failure"
-    ],
-    "stack": "python",
-    "violation_pattern": "def\\s+\\w+\\([^)]*=\\s*(?:\\[\\]|\\{\\}|set\\(\\))",
-    "source": "https://docs.python.org/3/tutorial/controlflow.html#default-argument-values",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "a list keeps items from the previous call to the same function"
-  },
-  {
-    "id": "python.bare-except-catches-the-exit",
-    "severity": "high",
-    "title": "A bare except swallows Ctrl-C and sys.exit too",
-    "rule": "Catch the exceptions you can actually handle. Never write a bare except, and use except Exception only at a boundary that logs and re-raises.",
-    "why": "A bare except catches KeyboardInterrupt and SystemExit as well, so Ctrl-C stops working and sys.exit() is ignored. It also hides a typo exactly as readily as the error it was written for, and the failure then surfaces much later as wrong data rather than as a traceback pointing at its cause.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [],
-    "wrong": "try:\n    qty = int(row['qty'])\nexcept:\n    qty = 0",
-    "correct": "try:\n    qty = int(row['qty'])\nexcept (KeyError, TypeError, ValueError) as exc:\n    raise ValueError('bad qty in row {0!r}'.format(row)) from exc",
-    "tags": [
-      "exceptions",
-      "error-handling",
-      "silent-failure"
-    ],
-    "stack": "python",
-    "violation_pattern": "except\\s*:",
-    "source": "https://docs.python.org/3/tutorial/errors.html",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "ctrl-c stops working and the script will not exit"
-  },
-  {
-    "id": "python.eval-and-pickle-execute-their-input",
-    "severity": "critical",
-    "title": "eval, exec and pickle run whatever they are handed",
-    "rule": "Never pass a value that came from outside the process to eval, exec, or pickle.loads. Use json.loads, ast.literal_eval, or a schema.",
-    "why": "eval and exec execute arbitrary code, and unpickling constructs arbitrary objects by calling arbitrary callables named in the byte stream. A payload reaching any of the three is remote code execution rather than a validation gap, and nothing checked afterwards undoes it. Python's own pickle documentation opens with this warning.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [],
-    "wrong": "config = eval(request.body)",
-    "correct": "import json\n\nconfig = json.loads(request.body)\nif not isinstance(config, dict):\n    raise ValueError('config must be a JSON object')",
-    "tags": [
-      "security",
-      "deserialisation",
-      "remote-code-execution",
-      "input"
-    ],
-    "stack": "python",
-    "violation_pattern": "\\beval\\(|\\bexec\\(|pickle\\.loads?\\(",
-    "source": "https://docs.python.org/3/library/pickle.html",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "turn a config string sent by a client into a Python object"
-  },
-  {
-    "id": "python.subprocess-shell-true-is-injection",
-    "severity": "critical",
-    "title": "shell=True hands your string to the shell",
-    "rule": "Pass subprocess a list of arguments and leave shell at its default. Never build a command string out of a value you did not write.",
-    "why": "With shell=True the string is interpreted by the shell, so a semicolon, a backtick or a $( ) in the middle of a filename becomes a second command running with your privileges. The argument-list form has no shell to interpret anything, which removes the class rather than filtering it.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [
-      "os.system",
-      "os.popen",
-      "shlex.split on an already-joined string"
-    ],
-    "wrong": "subprocess.run('convert {0} out.png'.format(path), shell=True)",
-    "correct": "subprocess.run(['convert', path, 'out.png'], check=True)",
-    "tags": [
-      "security",
-      "injection",
-      "subprocess",
-      "input"
-    ],
-    "stack": "python",
-    "violation_pattern": "shell\\s*=\\s*True|os\\.system\\(|os\\.popen\\(",
-    "source": "https://docs.python.org/3/library/subprocess.html#security-considerations",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "run a command line built from a filename the user gave me"
-  },
-  {
-    "id": "python.path-join-does-not-contain-a-path",
-    "severity": "high",
-    "title": "os.path.join discards everything before an absolute component",
-    "rule": "Never join a caller-supplied fragment onto a base directory and assume the result is inside it. Resolve both and compare before opening anything.",
-    "why": "os.path.join('/srv/uploads', '/etc/passwd') returns '/etc/passwd'. An absolute second argument discards the first entirely, and a fragment of '..' walks out more slowly. Either turns an upload handler into arbitrary filesystem access, and the join itself raises nothing.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [
-      "symlinks inside the base directory"
-    ],
-    "wrong": "full = os.path.join(UPLOAD_DIR, request.args['name'])\nreturn open(full, 'rb').read()",
-    "correct": "base = os.path.realpath(UPLOAD_DIR)\nfull = os.path.realpath(os.path.join(base, request.args['name']))\nif os.path.commonpath([base, full]) != base:\n    raise ValueError('path escapes the upload directory')\nreturn open(full, 'rb').read()",
-    "tags": [
-      "security",
-      "paths",
-      "traversal",
-      "input"
-    ],
-    "stack": "python",
-    "violation_pattern": "os\\.path\\.join\\([^)]*\\b(?:request|args|params|payload|form|user_input|uploaded|filename)\\b",
-    "satisfied_pattern": "commonpath|commonprefix|relpath|is_relative_to",
-    "source": "https://docs.python.org/3/library/os.path.html#os.path.join",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "open a file the user named inside my uploads directory"
-  },
-  {
-    "id": "python.decimal-for-money-not-float",
-    "severity": "high",
-    "title": "Binary floats cannot hold a decimal amount",
-    "rule": "Use decimal.Decimal for money, built from the original string. Never route the value through float on the way, including inside Decimal().",
-    "why": "0.1 + 0.2 is not 0.3 in binary floating point, so a total drifts by fractions of a unit and a reconciliation over a large batch fails for no visible reason. Decimal(0.1) carries the same error, because the float was already wrong before Decimal was given it; Decimal('0.1') is exact.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [
-      "json.loads, which parses every JSON number as a float"
-    ],
-    "wrong": "price = float(payload['price'])\ntotal = price * qty",
-    "correct": "from decimal import Decimal\n\nprice = Decimal(payload['price'])      # from the string, never through float\ntotal = price * qty",
-    "tags": [
-      "money",
-      "precision",
-      "floats",
-      "decimal"
-    ],
-    "stack": "python",
-    "violation_pattern": "(?:price|amount|total|cost|balance|fee|tax|subtotal|payment|salary)\\w*\\s*=\\s*float\\(|float\\(\\s*[^)]*\\b(?:price|amount|cost|balance|fee|tax|subtotal|payment|salary)\\b",
-    "satisfied_pattern": "Decimal",
-    "source": "https://docs.python.org/3/library/decimal.html",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "totals are off by a fraction of a penny after adding prices up"
-  },
-  {
-    "id": "python.naive-and-aware-datetimes-do-not-compare",
-    "severity": "medium",
-    "title": "A naive datetime cannot be compared with an aware one",
-    "rule": "Work in timezone-aware UTC from the moment a value enters the process. Never call datetime.now() or utcnow() without a tzinfo.",
-    "why": "Comparing a naive datetime with an aware one raises TypeError. datetime.now() is naive, and anything parsed from an ISO string carrying an offset is aware, so the two meet for the first time in whichever branch is exercised least -- usually expiry, usually in production.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [],
-    "wrong": "if expires_at < datetime.datetime.now():\n    raise ValueError('token expired')",
-    "correct": "from datetime import datetime, timezone\n\nif expires_at < datetime.now(timezone.utc):\n    raise ValueError('token expired')",
-    "tags": [
-      "datetime",
-      "timezone",
-      "comparison"
-    ],
-    "stack": "python",
-    "violation_pattern": "datetime\\.now\\(\\s*\\)|utcnow\\(\\s*\\)",
-    "source": "https://docs.python.org/3/library/datetime.html",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "TypeError comparing offset-naive and offset-aware datetimes"
-  }
-]

corpus/rules/typescript.json

@@ -1,238 +0,0 @@
-[
-  {
-    "id": "typescript.types-are-erased-at-runtime",
-    "severity": "critical",
-    "title": "Static types guarantee nothing about external data",
-    "rule": "Every value crossing a boundary must be parsed by a runtime schema. A type assertion on external data is a lie the compiler cannot catch.",
-    "why": "Interfaces and type annotations are erased during compilation. Casting an API response with 'as User' produces zero runtime checks, so a changed or malformed payload propagates as undefined deep inside unrelated code, far from its origin.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [
-      "type assertions (as T)",
-      "any",
-      "unchecked JSON.parse"
-    ],
-    "wrong": "const user = await res.json() as User;",
-    "correct": "const UserSchema = z.object({ id: z.number(), name: z.string() });\ntype User = z.infer<typeof UserSchema>;\n\nconst user = UserSchema.parse(await res.json());",
-    "tags": [
-      "zod",
-      "boundary",
-      "type-erasure"
-    ],
-    "stack": "typescript",
-    "violation_pattern": "\\.json\\(\\)\\s+as\\s+\\w+|as\\s+unknown\\s+as\\s+\\w+",
-    "source": "https://www.typescriptlang.org/docs/handbook/2/everyday-types.html",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "cast the JSON from an API response to my interface"
-  },
-  {
-    "id": "typescript.derive-type-from-schema",
-    "severity": "high",
-    "title": "Derive the type from the schema, never maintain both",
-    "rule": "Write the schema first and derive the static type with z.infer. Never hand-write an interface alongside a schema for the same data.",
-    "why": "Two hand-maintained definitions drift. The compiler cannot detect the drift because each is internally consistent, so the type says one thing while the parser enforces another and the mismatch only appears at runtime.",
-    "enforcement_layer": "compile-time",
-    "bypassed_by": [],
-    "wrong": "interface Order { id: number; total: number; }\nconst OrderSchema = z.object({ id: z.number(), total: z.number(), currency: z.string() });",
-    "correct": "const OrderSchema = z.object({\n  id: z.number(),\n  total: z.number(),\n  currency: z.string(),\n});\ntype Order = z.infer<typeof OrderSchema>;",
-    "tags": [
-      "zod",
-      "single-source-of-truth",
-      "drift"
-    ],
-    "stack": "typescript",
-    "violation_pattern": "interface\\s+\\w+\\s*\\{[\\s\\S]*?\\}[\\s\\S]*?z\\.object\\(",
-    "source": "https://zod.dev/api",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "keep my interface and my validation schema from drifting apart"
-  },
-  {
-    "id": "typescript.odoo-returns-false-for-every-empty-field",
-    "severity": "critical",
-    "title": "Odoo JSON-RPC returns false for every empty field",
-    "rule": "Model every optional Odoo scalar as a union with literal false, normalised through one shared helper. This applies to Char, Text, Date, Datetime, Binary and Many2one alike, not only to relations.",
-    "why": "Odoo returns boolean false for any empty value, never null, never an empty string. Typing an optional email as string().nullable() throws at the parse boundary the first time a partner has no email, which is ordinary production data rather than an edge case.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [],
-    "wrong": "const PartnerSchema = z.object({\n  email: z.string().nullable(),\n  parent_id: z.array(z.number()),\n});",
-    "correct": "const odooNullable = <T extends z.ZodTypeAny>(inner: T) =>\n  z.union([inner, z.literal(false)]).transform((v) => (v === false ? null : v));\n\nconst PartnerSchema = z.object({\n  id: z.number().int(),\n  name: z.string(),\n  email: odooNullable(z.string().email()),\n  parent_id: odooNullable(z.tuple([z.number().int(), z.string()])),\n});",
-    "tags": [
-      "odoo",
-      "json-rpc",
-      "boundary",
-      "zod"
-    ],
-    "violation_pattern": "z\\.(?:string|number|date|coerce)[^\\n]*\\.nullable\\(\\)",
-    "satisfied_pattern": "odooNullable|z\\.literal\\(false\\)",
-    "stack": "typescript",
-    "source": "https://www.odoo.com/documentation/18.0/developer/reference/external_api.html",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "parsing fails because Odoo sent false for a partner with no email"
-  },
-  {
-    "id": "typescript.odoo-many2one-is-a-tuple",
-    "severity": "high",
-    "title": "A set Many2one is a two-element tuple, not an array of ids",
-    "rule": "Model a populated Many2one as z.tuple([z.number(), z.string()]) holding id and display_name. Model an empty one as false.",
-    "why": "Odoo read() returns [id, display_name] for a set Many2one. Typing it as an array of numbers parses the id but discards display_name and fails the moment the schema meets real data, because element one is a string.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [],
-    "wrong": "parent_id: z.array(z.number())",
-    "correct": "parent_id: odooNullable(z.tuple([z.number().int(), z.string()]))",
-    "tags": [
-      "odoo",
-      "json-rpc",
-      "many2one"
-    ],
-    "stack": "typescript",
-    "violation_pattern": "_id\\s*:\\s*(?:\\w+\\()?z\\.array\\(\\s*z\\.number",
-    "source": "https://www.odoo.com/documentation/18.0/developer/reference/external_api.html",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "read the parent company name off a many2one field from Odoo"
-  },
-  {
-    "id": "typescript.odoo-read-returns-an-array",
-    "severity": "medium",
-    "title": "Odoo read returns an array even for one id",
-    "rule": "Parse the response of read() with z.array(Schema) and index into it, rather than parsing it as a single object.",
-    "why": "read() always returns a list of dictionaries. Parsing it directly against an object schema fails, and defensively coercing with Array.isArray hides whether the call actually returned the record or an empty list for a missing id.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [],
-    "wrong": "const partner = PartnerSchema.parse(await callOdoo('res.partner', 'read', [id]));",
-    "correct": "const rows = z.array(PartnerSchema).parse(\n  await callOdoo('res.partner', 'read', [id]),\n);\nif (rows.length === 0) throw new Error(`res.partner ${id} not found or not readable`);\nconst partner = rows[0];",
-    "tags": [
-      "odoo",
-      "json-rpc",
-      "read"
-    ],
-    "stack": "typescript",
-    "violation_pattern": "\\w+Schema\\.(?:safe)?[Pp]arse\\(\\s*await[^)]*(?:callOdoo|jsonrpc|'read'|\\\"read\\\")",
-    "satisfied_pattern": "z\\.array\\(",
-    "source": "https://www.odoo.com/documentation/18.0/developer/reference/external_api.html",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "parse the result of an Odoo read call for a single id"
-  },
-  {
-    "id": "typescript.unknown-not-any-at-boundaries",
-    "severity": "high",
-    "title": "Use unknown at boundaries, never any",
-    "rule": "Type every value that arrives unparsed as unknown: the body of an incoming webhook, a request payload, a handler parameter, the result of JSON.parse, anything from an untyped import. Reserve any for nothing.",
-    "why": "any silently disables checking for every expression derived from it, so one any on a webhook handler's payload removes type safety from the whole call chain downstream, and the compiler reports nothing. unknown refuses every use until the value has been parsed or narrowed, which is the behaviour that was wanted from the annotation in the first place.",
-    "enforcement_layer": "compile-time",
-    "bypassed_by": [
-      "explicit any",
-      "implicit any from untyped imports"
-    ],
-    "wrong": "function handle(payload: any) { return payload.order.total; }",
-    "correct": "function handle(payload: unknown) {\n  const { order } = WebhookSchema.parse(payload);\n  return order.total;\n}",
-    "tags": [
-      "any",
-      "unknown",
-      "boundary",
-      "webhook",
-      "payload",
-      "request-body",
-      "handler",
-      "external-input"
-    ],
-    "stack": "typescript",
-    "violation_pattern": ":\\s*any\\b",
-    "source": "https://www.typescriptlang.org/docs/handbook/2/everyday-types.html",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "what type should the payload of an incoming webhook handler have"
-  },
-  {
-    "id": "typescript.safeparse-when-failure-is-expected",
-    "severity": "medium",
-    "title": "Choose parse or safeParse deliberately",
-    "rule": "Use safeParse where a malformed value is expected and recoverable; use parse only where throwing is the correct response. State which and why.",
-    "why": "parse throws a ZodError that an unprepared caller turns into a 500 and an opaque stack trace. safeParse returns a discriminated result carrying the field-level issues, which is what a user-facing error or a per-row import skip actually needs.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [],
-    "wrong": "const row = RowSchema.parse(csvRow); // aborts the whole import on row 4000",
-    "correct": "const result = RowSchema.safeParse(csvRow);\nif (!result.success) {\n  errors.push({ line, issues: result.error.issues });\n  continue;\n}\nconst row = result.data;",
-    "tags": [
-      "zod",
-      "error-handling"
-    ],
-    "stack": "typescript",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "source": "https://zod.dev/api",
-    "probe": "skip the bad rows in a CSV import instead of aborting the whole file",
-    "no_check_reason": "Whether parse or safeParse is correct depends on whether the caller can recover, which is context the snippet does not contain. Any pattern here would be noise."
-  },
-  {
-    "id": "typescript.validate-env-at-startup",
-    "severity": "high",
-    "title": "Parse environment variables once at startup",
-    "rule": "Validate the whole environment against a schema at process start and export the parsed object. Never read process.env deep inside application code.",
-    "why": "process.env values are string or undefined and are unchecked. A missing variable read lazily inside a rarely-exercised branch fails in production at the worst moment, whereas a startup parse turns the same fault into a deployment that refuses to boot.",
-    "enforcement_layer": "startup",
-    "bypassed_by": [],
-    "wrong": "const url = process.env.ODOO_URL; // string | undefined, used 40 files away",
-    "correct": "const EnvSchema = z.object({\n  ODOO_URL: z.string().url(),\n  ODOO_DB: z.string().min(1),\n  PORT: z.coerce.number().int().positive().default(3000),\n});\nexport const env = EnvSchema.parse(process.env);",
-    "tags": [
-      "config",
-      "startup",
-      "fail-fast"
-    ],
-    "stack": "typescript",
-    "violation_pattern": "process\\.env\\.[A-Z][A-Z0-9_]*",
-    "source": "https://nodejs.org/api/process.html",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "make sure the required environment variables are set before the app runs"
-  },
-  {
-    "id": "typescript.discriminated-union-for-variants",
-    "severity": "medium",
-    "title": "Use discriminatedUnion for tagged variant payloads",
-    "rule": "When a payload has a literal tag field selecting its shape, use z.discriminatedUnion on that field rather than z.union.",
-    "why": "A plain union tries every member and reports the failure of all of them, producing an unreadable error and slower parsing. discriminatedUnion selects the branch by tag, reports issues only for the intended shape, and narrows correctly in TypeScript afterwards.",
-    "enforcement_layer": "runtime-parse",
-    "bypassed_by": [],
-    "wrong": "z.union([PaymentSucceeded, PaymentFailed, PaymentPending])",
-    "correct": "z.discriminatedUnion('status', [\n  z.object({ status: z.literal('succeeded'), chargeId: z.string() }),\n  z.object({ status: z.literal('failed'), reason: z.string() }),\n  z.object({ status: z.literal('pending') }),\n])",
-    "tags": [
-      "zod",
-      "unions",
-      "narrowing"
-    ],
-    "stack": "typescript",
-    "violation_pattern": "z\\.union\\(\\[\\s*[A-Z]",
-    "satisfied_pattern": "z\\.discriminatedUnion",
-    "source": "https://zod.dev/api",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "probe": "parse a webhook whose body shape depends on a status field"
-  },
-  {
-    "id": "typescript.brand-validated-primitives",
-    "severity": "medium",
-    "title": "Brand validated primitives so they cannot be swapped for raw ones",
-    "rule": "Give checked primitives a branded type so a validated value is not assignable from an arbitrary string or number.",
-    "why": "Without branding, every string is assignable to every string-typed parameter, so a raw user input can be passed where a validated email or a trusted id is required and the compiler accepts it. Branding makes that a compile error.",
-    "enforcement_layer": "compile-time",
-    "bypassed_by": [
-      "casting through as"
-    ],
-    "wrong": "function send(to: string) { /* any string at all */ }",
-    "correct": "const Email = z.string().email().brand<'Email'>();\ntype Email = z.infer<typeof Email>;\n\nfunction send(to: Email) { /* only a parsed Email */ }",
-    "tags": [
-      "branding",
-      "nominal-typing"
-    ],
-    "stack": "typescript",
-    "likelihood": "unmeasured",
-    "advisory": false,
-    "source": "https://zod.dev/api",
-    "probe": "stop a raw string being passed where a checked email address is required",
-    "no_check_reason": "Absence of branding is not detectable: plain string parameters are correct in most code. Flagging them all would bury the real findings."
-  }
-]

