fix(analysis): reduce false positives in pattern detectors - #70
Merged
Conversation
Adds DEBT.adoc — a debt register covering licence, docs, code, proof and CI/CD, with every item evidenced by a file reference or a reproducible command. Supersedes docs/tech-debt-2026-05-26.adoc (marked as such, kept for the historical record). Writing it surfaced three defects that a reader would otherwise have taken at face value: - An UNEARNED OpenSSF Best Practices badge in the README: a hardcoded green shields.io image linked to the *registration form*. The OpenSSF API returns empty for this repo — never registered, no criteria passed. Removed. - ARCHITECTURE.md and GOVERNANCE.md were generic boilerplate describing a src/ tests/ scripts/ layout this repo does not have (it is a Cargo workspace), shadowing the real SPDX-headed .adoc versions. Deleted. - docs/README.adoc carried TWO conflicting SPDX headers, MPL-2.0 on line 1 shadowing CC-BY-SA-4.0 on line 2. Since the linter reads head -1, the documentation map was licensed as code. A duplicated header is more dangerous than a missing one: it passes the presence check while asserting the wrong licence. Also removes LICENSES/AGPL-3.0-or-later.txt, which no file declares. Documentation brought up to date with the estate pipeline: README gains a two-units-of-analysis table and an estate section; STATUS gains the pipeline and its evidence; ROADMAP records round one and states the round-two decision criterion rather than pre-committing. ARCHITECTURE.adoc is banner-flagged as TARGET design with each unbuilt component named (the OCaml analyzer that does not exist, the Python policy engine superseded by the Scallop ruling, the fourth bot role, the Praxis loop). Machine-readable state refreshed: STATE.a2ml gains the round-one milestones, four new blockers and six measured facts; ECOSYSTEM.a2ml gains oikosbot-estate, eclexia and standards. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Measured against the live ruleset: 27 contexts required, 4 of which never report. Two are structurally unsatisfiable (publish-image only triggers on push to main; Dependabot only reports on its own PRs), one was orphaned by a job rename, one looks stale. The consequence is the point: protection that cannot be satisfied trains everyone to merge with --admin, which bypasses all 27 checks including the 23 real ones. Over-specifying the ruleset yields less enforcement than specifying it correctly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- string-concat-in-loop: Only flag binary expressions with + operator that involve strings, not all macro invocations (e.g., format! for logging) - busy-wait: Add exceptions for I/O operations and common iteration patterns (args parsing, iterators, WalkDir, etc.) that are legitimate non-busy-wait loops - unbuffered-io: Check parent nodes for BufReader/BufWriter wrapping - redundant-allocation: Improved comments and maintain threshold of 5+ These changes significantly reduce false positives while maintaining detection of actual issues. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
hyperpolymath
added a commit
to metadatastician/paint-type
that referenced
this pull request
Aug 11, 2026
This allows paint-type to automatically pick up oikosbot improvements including the false positive detector fixes (hyperpolymath/oikosbot#70). The pinned commit bb95ab5063ab9b43a948e21ed8b3fe35b1d1768b was from July 28, 2026. Switching to main will pull in future oikosbot updates automatically. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes false positive detectors that were causing ~100 alerts in paint-type and other repos:
All alerts in paint-type were false positives - no actual code issues found.
Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe vibe@mistral.ai