Context
The dev branch CI has been red on the sonar job since tools/ became a Sonar source root (#54) under the raes-strict gate (#527): branch analysis reports 215 new-code violations and a new-code security rating of 4, while PR analysis stays green because it only scans each PR's changed lines. Every functional lane (verify, compatibility matrix, fuzz, integration-docker, supply-chain) passes.
The security rating is driven by three false positives:
tools/isabelle_tool.py:282 (S5443): the /tmp literal is the target of a private bubblewrap tmpfs mount inside the sandbox, not a shared host path (already justified for Bandit via noqa: S108).tools/check_sdl_catalog_parity.py:1785,1910 (S5332): the "http://" literals are markdown link-scheme classifiers, not insecure connections.
Scope
Mechanical fixes across tools/ — missing or unparameterized type hints (S6538/S6540/S6543/S6542), duplicated literals (S1192), redundant exception classes (S5713), chained startswith to tuple form (S8513), trailing comments (S139), suppression-comment syntax (S7632), line length, unused locals/params (S1481/S1172), nested conditionals (S3358), empty block (S108), confusing type checks (S5864), collection literal (S7498) — plus sonar-project.properties multicriteria exemptions with recorded justification for:
- S5443 scoped to
tools/isabelle_tool.py (bubblewrap-internal tmpfs target);
- S1309 (the "track noqa usage" meta-rule: the repo lint contract requires justified
noqa, so tracking each one as a new violation conflicts with policy — same shape as the existing e1–e4 exemptions);
- S1313 scoped to
tools/real-daemon/ (authored RFC-1918 lab addresses in the hardware smoke scenario).
The S5332 hits are fixed in code by classifying markdown link targets on scheme prefixes (http:) rather than http://.
Structural work (S104 file splits, mega-function decomposition, return-count restructuring) and the 16 package-module violations are tracked separately so this slice stays reviewable.
Verification
- Ruff format and lint clean on changed files.
- The dedicated tool test suites pass (
test_formal_semantic_validation.py, test_sdl_catalog_parity.py, test_specification_coverage.py, test_requirement_governance.py, test_repo_policy_tools.py).
- Each checker produces identical output and exit status on the current repo before and after the change.
Context
The
devbranch CI has been red on thesonarjob sincetools/became a Sonar source root (#54) under theraes-strictgate (#527): branch analysis reports 215 new-code violations and a new-code security rating of 4, while PR analysis stays green because it only scans each PR's changed lines. Every functional lane (verify, compatibility matrix, fuzz, integration-docker, supply-chain) passes.The security rating is driven by three false positives:
tools/isabelle_tool.py:282(S5443): the/tmpliteral is the target of a private bubblewrap tmpfs mount inside the sandbox, not a shared host path (already justified for Bandit vianoqa: S108).tools/check_sdl_catalog_parity.py:1785,1910(S5332): the"http://"literals are markdown link-scheme classifiers, not insecure connections.Scope
Mechanical fixes across
tools/— missing or unparameterized type hints (S6538/S6540/S6543/S6542), duplicated literals (S1192), redundant exception classes (S5713), chainedstartswithto tuple form (S8513), trailing comments (S139), suppression-comment syntax (S7632), line length, unused locals/params (S1481/S1172), nested conditionals (S3358), empty block (S108), confusing type checks (S5864), collection literal (S7498) — plussonar-project.propertiesmulticriteriaexemptions with recorded justification for:tools/isabelle_tool.py(bubblewrap-internal tmpfs target);noqa, so tracking each one as a new violation conflicts with policy — same shape as the existing e1–e4 exemptions);tools/real-daemon/(authored RFC-1918 lab addresses in the hardware smoke scenario).The S5332 hits are fixed in code by classifying markdown link targets on scheme prefixes (
http:) rather thanhttp://.Structural work (S104 file splits, mega-function decomposition, return-count restructuring) and the 16 package-module violations are tracked separately so this slice stays reviewable.
Verification
test_formal_semantic_validation.py,test_sdl_catalog_parity.py,test_specification_coverage.py,test_requirement_governance.py,test_repo_policy_tools.py).