fieldtest-js-2026-09.json

@@ -1,451 +0,0 @@
-{
-  "stack": "javascript",
-  "roots": [
-    "OpenSPP2-19.0",
-    "server-tools",
-    "account-financial-tools"
-  ],
-  "files": 62,
-  "lines": 9304,
-  "checkers": 5,
-  "triggers": {
-    "files": 3144,
-    "models_declared": 631,
-    "models_deleted": 526,
-    "declared_and_deleted": 516,
-    "never_deleted": 115,
-    "multi_company": true
-  },
-  "hits": [
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 11,
-      "evidence": "const docUrl = session.spp_documentation_url || \"https://docs.openspp.org\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_branding_kit/static/src/js/user_menu.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 12,
-      "evidence": "const supportUrl = session.spp_support_url || \"https://openspp.org\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_branding_kit/static/src/js/user_menu.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 9,
-      "evidence": "const systemName = session.spp_system_name || \"OpenSPP Platform\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_branding_kit/static/src/js/webclient.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 128,
-      "evidence": "return this._currentProfile || this.props.profile || \"registry_individuals\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_cel_widget/static/src/js/cel_editor.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 243,
-      "evidence": "minHeight: this.props.minHeight || \"80px\",",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_cel_widget/static/src/js/cel_editor.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 467,
-      "evidence": "return firstError?.message || \"Invalid expression\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_cel_widget/static/src/js/cel_editor.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 78,
-      "evidence": "message: error.message || \"Validation failed\",",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_cel_widget/static/src/js/cel_symbol_service.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 198,
-      "evidence": "if (!prefix || \"andornot\".includes(prefix)) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_cel_widget/static/src/js/cel_language/autocomplete.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 105,
-      "evidence": "message: error.message || \"Unknown error\",",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_cel_widget/static/src/js/cel_language/lint.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 143,
-      "evidence": "currentTier: pendingReview.current_tier || 1,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_change_request_v2/static/src/components/review_panel/review_panel.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 144,
-      "evidence": "totalTiers: pendingReview.tier_review_ids?.length || 1,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_change_request_v2/static/src/components/review_panel/review_panel.js"
-    },
-    {
-      "rule": "javascript.number-parsing-is-lossy",
-      "severity": "high",
-      "line": 37,
-      "evidence": "const docId = parseInt(el.dataset.docId, 10);",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_change_request_v2/static/src/js/cr_review_documents.js"
-    },
-    {
-      "rule": "javascript.number-parsing-is-lossy",
-      "severity": "high",
-      "line": 36,
-      "evidence": "const partnerId = parseInt(row.dataset.partnerId, 10);",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_change_request_v2/static/src/js/cr_search_results_field.js"
-    },
-    {
-      "rule": "javascript.number-parsing-is-lossy",
-      "severity": "high",
-      "line": 47,
-      "evidence": "const page = parseInt(link.dataset.page);",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_change_request_v2/static/src/js/cr_search_results_field.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 27,
-      "evidence": "name: params.name || \"Change Request Details\",",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_change_request_v2/static/src/js/create_change_request.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 51,
-      "evidence": "name: params.name || \"Change Request\",",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_change_request_v2/static/src/js/create_change_request.js"
-    },
-    {
-      "rule": "javascript.number-parsing-is-lossy",
-      "severity": "high",
-      "line": 73,
-      "evidence": "limit: limit ? parseInt(limit, 10) : null,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_arch_parser.esm.js"
-    },
-    {
-      "rule": "javascript.number-parsing-is-lossy",
-      "severity": "high",
-      "line": 74,
-      "evidence": "countLimit: countLimit ? parseInt(countLimit, 10) : null,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_arch_parser.esm.js"
-    },
-    {
-      "rule": "javascript.json-parse-returns-any",
-      "severity": "critical",
-      "line": 397,
-      "evidence": "defaultCenter = JSON.parse(editInfo.default_center);",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 606,
-      "evidence": "return layer.begin_color || \"#3388ff\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 611,
-      "evidence": "const maxValue = config.max_value || 100;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 649,
-      "evidence": "return layer.begin_color || \"#3388ff\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 665,
-      "evidence": "const classCount = config.class_count || 5;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 702,
-      "evidence": "fillColor = layer.begin_color || \"#3388ff\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 913,
-      "evidence": "fillColor = layer.begin_color || \"#3388ff\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 1040,
-      "evidence": "const maxValue = config.max_value || 100;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 1087,
-      "evidence": "const classCount = config.class_count || 5;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/views/gis/gis_renderer/gis_renderer.esm.js"
-    },
-    {
-      "rule": "javascript.json-parse-returns-any",
-      "severity": "critical",
-      "line": 46,
-      "evidence": "const default_center = JSON.parse(editInfo.default_center);",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/widgets/gis_edit_map/field_gis_edit_map.esm.js"
-    },
-    {
-      "rule": "javascript.json-parse-returns-any",
-      "severity": "critical",
-      "line": 96,
-      "evidence": "const obj = JSON.parse(this.props.record.data[this.props.name]);",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/widgets/gis_edit_map/field_gis_edit_map.esm.js"
-    },
-    {
-      "rule": "javascript.json-parse-returns-any",
-      "severity": "critical",
-      "line": 140,
-      "evidence": "const obj = JSON.parse(record.data[fieldName]);",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/widgets/gis_edit_map/field_gis_edit_map.esm.js"
-    },
-    {
-      "rule": "javascript.json-parse-returns-any",
-      "severity": "critical",
-      "line": 220,
-      "evidence": "const geom = JSON.parse(this.props.record.data[this.props.name]);",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_gis/static/src/js/widgets/gis_edit_map/field_gis_edit_map.esm.js"
-    },
-    {
-      "rule": "javascript.number-parsing-is-lossy",
-      "severity": "high",
-      "line": 85,
-      "evidence": "const matchId = parseInt(ev.target.value, 10) || false;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_import_match/static/src/import_match_selector/import_match_selector.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 117,
-      "evidence": "return result || \"••••••••\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_pii_encryption/static/src/js/masked_field.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 18,
-      "evidence": "const programName = action.params?.name || \"Program\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_programs/static/src/js/create_program.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 15,
-      "evidence": "type: params.type || \"info\",",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_registry/static/src/js/custom_client_action.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 89,
-      "evidence": "this.state.searchMode = config.search_mode || \"unified\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_registry_search/static/src/js/registry_search_portal.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 90,
-      "evidence": "this.state.searchField = config.target_field || \"name\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_registry_search/static/src/js/registry_search_portal.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 91,
-      "evidence": "this.resultLimit = config.result_limit || 50;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_registry_search/static/src/js/registry_search_portal.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 92,
-      "evidence": "this.minSearchChars = config.min_chars || 3;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_registry_search/static/src/js/registry_search_portal.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 289,
-      "evidence": "const scope = this.state.scopeFilter || \"all\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_studio/static/src/js/logic_editor/variable_picker.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 295,
-      "evidence": "const applies = v.applies_to || \"both\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_studio/static/src/js/logic_editor/variable_picker.js"
-    },
-    {
-      "rule": "javascript.loose-equality-and-falsy-defaults",
-      "severity": "high",
-      "line": 313,
-      "evidence": "const applies = variable.applies_to || \"both\";",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/spp_studio/static/src/js/logic_editor/variable_picker.js"
-    },
-    {
-      "rule": "javascript.json-parse-returns-any",
-      "severity": "critical",
-      "line": 25,
-      "evidence": "const excData = JSON.parse(originalError.data.message);",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "server-tools/base_exception/static/src/js/base_exception.esm.js"
-    }
-  ]
-}

fieldtest-oca-2026-09.json

@@ -0,0 +1,1260 @@
+{
+  "stack": "odoo",
+  "roots": [
+    "server-tools",
+    "account-financial-tools"
+  ],
+  "files": 606,
+  "lines": 33960,
+  "checkers": 26,
+  "triggers": {
+    "files": 879,
+    "models_declared": 139,
+    "models_deleted": 123,
+    "declared_and_deleted": 113,
+    "never_deleted": 26,
+    "multi_company": true
+  },
+  "hits": [
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "severity": "critical",
+      "line": 71,
+      "evidence": "sudo().search() on ir.model runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "server-tools/attachment_delete_restrict/models/ir_attachment.py"
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "severity": "high",
+      "line": 14,
+      "evidence": "task_id declares no ondelete, so the ORM defaults it to 'set null' -- and task_id.filepath on line 37 reads through it, which yields False rather than raising once the parent is deleted, and this tree does delete attachment.synchronize.task",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "server-tools/attachment_synchronize/models/attachment_queue.py"
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "severity": "high",
+      "line": 64,
+      "evidence": "backend_id declares no ondelete, so the ORM defaults it to 'set null' -- and backend_id.fs on line 166 reads through it, which yields False rather than raising once the parent is deleted",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "server-tools/attachment_synchronize/models/attachment_synchronize_task.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 25,
+      "evidence": "deadline = datetime.now() - timedelta(days=days)",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/auditlog/models/autovacuum.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 29,
+      "evidence": "_compute_display_name() reads 'user_id.name' but @api.depends does not declare it -- the stored value goes stale when 'user_id.name' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "server-tools/auditlog/models/http_session.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 146,
+      "evidence": "filename = self.filename(datetime.now(), ext=rec.backup_format)",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/auto_backup/models/db_backup.py"
+    },
+    {
+      "rule": "python.path-join-does-not-contain-a-path",
+      "severity": "high",
+      "line": 154,
+      "evidence": "with open(os.path.join(rec.folder, filename), \"wb\") as destiny:",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/auto_backup/models/db_backup.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 171,
+      "evidence": "filename = self.filename(datetime.now(), ext=rec.backup_format)",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/auto_backup/models/db_backup.py"
+    },
+    {
+      "rule": "python.path-join-does-not-contain-a-path",
+      "severity": "high",
+      "line": 186,
+      "evidence": "os.path.join(rec.folder, filename), \"wb\"",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/auto_backup/models/db_backup.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 218,
+      "evidence": "now = datetime.now()",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/auto_backup/models/db_backup.py"
+    },
+    {
+      "rule": "odoo.constrains-must-list-every-field-read",
+      "severity": "critical",
+      "line": 100,
+      "evidence": "_check_inheriting_model() reads 'ttype' but @api.constrains declares only inheriting_model -- writing 'ttype' alone skips the check entirely",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/autovacuum_message_attachment/models/vacuum_rule.py"
+    },
+    {
+      "rule": "odoo.constrains-must-list-every-field-read",
+      "severity": "critical",
+      "line": 59,
+      "evidence": "check_exception_type_consistency() reads 'method' but @api.constrains declares only code, domain, exception_type, model -- writing 'method' alone skips the check entirely",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/base_exception/models/exception_rule.py"
+    },
+    {
+      "rule": "odoo.sql-needs-query-parameters",
+      "severity": "critical",
+      "line": 47,
+      "evidence": "the query handed to cr.execute() is built by an f-string -- pass the values as the second argument so the driver quotes them",
+      "suppressed": true,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/base_multi_image/hooks.py"
+    },
+    {
+      "rule": "odoo.depends-must-not-name-unread-fields",
+      "severity": "medium",
+      "line": 103,
+      "evidence": "_compute_show_technical() declares 'owner_id', 'owner_model' in @api.depends and never reads them -- the value recomputes on writes that cannot change it, and the decorator stops describing the method",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/base_multi_image/models/image.py"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "severity": "critical",
+      "line": 95,
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "server-tools/base_sequence_option/models/ir_sequence_option.py"
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "severity": "critical",
+      "line": 19,
+      "evidence": "assert type(date) is datetime.date or date is None, \"Wrong date\"",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/base_time_parameter/models/base.py"
+    },
+    {
+      "rule": "odoo.sql-needs-query-parameters",
+      "severity": "critical",
+      "line": 24,
+      "evidence": "the query handed to cr.execute() is built by an f-string -- pass the values as the second argument so the driver quotes them",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/database_autovacuum_tuning/models/database_autovacuum_tuning.py"
+    },
+    {
+      "rule": "odoo.commit-inside-a-loop-splits-the-transaction",
+      "severity": "high",
+      "line": 58,
+      "evidence": "cr.commit() inside a loop -- an exception on a later iteration leaves the earlier ones written, and the caller cannot roll the batch back",
+      "suppressed": true,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/database_cleanup/models/purge_columns.py"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "severity": "critical",
+      "line": 87,
+      "evidence": "sudo().search() on ir.model runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "server-tools/database_size/models/ir_model_size.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 268,
+      "evidence": "stamp = dt.utcnow().strftime(\"%H%M%S%f\")[:-3]",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/excel_import_export/models/xlsx_export.py"
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "severity": "high",
+      "line": 108,
+      "evidence": "result_model_id declares no ondelete, so the ORM defaults it to 'set null' -- and result_model_id.model on line 199 reads through it, which yields False rather than raising once the parent is deleted, and this tree does delete ir.model",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "server-tools/excel_import_export/models/xlsx_template.py"
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "severity": "high",
+      "line": 25,
+      "evidence": "server_id declares no ondelete, so the ORM defaults it to 'set null' -- and server_id.connect on line 139 reads through it, which yields False rather than raising once the parent is deleted",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "server-tools/fetchmail_attach_from_folder/models/fetchmail_server_folder.py"
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "severity": "critical",
+      "line": 42,
+      "evidence": "assert len(param) == len(records)",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/jsonifier/models/ir_exports_resolver.py"
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "severity": "critical",
+      "line": 3,
+      "evidence": "assert isinstance(parser, list)",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/jsonifier/models/utils.py"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "severity": "critical",
+      "line": 34,
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "server-tools/tracking_manager/models/ir_model.py"
+    },
+    {
+      "rule": "odoo.depends-must-not-name-unread-fields",
+      "severity": "medium",
+      "line": 101,
+      "evidence": "_compute_automatic_custom_tracking() declares 'active_custom_tracking' in @api.depends and never reads it -- the value recomputes on writes that cannot change it, and the decorator stops describing the method",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/tracking_manager/models/ir_model.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 135,
+      "evidence": "_compute_automatic_custom_tracking_domain() reads 'model' but @api.depends does not declare it -- the stored value goes stale when 'model' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "server-tools/tracking_manager/models/ir_model.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 30,
+      "evidence": "_compute_custom_tracking() reads 'model_id' but @api.depends does not declare it -- the stored value goes stale when 'model_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "server-tools/tracking_manager/models/ir_model_fields.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 30,
+      "evidence": "_compute_custom_tracking() reads 'model_id.automatic_custom_tracking' but @api.depends does not declare it -- the stored value goes stale when 'model_id.automatic_custom_tracking' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "server-tools/tracking_manager/models/ir_model_fields.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 31,
+      "evidence": "_compute_custom_tracking() reads 'model_id.automatic_custom_tracking_domain' but @api.depends does not declare it -- the stored value goes stale when 'model_id.automatic_custom_tracking_domain' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "server-tools/tracking_manager/models/ir_model_fields.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 52,
+      "evidence": "_compute_trackable() reads 'name' but @api.depends does not declare it -- the stored value goes stale when 'name' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "server-tools/tracking_manager/models/ir_model_fields.py"
+    },
+    {
+      "rule": "python.path-join-does-not-contain-a-path",
+      "severity": "high",
+      "line": 106,
+      "evidence": "logfile = os.path.join(full_path, filename)",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "server-tools/upgrade_analysis/models/upgrade_analysis.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 60,
+      "evidence": "_compute_account_asset_id() reads 'state' but @api.depends does not declare it -- the stored value goes stale when 'state' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_force_account/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 64,
+      "evidence": "_compute_account_asset_id() reads 'account_move_line_ids.account_id' but @api.depends does not declare it -- the stored value goes stale when 'account_move_line_ids.account_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_force_account/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 72,
+      "evidence": "_compute_account_asset_id() reads 'profile_id.account_asset_id' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.account_asset_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_force_account/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 311,
+      "evidence": "_compute_group_ids() reads 'profile_id.group_ids' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.group_ids' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_management/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 316,
+      "evidence": "_compute_method() reads 'profile_id.method' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.method' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_management/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 324,
+      "evidence": "_compute_method_number() reads 'profile_id.method_number' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.method_number' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_management/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 329,
+      "evidence": "_compute_method_period() reads 'profile_id.method_period' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.method_period' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_management/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 340,
+      "evidence": "_compute_method_progress_factor() reads 'profile_id.method_progress_factor' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.method_progress_factor' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_management/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 345,
+      "evidence": "_compute_method_time() reads 'profile_id.method_time' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.method_time' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_management/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 350,
+      "evidence": "_compute_days_calc() reads 'profile_id.days_calc' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.days_calc' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_management/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 355,
+      "evidence": "_compute_use_leap_years() reads 'profile_id.use_leap_years' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.use_leap_years' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_management/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 363,
+      "evidence": "_compute_prorrata() reads 'profile_id.prorata' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.prorata' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_management/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 368,
+      "evidence": "_compute_account_analytic_id() reads 'profile_id.account_analytic_id' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.account_analytic_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_management/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 373,
+      "evidence": "_compute_analytic_distribution() reads 'profile_id.analytic_distribution' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.analytic_distribution' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_management/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.constrains-must-list-every-field-read",
+      "severity": "critical",
+      "line": 398,
+      "evidence": "_check_profile_change() reads 'depreciation_line_ids' but @api.constrains declares only profile_id -- writing 'depreciation_line_ids' alone skips the check entirely",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_asset_management/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "severity": "critical",
+      "line": 1190,
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_asset_management/models/account_asset.py"
+    },
+    {
+      "rule": "odoo.recursion-check-on-hierarchy",
+      "severity": "high",
+      "line": 27,
+      "evidence": "parent_id = fields.Many2one(",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_asset_management/models/account_asset_group.py"
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "severity": "high",
+      "line": 174,
+      "evidence": "asset_profile_id declares no ondelete, so the ORM defaults it to 'set null' -- and asset_profile_id.account_asset_id on line 200 reads through it, which yields False rather than raising once the parent is deleted, and this tree does delete account.asset.profile",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_asset_management/models/account_move.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 192,
+      "evidence": "_compute_asset_profile() reads 'account_id.asset_profile_id' but @api.depends does not declare it -- the stored value goes stale when 'account_id.asset_profile_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_management/models/account_move.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 195,
+      "evidence": "_compute_asset_profile() reads 'asset_id.profile_id' but @api.depends does not declare it -- the stored value goes stale when 'asset_id.profile_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_asset_management/models/account_move.py"
+    },
+    {
+      "rule": "odoo.constrains-iterate-recordset",
+      "severity": "high",
+      "line": 80,
+      "evidence": "@api.constrains(\"sale_value\", \"company_id\")",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_asset_management/wizard/account_asset_remove.py"
+    },
+    {
+      "rule": "odoo.constrains-must-list-every-field-read",
+      "severity": "critical",
+      "line": 130,
+      "evidence": "_check_deposit() reads 'company_id' but @api.constrains declares only cash_journal_id, currency_id -- writing 'company_id' alone skips the check entirely",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 203,
+      "evidence": "_compute_is_reconcile() reads 'cash_journal_id' but @api.depends does not declare it -- the stored value goes stale when 'cash_journal_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 203,
+      "evidence": "_compute_is_reconcile() reads 'cash_journal_id.default_account_id' but @api.depends does not declare it -- the stored value goes stale when 'cash_journal_id.default_account_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 203,
+      "evidence": "_compute_is_reconcile() reads 'move_id.line_ids.account_id' but @api.depends does not declare it -- the stored value goes stale when 'move_id.line_ids.account_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py"
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "severity": "critical",
+      "line": 265,
+      "evidence": "assert self.operation_type == \"order\", \"Wrong operation type\"",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py"
+    },
+    {
+      "rule": "odoo.float-comparison-needs-float-utils",
+      "severity": "high",
+      "line": 271,
+      "evidence": "self.line_ids.filtered(lambda x: x.qty == 0).unlink()",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py"
+    },
+    {
+      "rule": "odoo.recursion-check-on-hierarchy",
+      "severity": "high",
+      "line": 381,
+      "evidence": "parent_id = fields.Many2one(\"account.cash.deposit\", ondelete=\"cascade\")",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 420,
+      "evidence": "_compute_subtotal() reads 'cash_unit_id.total_value' but @api.depends does not declare it -- the stored value goes stale when 'cash_unit_id.total_value' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py"
+    },
+    {
+      "rule": "odoo.prefer-sql-constraint",
+      "severity": "high",
+      "line": 68,
+      "evidence": "_check_cash_unit() compares its own declared column against a literal and does nothing else -- the same rule as a CHECK in models.Constraint holds for every writer, including imports, XML-RPC and sudo",
+      "suppressed": false,
+      "advisory": true,
+      "likelihood": "preference",
+      "path": "account-financial-tools/account_cash_deposit/models/cash_unit.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 114,
+      "evidence": "_compute_display_name() reads 'total_value' but @api.depends does not declare it -- the stored value goes stale when 'total_value' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_cash_deposit/models/cash_unit.py"
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "severity": "critical",
+      "line": 27,
+      "evidence": "assert self._context.get(\"active_model\") == \"account.cash.deposit\"",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_cash_deposit/wizards/account_cash_order_reception.py"
+    },
+    {
+      "rule": "odoo.check-company-on-relations",
+      "severity": "critical",
+      "line": 41,
+      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_check_deposit/models/account_check_deposit.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 132,
+      "evidence": "_compute_check_deposit() reads 'company_id.currency_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id.currency_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_check_deposit/models/account_check_deposit.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 145,
+      "evidence": "_compute_currency_id() reads 'company_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_check_deposit/models/account_check_deposit.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 146,
+      "evidence": "_compute_currency_id() reads 'journal_id.currency_id' but @api.depends does not declare it -- the stored value goes stale when 'journal_id.currency_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_check_deposit/models/account_check_deposit.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 151,
+      "evidence": "_compute_in_hand_check_account_id() reads 'journal_id.inbound_payment_method_line_ids' but @api.depends does not declare it -- the stored value goes stale when 'journal_id.inbound_payment_method_line_ids' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_check_deposit/models/account_check_deposit.py"
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "severity": "critical",
+      "line": 289,
+      "evidence": "assert sign in (1, -1)",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_dashboard_banner/models/account_dashboard_banner_cell.py"
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "severity": "high",
+      "line": 17,
+      "evidence": "mis_report_instance_id declares no ondelete, so the ORM defaults it to 'set null' -- and mis_report_instance_id.currency_id on line 105 reads through it, which yields False rather than raising once the parent is deleted",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_dashboard_banner_mis_builder/models/account_dashboard_banner_cell.py"
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "severity": "high",
+      "line": 35,
+      "evidence": "mis_report_instance_period_id declares no ondelete, so the ORM defaults it to 'set null' -- and mis_report_instance_period_id.date_from on line 103 reads through it, which yields False rather than raising once the parent is deleted",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_dashboard_banner_mis_builder/models/account_dashboard_banner_cell.py"
+    },
+    {
+      "rule": "odoo.constrains-must-list-every-field-read",
+      "severity": "critical",
+      "line": 47,
+      "evidence": "_check_mis_builder() reads 'cell_type' but @api.constrains declares only mis_report_instance_id, mis_report_kpi_id -- writing 'cell_type' alone skips the check entirely",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_dashboard_banner_mis_builder/models/account_dashboard_banner_cell.py"
+    },
+    {
+      "rule": "odoo.constrains-must-list-every-field-read",
+      "severity": "critical",
+      "line": 74,
+      "evidence": "_check_mis_builder() reads 'mis_report_instance_period_id' but @api.constrains declares only mis_report_instance_id, mis_report_kpi_id -- writing 'mis_report_instance_period_id' alone skips the check entirely",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_dashboard_banner_mis_builder/models/account_dashboard_banner_cell.py"
+    },
+    {
+      "rule": "odoo.prefer-sql-constraint",
+      "severity": "high",
+      "line": 46,
+      "evidence": "_check_dates() tests uniqueness in Python -- two concurrent transactions can both pass it and both insert; a UNIQUE models.Constraint cannot race",
+      "suppressed": false,
+      "advisory": true,
+      "likelihood": "preference",
+      "path": "account-financial-tools/account_fiscal_year/models/account_fiscal_year.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 23,
+      "evidence": "last_fiscal_year.date_to < datetime.now().date() + relativedelta(days=1)",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_fiscal_year_auto_create/models/account_fiscal_year.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 42,
+      "evidence": "_compute_entry_number_sequence() reads 'company_id.name' but @api.depends does not declare it -- the stored value goes stale when 'company_id.name' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_journal_general_sequence/models/account_journal.py"
+    },
+    {
+      "rule": "odoo.check-company-on-relations",
+      "severity": "critical",
+      "line": 144,
+      "evidence": "relation to account.journal with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.journal, and this codebase runs multi-company",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_loan/models/account_loan.py"
+    },
+    {
+      "rule": "odoo.check-company-on-relations",
+      "severity": "critical",
+      "line": 149,
+      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_loan/models/account_loan.py"
+    },
+    {
+      "rule": "odoo.check-company-on-relations",
+      "severity": "critical",
+      "line": 156,
+      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_loan/models/account_loan.py"
+    },
+    {
+      "rule": "odoo.check-company-on-relations",
+      "severity": "critical",
+      "line": 162,
+      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_loan/models/account_loan.py"
+    },
+    {
+      "rule": "odoo.check-company-on-relations",
+      "severity": "critical",
+      "line": 170,
+      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_loan/models/account_loan.py"
+    },
+    {
+      "rule": "odoo.depends-must-not-name-unread-fields",
+      "severity": "medium",
+      "line": 246,
+      "evidence": "_compute_total_amounts() declares 'currency_id' in @api.depends and never reads it -- the value recomputes on writes that cannot change it, and the decorator stops describing the method",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_loan/models/account_loan.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 132,
+      "evidence": "_compute_rate() reads 'pending_principal_amount' but @api.depends does not declare it -- the stored value goes stale when 'pending_principal_amount' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_loan/models/account_loan_line.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 139,
+      "evidence": "_compute_interests_amount() reads 'pending_principal_amount' but @api.depends does not declare it -- the stored value goes stale when 'pending_principal_amount' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_loan/models/account_loan_line.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 174,
+      "evidence": "_compute_principal_amount() reads 'interests_amount' but @api.depends does not declare it -- the stored value goes stale when 'interests_amount' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_loan/models/account_loan_line.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 174,
+      "evidence": "_compute_principal_amount() reads 'payment_amount' but @api.depends does not declare it -- the stored value goes stale when 'payment_amount' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_loan/models/account_loan_line.py"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "severity": "critical",
+      "line": 60,
+      "evidence": "sudo().search_read() on ir.model.fields runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_lock_date_update/wizards/account_update_lock_date.py"
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "severity": "high",
+      "line": 59,
+      "evidence": "oca_purchase_line_id declares no ondelete, so the ORM defaults it to 'set null' -- and oca_purchase_line_id.order_id on line 84 reads through it, which yields False rather than raising once the parent is deleted",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_move_line_purchase_info/models/account_move.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 84,
+      "evidence": "_compute_purchase_id() reads 'oca_purchase_line_id.order_id' but @api.depends does not declare it -- the stored value goes stale when 'oca_purchase_line_id.order_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_move_line_purchase_info/models/account_move.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 84,
+      "evidence": "_compute_purchase_id() reads 'purchase_line_id.order_id' but @api.depends does not declare it -- the stored value goes stale when 'purchase_line_id.order_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_move_line_purchase_info/models/account_move.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 17,
+      "evidence": "_compute_display_name() reads 'order_id' but @api.depends does not declare it -- the stored value goes stale when 'order_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_move_line_sale_info/models/sale_order_line.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 17,
+      "evidence": "_compute_display_name() reads 'order_id.name' but @api.depends does not declare it -- the stored value goes stale when 'order_id.name' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_move_line_sale_info/models/sale_order_line.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 17,
+      "evidence": "_compute_display_name() reads 'product_id' but @api.depends does not declare it -- the stored value goes stale when 'product_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_move_line_sale_info/models/sale_order_line.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 17,
+      "evidence": "_compute_display_name() reads 'product_id.name' but @api.depends does not declare it -- the stored value goes stale when 'product_id.name' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_move_line_sale_info/models/sale_order_line.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 18,
+      "evidence": "_compute_display_name() reads 'order_id.state' but @api.depends does not declare it -- the stored value goes stale when 'order_id.state' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_move_line_sale_info/models/sale_order_line.py"
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "severity": "high",
+      "line": 14,
+      "evidence": "tax_line_id declares no ondelete, so the ORM defaults it to 'set null' -- and tax_line_id.refund_repartition_line_ids on line 27 reads through it, which yields False rather than raising once the parent is deleted",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_move_line_tax_editable/models/account_move_line.py"
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "severity": "high",
+      "line": 132,
+      "evidence": "partner_id declares no ondelete, so the ORM defaults it to 'set null' -- and partner_id.category_id on line 206 reads through it, which yields False rather than raising once the parent is deleted",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_move_template/models/account_move_template.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 206,
+      "evidence": "_compute_analytic_distribution() reads 'partner_id.category_id' but @api.depends does not declare it -- the stored value goes stale when 'partner_id.category_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_move_template/models/account_move_template.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 209,
+      "evidence": "_compute_analytic_distribution() reads 'account_id.code' but @api.depends does not declare it -- the stored value goes stale when 'account_id.code' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_move_template/models/account_move_template.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 210,
+      "evidence": "_compute_analytic_distribution() reads 'template_id' but @api.depends does not declare it -- the stored value goes stale when 'template_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_move_template/models/account_move_template.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 210,
+      "evidence": "_compute_analytic_distribution() reads 'template_id.company_id' but @api.depends does not declare it -- the stored value goes stale when 'template_id.company_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_move_template/models/account_move_template.py"
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "severity": "critical",
+      "line": 117,
+      "evidence": "assert isinstance(overwrite_vals, dict)",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_move_template/wizard/account_move_template_run.py"
+    },
+    {
+      "rule": "odoo.check-company-on-relations",
+      "severity": "critical",
+      "line": 12,
+      "evidence": "relation to account.journal with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.journal, and this codebase runs multi-company",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_payroll_sheet_import/models/payroll_import_mapping.py"
+    },
+    {
+      "rule": "odoo.check-company-on-relations",
+      "severity": "critical",
+      "line": 36,
+      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_payroll_sheet_import/models/payroll_import_mapping.py"
+    },
+    {
+      "rule": "python.decimal-for-money-not-float",
+      "severity": "high",
+      "line": 110,
+      "evidence": "amount = float(raw_value)",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_payroll_sheet_import/wizard/payroll_import_wizard.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 53,
+      "evidence": "_compute_name() reads 'create_date' but @api.depends does not declare it -- the stored value goes stale when 'create_date' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_sequence_option/models/account_move.py"
+    },
+    {
+      "rule": "odoo.constrains-must-list-every-field-read",
+      "severity": "critical",
+      "line": 71,
+      "evidence": "_check_spread_account_balance_sheet() reads 'move_id' but @api.constrains declares only account_id, spread_id -- writing 'move_id' alone skips the check entirely",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_move_line.py"
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "severity": "high",
+      "line": 22,
+      "evidence": "template_id declares no ondelete, so the ORM defaults it to 'set null' -- and template_id.spread_type on line 310 reads through it, which yields False rather than raising once the parent is deleted, and this tree does delete account.spread.template",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py"
+    },
+    {
+      "rule": "odoo.check-company-on-relations",
+      "severity": "critical",
+      "line": 55,
+      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py"
+    },
+    {
+      "rule": "odoo.check-company-on-relations",
+      "severity": "critical",
+      "line": 62,
+      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py"
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "severity": "high",
+      "line": 113,
+      "evidence": "invoice_line_id declares no ondelete, so the ORM defaults it to 'set null' -- and invoice_line_id.name on line 537 reads through it, which yields False rather than raising once the parent is deleted",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 218,
+      "evidence": "_compute_all_posted() reads 'currency_id' but @api.depends does not declare it -- the stored value goes stale when 'currency_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 218,
+      "evidence": "_compute_all_posted() reads 'currency_id.rounding' but @api.depends does not declare it -- the stored value goes stale when 'currency_id.rounding' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 268,
+      "evidence": "_compute_journal_id() reads 'company_id.default_spread_expense_journal_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id.default_spread_expense_journal_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 270,
+      "evidence": "_compute_journal_id() reads 'company_id.default_spread_revenue_journal_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id.default_spread_revenue_journal_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 280,
+      "evidence": "_compute_debit_account_id() reads 'company_id.default_spread_revenue_account_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id.default_spread_revenue_account_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py"
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "severity": "critical",
+      "line": 288,
+      "evidence": "_compute_credit_account_id() reads 'company_id.default_spread_expense_account_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id.default_spread_expense_account_id' changes",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "construct",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py"
+    },
+    {
+      "rule": "odoo.check-company-on-relations",
+      "severity": "critical",
+      "line": 20,
+      "evidence": "relation to account.journal with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.journal, and this codebase runs multi-company",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread_template.py"
+    },
+    {
+      "rule": "odoo.check-company-on-relations",
+      "severity": "critical",
+      "line": 33,
+      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread_template.py"
+    },
+    {
+      "rule": "odoo.check-company-on-relations",
+      "severity": "critical",
+      "line": 41,
+      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread_template.py"
+    },
+    {
+      "rule": "odoo.check-company-on-relations",
+      "severity": "critical",
+      "line": 176,
+      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread_template.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 45,
+      "evidence": "move_date = writeoff_vals.get(\"date\", datetime.now())",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "account-financial-tools/purchase_unreconciled/models/account_move_line.py"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "severity": "critical",
+      "line": 14,
+      "evidence": "sudo().search() on ir.model runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "account-financial-tools/purchase_unreconciled/wizards/purchase_unreconciled_exceeded.py"
+    }
+  ]
+}

