crosswalk reads another ruleset's PATTERNS rather than running it, because
"semgrep is not installed here and adding it would make an offline tool need
a package index". That reasoning conflated two things. Running another
analyser costs `stdlib only`. It does not cost OFFLINE -- pylint runs on this
machine, OpenSPP's lint scripts are Python in their own tree, and nothing
leaves the laptop either way.
So bin/external.py shells out rather than importing. subprocess and json are
stdlib, the analyser is optional, and an absent one is a gap -- the same shape
as the OpenTelemetry bridge in telemetry.py.
nexa fieldtest --stack odoo . --with-json their-lint.json --with-name openspp
Their findings become SourceHits: namespaced so an external id can never be
mistaken for one of ours, mapped conservatively (their `error` is our `high`,
never `critical`, because critical here is a judgement somebody made about a
rule), obeying the same suppression convention, and counted in the same
per-kl…
