ci(sonar): clear the tools new-code violations and exempt false positives

implementations/python/tests/test_formal_semantic_validation.py

@@ -76,7 +76,10 @@ def test_historical_release_validation_does_not_replay_current_code(
     def fail_if_replayed(*_args: object, **_kwargs: object) -> dict[str, object]:
         raise AssertionError("historical evidence must not replay current code")
 
-    monkeypatch.setattr(formal_validation, "replay_case", fail_if_replayed)
+    from tools.formal_semantic_validation import _retest, _snapshot
+
+    monkeypatch.setattr(_snapshot, "replay_case", fail_if_replayed)
+    monkeypatch.setattr(_retest, "replay_case", fail_if_replayed)
 
     assert validate_release_bundle(REPO_ROOT, release) == []
 
@@ -201,7 +204,9 @@ def replace_stored_evidence(repo_root: Path, relative_path: str, *, max_bytes: i
             return replacement
         return original_loader(repo_root, relative_path, max_bytes=max_bytes)
 
-    monkeypatch.setattr(formal_validation, "load_bounded_json_object", replace_stored_evidence)
+    from tools.formal_semantic_validation import _production
+
+    monkeypatch.setattr(_production, "load_bounded_json_object", replace_stored_evidence)
 
     failures = validate_retest_bundle(REPO_ROOT, release, protocol, corpus, snapshot, analysis)
 
@@ -364,7 +369,7 @@ def test_participant_test_replay_maps_pytest_status(
     expected: tuple[bool, str],
 ) -> None:
     monkeypatch.setattr(
-        "tools.check_formal_semantic_validation.subprocess.run",
+        "tools.formal_semantic_validation._replay.subprocess.run",
         lambda *_args, **_kwargs: SimpleNamespace(returncode=returncode),
     )
 
@@ -375,7 +380,7 @@ def test_participant_test_replay_fails_closed_on_timeout(monkeypatch: pytest.Mon
     def timed_out(*_args: object, **_kwargs: object) -> None:
         raise subprocess.TimeoutExpired(cmd="pytest", timeout=600)
 
-    monkeypatch.setattr("tools.check_formal_semantic_validation.subprocess.run", timed_out)
+    monkeypatch.setattr("tools.formal_semantic_validation._replay.subprocess.run", timed_out)
 
     ok, message = _replay_participant_tests(REPO_ROOT, ["tests/test_example.py::test_case"])
 

implementations/python/tests/test_repo_policy_tools.py

@@ -2531,7 +2531,7 @@ def test_osv_scanner_release_asset_names_match_platform_conventions(
     monkeypatch.setattr("platform.machine", lambda: machine)
 
     # OSV-Scanner ships plain per-platform binaries, not archives.
-    assert osv_scanner_tool._release_asset_name("2.4.0") == expected
+    assert osv_scanner_tool._release_asset_name() == expected
 
 
 @pytest.mark.parametrize("system", ["Windows", "Plan9"])
@@ -2542,7 +2542,7 @@ def test_osv_scanner_release_asset_name_rejects_unsupported_platform(
     monkeypatch.setattr("platform.machine", lambda: "x86_64")
 
     with pytest.raises(RuntimeError, match="unsupported osv-scanner platform"):
-        osv_scanner_tool._release_asset_name("2.4.0")
+        osv_scanner_tool._release_asset_name()
 
 
 def test_osv_scanner_binary_path_uses_repo_local_cache(tmp_path: Path) -> None:

sonar-project.properties

@@ -66,7 +66,7 @@ sonar.python.version=3.11, 3.12
 # The repo lint contract is Python 3.11+ with Ruff pyupgrade enabled.  Keep
 # Sonar from reporting rules that conflict with that contract or with deliberate
 # compatibility re-export surfaces.
-sonar.issue.ignore.multicriteria=e1,e2,e3,e4,e5
+sonar.issue.ignore.multicriteria=e1,e2,e3,e4,e5,e6,e7,e8,e9,e10
 
 sonar.issue.ignore.multicriteria.e1.ruleKey=python:S1722
 sonar.issue.ignore.multicriteria.e1.resourceKey=**/*.py
@@ -85,5 +85,36 @@ sonar.issue.ignore.multicriteria.e4.resourceKey=implementations/python/packages/
 sonar.issue.ignore.multicriteria.e5.ruleKey=python:S2612
 sonar.issue.ignore.multicriteria.e5.resourceKey=implementations/python/packages/raes_backend_libvirt/techvault_appliance.py
 
+# The flagged "/tmp" literal is the target of a PRIVATE bubblewrap tmpfs mount
+# inside the proof sandbox (`--tmpfs /tmp`), not a shared host directory. The
+# same line already carries a justified Bandit suppression (noqa: S108).
+sonar.issue.ignore.multicriteria.e6.ruleKey=python:S5443
+sonar.issue.ignore.multicriteria.e6.resourceKey=tools/isabelle_tool.py
+
+# The repo lint contract (Ruff) requires targeted `noqa` suppressions, each
+# carrying an inline justification; tracking every such suppression as a new
+# quality-gate violation conflicts with that contract (same shape as e1-e4).
+sonar.issue.ignore.multicriteria.e7.ruleKey=python:S1309
+sonar.issue.ignore.multicriteria.e7.resourceKey=**/*.py
+
+# The hardware-certification smoke scenario authors fixed RFC-1918 lab
+# addresses for real libvirt networks; they are scenario data, not service
+# endpoints, and must stay stable across certification runs.
+sonar.issue.ignore.multicriteria.e8.ruleKey=python:S1313
+sonar.issue.ignore.multicriteria.e8.resourceKey=tools/real-daemon/**
+
+# isabelle_tool.py's exact bytes are digest-pinned by the participant-opacity
+# proof evidence manifest (specs/formal/participant-semantics/
+# participant-opacity-proof-evidence.json, enforced by
+# check_participant_opacity_proof.py). Cosmetic lint edits would invalidate
+# recorded proof evidence, so its residual style findings are exempted instead
+# of re-certifying the proof: e9 covers the redundant-exception-class smell,
+# e10 the legacy noqa comment format.
+sonar.issue.ignore.multicriteria.e9.ruleKey=python:S5713
+sonar.issue.ignore.multicriteria.e9.resourceKey=tools/isabelle_tool.py
+
+sonar.issue.ignore.multicriteria.e10.ruleKey=python:S7632
+sonar.issue.ignore.multicriteria.e10.resourceKey=tools/isabelle_tool.py
+
 # Coverage
 sonar.python.coverage.reportPaths=implementations/python/coverage.xml