fieldtest-openspp-2026-09.json

@@ -5,7 +5,7 @@
   ],
   "files": 1351,
   "lines": 226937,
-  "checkers": 18,
+  "checkers": 26,
   "triggers": {
     "files": 2265,
     "models_declared": 492,
@@ -15,6 +15,26 @@
     "multi_company": true
   },
   "hits": [
+    {
+      "rule": "python.assert-is-not-validation",
+      "severity": "critical",
+      "line": 314,
+      "evidence": "assert \"klass_dotted_path\" in value[\"handler\"]",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "endpoint_route_handler/registry.py"
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "severity": "critical",
+      "line": 315,
+      "evidence": "assert \"method_name\" in value[\"handler\"]",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "endpoint_route_handler/registry.py"
+    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
@@ -55,6 +75,26 @@
       "likelihood": "defect",
       "path": "fastapi/models/fastapi_endpoint_demo.py"
     },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 745,
+      "evidence": "f\"**Generated:** {__import__('datetime').datetime.now().isoformat()}\",",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "scripts/compliance/checker.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 813,
+      "evidence": "\"generated\": __import__(\"datetime\").datetime.now().isoformat(),",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "scripts/compliance/checker.py"
+    },
     {
       "rule": "odoo.ondelete-is-a-decision",
       "severity": "high",
@@ -135,6 +175,16 @@
       "likelihood": "defect",
       "path": "spp_analytics/models/indicator_registry.py"
     },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 97,
+      "evidence": "\"computed_at\": datetime.now().isoformat(),",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_analytics/models/service_aggregation.py"
+    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
@@ -225,6 +275,46 @@
       "likelihood": "preference",
       "path": "spp_api_v2/models/api_path_filter.py"
     },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 178,
+      "evidence": "revoked_at=datetime.utcnow(),",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_api_v2/routers/consent.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 270,
+      "evidence": "timestamp=datetime.utcnow(),",
+      "suppressed": true,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_api_v2/routers/consent.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 217,
+      "evidence": "now = datetime.utcnow()",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_api_v2/routers/oauth.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 142,
+      "evidence": "now = datetime.now()",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_api_v2/services/group_service.py"
+    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
@@ -235,6 +325,26 @@
       "likelihood": "defect",
       "path": "spp_api_v2/services/group_service.py"
     },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 748,
+      "evidence": "ended_datetime = datetime.now()",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_api_v2/services/group_service.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 886,
+      "evidence": "now = datetime.now()",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_api_v2/services/group_service.py"
+    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
@@ -245,6 +355,16 @@
       "likelihood": "defect",
       "path": "spp_api_v2/services/group_service.py"
     },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 1100,
+      "evidence": "now = datetime.now()",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_api_v2/services/group_service.py"
+    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
@@ -725,6 +845,46 @@
       "likelihood": "defect",
       "path": "spp_attendance/controllers/controllers.py"
     },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 198,
+      "evidence": "current_date = datetime.now().strftime(\"%Y-%m-%d\")",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_attendance/controllers/controllers.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 351,
+      "evidence": "current_date = datetime.now().strftime(\"%Y-%m-%d\")",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_attendance/controllers/controllers.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 198,
+      "evidence": "today = datetime.utcnow().strftime(\"%Y-%m-%d\")",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_audit/models/spp_audit_backend.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 216,
+      "evidence": "today = datetime.utcnow().strftime(\"%Y-%m-%d\")",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_audit/models/spp_audit_backend.py"
+    },
     {
       "rule": "odoo.recursion-check-on-hierarchy",
       "severity": "high",
@@ -825,6 +985,16 @@
       "likelihood": "unmeasured",
       "path": "spp_cel_domain/models/cel_expression.py"
     },
+    {
+      "rule": "python.eval-and-pickle-execute-their-input",
+      "severity": "critical",
+      "line": 417,
+      "evidence": "and secure than regex-based conversion to Python eval().",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_cel_domain/models/cel_service.py"
+    },
     {
       "rule": "odoo.constrains-must-list-every-field-read",
       "severity": "critical",
@@ -895,6 +1065,36 @@
       "likelihood": "preference",
       "path": "spp_cel_domain/models/data_provider.py"
     },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 92,
+      "evidence": "return datetime.now()",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_cel_domain/services/cel_functions.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 757,
+      "evidence": ">>> two_hours_ago = datetime.now() - timedelta(hours=2)",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_cel_domain/services/cel_parser.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 766,
+      "evidence": "delta = datetime.now() - datetime_value",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_cel_domain/services/cel_parser.py"
+    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -1255,6 +1455,16 @@
       "likelihood": "construct",
       "path": "spp_dci_client_sr/models/sr_record.py"
     },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 52,
+      "evidence": "now = datetime.now()",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_dci_server/middleware/rate_limit.py"
+    },
     {
       "rule": "odoo.prefer-sql-constraint",
       "severity": "high",
@@ -1605,6 +1815,26 @@
       "likelihood": "unmeasured",
       "path": "spp_drims/wizard/report_4w_wizard.py"
     },
+    {
+      "rule": "python.path-join-does-not-contain-a-path",
+      "severity": "high",
+      "line": 486,
+      "evidence": "file_path = os.path.join(data_path, file_config[\"filename\"])",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_drims_sl_demo/wizard/drims_demo_generator.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 110,
+      "evidence": "curr_datetime = f\"{datetime.now().isoformat(timespec='milliseconds')}Z\"",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_encryption/models/encryption_provider.py"
+    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -1715,6 +1945,16 @@
       "likelihood": "unmeasured",
       "path": "spp_farmer_registry_demo/models/farmer_demo_generator.py"
     },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 1127,
+      "evidence": "enrollment_dt = datetime.datetime.now()",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_farmer_registry_demo/models/seeded_farm_generator.py"
+    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
@@ -1995,6 +2235,16 @@
       "likelihood": "preference",
       "path": "spp_grm_demo/models/generate_tickets.py"
     },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 922,
+      "evidence": "now = datetime.now()",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_grm_demo/models/generate_tickets.py"
+    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -2165,6 +2415,46 @@
       "likelihood": "unmeasured",
       "path": "spp_mis_demo_v2/models/mis_demo_generator.py"
     },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 3388,
+      "evidence": "current_period = datetime.datetime.now().strftime(\"%Y-%m\")",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_mis_demo_v2/models/mis_demo_generator.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 3390,
+      "evidence": "(datetime.datetime.now() - datetime.timedelta(days=30 * i)).strftime(\"%Y-%m\")",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_mis_demo_v2/models/mis_demo_generator.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 3740,
+      "evidence": "now = datetime.datetime.now()",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_mis_demo_v2/models/mis_demo_generator.py"
+    },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 406,
+      "evidence": "enrollment_dt = datetime.datetime.now()",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_mis_demo_v2/models/seeded_volume_generator.py"
+    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -2355,6 +2645,26 @@
       "likelihood": "unmeasured",
       "path": "spp_programs/models/accounting/fund_report.py"
     },
+    {
+      "rule": "python.decimal-for-money-not-float",
+      "severity": "high",
+      "line": 300,
+      "evidence": "\"base_amount\": float(self.amount or 0.0),",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_programs/models/cel/entitlement_amount_cel.py"
+    },
+    {
+      "rule": "python.decimal-for-money-not-float",
+      "severity": "high",
+      "line": 316,
+      "evidence": "amount = float(result)",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_programs/models/cel/entitlement_amount_cel.py"
+    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
@@ -2465,6 +2775,16 @@
       "likelihood": "unmeasured",
       "path": "spp_programs/models/managers/payment_manager.py"
     },
+    {
+      "rule": "python.naive-and-aware-datetimes-do-not-compare",
+      "severity": "medium",
+      "line": 141,
+      "evidence": "new_cycle = cm.new_cycle(\"Cycle 1\", datetime.now(), 1)",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_programs/models/managers/program_manager.py"
+    },
     {
       "rule": "odoo.onchange-is-not-validation",
       "severity": "critical",
@@ -2565,6 +2885,16 @@
       "likelihood": "preference",
       "path": "spp_registry/models/reg_id.py"
     },
+    {
+      "rule": "python.assert-is-not-validation",
+      "severity": "critical",
+      "line": 165,
+      "evidence": "assert side in [\"source\", \"destination\"]",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "unmeasured",
+      "path": "spp_registry/models/reg_relationship.py"
+    },
     {
       "rule": "odoo.constrains-must-list-every-field-read",
       "severity": "critical",

fieldtest-py-2026-09.json

@@ -1,50 +0,0 @@
-{
-  "stack": "python",
-  "roots": [
-    "llm-router-main",
-    "scripts"
-  ],
-  "files": 42,
-  "lines": 10225,
-  "checkers": 8,
-  "triggers": {
-    "files": 40,
-    "models_declared": 0,
-    "models_deleted": 0,
-    "declared_and_deleted": 0,
-    "never_deleted": 0,
-    "multi_company": true
-  },
-  "hits": [
-    {
-      "rule": "python.assert-is-not-validation",
-      "severity": "critical",
-      "line": 129,
-      "evidence": "correlation_id=\"req-1\")",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "nexa/llm-router-main/router/security/audit.py"
-    },
-    {
-      "rule": "python.naive-and-aware-datetimes-do-not-compare",
-      "severity": "medium",
-      "line": 745,
-      "evidence": "f\"**Generated:** {__import__('datetime').datetime.now().isoformat()}\",",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/scripts/compliance/checker.py"
-    },
-    {
-      "rule": "python.naive-and-aware-datetimes-do-not-compare",
-      "severity": "medium",
-      "line": 813,
-      "evidence": "\"generated\": __import__(\"datetime\").datetime.now().isoformat(),",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "OpenSPP2-19.0/scripts/compliance/checker.py"
-    }
-  ]
-}

fieldtest-ts-2026-09.json

@@ -1,2790 +0,0 @@
-{
-  "stack": "typescript",
-  "roots": [
-    "hono",
-    "trpc"
-  ],
-  "files": 781,
-  "lines": 73762,
-  "checkers": 8,
-  "triggers": {
-    "files": 0,
-    "models_declared": 0,
-    "models_deleted": 0,
-    "declared_and_deleted": 0,
-    "never_deleted": 0,
-    "multi_company": false
-  },
-  "hits": [
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 4,
-      "evidence": "export const buildPage = ({ jsx, Fragment }: { jsx: any; Fragment: any }) => {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/benchmarks/jsx/src/page-react.tsx"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 4,
-      "evidence": "export const buildPage = ({ jsx, Fragment }: { jsx: any; Fragment: any }) => {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/benchmarks/jsx/src/page.tsx"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 46,
-      "evidence": "props: any",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/context.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 51,
-      "evidence": "exports?: any",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/context.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 333,
-      "evidence": "applicationHandler: (request: Request, ...args: any) => Response | Promise<Response>,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/hono-base.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 21,
-      "evidence": "json: any",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/request.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 123,
-      "evidence": "#getParamValue(paramKey: any): string | undefined {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/request.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 2547,
-      "evidence": "input: any",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 2548,
-      "evidence": "output: any",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 2662,
-      "evidence": "type MergeMiddlewareResponse<T> = T extends (c: any, next: any) => Promise<infer R>",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 2668,
-      "evidence": ": T extends (c: any, next: any) => infer R",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 2684,
-      "evidence": "json: any",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 2750,
-      "evidence": "export type ExtractHandlerResponse<T> = T extends (c: any, next: any) => Promise<infer R>",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 2756,
-      "evidence": ": T extends (c: any, next: any) => infer R",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 11,
-      "evidence": "Custom?: any",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/adapter/aws-lambda/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 18,
-      "evidence": "props: any",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/adapter/cloudflare-pages/handler.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 49,
-      "evidence": "return content as unknown as ReadableStream",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/adapter/cloudflare-workers/utils.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 6,
-      "evidence": "): ((req: Request, context: any) => Response | Promise<Response>) => {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/adapter/netlify/handler.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 7,
-      "evidence": "return (req: Request, context: any) => {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/adapter/netlify/handler.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 15,
-      "evidence": "const _fetchRes = (await fetchRes) as unknown as Response & {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/client/fetch-result-please.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 16,
-      "evidence": "_data: any",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/client/fetch-result-please.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 22,
-      "evidence": "_bodyInit?: any",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/client/fetch-result-please.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 50,
-      "evidence": "public detail?: any",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/client/fetch-result-please.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 54,
-      "evidence": "public code?: any",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/client/fetch-result-please.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 58,
-      "evidence": "public log?: any",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/client/fetch-result-please.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 62,
-      "evidence": "public statusCode?: any",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/client/fetch-result-please.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 66,
-      "evidence": "options: { detail?: any; code?: any; statusCode?: number; log?: any } = {}",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/client/fetch-result-please.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 242,
-      "evidence": "options: any | undefined",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/client/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 268,
-      "evidence": "options: any | undefined",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/client/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 275,
-      "evidence": "args: any,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/client/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 325,
-      "evidence": "args: any[]",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/client/types.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 195,
-      "evidence": "children ? (children as unknown as CssClassName)[STYLE_STRING] : ''",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/helper/css/index.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 357,
-      "evidence": "createHandlers: CreateHandlersInterface<E, P> = (...handlers: any) => {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/helper/factory/index.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 240,
-      "evidence": "forGetInfoURLRequest = maybeRequest as unknown as AddedSSGDataRequest",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/helper/ssg/ssg.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 150,
-      "evidence": "} else if ((child as unknown as HtmlEscaped).isEscaped) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/base.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 152,
-      "evidence": "const callbacks = (child as unknown as HtmlEscapedString).callbacks",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/base.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 223,
-      "evidence": "get ref(): any {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/base.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 88,
-      "evidence": "(awaitedFallback as unknown as HtmlEscapedString).callbacks",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/components.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 109,
-      "evidence": "resArray = children.map(resolveChildEarly) as unknown as HtmlEscapedString[]",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/components.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 19,
-      "evidence": "type AnyAttributes = { [attributeName: string]: any }",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/intrinsic-elements.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 39,
-      "evidence": "} else if (typeof v === 'number' || (v as unknown as HtmlEscaped).isEscaped) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/jsx-runtime.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 51,
-      "evidence": "export const Suspense: FC<PropsWithChildren<{ fallback: any }>> = async ({",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/streaming.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 64,
-      "evidence": "const stackNode = { [DOM_STASH]: [0, []] } as unknown as NodeObject",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/streaming.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 13,
-      "evidence": "> = (({ children, fallback, fallbackRender, onError }: any) => {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/components.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 15,
-      "evidence": ";(res as any)[DOM_ERROR_HANDLER] = (err: any) => {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/components.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 25,
-      "evidence": "export const Suspense: FC<PropsWithChildren<{ fallback: any }>> = (({",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/components.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 28,
-      "evidence": "}: any) => {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/components.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 30,
-      "evidence": ";(res as any)[DOM_ERROR_HANDLER] = (err: any, retry: () => void) => {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/components.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 15,
-      "evidence": "const props: { children: any } = {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/context.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 136,
-      "evidence": "(c) => (c as unknown as CssClassName)[STYLE_STRING]",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/css.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 193,
-      "evidence": "return cssClassName as unknown as string",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/css.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 32,
-      "evidence": "export type ErrorHandler = (error: any, retry: () => void) => Child | undefined",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/render.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 216,
-      "evidence": ";(container as unknown as HTMLInputElement).value = normalizeFormValue(value)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/render.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 612,
-      "evidence": "if ((oldChild as unknown as NodeString).t !== child.t) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/render.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 613,
-      "evidence": ";(oldChild as unknown as NodeString).t = child.t // update text content",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/render.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 614,
-      "evidence": ";(oldChild as unknown as NodeString).d = true",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/render.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 244,
-      "evidence": "} as unknown as JSXNode & { e?: HTMLElement; p?: PreserveNodeType }",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/intrinsic-element/components.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 267,
-      "evidence": "} as unknown as JSXNode",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/intrinsic-element/components.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 279,
-      "evidence": "} as unknown as JSXNode",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/intrinsic-element/components.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 291,
-      "evidence": "} as unknown as JSXNode",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/intrinsic-element/components.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 309,
-      "evidence": "} as unknown as JSXNode",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/intrinsic-element/components.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 365,
-      "evidence": "tag: FormContext as unknown as Function,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/dom/intrinsic-element/components.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 130,
-      "evidence": ") as unknown as HtmlEscapedString",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/jsx/intrinsic-element/components.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 49,
-      "evidence": "(props: any) => component(props, c),",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/middleware/jsx-renderer/index.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 281,
-      "evidence": "const clone = values[1].slice() as unknown as string[]",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/middleware/secure-headers/secure-headers.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 47,
-      "evidence": "}, duration) as unknown as number",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/middleware/timeout/index.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 147,
-      "evidence": "all[1][i] = all[1][i] ? [] : (0 as unknown as HandlerData<string>)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/router/reg-exp-router/prepared-router.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 141,
-      "evidence": "request.bodyCache.formData = formDataPromise as unknown as FormData",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/utils/body.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 256,
-      "evidence": "nestedForm = nestedForm[key] as unknown as BodyData",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/utils/body.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 151,
-      "evidence": "str = (str as unknown as string).toString() // HtmlEscapedString object to string",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/utils/html.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 154,
-      "evidence": "str = await (str as unknown as Promise<string>)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/utils/html.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 28,
-      "evidence": "export type ExtractValidationResponse<VF> = VF extends (value: any, c: any) => infer R",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/validator/validator.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 175,
-      "evidence": "export type ExtractValidatorOutput<VF> = VF extends (value: any, c: any) => infer R",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "hono/src/validator/validator.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 3,
-      "evidence": "const baseUrl = process.env.PLAYWRIGHT_TEST_BASE_URL || 'http://localhost:3000';",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.experimental/next-app-dir/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 8,
-      "evidence": "headless: !!process.env.CI || !!process.env.PLAYWRIGHT_HEADLESS,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.experimental/next-app-dir/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 17,
-      "evidence": "channel: process.env.CI ? 'chrome' : undefined,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.experimental/next-app-dir/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 19,
-      "evidence": "retries: process.env.CI ? 3 : 0,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.experimental/next-app-dir/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 18,
-      "evidence": "clientId: process.env.GITHUB_ID!,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.experimental/next-app-dir/src/auth.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 20,
-      "evidence": "clientSecret: process.env.GITHUB_SECRET!,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.experimental/next-app-dir/src/auth.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 9,
-      "evidence": "if (process.env.NODE_ENV === 'development') {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.experimental/next-app-dir/src/app/posts/layout.tsx"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 39,
-      "evidence": "export const db = process.env.POSTGRES_URL ? pgDb() : mockDb();",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.experimental/next-app-dir/src/app/posts/_lib/db.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 37,
-      "evidence": "process.env.NODE_ENV === 'development' ||",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.experimental/next-app-dir/src/trpc/rq-client.tsx"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 10,
-      "evidence": "if (process.env.VERCEL_URL) return `https://${process.env.VERCEL_URL}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.experimental/next-app-dir/src/trpc/shared.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 5,
-      "evidence": "eslint: { ignoreDuringBuilds: !!process.env.CI },",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/diagnostics-big-router/next.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 15,
-      "evidence": "if (process.env.VERCEL_URL) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/diagnostics-big-router/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 16,
-      "evidence": "return `https://${process.env.VERCEL_URL}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/diagnostics-big-router/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 20,
-      "evidence": "return `http://localhost:${process.env.PORT ?? 3000}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/diagnostics-big-router/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 19,
-      "evidence": "export function genericRouter<TSchema extends (value: any) => unknown>(",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/internal-types-export/src/server.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 5,
-      "evidence": "eslint: { ignoreDuringBuilds: !!process.env.CI },",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/ssg-infinite-serialization/next.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 3,
-      "evidence": "const baseUrl = process.env.PLAYWRIGHT_TEST_BASE_URL || 'http://localhost:3000';",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/ssg-infinite-serialization/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 8,
-      "evidence": "headless: !!process.env.CI || !!process.env.PLAYWRIGHT_HEADLESS,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/ssg-infinite-serialization/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 10,
-      "evidence": "if (process.env.VERCEL_URL) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/ssg-infinite-serialization/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 11,
-      "evidence": "return `https://${process.env.VERCEL_URL}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/ssg-infinite-serialization/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 13,
-      "evidence": "return `http://localhost:${process.env.PORT ?? 3000}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/ssg-infinite-serialization/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 5,
-      "evidence": "eslint: { ignoreDuringBuilds: !!process.env.CI },",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/ssg/next.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 3,
-      "evidence": "const baseUrl = process.env.PLAYWRIGHT_TEST_BASE_URL || 'http://localhost:3000';",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/ssg/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 8,
-      "evidence": "headless: !!process.env.CI || !!process.env.PLAYWRIGHT_HEADLESS,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/ssg/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 17,
-      "evidence": "channel: process.env.CI ? 'chrome' : undefined,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/ssg/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 20,
-      "evidence": "retries: process.env.CI ? 3 : 0,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/ssg/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 10,
-      "evidence": "if (process.env.VERCEL_URL) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/ssg/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 11,
-      "evidence": "return `https://${process.env.VERCEL_URL}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/ssg/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 13,
-      "evidence": "return `http://localhost:${process.env.PORT ?? 3000}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/.test/ssg/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.derive-type-from-schema",
-      "severity": "high",
-      "line": 5,
-      "evidence": "interface Post {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/fastify-server/src/server/router/routers/posts.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 3,
-      "evidence": "const baseUrl = process.env.PLAYWRIGHT_TEST_BASE_URL || 'http://localhost:3000';",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/minimal-content-types/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 8,
-      "evidence": "headless: !!process.env.CI || !!process.env.PLAYWRIGHT_HEADLESS,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/minimal-content-types/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 18,
-      "evidence": "retries: process.env.CI ? 3 : 0,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/minimal-content-types/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 4,
-      "evidence": "const baseUrl = process.env.PLAYWRIGHT_TEST_BASE_URL || 'http://localhost:3000';",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/minimal-react/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 9,
-      "evidence": "headless: !!process.env.CI || !!process.env.PLAYWRIGHT_HEADLESS,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/minimal-react/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 18,
-      "evidence": "channel: process.env.CI ? 'chrome' : undefined,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/minimal-react/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 5,
-      "evidence": "eslint: { ignoreDuringBuilds: !!process.env.CI },",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-big-router/next.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 13,
-      "evidence": "if (process.env.VERCEL_URL) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-big-router/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 14,
-      "evidence": "return `https://${process.env.VERCEL_URL}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-big-router/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 18,
-      "evidence": "return `http://localhost:${process.env.PORT ?? 3000}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-big-router/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 5,
-      "evidence": "eslint: { ignoreDuringBuilds: !!process.env.CI },",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-edge-runtime/next.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 13,
-      "evidence": "if (process.env.VERCEL_URL) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-edge-runtime/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 14,
-      "evidence": "return `https://${process.env.VERCEL_URL}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-edge-runtime/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 18,
-      "evidence": "return `http://localhost:${process.env.PORT ?? 3000}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-edge-runtime/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 5,
-      "evidence": "eslint: { ignoreDuringBuilds: !!process.env.CI },",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-formdata/next.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 20,
-      "evidence": "if (process.env.VERCEL_URL) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-formdata/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 21,
-      "evidence": "return `https://${process.env.VERCEL_URL}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-formdata/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 25,
-      "evidence": "return `http://localhost:${process.env.PORT ?? 3000}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-formdata/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 55,
-      "evidence": "process.env.NODE_ENV === 'development' ||",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-formdata/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 5,
-      "evidence": "eslint: { ignoreDuringBuilds: !!process.env.CI },",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-minimal-starter/next.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 15,
-      "evidence": "if (process.env.VERCEL_URL) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-minimal-starter/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 16,
-      "evidence": "return `https://${process.env.VERCEL_URL}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-minimal-starter/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 20,
-      "evidence": "return `http://localhost:${process.env.PORT ?? 3000}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-minimal-starter/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 5,
-      "evidence": "headless: !!process.env.CI || !!process.env.PLAYWRIGHT_HEADLESS,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-starter/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 14,
-      "evidence": "reporter: process.env.CI ? 'github' : 'list',",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-starter/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 18,
-      "evidence": "channel: process.env.CI ? 'chrome' : undefined,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-starter/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 19,
-      "evidence": "video: process.env.CI ? 'off' : 'on',",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-starter/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 21,
-      "evidence": "retries: process.env.CI ? 3 : 0,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-starter/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 23,
-      "evidence": "command: process.env.CI ? 'npm run start' : 'npm run dev',",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-starter/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 24,
-      "evidence": "reuseExistingServer: Boolean(process.env.TEST_LOCAL === '1'),",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-starter/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 16,
-      "evidence": "if (process.env.VERCEL_URL) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-starter/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 17,
-      "evidence": "return `https://${process.env.VERCEL_URL}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-starter/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 21,
-      "evidence": "if (process.env.RENDER_INTERNAL_HOSTNAME) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-starter/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 22,
-      "evidence": "return `http://${process.env.RENDER_INTERNAL_HOSTNAME}:${process.env.PORT}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-starter/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 26,
-      "evidence": "return `http://127.0.0.1:${process.env.PORT ?? 3000}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-starter/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 62,
-      "evidence": "process.env.NODE_ENV === 'development' ||",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-starter/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 3,
-      "evidence": "const baseUrl = process.env.PLAYWRIGHT_TEST_BASE_URL || 'http://localhost:3000';",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-todomvc/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 8,
-      "evidence": "headless: !!process.env.CI || !!process.env.PLAYWRIGHT_HEADLESS,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-todomvc/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 17,
-      "evidence": "channel: process.env.CI ? 'chrome' : undefined,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-todomvc/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 19,
-      "evidence": "retries: process.env.CI ? 3 : 0,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-todomvc/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 10,
-      "evidence": "if (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = prisma;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-todomvc/src/server/prisma.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 14,
-      "evidence": "if (process.env.VERCEL_URL) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-todomvc/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 15,
-      "evidence": "return `https://${process.env.VERCEL_URL}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-todomvc/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 19,
-      "evidence": "if (process.env.RENDER_INTERNAL_HOSTNAME) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-todomvc/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 20,
-      "evidence": "return `http://${process.env.RENDER_INTERNAL_HOSTNAME}:${process.env.PORT}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-todomvc/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 24,
-      "evidence": "return `http://localhost:${process.env.PORT ?? 3000}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-todomvc/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 46,
-      "evidence": "process.env.NODE_ENV === 'development' ||",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-todomvc/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 12,
-      "evidence": "APP_URL: process.env.APP_URL,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/next.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 13,
-      "evidence": "WS_URL: process.env.WS_URL,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/next.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 16,
-      "evidence": "eslint: { ignoreDuringBuilds: !!process.env.CI },",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/next.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 3,
-      "evidence": "const baseUrl = process.env.PLAYWRIGHT_TEST_BASE_URL || 'http://localhost:3000';",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 8,
-      "evidence": "headless: !!process.env.CI || !!process.env.PLAYWRIGHT_HEADLESS,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 17,
-      "evidence": "channel: process.env.CI ? 'chrome' : undefined,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 19,
-      "evidence": "retries: process.env.CI ? 3 : 0,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 297,
-      "evidence": "{process.env.NODE_ENV !== 'production' && (",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/src/pages/index.tsx"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 7,
-      "evidence": "process.env.NODE_ENV === 'test' ||",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/src/pages/api/auth/[...nextauth].ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 8,
-      "evidence": "process.env.RAILWAY_ENVIRONMENT_NAME?.includes('-pr-'); // example: 'trpc-pr-5821'",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/src/pages/api/auth/[...nextauth].ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 15,
-      "evidence": "process.env.NODE_ENV === 'development'",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/src/server/prisma.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 20,
-      "evidence": "if (process.env.NODE_ENV !== 'production') {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/src/server/prisma.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 11,
-      "evidence": "const port = parseInt(process.env.PORT || '3000', 10);",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/src/server/prodServer.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 12,
-      "evidence": "const dev = process.env.NODE_ENV !== 'production';",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/src/server/prodServer.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 46,
-      "evidence": "dev ? 'development' : process.env.NODE_ENV",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/src/server/prodServer.ts"
-    },
-    {
-      "rule": "typescript.derive-type-from-schema",
-      "severity": "high",
-      "line": 23,
-      "evidence": "interface MyEvents {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/src/server/routers/post.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 79,
-      "evidence": "(process.env.NODE_ENV === 'development' &&",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-prisma-websockets-starter/src/utils/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 3,
-      "evidence": "const DB_URL = process.env.DATABASE_URL ?? process.env.POSTGRES_URL;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-sse-chat/drizzle.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 31,
-      "evidence": "if (process.env.APP_URL) return process.env.APP_URL;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-sse-chat/src/app/providers.tsx"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 32,
-      "evidence": "return `http://localhost:${process.env.PORT ?? 3000}`;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-sse-chat/src/app/providers.tsx"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 13,
-      "evidence": "process.env.NODE_ENV === 'test' ||",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-sse-chat/src/server/auth.tsx"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 14,
-      "evidence": "process.env.RAILWAY_ENVIRONMENT_NAME?.includes('-pr-'); // example: 'trpc-pr-5821'",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-sse-chat/src/server/auth.tsx"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 54,
-      "evidence": "if (process.env.NODE_ENV === 'development') {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-sse-chat/src/server/trpc.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 5,
-      "evidence": "const DB_URL = process.env.DATABASE_URL ?? process.env.POSTGRES_URL;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-sse-chat/src/server/db/client.ts"
-    },
-    {
-      "rule": "typescript.derive-type-from-schema",
-      "severity": "high",
-      "line": 21,
-      "evidence": "export interface MyEvents {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-sse-chat/src/server/routers/channel.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 5,
-      "evidence": "APP_URL: process.env.APP_URL ?? 'http://localhost:3000',",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-websockets-encoder/next.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 6,
-      "evidence": "WS_URL: process.env.WS_URL ?? 'ws://localhost:3001',",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-websockets-encoder/next.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 8,
-      "evidence": "eslint: { ignoreDuringBuilds: !!process.env.CI },",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-websockets-encoder/next.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 10,
-      "evidence": "const port = parseInt(process.env.PORT ?? '3000', 10);",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-websockets-encoder/src/server/prodServer.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 11,
-      "evidence": "const dev = process.env.NODE_ENV !== 'production';",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-websockets-encoder/src/server/prodServer.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 48,
-      "evidence": "dev ? 'development' : process.env.NODE_ENV",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/next-websockets-encoder/src/server/prodServer.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 5,
-      "evidence": "headless: !!process.env.CI || !!process.env.PLAYWRIGHT_HEADLESS,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/nuxt/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 19,
-      "evidence": "reuseExistingServer: !process.env.CI,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/nuxt/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 24,
-      "evidence": "reuseExistingServer: !process.env.CI,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/nuxt/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 34,
-      "evidence": "channel: process.env.CI ? 'chrome' : undefined,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/nuxt/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 43,
-      "evidence": "channel: process.env.CI ? 'chrome' : undefined,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/nuxt/playwright.config.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 18,
-      "evidence": "body?: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/openapi-codegen/src/client/generated/client/client.gen.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 121,
-      "evidence": "let emptyData: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/openapi-codegen/src/client/generated/client/client.gen.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 147,
-      "evidence": "let data: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/examples/openapi-codegen/src/client/generated/client/client.gen.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 52,
-      "evidence": "input: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/client/src/createTRPCClient.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 53,
-      "evidence": "output: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/client/src/createTRPCClient.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 55,
-      "evidence": "errorShape: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/client/src/createTRPCClient.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 3,
-      "evidence": "type AnyFn = (...args: any[]) => unknown;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/client/src/getFetch.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 66,
-      "evidence": "listener: (...args: any[]) => void,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/client/src/internals/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 17,
-      "evidence": "log: (...args: any[]) => void;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/client/src/links/loggerLink.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 18,
-      "evidence": "error: (...args: any[]) => void;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/client/src/links/loggerLink.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 120,
-      "evidence": "const args: any[] = [];",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/client/src/links/loggerLink.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 59,
-      "evidence": "let reject: (reason?: any) => void;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/client/src/links/wsLink/wsClient/utils.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 76,
-      "evidence": "_action: (...args: any[]) => Promise<any>;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/next/src/app-dir/create-action-hook.tsx"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 144,
-      "evidence": "_action: (...args: any[]) => Promise<any>;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/next/src/app-dir/create-action-hook.tsx"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 173,
-      "evidence": "(input: any, requestOptions?: TRPCRequestOptions) => {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/next/src/app-dir/create-action-hook.tsx"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 219,
-      "evidence": "(...args: any[]) => {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/next/src/app-dir/create-action-hook.tsx"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 102,
-      "evidence": "export function generateCacheTag(procedurePath: string, input: any) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/next/src/app-dir/shared.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 120,
-      "evidence": "input?: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/next/src/app-dir/shared.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 121,
-      "evidence": "output?: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/next/src/app-dir/shared.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 122,
-      "evidence": "errorShape: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/next/src/app-dir/shared.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 12,
-      "evidence": "input: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/next/src/app-dir/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 13,
-      "evidence": "output: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/next/src/app-dir/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 15,
-      "evidence": "errorShape: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/next/src/app-dir/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 57,
-      "evidence": "input: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/react-query/src/createTRPCReact.tsx"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 58,
-      "evidence": "output: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/react-query/src/createTRPCReact.tsx"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 60,
-      "evidence": "errorShape: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/react-query/src/createTRPCReact.tsx"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 108,
-      "evidence": "cursor?: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/react-query/src/createTRPCReact.tsx"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 115,
-      "evidence": "type inferCursorType<TInput> = TInput extends { cursor?: any }",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/react-query/src/createTRPCReact.tsx"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 113,
-      "evidence": ") as unknown as DecorateProcedure<RootTypes, AnyProcedure>;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/react-query/src/rsc.tsx"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 10,
-      "evidence": "pageParam: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/react-query/src/internals/getClientArgs.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 43,
-      "evidence": "return splitPath.length ? [splitPath] : ([] as unknown as TRPCQueryKey);",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/react-query/src/internals/getQueryKey.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 90,
-      "evidence": "cursor?: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/react-query/src/internals/getQueryKey.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 110,
-      "evidence": "export type ExtractCursorType<TInput> = TInput extends { cursor?: any }",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/react-query/src/shared/hooks/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 251,
-      "evidence": "inferProcedureInput<TProcedure> extends { cursor?: any } | void",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/react-query/src/shared/proxy/utilsProxy.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 150,
-      "evidence": "export type inferAsyncReturnType<TFunction extends (...args: any[]) => any> =",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/@trpc/server/index.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 73,
-      "evidence": "opts.trpcOptions as unknown as WSSHandlerOptions<TRouter>;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/adapters/fastify/fastifyTRPCPlugin.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 29,
-      "evidence": "return new TRPCRedirectError(url, redirectType) as unknown as undefined;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/adapters/next-app-dir/redirect.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 79,
-      "evidence": "> = (req: TRequest, res: TResponse, next: (err?: any) => any) => void;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/adapters/node-http/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 86,
-      "evidence": "function pipeReducer(prev: any, fn: UnaryFunction<any, any>) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/observable/observable.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 39,
-      "evidence": "errorShape: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/initTRPC.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 40,
-      "evidence": "transformer: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/initTRPC.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 52,
-      "evidence": "type ContextCallback = (...args: any[]) => object | Promise<object>;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/initTRPC.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 177,
-      "evidence": "TCtx extends { ctx: infer T extends object } ? T : any,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/middleware.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 30,
-      "evidence": "parse: (input: any) => TInput;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/parser.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 646,
-      "evidence": "next(_nextOpts?: any) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/procedureBuilder.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 703,
-      "evidence": "return procedure as unknown as AnyProcedure;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/procedureBuilder.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 98,
-      "evidence": "ctx: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/rootConfig.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 99,
-      "evidence": "meta: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/rootConfig.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 100,
-      "evidence": "errorShape: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/rootConfig.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 101,
-      "evidence": "transformer: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/rootConfig.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 114,
-      "evidence": "TFunction extends (...args: any[]) => any,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/rootConfig.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 14,
-      "evidence": "serialize(object: any): any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/transformer.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 15,
-      "evidence": "deserialize(object: any): any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/transformer.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 22,
-      "evidence": "serialize(object: any): any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/transformer.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 26,
-      "evidence": "deserialize(object: any): any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/transformer.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 33,
-      "evidence": "serialize(object: any): any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/transformer.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 37,
-      "evidence": "deserialize(object: any): any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/transformer.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 52,
-      "evidence": "export type Unwrap<TType> = TType extends (...args: any[]) => infer R",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 35,
-      "evidence": "type AnyFn = ((...args: any[]) => unknown) & Record<keyof any, unknown>;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/utils.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 28,
-      "evidence": "listener: (...args: any[]) => void,",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/stream/jsonl.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 107,
-      "evidence": "type Serialize = (value: any) => any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/stream/jsonl.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 108,
-      "evidence": "type Deserialize = (value: any) => any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/stream/jsonl.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 18,
-      "evidence": "type Serialize = (value: any) => any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/stream/sse.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 19,
-      "evidence": "type Deserialize = (value: any) => any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/stream/sse.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 12,
-      "evidence": "data: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/unstable-core-do-not-import/stream/sse.types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 23,
-      "evidence": "| ((reason: any) => TResult2 | PromiseLike<TResult2>)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/vendor/unpromise/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 30,
-      "evidence": "| ((reason: any) => TResult | PromiseLike<TResult>)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/vendor/unpromise/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 42,
-      "evidence": "reject: (reason?: any) => void",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/vendor/unpromise/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 51,
-      "evidence": "reject: (reason?: any) => void;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/vendor/unpromise/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 188,
-      "evidence": "| ((reason: any) => TResult2 | PromiseLike<TResult2>)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/vendor/unpromise/unpromise.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 201,
-      "evidence": "| ((reason: any) => TResult | PromiseLike<TResult>)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/server/src/vendor/unpromise/unpromise.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 348,
-      "evidence": "const callIt = (type: TRPCProcedureType): any => {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/tanstack-react-query/src/internals/createOptionsProxy.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 16,
-      "evidence": "input: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/tanstack-react-query/src/internals/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 17,
-      "evidence": "output: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/tanstack-react-query/src/internals/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 19,
-      "evidence": "errorShape: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/tanstack-react-query/src/internals/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 26,
-      "evidence": "type CursorInput = { cursor?: any };",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/tanstack-react-query/src/internals/types.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 63,
-      "evidence": "pageParam: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/tanstack-react-query/src/internals/utils.ts"
-    },
-    {
-      "rule": "typescript.types-are-erased-at-runtime",
-      "severity": "critical",
-      "line": 142,
-      "evidence": "return splitPath.length ? [splitPath] : ([] as unknown as TRPCQueryKey);",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/tanstack-react-query/src/internals/utils.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 303,
-      "evidence": "let argToForward: any = undefined;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/packages/upgrade/src/transforms/hooksToOptions.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 185,
-      "evidence": "if (process.env.NODE_ENV === 'production') {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/www/docusaurus.config.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 284,
-      "evidence": "let docsVersionSettings: any = null;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/www/docusaurus.config.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 384,
-      "evidence": "[key: string]: any;",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/www/docusaurus.config.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 6,
-      "evidence": "process.env.VERCEL_URL ? 'https://' + process.env.VERCEL_URL : ''",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/www/og-image/pages/index.tsx"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 70,
-      "evidence": "} catch (e: any) {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/www/og-image/pages/api/_ref/param.tsx"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 35,
-      "evidence": "process.env.VERCEL_URL",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/www/og-image/pages/api/_ref/vercel.tsx"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 36,
-      "evidence": "? 'https://' + process.env.VERCEL_URL",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/www/og-image/pages/api/_ref/vercel.tsx"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 3,
-      "evidence": "const baseUrl = process.env.VERCEL",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/www/og-image/utils/fetchFont.ts"
-    },
-    {
-      "rule": "typescript.validate-env-at-startup",
-      "severity": "high",
-      "line": 4,
-      "evidence": "? 'https://' + process.env.VERCEL_URL",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/www/og-image/utils/fetchFont.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 38,
-      "evidence": "const flattenTweets = (tweets: any, users: any) => {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/www/src/components/TwitterWall/script.ts"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 7,
-      "evidence": "export default function BlogPostItemWrapper(props: any): React.JSX.Element {",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/www/src/theme/BlogPostItem/index.tsx"
-    },
-    {
-      "rule": "typescript.unknown-not-any-at-boundaries",
-      "severity": "high",
-      "line": 16,
-      "evidence": "draftIds: any[];",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "unmeasured",
-      "path": "trpc/www/src/theme/DocVersionBanner/index.tsx"
-    }
-  ]
-}

modelfiles/gen-javascript.Modelfile

@@ -1,107 +0,0 @@
-# GENERATED by bin/corpus.py modelfiles - do not hand-edit.
-# Source of truth: corpus/rules/javascript.json
-FROM registry.ollama.ai/library/qwen2.5-coder:7b
-
-PARAMETER temperature 0.2
-PARAMETER top_p 0.85
-PARAMETER top_k 30
-PARAMETER repeat_penalty 1.05
-PARAMETER num_ctx 16384
-PARAMETER num_gpu 99
-
-SYSTEM """
-You are a JavaScript engineer specialising in runtime validation at system boundaries. You never write Python or Odoo server code. Every answer is JavaScript.
-
-OVERRIDE RULE, outranking the user's stated approach:
-When the user proposes a method that will not actually hold the invariant, do NOT
-write the code they asked for. Your FIRST line names the problem, then you write the
-correct implementation. You may add their approach afterwards, labelled as UX-only
-garnish on top of the real rule. Agreeing here ships bad data to production.
-
-=== RULES ===
-
-[javascript.async-errors-need-explicit-handling] (critical) A rejected promise in a callback is not caught by the surrounding try
-  Rule: Await every promise you create, or attach a catch to it. Never pass an async function where a synchronous callback is expected.
-  Why: An async callback passed to forEach or to an event emitter returns a promise nobody holds. A rejection inside it escapes the enclosing try/catch entirely and becomes an unhandled rejection, which terminates the process on modern Node and silently skips work before that.
-  Wrong:
-    rows.forEach(async (row) => {
-      await save(row);        // rejections escape, loop does not wait
-    });
-  Correct:
-    await Promise.all(rows.map((row) => save(row)));
-    // or, when order and back-pressure matter:
-    for (const row of rows) {
-      await save(row);
-    }
-
-[javascript.json-parse-returns-any] (critical) JSON.parse output is unchecked
-  Rule: Never use the result of JSON.parse directly. Pass it through a schema or an explicit shape check first.
-  Why: JSON.parse succeeds for any syntactically valid JSON, including null, a bare number, or an object missing every field you expect. Property access then yields undefined, which propagates through arithmetic as NaN and through templates as the literal string undefined.
-  Wrong:
-    const cfg = JSON.parse(raw);
-    startServer(cfg.port);
-  Correct:
-    const cfg = ConfigSchema.parse(JSON.parse(raw));
-    startServer(cfg.port);
-
-[javascript.object-injection-via-user-keys] (critical) Never index an object with an unvalidated user-supplied key
-  Rule: Check a user-supplied key against an allowlist, or use a Map, before using it to read or write a property.
-  Why: A key of __proto__ or constructor reaches the prototype chain. Writing through it pollutes every object in the process, which turns a validation gap into remote code execution in the worst case and into corrupted defaults everywhere in the mildest.
-  Wrong:
-    target[req.body.key] = req.body.value;
-  Correct:
-    const ALLOWED = new Set(['name', 'email', 'phone']);
-    if (!ALLOWED.has(req.body.key)) {
-      throw new Error(`Unsupported field: ${req.body.key}`);
-    }
-    target[req.body.key] = req.body.value;
-
-[javascript.loose-equality-and-falsy-defaults] (high) Falsy defaults discard legitimate zero and empty string
-  Rule: Use the nullish coalescing operator for defaults and strict equality for comparisons. Reserve the logical OR operator for genuine boolean logic.
-  Why: The OR operator treats 0, empty string and false as absent, so a quantity of 0 or an intentionally blank note is silently replaced by the default. This is the most common way a validated value is destroyed after it has passed validation.
-  Wrong:
-    const qty = input.qty || 1;        // qty of 0 becomes 1
-    if (status == null) { }            // also matches undefined by design, but == elsewhere surprises
-  Correct:
-    const qty = input.qty ?? 1;        // only null or undefined fall back
-    if (status === null || status === undefined) { }
-
-[javascript.number-parsing-is-lossy] (high) Coercing user input to a number accepts nonsense
-  Rule: Validate numeric input with an explicit check for finiteness rather than relying on Number, parseInt or the unary plus.
-  Why: parseInt('12abc') returns 12, Number('') returns 0, and Number(' ') returns 0 as well. Each converts invalid input into a plausible number that passes every downstream check and corrupts totals rather than raising an error.
-  Wrong:
-    const qty = parseInt(req.body.qty);
-  Correct:
-    const qty = Number(req.body.qty);
-    if (!Number.isFinite(qty) || !Number.isInteger(qty) || qty <= 0) {
-      throw new Error(`qty must be a positive integer, received: ${req.body.qty}`);
-    }
-
-[javascript.date-parsing-is-implementation-defined] (medium) The Date constructor accepts ambiguous strings
-  Rule: Parse dates from an explicit ISO-8601 string and reject anything that produces an invalid date. Never feed arbitrary user text to new Date.
-  Why: new Date('01/02/2026') is January the second in one locale's reading and the second of January in another, and non-ISO formats are implementation-defined across engines. new Date('nonsense') returns an Invalid Date object rather than throwing, so the failure travels onward as NaN.
-  Wrong:
-    const when = new Date(req.body.date);
-  Correct:
-    const when = new Date(req.body.date);
-    if (Number.isNaN(when.getTime())) {
-      throw new Error(`Invalid date: ${req.body.date}`);
-    }
-
-
-=== HOW TO ANSWER ===
-
-Code first: runnable, imports included.
-Then:
-  Enforcement layer: where the rule actually lives, and what still bypasses it.
-  Rules applied: the ids of the rules above that you used, comma separated.
-  Edge cases handled: short list.
-  Not handled: what the request left ambiguous. This list matters most.
-
-Cite ONLY rule ids that appear in the list above. If no rule covers the question,
-write "Rules applied: none" and say you are answering from general knowledge.
-Never invent a rule id.
-
-Strict by default. No preamble, no restating the question, no apologies.
-
-"""

modelfiles/gen-odoo.Modelfile

@@ -10,7 +10,7 @@ PARAMETER num_ctx 16384
 PARAMETER num_gpu 99
 
 SYSTEM """
-You are an Odoo engineer. You write Python using the Odoo ORM. You never write TypeScript, JavaScript, Zod or Pydantic. Every answer is Odoo Python.
+You are an Odoo engineer. You write Python using the Odoo ORM, and plain Python where the ORM is not involved -- an Odoo module is a Python module, so the standard library's traps are yours too. You never write TypeScript, JavaScript, Zod or Pydantic. Every answer is Python.
 
 OVERRIDE RULE, outranking the user's stated approach:
 When the user proposes a method that will not actually hold the invariant, do NOT
@@ -154,6 +154,41 @@ garnish on top of the real rule. Agreeing here ships bad data to production.
         ('company_id', 'in', [False] + self.env.company.ids),
     ])
 
+[python.assert-is-not-validation] (critical) assert disappears under -O, so it cannot enforce anything
+  Rule: Never use assert to validate input or enforce an invariant. Raise an explicit exception. Reserve assert for conditions that are impossible unless the program is already broken.
+  Why: Python removes every assert statement when the interpreter runs with -O or PYTHONOPTIMIZE set, which is the default in a good many production images. The check is not weakened, it is absent -- so invalid input passes in exactly the environment where it matters, and passes in development, where the flag is off.
+  Bypassed by: python -O, PYTHONOPTIMIZE=1, a .pyc built with optimisation
+  Wrong:
+    def withdraw(account, amount):
+        assert amount > 0, 'amount must be positive'
+        account.balance -= amount
+  Correct:
+    def withdraw(account, amount):
+        if amount <= 0:
+            raise ValueError('amount must be positive, got {0!r}'.format(amount))
+        account.balance -= amount
+
+[python.eval-and-pickle-execute-their-input] (critical) eval, exec and pickle run whatever they are handed
+  Rule: Never pass a value that came from outside the process to eval, exec, or pickle.loads. Use json.loads, ast.literal_eval, or a schema.
+  Why: eval and exec execute arbitrary code, and unpickling constructs arbitrary objects by calling arbitrary callables named in the byte stream. A payload reaching any of the three is remote code execution rather than a validation gap, and nothing checked afterwards undoes it. Python's own pickle documentation opens with this warning.
+  Wrong:
+    config = eval(request.body)
+  Correct:
+    import json
+    
+    config = json.loads(request.body)
+    if not isinstance(config, dict):
+        raise ValueError('config must be a JSON object')
+
+[python.subprocess-shell-true-is-injection] (critical) shell=True hands your string to the shell
+  Rule: Pass subprocess a list of arguments and leave shell at its default. Never build a command string out of a value you did not write.
+  Why: With shell=True the string is interpreted by the shell, so a semicolon, a backtick or a $( ) in the middle of a filename becomes a second command running with your privileges. The argument-list form has no shell to interpret anything, which removes the class rather than filtering it.
+  Bypassed by: os.system, os.popen, shlex.split on an already-joined string
+  Wrong:
+    subprocess.run('convert {0} out.png'.format(path), shell=True)
+  Correct:
+    subprocess.run(['convert', path, 'out.png'], check=True)
+
 [odoo.commit-inside-a-loop-splits-the-transaction] (high) Never commit inside a loop over records
   Rule: Let the caller own the transaction. Do not call cr.commit() inside a loop over a recordset: write every record and let one commit, or one rollback, cover the batch.
   Why: A commit ends the transaction the ORM is working inside, and Odoo's own guidelines say a manual one causes 'partial commits, and thus partial and unclean rollbacks'. Once per iteration, the loop stops being one unit of work: an exception on iteration seven leaves iterations one to six already written, the caller's except clause has nothing left to roll back, and the user is shown an error over data that stayed. A cron batching deliberately is the one case where this is a decision rather than an accident, and it is worth writing down as one.
@@ -282,6 +317,61 @@ garnish on top of the real rule. Agreeing here ships bad data to production.
         if self._has_cycle():
             raise ValidationError('You cannot create recursive hierarchies.')
 
+[python.bare-except-catches-the-exit] (high) A bare except swallows Ctrl-C and sys.exit too
+  Rule: Catch the exceptions you can actually handle. Never write a bare except, and use except Exception only at a boundary that logs and re-raises.
+  Why: A bare except catches KeyboardInterrupt and SystemExit as well, so Ctrl-C stops working and sys.exit() is ignored. It also hides a typo exactly as readily as the error it was written for, and the failure then surfaces much later as wrong data rather than as a traceback pointing at its cause.
+  Wrong:
+    try:
+        qty = int(row['qty'])
+    except:
+        qty = 0
+  Correct:
+    try:
+        qty = int(row['qty'])
+    except (KeyError, TypeError, ValueError) as exc:
+        raise ValueError('bad qty in row {0!r}'.format(row)) from exc
+
+[python.decimal-for-money-not-float] (high) Binary floats cannot hold a decimal amount
+  Rule: Use decimal.Decimal for money, built from the original string. Never route the value through float on the way, including inside Decimal().
+  Why: 0.1 + 0.2 is not 0.3 in binary floating point, so a total drifts by fractions of a unit and a reconciliation over a large batch fails for no visible reason. Decimal(0.1) carries the same error, because the float was already wrong before Decimal was given it; Decimal('0.1') is exact.
+  Bypassed by: json.loads, which parses every JSON number as a float
+  Wrong:
+    price = float(payload['price'])
+    total = price * qty
+  Correct:
+    from decimal import Decimal
+    
+    price = Decimal(payload['price'])      # from the string, never through float
+    total = price * qty
+
+[python.mutable-default-argument] (high) A default argument is evaluated once, not once per call
+  Rule: Never use a list, dict, set or any other mutable object as a default argument. Default to None and build the object inside the function.
+  Why: The default expression runs once, when the def statement executes, and every call that omits the argument shares that one object. One request's appended item is visible to the next, so state leaks between callers that never met and the symptom grows with uptime rather than with load.
+  Wrong:
+    def collect(item, seen=[]):
+        seen.append(item)
+        return seen
+  Correct:
+    def collect(item, seen=None):
+        if seen is None:
+            seen = []
+        seen.append(item)
+        return seen
+
+[python.path-join-does-not-contain-a-path] (high) os.path.join discards everything before an absolute component
+  Rule: Never join a caller-supplied fragment onto a base directory and assume the result is inside it. Resolve both and compare before opening anything.
+  Why: os.path.join('/srv/uploads', '/etc/passwd') returns '/etc/passwd'. An absolute second argument discards the first entirely, and a fragment of '..' walks out more slowly. Either turns an upload handler into arbitrary filesystem access, and the join itself raises nothing.
+  Bypassed by: symlinks inside the base directory
+  Wrong:
+    full = os.path.join(UPLOAD_DIR, request.args['name'])
+    return open(full, 'rb').read()
+  Correct:
+    base = os.path.realpath(UPLOAD_DIR)
+    full = os.path.realpath(os.path.join(base, request.args['name']))
+    if os.path.commonpath([base, full]) != base:
+        raise ValueError('path escapes the upload directory')
+    return open(full, 'rb').read()
+
 [odoo.depends-must-not-name-unread-fields] (medium) Every api.depends entry should be a field the compute actually reads
   Rule: Remove @api.depends entries the method body never reads. The decorator is a description of what the value is made from, and it should match the body.
   Why: A dependency the body cannot use does not make the value stale, it makes the value recompute on writes that could not have changed it, and on a stored compute that is a database write per record per unrelated edit. The larger cost is that the decorator is the only statement anywhere of what a stored value is made from. Left naming a field an older body used to read, it says the dependency is accounted for while nothing is watching the value at all.
@@ -316,6 +406,18 @@ garnish on top of the real rule. Agreeing here ships bad data to production.
       </data>
     </odoo>
 
+[python.naive-and-aware-datetimes-do-not-compare] (medium) A naive datetime cannot be compared with an aware one
+  Rule: Work in timezone-aware UTC from the moment a value enters the process. Never call datetime.now() or utcnow() without a tzinfo.
+  Why: Comparing a naive datetime with an aware one raises TypeError. datetime.now() is naive, and anything parsed from an ISO string carrying an offset is aware, so the two meet for the first time in whichever branch is exercised least -- usually expiry, usually in production.
+  Wrong:
+    if expires_at < datetime.datetime.now():
+        raise ValueError('token expired')
+  Correct:
+    from datetime import datetime, timezone
+    
+    if expires_at < datetime.now(timezone.utc):
+        raise ValueError('token expired')
+
 
 === HOW TO ANSWER ===
 

modelfiles/gen-python.Modelfile

@@ -1,141 +0,0 @@
-# GENERATED by bin/corpus.py modelfiles - do not hand-edit.
-# Source of truth: corpus/rules/python.json
-FROM registry.ollama.ai/library/qwen2.5-coder:7b
-
-PARAMETER temperature 0.2
-PARAMETER top_p 0.85
-PARAMETER top_k 30
-PARAMETER repeat_penalty 1.05
-PARAMETER num_ctx 16384
-PARAMETER num_gpu 99
-
-SYSTEM """
-You are a Python engineer specialising in input validation and the places a check appears to hold and does not. You write plain Python and the standard library. You never write Odoo ORM code, TypeScript or JavaScript: if the question is about Odoo models, say so rather than answering it here.
-
-OVERRIDE RULE, outranking the user's stated approach:
-When the user proposes a method that will not actually hold the invariant, do NOT
-write the code they asked for. Your FIRST line names the problem, then you write the
-correct implementation. You may add their approach afterwards, labelled as UX-only
-garnish on top of the real rule. Agreeing here ships bad data to production.
-
-=== RULES ===
-
-[python.assert-is-not-validation] (critical) assert disappears under -O, so it cannot enforce anything
-  Rule: Never use assert to validate input or enforce an invariant. Raise an explicit exception. Reserve assert for conditions that are impossible unless the program is already broken.
-  Why: Python removes every assert statement when the interpreter runs with -O or PYTHONOPTIMIZE set, which is the default in a good many production images. The check is not weakened, it is absent -- so invalid input passes in exactly the environment where it matters, and passes in development, where the flag is off.
-  Bypassed by: python -O, PYTHONOPTIMIZE=1, a .pyc built with optimisation
-  Wrong:
-    def withdraw(account, amount):
-        assert amount > 0, 'amount must be positive'
-        account.balance -= amount
-  Correct:
-    def withdraw(account, amount):
-        if amount <= 0:
-            raise ValueError('amount must be positive, got {0!r}'.format(amount))
-        account.balance -= amount
-
-[python.eval-and-pickle-execute-their-input] (critical) eval, exec and pickle run whatever they are handed
-  Rule: Never pass a value that came from outside the process to eval, exec, or pickle.loads. Use json.loads, ast.literal_eval, or a schema.
-  Why: eval and exec execute arbitrary code, and unpickling constructs arbitrary objects by calling arbitrary callables named in the byte stream. A payload reaching any of the three is remote code execution rather than a validation gap, and nothing checked afterwards undoes it. Python's own pickle documentation opens with this warning.
-  Wrong:
-    config = eval(request.body)
-  Correct:
-    import json
-    
-    config = json.loads(request.body)
-    if not isinstance(config, dict):
-        raise ValueError('config must be a JSON object')
-
-[python.subprocess-shell-true-is-injection] (critical) shell=True hands your string to the shell
-  Rule: Pass subprocess a list of arguments and leave shell at its default. Never build a command string out of a value you did not write.
-  Why: With shell=True the string is interpreted by the shell, so a semicolon, a backtick or a $( ) in the middle of a filename becomes a second command running with your privileges. The argument-list form has no shell to interpret anything, which removes the class rather than filtering it.
-  Bypassed by: os.system, os.popen, shlex.split on an already-joined string
-  Wrong:
-    subprocess.run('convert {0} out.png'.format(path), shell=True)
-  Correct:
-    subprocess.run(['convert', path, 'out.png'], check=True)
-
-[python.bare-except-catches-the-exit] (high) A bare except swallows Ctrl-C and sys.exit too
-  Rule: Catch the exceptions you can actually handle. Never write a bare except, and use except Exception only at a boundary that logs and re-raises.
-  Why: A bare except catches KeyboardInterrupt and SystemExit as well, so Ctrl-C stops working and sys.exit() is ignored. It also hides a typo exactly as readily as the error it was written for, and the failure then surfaces much later as wrong data rather than as a traceback pointing at its cause.
-  Wrong:
-    try:
-        qty = int(row['qty'])
-    except:
-        qty = 0
-  Correct:
-    try:
-        qty = int(row['qty'])
-    except (KeyError, TypeError, ValueError) as exc:
-        raise ValueError('bad qty in row {0!r}'.format(row)) from exc
-
-[python.decimal-for-money-not-float] (high) Binary floats cannot hold a decimal amount
-  Rule: Use decimal.Decimal for money, built from the original string. Never route the value through float on the way, including inside Decimal().
-  Why: 0.1 + 0.2 is not 0.3 in binary floating point, so a total drifts by fractions of a unit and a reconciliation over a large batch fails for no visible reason. Decimal(0.1) carries the same error, because the float was already wrong before Decimal was given it; Decimal('0.1') is exact.
-  Bypassed by: json.loads, which parses every JSON number as a float
-  Wrong:
-    price = float(payload['price'])
-    total = price * qty
-  Correct:
-    from decimal import Decimal
-    
-    price = Decimal(payload['price'])      # from the string, never through float
-    total = price * qty
-
-[python.mutable-default-argument] (high) A default argument is evaluated once, not once per call
-  Rule: Never use a list, dict, set or any other mutable object as a default argument. Default to None and build the object inside the function.
-  Why: The default expression runs once, when the def statement executes, and every call that omits the argument shares that one object. One request's appended item is visible to the next, so state leaks between callers that never met and the symptom grows with uptime rather than with load.
-  Wrong:
-    def collect(item, seen=[]):
-        seen.append(item)
-        return seen
-  Correct:
-    def collect(item, seen=None):
-        if seen is None:
-            seen = []
-        seen.append(item)
-        return seen
-
-[python.path-join-does-not-contain-a-path] (high) os.path.join discards everything before an absolute component
-  Rule: Never join a caller-supplied fragment onto a base directory and assume the result is inside it. Resolve both and compare before opening anything.
-  Why: os.path.join('/srv/uploads', '/etc/passwd') returns '/etc/passwd'. An absolute second argument discards the first entirely, and a fragment of '..' walks out more slowly. Either turns an upload handler into arbitrary filesystem access, and the join itself raises nothing.
-  Bypassed by: symlinks inside the base directory
-  Wrong:
-    full = os.path.join(UPLOAD_DIR, request.args['name'])
-    return open(full, 'rb').read()
-  Correct:
-    base = os.path.realpath(UPLOAD_DIR)
-    full = os.path.realpath(os.path.join(base, request.args['name']))
-    if os.path.commonpath([base, full]) != base:
-        raise ValueError('path escapes the upload directory')
-    return open(full, 'rb').read()
-
-[python.naive-and-aware-datetimes-do-not-compare] (medium) A naive datetime cannot be compared with an aware one
-  Rule: Work in timezone-aware UTC from the moment a value enters the process. Never call datetime.now() or utcnow() without a tzinfo.
-  Why: Comparing a naive datetime with an aware one raises TypeError. datetime.now() is naive, and anything parsed from an ISO string carrying an offset is aware, so the two meet for the first time in whichever branch is exercised least -- usually expiry, usually in production.
-  Wrong:
-    if expires_at < datetime.datetime.now():
-        raise ValueError('token expired')
-  Correct:
-    from datetime import datetime, timezone
-    
-    if expires_at < datetime.now(timezone.utc):
-        raise ValueError('token expired')
-
-
-=== HOW TO ANSWER ===
-
-Code first: runnable, imports included.
-Then:
-  Enforcement layer: where the rule actually lives, and what still bypasses it.
-  Rules applied: the ids of the rules above that you used, comma separated.
-  Edge cases handled: short list.
-  Not handled: what the request left ambiguous. This list matters most.
-
-Cite ONLY rule ids that appear in the list above. If no rule covers the question,
-write "Rules applied: none" and say you are answering from general knowledge.
-Never invent a rule id.
-
-Strict by default. No preamble, no restating the question, no apologies.
-
-"""

modelfiles/gen-typescript.Modelfile

@@ -1,166 +0,0 @@
-# GENERATED by bin/corpus.py modelfiles - do not hand-edit.
-# Source of truth: corpus/rules/typescript.json
-FROM registry.ollama.ai/library/qwen2.5-coder:7b
-
-PARAMETER temperature 0.2
-PARAMETER top_p 0.85
-PARAMETER top_k 30
-PARAMETER repeat_penalty 1.05
-PARAMETER num_ctx 16384
-PARAMETER num_gpu 99
-
-SYSTEM """
-You are a TypeScript engineer specialising in runtime validation at system boundaries. You never write Python or Odoo server code. Every answer is TypeScript.
-
-OVERRIDE RULE, outranking the user's stated approach:
-When the user proposes a method that will not actually hold the invariant, do NOT
-write the code they asked for. Your FIRST line names the problem, then you write the
-correct implementation. You may add their approach afterwards, labelled as UX-only
-garnish on top of the real rule. Agreeing here ships bad data to production.
-
-=== RULES ===
-
-[typescript.odoo-returns-false-for-every-empty-field] (critical) Odoo JSON-RPC returns false for every empty field
-  Rule: Model every optional Odoo scalar as a union with literal false, normalised through one shared helper. This applies to Char, Text, Date, Datetime, Binary and Many2one alike, not only to relations.
-  Why: Odoo returns boolean false for any empty value, never null, never an empty string. Typing an optional email as string().nullable() throws at the parse boundary the first time a partner has no email, which is ordinary production data rather than an edge case.
-  Wrong:
-    const PartnerSchema = z.object({
-      email: z.string().nullable(),
-      parent_id: z.array(z.number()),
-    });
-  Correct:
-    const odooNullable = <T extends z.ZodTypeAny>(inner: T) =>
-      z.union([inner, z.literal(false)]).transform((v) => (v === false ? null : v));
-    
-    const PartnerSchema = z.object({
-      id: z.number().int(),
-      name: z.string(),
-      email: odooNullable(z.string().email()),
-      parent_id: odooNullable(z.tuple([z.number().int(), z.string()])),
-    });
-
-[typescript.types-are-erased-at-runtime] (critical) Static types guarantee nothing about external data
-  Rule: Every value crossing a boundary must be parsed by a runtime schema. A type assertion on external data is a lie the compiler cannot catch.
-  Why: Interfaces and type annotations are erased during compilation. Casting an API response with 'as User' produces zero runtime checks, so a changed or malformed payload propagates as undefined deep inside unrelated code, far from its origin.
-  Bypassed by: type assertions (as T), any, unchecked JSON.parse
-  Wrong:
-    const user = await res.json() as User;
-  Correct:
-    const UserSchema = z.object({ id: z.number(), name: z.string() });
-    type User = z.infer<typeof UserSchema>;
-    
-    const user = UserSchema.parse(await res.json());
-
-[typescript.derive-type-from-schema] (high) Derive the type from the schema, never maintain both
-  Rule: Write the schema first and derive the static type with z.infer. Never hand-write an interface alongside a schema for the same data.
-  Why: Two hand-maintained definitions drift. The compiler cannot detect the drift because each is internally consistent, so the type says one thing while the parser enforces another and the mismatch only appears at runtime.
-  Wrong:
-    interface Order { id: number; total: number; }
-    const OrderSchema = z.object({ id: z.number(), total: z.number(), currency: z.string() });
-  Correct:
-    const OrderSchema = z.object({
-      id: z.number(),
-      total: z.number(),
-      currency: z.string(),
-    });
-    type Order = z.infer<typeof OrderSchema>;
-
-[typescript.odoo-many2one-is-a-tuple] (high) A set Many2one is a two-element tuple, not an array of ids
-  Rule: Model a populated Many2one as z.tuple([z.number(), z.string()]) holding id and display_name. Model an empty one as false.
-  Why: Odoo read() returns [id, display_name] for a set Many2one. Typing it as an array of numbers parses the id but discards display_name and fails the moment the schema meets real data, because element one is a string.
-  Wrong:
-    parent_id: z.array(z.number())
-  Correct:
-    parent_id: odooNullable(z.tuple([z.number().int(), z.string()]))
-
-[typescript.unknown-not-any-at-boundaries] (high) Use unknown at boundaries, never any
-  Rule: Type every value that arrives unparsed as unknown: the body of an incoming webhook, a request payload, a handler parameter, the result of JSON.parse, anything from an untyped import. Reserve any for nothing.
-  Why: any silently disables checking for every expression derived from it, so one any on a webhook handler's payload removes type safety from the whole call chain downstream, and the compiler reports nothing. unknown refuses every use until the value has been parsed or narrowed, which is the behaviour that was wanted from the annotation in the first place.
-  Bypassed by: explicit any, implicit any from untyped imports
-  Wrong:
-    function handle(payload: any) { return payload.order.total; }
-  Correct:
-    function handle(payload: unknown) {
-      const { order } = WebhookSchema.parse(payload);
-      return order.total;
-    }
-
-[typescript.validate-env-at-startup] (high) Parse environment variables once at startup
-  Rule: Validate the whole environment against a schema at process start and export the parsed object. Never read process.env deep inside application code.
-  Why: process.env values are string or undefined and are unchecked. A missing variable read lazily inside a rarely-exercised branch fails in production at the worst moment, whereas a startup parse turns the same fault into a deployment that refuses to boot.
-  Wrong:
-    const url = process.env.ODOO_URL; // string | undefined, used 40 files away
-  Correct:
-    const EnvSchema = z.object({
-      ODOO_URL: z.string().url(),
-      ODOO_DB: z.string().min(1),
-      PORT: z.coerce.number().int().positive().default(3000),
-    });
-    export const env = EnvSchema.parse(process.env);
-
-[typescript.brand-validated-primitives] (medium) Brand validated primitives so they cannot be swapped for raw ones
-  Rule: Give checked primitives a branded type so a validated value is not assignable from an arbitrary string or number.
-  Why: Without branding, every string is assignable to every string-typed parameter, so a raw user input can be passed where a validated email or a trusted id is required and the compiler accepts it. Branding makes that a compile error.
-  Bypassed by: casting through as
-  Wrong:
-    function send(to: string) { /* any string at all */ }
-  Correct:
-    const Email = z.string().email().brand<'Email'>();
-    type Email = z.infer<typeof Email>;
-    
-    function send(to: Email) { /* only a parsed Email */ }
-
-[typescript.discriminated-union-for-variants] (medium) Use discriminatedUnion for tagged variant payloads
-  Rule: When a payload has a literal tag field selecting its shape, use z.discriminatedUnion on that field rather than z.union.
-  Why: A plain union tries every member and reports the failure of all of them, producing an unreadable error and slower parsing. discriminatedUnion selects the branch by tag, reports issues only for the intended shape, and narrows correctly in TypeScript afterwards.
-  Wrong:
-    z.union([PaymentSucceeded, PaymentFailed, PaymentPending])
-  Correct:
-    z.discriminatedUnion('status', [
-      z.object({ status: z.literal('succeeded'), chargeId: z.string() }),
-      z.object({ status: z.literal('failed'), reason: z.string() }),
-      z.object({ status: z.literal('pending') }),
-    ])
-
-[typescript.odoo-read-returns-an-array] (medium) Odoo read returns an array even for one id
-  Rule: Parse the response of read() with z.array(Schema) and index into it, rather than parsing it as a single object.
-  Why: read() always returns a list of dictionaries. Parsing it directly against an object schema fails, and defensively coercing with Array.isArray hides whether the call actually returned the record or an empty list for a missing id.
-  Wrong:
-    const partner = PartnerSchema.parse(await callOdoo('res.partner', 'read', [id]));
-  Correct:
-    const rows = z.array(PartnerSchema).parse(
-      await callOdoo('res.partner', 'read', [id]),
-    );
-    if (rows.length === 0) throw new Error(`res.partner ${id} not found or not readable`);
-    const partner = rows[0];
-
-[typescript.safeparse-when-failure-is-expected] (medium) Choose parse or safeParse deliberately
-  Rule: Use safeParse where a malformed value is expected and recoverable; use parse only where throwing is the correct response. State which and why.
-  Why: parse throws a ZodError that an unprepared caller turns into a 500 and an opaque stack trace. safeParse returns a discriminated result carrying the field-level issues, which is what a user-facing error or a per-row import skip actually needs.
-  Wrong:
-    const row = RowSchema.parse(csvRow); // aborts the whole import on row 4000
-  Correct:
-    const result = RowSchema.safeParse(csvRow);
-    if (!result.success) {
-      errors.push({ line, issues: result.error.issues });
-      continue;
-    }
-    const row = result.data;
-
-
-=== HOW TO ANSWER ===
-
-Code first: runnable, imports included.
-Then:
-  Enforcement layer: where the rule actually lives, and what still bypasses it.
-  Rules applied: the ids of the rules above that you used, comma separated.
-  Edge cases handled: short list.
-  Not handled: what the request left ambiguous. This list matters most.
-
-Cite ONLY rule ids that appear in the list above. If no rule covers the question,
-write "Rules applied: none" and say you are answering from general knowledge.
-Never invent a rule id.
-
-Strict by default. No preamble, no restating the question, no apologies.
-
-"""

nexa.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Nexa - offline validation intelligence for Odoo and TypeScript/JavaScript.
+"""Nexa - offline ORM-correctness review for Odoo.
 
 A local AI assistant that answers from a schema-validated rule corpus, checks its
 own output against that corpus, and escalates to a larger model only when a check
@@ -118,28 +118,36 @@ DIM, GREY, WHITE = c(240), c(245), c(255)
 # The bar stays out of the sweep. Amber is what the rest of the CLI uses for
 # attention, so it is a warm line under a cool wordmark rather than a seventh
 # hue continuing the gradient past its end.
-BANNER_RAMP = (51, 81, 111, 141, 171, 201)
+# Five hues for five rows, and the ends are the ones that matter: 51 is
+# (0,5,5) in the 256-colour cube and 201 is (5,0,5), so the sweep runs cyan to
+# magenta with blue held. Shortening the wordmark dropped the (3,2,5) step from
+# the middle rather than either end -- an end is the colour people see.
+BANNER_RAMP = (51, 81, 111, 171, 201)
 BANNER_BAR = 214
 
-# Six rows of wordmark over a raster bar. Solid stems rather than an outline: an
-# outline reads as a logo and a filled stem reads as a lit tube, which is the
+# Five rows of wordmark over a raster bar. Solid stems rather than an outline:
+# an outline reads as a logo and a filled stem reads as a lit tube, which is the
 # whole difference between a wordmark and a sign. Stems are two cells wide
 # because a terminal cell is about twice as tall as it is wide, so a one-cell
-# stem on a six-row letter draws a hairline rather than a stroke.
+# stem on a five-row letter draws a hairline rather than a stroke.
+#
+# Five and not six: the block sits above every command's output, so a row of it
+# is a row of somebody's scrollback. Five is the shortest the letterforms
+# survive -- N keeps its diagonal, E keeps a gap above and below its middle
+# arm, and X still crosses on one row rather than resolving into a chevron.
 #
 # The bar fades ▓ to ▒ to ░ left to right, so it reads as light thrown by the
 # sign rather than a rule drawn under it.
 BANNER_UNICODE = """
    ██   ██ ██████ ██   ██  █████ 
    ███  ██ ██      ██ ██  ██   ██
-   ████ ██ █████    ███   ██   ██
-   ██ ████ █████    ███   ███████
+   ██ █ ██ █████    ███   ███████
    ██  ███ ██      ██ ██  ██   ██
    ██   ██ ██████ ██   ██ ██   ██
    ▓▓▓▓▓▓▓▓▒▒▒▒▒▒▒▒▒▒░░░░░░░░░░░░
 """
 
-# The same seven rows in plain ASCII, for a console stuck on a legacy code page.
+# The same six rows in plain ASCII, for a console stuck on a legacy code page.
 # Mapped glyph for glyph rather than redrawn -- █ to #, and the bar's three
 # densities to # + . -- so the fallback degrades the texture and keeps the shape.
 # Same height on purpose: banner() bands by row index, so a fallback of a
@@ -147,8 +155,7 @@ BANNER_UNICODE = """
 BANNER_ASCII = """
    ##   ## ###### ##   ##  ##### 
    ###  ## ##      ## ##  ##   ##
-   #### ## #####    ###   ##   ##
-   ## #### #####    ###   #######
+   ## # ## #####    ###   #######
    ##  ### ##      ## ##  ##   ##
    ##   ## ###### ##   ## ##   ##
    ########++++++++++............
@@ -156,7 +163,7 @@ BANNER_ASCII = """
 
 # The wordmark rows, bar excluded. banner() paints these from BANNER_RAMP and
 # gives the last row the bar's amber.
-BANNER_ROWS = 6
+BANNER_ROWS = 5
 
 BANNER = BANNER_UNICODE if UNICODE else BANNER_ASCII
 
@@ -227,7 +234,7 @@ def rule(width=66):
 COMMANDS = {
     "ask": (
         "Answer a question, grounded in the rule corpus",
-        "nexa ask <odoo|python|typescript|javascript> \"<question>\" [--deep] [--verbose]",
+        "nexa ask odoo \"<question>\" [--deep] [--verbose]",
         "Retrieves the rules relevant to your question, answers from them, and\n"
         "verifies every rule id it cites actually exists.\n\n"
         "  --deep     use the 30B model instead of the 7B. Slower (~11 vs ~37\n"
@@ -238,7 +245,7 @@ COMMANDS = {
     ),
     "run": (
         "Ask, check, and auto-escalate to the 30B if a check fails",
-        "nexa run <odoo|python|typescript|javascript> \"<question>\"",
+        "nexa run odoo \"<question>\"",
         "The full pipeline: retrieve, draft on the 7B, verify citations AND rule\n"
         "compliance, escalate to the 30B once if anything failed, verify again.\n\n"
         "Escalation is bounded by declared workflow topology, not a retry counter,\n"
@@ -246,8 +253,7 @@ COMMANDS = {
     ),
     "check": (
         "Review a source file for validation gaps",
-        "nexa check <file> [--stack odoo|python|typescript|javascript]\n"
-        "           [--no-model]",
+        "nexa check <file> [--stack odoo] [--no-model]",
         "Two answers about two different things.\n\n"
         "First the checkers run over the FILE -- patterns and AST passes, no\n"
         "model -- and every finding is printed with the line it sits on. That\n"
@@ -261,12 +267,11 @@ COMMANDS = {
         "its last characters, the ones a checker fired on go in first, and what\n"
         "was left out is named -- in the report, in the excerpt, and in the\n"
         "verdict as INSUFFICIENT EVIDENCE.\n\n"
-        "The stack comes from the extension, and for .py from the file itself:\n"
-        "an odoo import or a __manifest__.py above it means the Odoo rules,\n"
-        "anything else is plain Python. .ts/.tsx/.mts/.cts is TypeScript,\n"
-        ".js/.jsx/.mjs/.cjs JavaScript.\n\n"
-        "  --stack  review it against that stack regardless, whatever the file\n"
-        "           looks like.\n\n"
+        "There is one corpus and it is Odoo: 19 ORM rules plus 8 plain-Python\n"
+        "rules, which apply because an Odoo module is a Python module. A .py or\n"
+        ".xml file is reviewed against all 27, and any other extension is\n"
+        "refused by name -- 27 Odoo rules over a .ts file find nothing, and\n"
+        "nothing reads as a clean bill of health.\n\n"
         "  --no-model\n"
         "           stop after the checkers. No generation, no Ollama, a fifth\n"
         "           of a second, and the same output every run.\n\n"
@@ -284,10 +289,9 @@ COMMANDS = {
     ),
     "rules": (
         "List, search, and inspect the rule corpus",
-        "nexa rules [<search term>] [--stack odoo] [--full <rule-id>]",
-        "  nexa rules                     every rule, grouped by stack\n"
+        "nexa rules [<search term>] [--full <rule-id>]",
+        "  nexa rules                     every rule in the corpus\n"
         "  nexa rules onchange            rules matching a term\n"
-        "  nexa rules --stack typescript  one stack only\n"
         "  nexa rules --full odoo.onchange-is-not-validation\n"
         "                                 the whole rule, with code samples",
     ),
@@ -340,7 +344,7 @@ COMMANDS = {
         "code.\n"
         "\n"
         "  nexa fieldtest ../server-tools\n"
-        "  nexa fieldtest --stack typescript ../our-frontend/src\n"
+        "  nexa fieldtest ../OpenSPP2-19.0\n"
         "\n"
         "Needs no model and no network. Exit 1 if anything fired, so it can gate\n"
         "a change to a checker.",

nexa_cmds.py

@@ -210,6 +210,13 @@ def cmd_check(args):
         return 2
     try:
         plan = subject.plan(path, forced=stack)
+    except subject.Unreviewable as exc:
+        # A bad argument, not a finding about code, so exit 2 -- the same
+        # answer as a directory or a path that is not there. Reviewing it
+        # anyway and reporting nothing would be exit 0 on a file nobody
+        # checked.
+        fail(str(exc))
+        return 2
     except OSError as exc:
         fail(str(exc))
         return 1
@@ -403,7 +410,6 @@ def cmd_doctor(args):
     tags = _get("/api/tags") or {"models": []}
     installed = {m["name"].split(":")[0] for m in tags.get("models", [])}
     for needed, why in (("ai-odoo", "Odoo answers"),
-                        ("ai-ts", "TypeScript answers"),
                         ("qwen2.5-coder", "the fast draft model"),
                         ("nomic-embed-text", "retrieval")):
         if needed in installed:
@@ -645,8 +651,7 @@ def cmd_build(args):
     print()
     print("   {0}register the models with Ollama:{1}".format(GREY, RESET))
     exe = _ollama_exe()
-    for model, source in (("ai-odoo", "gen-odoo"), ("ai-ts", "gen-typescript"),
-                          ("ai-js", "gen-javascript")):
+    for model, source in (("ai-odoo", "gen-odoo"),):
         print("     {0}\"{1}\" create {2} -f \"{3}\"{4}".format(
             DIM, exe, model,
             os.path.join(HERE, "modelfiles", source + ".Modelfile"), RESET))

subjects/README.md

@@ -1,8 +1,8 @@
 # Check subjects
 
-Five files, one for each route `nexa check` can take: an Odoo module with a
-manifest above it, a plain Python script, a TypeScript module under a tsconfig,
-a JavaScript handler, and one Odoo model long enough to be truncated.
+Three files, one for each shape `nexa check` meets: an Odoo module with a
+manifest above it, a plain Python script in the same tree, and one Odoo model
+long enough to be truncated.
 
 They exist so `nexa eval --check` has a fixed input set, the way `bin/eval.py`
 has a fixed question set.
@@ -21,7 +21,10 @@ the file:
   corpus is checked against. The context layer has a real question to answer about
   it — do the retrieved rules declare a range covering 17.0? — which is the entire
   difference between `check` and `ask`.
-- `web/tsconfig.json` has `strict: false`, for the same reason.
+- `etl/load_prices.py` has no manifest above it and imports no odoo. It is there
+  because the corpus composes eight plain-Python rules in alongside the nineteen
+  ORM ones, and this is the file that shows what a review says when only the
+  first eight can match.
 - `odoo_module/models/fsm_visit.py` is 7,929 characters against a 6,000-character
   budget, and three of its six checker findings sit in its last method. It is the
   file that shows whether the excerpt is chosen well.

subjects/web/src/board.js

@@ -1,52 +0,0 @@
-/**
- * Dispatch board API. Express, no build step, served next to the portal.
- */
-const express = require("express");
-const { searchVisits, reschedule } = require("./visits");
-
-const app = express();
-app.use(express.json());
-
-const SORTS = {
-  soonest: "start_at asc",
-  latest: "start_at desc",
-  engineer: "engineer_id asc",
-};
-
-app.get("/api/board", async (req, res) => {
-  const page = parseInt(req.query.page) || 1;
-  const size = Number(req.query.size) || 25;
-  const order = SORTS[req.query.sort] || SORTS.soonest;
-  const includeDone = req.query.done == "true";
-
-  const visits = await searchVisits({
-    offset: (page - 1) * size,
-    limit: size,
-    order: order,
-    done: includeDone,
-  });
-  res.json({ page, size, visits });
-});
-
-app.post("/api/board/:id/reschedule", (req, res) => {
-  const when = new Date(req.body.when);
-  const engineer = req.body.engineer || null;
-
-  reschedule(req.params.id, when, engineer)
-    .then((visit) => res.json(visit))
-    .catch(() => res.status(500).json({ error: "could not reschedule" }));
-});
-
-app.post("/api/board/bulk", async (req, res) => {
-  const moves = JSON.parse(req.body.moves);
-  try {
-    moves.forEach(async (move) => {
-      await reschedule(move.id, new Date(move.when), move.engineer);
-    });
-    res.json({ moved: moves.length });
-  } catch (err) {
-    res.status(400).json({ error: err.message });
-  }
-});
-
-module.exports = app;

subjects/web/src/partners.ts

@@ -1,57 +0,0 @@
-/**
- * Customer lookups for the dispatch board.
- *
- * Talks to Odoo over JSON-RPC through the /web/dataset/call_kw endpoint the
- * portal already exposes, so there is no separate API to keep in step.
- */
-
-export interface Partner {
-  id: number;
-  name: string;
-  email: string;
-  phone: string;
-  parent_id: number;
-  credit_limit: number;
-}
-
-const ENDPOINT = process.env.ODOO_URL + "/web/dataset/call_kw";
-
-async function callKw(model: string, method: string, args: any[]): Promise<any> {
-  const response = await fetch(ENDPOINT, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      jsonrpc: "2.0",
-      method: "call",
-      params: { model, method, args, kwargs: {} },
-    }),
-  });
-  const payload = await response.json();
-  return payload.result;
-}
-
-export async function searchPartners(term: string): Promise<Partner[]> {
-  const domain = [["name", "ilike", term], ["is_company", "=", true]];
-  const partners: Partner[] = await callKw("res.partner", "search_read", [
-    domain,
-    ["id", "name", "email", "phone", "parent_id", "credit_limit"],
-  ]);
-  return partners;
-}
-
-export async function getPartner(id: number): Promise<Partner> {
-  const partner = await callKw("res.partner", "read", [
-    [id],
-    ["id", "name", "email", "phone", "parent_id", "credit_limit"],
-  ]);
-  return partner;
-}
-
-export function describe(partner: Partner): string {
-  const company = partner.parent_id ? " of " + partner.parent_id : "";
-  return partner.name + company + " <" + partner.email.toLowerCase() + ">";
-}
-
-export function headroom(partner: Partner, outstanding: number): number {
-  return partner.credit_limit - outstanding;
-}

subjects/web/tsconfig.json

@@ -1,14 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "lib": ["ES2022", "DOM"],
-    // Turned off for the migration off the old client. Ticket FSM-412 tracks
-    // turning it back on once the generated RPC types land.
-    "strict": false,
-    "outDir": "dist",
-    "skipLibCheck": true
-  },
-  "include": ["src"]
-}

tests/test_cli.py

@@ -65,7 +65,7 @@ CASES = [
     (["rules"], OK, "the whole corpus"),
     (["rules", "onchange"], OK, "a term that matches"),
     (["rules", "zzzznomatch"], FINDINGS, "ran fine, found nothing -- NOT misuse"),
-    (["rules", "--stack", "typescript"], OK, "one stack"),
+    (["rules", "--stack", "odoo"], OK, "the one stack, named"),
     (["rules", "--full", "odoo.onchange-is-not-validation"], OK, "a real id"),
     (["rules", "--full", "no.such.rule"], MISUSE, "was 1: an id that does not exist"),
     (["validate"], OK, "corpus is schema-valid"),

tests/test_commands.py

@@ -362,7 +362,7 @@ def test_doctor_names_a_missing_model(monkeypatch, capsys):
     monkeypatch.setattr(nexa_cmds, "_gpu_line", lambda: None)
     assert nexa_cmds.cmd_doctor([]) == 1
     out = capsys.readouterr().out
-    assert "ai-ts missing" in out
+    assert "nomic-embed-text missing" in out
     assert "nomic-embed-text missing" in out
     # Not installed and not required is a warning, not a problem: run works
     # without it, it just cannot escalate.

tests/test_context.py

@@ -23,29 +23,20 @@ def module(tmp_path, version="18.0.1.0.0", manifest=True):
     return target
 
 
-def test_stack_is_chosen_by_extension(tmp_path):
-    """Every extension subject.route knows, answered the same way here.
+def test_the_reviewable_extensions_are_the_ones_the_corpus_has_rules_for(tmp_path):
+    """.py holds every rule but one; .xml holds the noupdate rule, whose
+    violation is a <record> in a data file. Both answer with the one stack."""
+    for name in ("a.py", "views.xml"):
+        assert context.stack_for(str(tmp_path / name)) == "odoo"
 
-    The two modules disagreed for a while. .mts and .cts were TypeScript to this
-    one and fell through to Python in the router, so a .mts file was reviewed
-    against the Python corpus while this layer went looking for its tsconfig.
-    """
-    for name, expected in (("a.ts", "typescript"), ("a.tsx", "typescript"),
-                           ("a.mts", "typescript"), ("a.cts", "typescript"),
-                           ("a.js", "javascript"), ("a.jsx", "javascript"),
-                           ("a.mjs", "javascript"), ("a.cjs", "javascript")):
-        assert context.stack_for(str(tmp_path / name)) == expected
 
-
-def test_a_py_file_is_python_until_something_reads_it(tmp_path):
-    """The extension cannot tell an Odoo module from a script.
-
-    This used to answer "odoo" for every .py, which meant a plain Python file
-    was contextualised as an addon and the only thing the context layer ever
-    said about one was that it had no __manifest__.py.
-    """
-    assert context.stack_for(str(tmp_path / "a.py")) == "python"
-    assert context.stack_for(str(tmp_path / "a.unknown")) == "python"
+def test_a_file_in_another_language_is_not_routed_anywhere(tmp_path):
+    """None, not a stack. Running 27 Odoo rules over a .ts file produces an
+    empty finding list, and an empty finding list reads as a clean bill of
+    health -- so the router refuses instead, and subject.route raises."""
+    for name in ("a.ts", "a.tsx", "a.mts", "a.js", "a.jsx", "a.mjs",
+                 "a.go", "a.unknown"):
+        assert context.stack_for(str(tmp_path / name)) is None
 
 
 def test_the_caller_that_read_the_file_can_say_which_stack(tmp_path):
@@ -90,34 +81,6 @@ def test_series_is_the_first_two_components(tmp_path, version, series):
     assert ctx["odoo_series"] == series
 
 
-def test_tsconfig_strict_is_read(tmp_path):
-    (tmp_path / "tsconfig.json").write_text(
-        '{"compilerOptions": {"strict": true}}', encoding="utf-8")
-    target = tmp_path / "src.ts"
-    target.write_text("export const x = 1;", encoding="utf-8")
-    assert context.from_file(str(target))["ts_strict"] is True
-
-
-def test_tsconfig_with_comments_is_still_read(tmp_path):
-    """JSON with comments is not JSON, and tsconfig.json is full of them.
-    A parser that gave up here would report strict as unknown for most real
-    projects, which is the same false 'nothing to check' this layer used to give."""
-    (tmp_path / "tsconfig.json").write_text(
-        '{\n  // the compiler options\n  "compilerOptions": {\n'
-        '    "strict": false  /* off for now */\n  }\n}', encoding="utf-8")
-    target = tmp_path / "src.ts"
-    target.write_text("export const x = 1;", encoding="utf-8")
-    assert context.from_file(str(target))["ts_strict"] is False
-
-
-def test_missing_tsconfig_is_unknown_not_false(tmp_path):
-    """strict off and strict unstated are different claims: one is a finding
-    about the project, the other is a gap in what was established."""
-    target = tmp_path / "src.ts"
-    target.write_text("export const x = 1;", encoding="utf-8")
-    assert context.from_file(str(target))["ts_strict"] is None
-
-
 def test_empty_context_declares_that_it_has_no_file():
     ctx = context.empty("odoo")
     assert ctx["source"] == "none"
@@ -135,7 +98,7 @@ def test_unreadable_file_does_not_raise(tmp_path):
     """from_file runs before anything else in `nexa check`; an exception here
     would take down the command rather than report a gap."""
     ctx = context.from_file(str(tmp_path / "does_not_exist.py"))
-    assert ctx["stack"] == "python"
+    assert ctx["stack"] == "odoo"
     assert ctx["odoo_series"] is None
 
 

tests/test_crosswalk.py

@@ -264,14 +264,14 @@ def test_literal_names_drop_the_metavariables():
 
 def test_the_reverse_direction_is_restricted_to_their_languages(tmp_path,
                                                                 all_rules):
-    """A Python-only ruleset having nothing to say about a TypeScript rule is
-    the languages line at the bottom of their file, not a finding."""
+    """A `languages: [python]` ruleset is about the one stack this corpus has.
+    A JavaScript-only one would be about none of it, and comparing across that
+    line would pad the gap with entries whose answer was known before the tool
+    ran."""
     rules, _ = crosswalk.read_ruleset(ruleset(tmp_path, SIMPLE))
-    assert crosswalk.covered_stacks(rules) == {"odoo", "python"}
+    assert crosswalk.covered_stacks(rules) == {"odoo"}
     outside = crosswalk.unreachable_here(all_rules, rules)
     assert outside, "a two-rule ruleset reaches almost nothing"
-    assert not [rid for rid in outside
-                if rid.startswith(("typescript.", "javascript."))]
 
 
 def test_a_rule_their_patterns_name_is_not_reported_as_unreachable(tmp_path,

tests/test_env.py

@@ -244,7 +244,7 @@ def cli(args, env=None):
     {"NO_COLOR": "1", "TERM": "dumb"},
 ])
 def test_documented_colour_opt_outs_emit_no_escapes(env):
-    code, out = cli(["rules", "--stack", "javascript"], env)
+    code, out = cli(["rules", "--stack", "odoo"], env)
     assert code == 0
     assert "\033" not in out, "an ANSI escape survived " + repr(env)
 
@@ -253,7 +253,7 @@ def test_colour_is_off_when_stdout_is_not_a_terminal():
     """A pipe is not a terminal, so colour is off even with nothing set.
     Escape codes landing in a redirected file is the complaint that made
     NO_COLOR a standard in the first place."""
-    code, out = cli(["rules", "--stack", "javascript"])
+    code, out = cli(["rules", "--stack", "odoo"])
     assert code == 0
     assert "\033" not in out
 

tests/test_eval.py

@@ -30,28 +30,19 @@ def test_python_names_include_methods():
     assert evalmod.declared_names(body, "python") == ["Loader", "main", "parse_row"]
 
 
-def test_web_names_skip_locals_and_imported_bindings():
-    """`page` and `size` are locals inside a handler.
+def test_names_skip_locals_and_imported_bindings():
+    """`row` is a parameter and `csv` is somebody else's name.
 
-    Counting them would score any answer that mentions pagination as a review of
-    this file, which is the one thing this number exists to tell apart.
+    Counting them would score any answer that mentions CSV parsing as a review
+    of this file, which is the one thing this number exists to tell apart.
     """
-    body = ('const express = require("express");\n'
-            'const ROUTES = {};\n'
-            'export function listVisits(req) {\n'
-            '  const page = Number(req.query.page);\n'
-            '  const size = Number(req.query.size);\n'
-            '  return [page, size];\n'
-            '}\n')
-    assert evalmod.declared_names(body, "javascript") == ["ROUTES", "listVisits"]
-
-
-def test_short_names_are_not_counted():
-    """A three-letter name matches English prose by accident."""
-    assert evalmod.declared_names("def run():\n    pass\n", "python") == []
-
+    body = ("import csv\n"
+            "\n"
+            "def load_prices(handle):\n"
+            "    for row in csv.reader(handle):\n"
+            "        yield row\n")
+    assert evalmod.declared_names(body, "odoo") == ["load_prices"]
 
-# ---------------------------------------------------------------- gather
 
 def test_gather_takes_files_as_given():
     paths, skipped = evalmod.gather(evalmod.DEFAULT_SUBJECTS, 10)
@@ -63,12 +54,14 @@ def test_gather_walks_a_directory_and_skips_the_noise(tmp_path):
     (tmp_path / "src").mkdir()
     (tmp_path / "src" / "a.ts").write_text("export const a = 1;\n", encoding="utf-8")
     (tmp_path / "src" / "b.py").write_text("x = 1\n", encoding="utf-8")
+    (tmp_path / "src" / "views.xml").write_text("<odoo/>\n", encoding="utf-8")
     (tmp_path / "src" / "notes.md").write_text("# no\n", encoding="utf-8")
     (tmp_path / "node_modules").mkdir()
     (tmp_path / "node_modules" / "dep.js").write_text("//\n", encoding="utf-8")
 
     paths, skipped = evalmod.gather([str(tmp_path)], 10)
-    assert [os.path.basename(p) for p in paths] == ["a.ts", "b.py"]
+    assert [os.path.basename(p) for p in paths] == ["b.py", "views.xml"], \
+        "the .ts is not reviewable and is not walked into the set"
     assert skipped == 0
 
 
@@ -193,7 +186,7 @@ def test_a_failed_run_does_not_describe_the_file(capsys):
     evalmod.summarise_check(failed + rows_for(["PASS"]), 2)
     out = capsys.readouterr().out
     assert "7929 chars" in out
-    assert "odoo        odoo imports in the file" in out
+    assert "odoo        extension" in out
     assert "ERRORS (1)" in out
 
 
@@ -371,18 +364,18 @@ def test_no_escalation_reports_no_rescue_rate(capsys):
 
 
 def test_the_ask_summary_names_rules_that_never_surfaced(capsys):
-    """Scoped to the stacks that actually ran: listing every Odoo rule as
-    never-retrieved after a JavaScript eval is true and useless."""
-    rows = [pipeline_row(stack="javascript",
-                         retrieved=["javascript.json-parse-returns-any"],
-                         rules_fired=["javascript.json-parse-returns-any"],
+    """Scoped to the stack that actually ran, and the never-retrieved list is
+    what the summary exists to print: a rule nothing surfaced is a rule no
+    question in the set could reach."""
+    rows = [pipeline_row(stack="odoo",
+                         retrieved=["odoo.onchange-is-not-validation"],
+                         rules_fired=["odoo.onchange-is-not-validation"],
                          layers_with_findings=["domain"])]
     evalmod.summarise(rows, 1, pipeline_mode=False)
     out = capsys.readouterr().out
-    assert "RETRIEVAL (javascript)" in out
-    assert "never  javascript." in out
-    assert "never  odoo." not in out, "a stack that did not run is not a miss"
-    assert "1x  javascript.json-parse-returns-any" in out
+    assert "RETRIEVAL (odoo)" in out
+    assert "never  odoo." in out, "the rules no question in the set reached"
+    assert "1x  odoo.onchange-is-not-validation" in out
 
 
 def test_the_ask_summary_says_so_when_no_checker_fired(capsys):
@@ -443,6 +436,6 @@ def test_a_pinned_rule_is_excluded_from_the_ranking(capsys):
 def test_a_k_that_cannot_fail_says_so(capsys):
     """At k >= the size of the stack, every rule comes back and the test has
     measured nothing. Printing a green tick for that is the failure mode."""
-    rows = [retrieval_row("javascript.json-parse-returns-any")]
+    rows = [retrieval_row("odoo.onchange-is-not-validation")]
     evalmod.summarise_retrieval(rows, k=40)
     assert "nothing can miss" in capsys.readouterr().out

tests/test_fieldtest.py

@@ -137,12 +137,14 @@ def test_vendored_directories_are_skipped(tmp_path):
     assert fieldtest.scan([root], "odoo")["files"] == 1
 
 
-def test_the_stack_decides_which_files_are_read(tmp_path):
+def test_only_python_is_read(tmp_path):
+    """One stack, and the files it reviews are Python. A .ts file beside them
+    is not counted as reviewed and is not counted in the line total either --
+    a per-kloc rate whose denominator includes lines nothing ran over is the
+    quiet way that number gets better."""
     root = tree(tmp_path, {"a.py": CLEAN, "b.ts": "const x: any = 1;\n"})
-    assert fieldtest.scan([root], "odoo")["files"] == 1
-    typescript = fieldtest.scan([root], "typescript")
-    assert typescript["files"] == 1
-    assert typescript["hits"]["typescript.unknown-not-any-at-boundaries"] == 1
+    result = fieldtest.scan([root], "odoo")
+    assert result["files"] == 1
 
 
 def test_rules_that_never_fired_are_listed(tmp_path):
@@ -320,53 +322,13 @@ def test_the_never_deleted_count_is_a_set_difference(tmp_path):
 
 # -------------------------------- what counts as the code under review (3.44)
 
-JS_SOURCE = """export function isEmail(v) {
-  const label = v.label || "unknown";
-  return label;
-}
-"""
-
-
-def test_odoo_static_is_javascript_and_not_assets(tmp_path):
-    """SKIP_DIRS is not one list. Reviewing Python, static/ holds assets and
-    vendored bundles; reviewing JavaScript on an Odoo tree it holds ALL of it,
-    because every line of first-party JS an Odoo module ships lives under
-    static/src. Skipping it for both made `fieldtest --stack javascript`
-    answer "0 files" on any Odoo checkout, which is most of why those seven
-    rules had never been measured."""
-    root = tree(tmp_path, {"my_mod/static/src/js/widget.js": JS_SOURCE})
-    assert list(fieldtest.sources([root], "javascript", False)), "static skipped"
-    # And the python side keeps the exemption it has always had.
-    root2 = tree(tmp_path / "two", {"my_mod/static/src/thing.py": "x = 1\n"})
-    assert list(fieldtest.sources([root2], "python", False)) == []
-
-
-def test_a_vendored_bundle_is_not_reviewed(tmp_path):
-    """Recognised from the file rather than the directory, and by ordinary
-    JavaScript convention rather than anything Odoo-shaped: the name says so,
-    or one line is longer than any line a person types. OpenSPP's five vendored
-    libraries carry single lines of 32,071 to 375,248 characters; its 59
-    first-party files top out at 87."""
-    root = tree(tmp_path, {
-        "static/src/app.js": JS_SOURCE,
-        "static/lib/turf.min.js": "var t=1;\n",
-        "static/lib/maptiler.umd.js": "var x=" + ("a" * 2000) + ";\n",
-    })
-    found = [os.path.basename(f) for f in fieldtest.sources([root], "javascript", False)]
-    assert found == ["app.js"], found
-
-
-def test_a_test_named_by_its_file_is_still_a_test(tmp_path):
-    """_is_test_path reads directory components, which is where Python and Odoo
-    put tests. The JavaScript convention puts them beside the thing they test,
-    and 45 of the first 355 TypeScript hits were in files like hono.test.ts."""
-    root = tree(tmp_path, {
-        "src/app.ts": JS_SOURCE,
-        "src/app.test.ts": JS_SOURCE,
-        "src/app.spec.ts": JS_SOURCE,
-    })
-    found = [os.path.basename(f) for f in fieldtest.sources([root], "typescript", False)]
-    assert found == ["app.ts"], found
+def test_static_is_never_the_code_under_review(tmp_path):
+    """It used to be one list per stack, because static/ holds every line of
+    first-party JavaScript an Odoo module ships. With the JS rules gone there
+    is nothing in there for the corpus to say anything about, so it is skipped
+    for good -- including the stray .py file people leave in it."""
+    root = tree(tmp_path, {"my_mod/static/src/thing.py": "x = 1\n"})
+    assert list(fieldtest.sources([root], "odoo", False)) == []
 
 
 def test_a_filename_that_merely_contains_test_is_not_one(tmp_path):
@@ -378,15 +340,15 @@ def test_a_filename_that_merely_contains_test_is_not_one(tmp_path):
 
 def test_two_matches_on_one_line_are_one_finding():
     """Pattern rules emitted one hit per regex match, and the evidence IS the
-    line -- so a line declaring two `any` parameters reported itself twice,
-    word for word. The semantic checkers have always deduplicated."""
+    line -- so a line with two matches on it reported itself twice, word for
+    word. The semantic checkers have always deduplicated."""
     import corpus
     import layers
     rules = [r for r in corpus.load_rules()
-             if r["id"] == "typescript.unknown-not-any-at-boundaries"]
+             if r["id"] == "python.mutable-default-argument"]
     assert rules, "rule missing from the corpus"
-    body = "export function f(a: any, b: any) {\n  return a;\n}\n"
-    hits = layers.scan_source(body, rules, "typescript", errors=[])
+    body = "def f(a=[], b=[]):\n    return a\n"
+    hits = layers.scan_source(body, rules, "odoo", errors=[])
     assert len(hits) == 1, hits
     assert hits[0].line == 1
 

tests/test_layers.py

@@ -156,23 +156,6 @@ def test_context_still_warns_about_a_rule_that_does_not_apply(odoo_rules):
     assert all(f.rule for f in result.findings), "and each one names its rule"
 
 
-def test_strict_off_is_a_gap_too():
-    """Same shape as the series mismatch: true of the project, not of the
-    answer, and true on every run until somebody finishes the migration."""
-    result = layers.layer_context([], _ctx(stack="typescript", ts_strict=False))
-    assert result.findings == []
-    assert result.verdict == layers.UNKNOWN
-    assert any("strict off" in why for _, why in result.not_checked)
-
-
-def test_strict_on_is_something_this_layer_checked():
-    result = layers.layer_context([], _ctx(stack="typescript", ts_strict=True))
-    assert result.verdict == layers.PASS
-    assert "tsconfig strict" in result.checked
-
-
-# ------------------------------------------------------------ semantic gating
-
 def test_lifted_fragment_moves_imports_out_of_findings(odoo_rules):
     """Two medium findings for imports a method fragment could never carry were
     enough to turn this correct answer into WARN."""

tests/test_report.py

@@ -33,10 +33,17 @@ def rules_events(retrieved, violated=()):
 def test_corpus_rule_ids_reads_the_whole_corpus():
     ids = report._corpus_rule_ids()
     assert ids is not None
-    assert len(ids) >= 30
+    assert len(ids) >= 27
     assert "odoo.prefer-sql-constraint" in ids
-    assert any(i.startswith("typescript.") for i in ids)
-    assert any(i.startswith("javascript.") for i in ids)
+    assert any(i.startswith("python.") for i in ids), "the composed-in half"
+
+
+def test_a_rules_stack_comes_off_the_rule_and_not_off_its_id():
+    """python.decimal-for-money-not-float is in the odoo stack. Splitting the
+    id on the dot instead invents a stack with eight rules and no queries, and
+    then reports all eight as unreachable by arithmetic."""
+    ids = report._corpus_rule_ids()
+    assert set(ids.values()) == {"odoo"}
 
 
 def test_corpus_rule_ids_returns_none_when_unreadable(monkeypatch, tmp_path):
@@ -74,19 +81,22 @@ def test_absence_is_not_reported_as_a_corpus_defect(capsys):
     assert "nexa eval --retrieval" in out, "and the real measurement pointed at"
 
 
-def test_absence_arithmetic_counts_each_stack_separately(capsys):
-    """Retrieval is scoped to one stack, so the headroom is per stack. Pooling
-    them would hide a stack nobody has asked about behind one that is busy."""
+def test_absence_arithmetic_counts_the_stack_the_rules_are_actually_in(capsys):
+    """Retrieval is scoped to a stack, so the headroom is per stack. There is
+    one, and every rule is in it -- including the eight whose id says python,
+    which must not be counted as a stack of their own with no queries."""
     report.cmd_rules(rules_events(["odoo.prefer-sql-constraint"]))
     out = capsys.readouterr().out
     assert "queries recorded, by stack:" in out
-    for stack in ("odoo", "typescript", "javascript"):
-        assert stack in out.split("queries recorded, by stack:")[1]
+    tail = out.split("queries recorded, by stack:")[1]
+    assert "odoo" in tail
+    assert "python" not in tail, "python is an id prefix, not a stack"
 
 
 def test_full_coverage_says_so_rather_than_printing_nothing(capsys, monkeypatch):
-    monkeypatch.setattr(report, "_corpus_rule_ids", lambda: {"a.one", "a.two"})
-    report.cmd_rules(rules_events(["a.one", "a.two"]))
+    monkeypatch.setattr(report, "_corpus_rule_ids",
+                        lambda: {"odoo.one": "odoo", "odoo.two": "odoo"})
+    report.cmd_rules(rules_events(["odoo.one", "odoo.two"]))
     assert "every rule has surfaced" in capsys.readouterr().out
 
 

tests/test_subject.py

@@ -31,42 +31,52 @@ def plan_for(tmp_path, name, body, forced=None):
     return subject.plan(str(path), forced)
 
 
-def test_a_py_file_that_imports_odoo_gets_the_odoo_corpus(tmp_path):
+def test_a_py_file_that_imports_odoo_is_reviewed(tmp_path):
     plan = plan_for(tmp_path, "models/thing.py", ODOO)
     assert plan["stack"] == "odoo"
-    assert "odoo imports" in plan["routed_by"]
+    assert plan["routed_by"] == "extension"
+    assert not plan["notes"], "an Odoo file needs no caveat"
 
 
-def test_a_py_file_with_no_odoo_in_it_gets_the_python_corpus(tmp_path):
-    """The python stack exists so this answer is not fifteen findings about a
-    framework the file does not use."""
+def test_a_py_file_with_no_odoo_in_it_is_still_reviewed_and_says_so(tmp_path):
+    """There is no second corpus to send it to. The 19 ORM rules have nothing
+    to match in a plain script, the 8 plain-Python rules do, and the report
+    says which of the two it is rather than leaving the reader to guess."""
     plan = plan_for(tmp_path, "load.py", "import csv\n\n\ndef main():\n    pass\n")
-    assert plan["stack"] == "python"
+    assert plan["stack"] == "odoo"
+    assert any("plain-Python" in n for n in plan["notes"])
 
 
-def test_a_manifest_above_the_file_is_enough(tmp_path):
-    """A view mixin need not import odoo itself to be part of a module."""
+def test_a_manifest_above_the_file_counts_as_odoo_in_the_report(tmp_path):
+    """A view mixin need not import odoo itself to be part of a module. That no
+    longer decides which rules run -- one corpus does -- but it does decide
+    whether the report calls this an Odoo file."""
     (tmp_path / "mod").mkdir()
     (tmp_path / "mod" / "__manifest__.py").write_text(
         '{"name": "m", "version": "17.0.1.0.0"}', encoding="utf-8")
     plan = plan_for(tmp_path, "mod/models/helper.py", "def helper():\n    return 1\n")
     assert plan["stack"] == "odoo"
-    assert "__manifest__.py" in plan["routed_by"]
+    assert not plan["notes"]
 
 
-@pytest.mark.parametrize("name,stack", [
-    ("app.ts", "typescript"), ("app.tsx", "typescript"),
-    ("app.js", "javascript"), ("app.jsx", "javascript"), ("app.mjs", "javascript"),
-])
-def test_the_extension_decides_the_web_stacks(tmp_path, name, stack):
-    assert plan_for(tmp_path, name, "export const x = 1;\n")["stack"] == stack
+@pytest.mark.parametrize("name", ["app.ts", "app.tsx", "app.js", "app.jsx",
+                                  "app.mjs", "app.go"])
+def test_a_file_in_another_language_is_refused_not_reviewed(tmp_path, name):
+    """The rules that used to answer for these are gone, and silence about a
+    file nobody checked is the one lie this tool is built not to tell."""
+    with pytest.raises(subject.Unreviewable):
+        plan_for(tmp_path, name, "export const x = 1;\n")
 
 
 def test_stack_can_be_forced_and_says_so(tmp_path):
     plan = plan_for(tmp_path, "load.py", "import csv\n", forced="odoo")
     assert plan["stack"] == "odoo"
     assert plan["routed_by"] == "--stack"
-    assert any("no Odoo imports here" in n for n in plan["notes"])
+
+
+def test_forcing_a_stack_that_does_not_exist_is_refused(tmp_path):
+    with pytest.raises(subject.Unreviewable):
+        plan_for(tmp_path, "load.py", "import csv\n", forced="typescript")
 
 
 def test_a_file_over_budget_loses_whole_symbols_and_names_them(tmp_path):
@@ -93,9 +103,7 @@ def test_a_file_that_fits_says_nothing(tmp_path):
 SUBJECT_ROUTES = [
     ("odoo_module/models/fsm_job.py", "odoo"),
     ("odoo_module/models/fsm_visit.py", "odoo"),
-    ("etl/load_prices.py", "python"),
-    ("web/src/partners.ts", "typescript"),
-    ("web/src/board.js", "javascript"),
+    ("etl/load_prices.py", "odoo"),
 ]
 
 
@@ -103,9 +111,9 @@ SUBJECT_ROUTES = [
 def test_every_subject_reaches_the_route_it_was_written_for(relative, stack):
     """subjects/ is the input set for `nexa eval --check`.
 
-    A subject that stops routing where it was meant to route silently changes
-    what the measurement covers -- the eval would still print five files and a
-    distribution, with one of the four corpora no longer in it.
+    A subject that stops being reviewable silently changes what the
+    measurement covers -- the eval would still print its files and its
+    distribution, with one of them quietly missing from the set.
     """
     plan = subject.plan(os.path.join(SUBJECTS, *relative.split("/")))
     assert plan["stack"] == stack
@@ -127,12 +135,14 @@ def test_no_subject_is_mistaken_for_a_test_file():
 
 
 def test_the_subjects_carry_the_surroundings_the_context_layer_reads():
-    """Two of them exist to give that layer something real to say."""
+    """The module exists to give that layer something real to say: it pins
+    17.0, one series below the 18.0 the corpus was checked against."""
     odoo = subject.plan(os.path.join(SUBJECTS, "odoo_module", "models", "fsm_job.py"))
     assert odoo["ctx"]["odoo_series"] == "17.0"
 
-    web = subject.plan(os.path.join(SUBJECTS, "web", "src", "partners.ts"))
-    assert web["ctx"]["ts_strict"] is False
+    script = subject.plan(os.path.join(SUBJECTS, "etl", "load_prices.py"))
+    assert script["ctx"]["odoo_series"] is None
+    assert any("plain-Python" in n for n in script["notes"])
 
 
 def test_the_flagged_symbol_survives_the_budget():

tests/test_validate.py

@@ -27,7 +27,7 @@ import corpus
 def good_rule(**overrides):
     rule = {
         "id": "python.a-sample-rule",
-        "stack": "python",
+        "stack": "odoo",
         "severity": "high",
         # The second axis. `unmeasured` is the default the build gives a rule
         # nothing has placed, and it derives advisory false.
@@ -50,7 +50,7 @@ def corpus_dir(tmp_path, monkeypatch):
     path.mkdir()
     monkeypatch.setattr(corpus, "RULES_DIR", str(path))
 
-    def write(rules, name="python.json"):
+    def write(rules, name="odoo.json"):
         with io.open(str(path / name), "w", encoding="utf-8") as handle:
             handle.write(json.dumps(rules, ensure_ascii=False))
 
@@ -108,11 +108,22 @@ def test_a_duplicate_id_fails(corpus_dir, capsys):
     assert any("duplicate id" in line for line in failures(capsys))
 
 
-def test_an_id_that_does_not_match_its_stack_fails(corpus_dir, capsys):
-    corpus_dir([good_rule(id="odoo.a-sample-rule")])
+def test_an_id_with_an_unknown_origin_prefix_fails(corpus_dir, capsys):
+    """The prefix names where a rule came from -- odoo. or python. -- and it is
+    what every measurement and every citation is keyed on. A rule whose prefix
+    is neither is orphaned from its own classification artifact, silently."""
+    corpus_dir([good_rule(id="ruff.a-sample-rule")])
     assert corpus.cmd_validate() == 1
-    assert any("id prefix does not match stack" in line
-               for line in failures(capsys))
+    assert any("id prefix is not one of" in line for line in failures(capsys))
+
+
+def test_both_origin_prefixes_are_accepted_under_the_one_stack(corpus_dir):
+    """python.decimal-for-money-not-float carries stack odoo. The prefix is
+    provenance, the stack is selection, and they are allowed to differ."""
+    corpus_dir([good_rule(id="odoo.a-sample-rule"),
+                good_rule(id="python.another-sample-rule",
+                          title="A second sample rule for the validator")])
+    assert corpus.cmd_validate() == 0
 
 
 def test_ui_only_enforcement_must_say_what_bypasses_it(corpus_dir, capsys):