lutaml 0.10.4 → 0.10.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9db8def51fe994ba67b18e3e2045df78ebc06fab52a471fb95e7421738e10dcc
-  data.tar.gz: 1ba2c6caed21e4a4b35b4a117f39327312505ebe2b72f389db3561f568395577
+  metadata.gz: 2d1caee886e1e27cbbd7db3101f510bd0a1169050cbab47f48bdb31622e46c16
+  data.tar.gz: 4d42b151859f65339b67dffc2e5070e2851819daaf145295b05285d2cecc5e50
 SHA512:
-  metadata.gz: 9a529f0ab5096212dc808a5cd21ca2eba20cbc8f1bc940076398755302af766462e66e3984d33ef9349d0510c0d25aa845af4b8b7046b6cdc93317d2d21aba5d
-  data.tar.gz: e26992d6162b77054ef39f915d4633a213452a98b6e0057ae4240ad825d7f008f529024ba91b3dfbd7dc77ac40a02e4ee3c01cbbdeabcbe3e77c2d5898ebe468
+  metadata.gz: 62f845a38a4336cee141fb710ced850a20332db561ab44fe08d16c9e780c75c2844b982176902c0eab600175561e7efd7b63136ba9eabc707ce07d424f1c0c9f
+  data.tar.gz: 0ce0fd5ae74fdd0ba9f795e39e4b7b0ead7492443f06eeee34dbbeaaf31fdab16601174dbf53f72d412c13581a8cac82cefdf4906c060f317d7f7afd2a8f3b1d

data/.rubocop.yml

@@ -17,3 +17,13 @@ plugins:
 
 AllCops:
   TargetRubyVersion: 3.2
+
+# VerifiedDoubles is disabled because many spec files use double() to mock
+# UML model classes (Lutaml::Uml::Class, Package, etc.) that don't implement
+# all stubbed methods as real Ruby methods (they use Lutaml::Model::Serializable
+# attribute declarations). Converting to instance_double would cause test failures
+# due to method verification.
+RSpec/VerifiedDoubles:
+  Enabled: false
+  Exclude:
+    - 'spec/**/*'

data/.rubocop_todo.yml

@@ -1,32 +1,52 @@
 # This configuration was generated by
 # `rubocop --auto-gen-config`
-# on 2026-04-25 02:05:14 UTC using RuboCop version 1.86.1.
+# on 2026-04-28 10:51:28 UTC using RuboCop version 1.86.1.
 # The point is for the user to remove these configuration records
 # one by one as the offenses are removed from the code base.
 # Note that changes in the inspected code, or installation of new
 # versions of RuboCop, may require this file to be generated again.
 
-# Offense count: 1
+# Offense count: 16
 # This cop supports safe autocorrection (--autocorrect).
-Layout/ElseAlignment:
+Layout/EmptyLineAfterGuardClause:
   Exclude:
-    - 'lib/lutaml/qea/factory/class_transformer.rb'
+    - 'lib/lutaml/qea/factory/association_builder.rb'
+    - 'lib/lutaml/uml/inheritance_walker.rb'
+    - 'lib/lutaml/uml_repository/static_site/data_transformer.rb'
+    - 'lib/lutaml/uml_repository/static_site/serializers/class_serializer.rb'
+    - 'lib/lutaml/uml_repository/static_site/serializers/diagram_serializer.rb'
+    - 'lib/lutaml/uml_repository/static_site/serializers/inheritance_resolver.rb'
+    - 'lib/lutaml/uml_repository/static_site/serializers/package_serializer.rb'
+
+# Offense count: 4
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EmptyLineBetweenMethodDefs, EmptyLineBetweenClassDefs, EmptyLineBetweenModuleDefs, DefLikeMacros, AllowAdjacentOneLineDefs, NumberOfEmptyLines.
+Layout/EmptyLineBetweenDefs:
+  Exclude:
+    - 'lib/lutaml/cli/interactive_shell/command_base.rb'
 
 # Offense count: 1
 # This cop supports safe autocorrection (--autocorrect).
-# Configuration parameters: Width, EnforcedStyleAlignWith, AllowedPatterns.
-# SupportedStylesAlignWith: start_of_line, relative_to_receiver
-Layout/IndentationWidth:
+Layout/EmptyLinesAfterModuleInclusion:
   Exclude:
-    - 'lib/lutaml/qea/factory/class_transformer.rb'
+    - 'lib/lutaml/uml_repository/repository.rb'
 
-# Offense count: 80
+# Offense count: 183
 # This cop supports safe autocorrection (--autocorrect).
 # Configuration parameters: Max, AllowHeredoc, AllowURI, AllowQualifiedName, URISchemes, AllowRBSInlineAnnotation, AllowCopDirectives, AllowedPatterns, SplitStrings.
 # URISchemes: http, https
 Layout/LineLength:
   Enabled: false
 
+# Offense count: 2
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EnforcedStyle, EnforcedStyleForEmptyBraces.
+# SupportedStyles: space, no_space, compact
+# SupportedStylesForEmptyBraces: space, no_space
+Layout/SpaceInsideHashLiteralBraces:
+  Exclude:
+    - 'lib/lutaml/uml/model_helpers.rb'
+
 # Offense count: 1
 Lint/BinaryOperatorWithIdenticalOperands:
   Exclude:
@@ -43,23 +63,12 @@ Lint/ConstantDefinitionInBlock:
     - 'spec/lutaml/model_transformations_spec.rb'
     - 'spec/lutaml/uml_repository/presenters/presenter_factory_spec.rb'
 
-# Offense count: 1
-Lint/CopDirectiveSyntax:
-  Exclude:
-    - 'lib/lutaml/uml_repository/repository.rb'
-
-# Offense count: 8
+# Offense count: 2
 # Configuration parameters: IgnoreLiteralBranches, IgnoreConstantBranches, IgnoreDuplicateElseBranch.
 Lint/DuplicateBranch:
   Exclude:
-    - 'lib/lutaml/cli/element_identifier.rb'
-    - 'lib/lutaml/cli/uml/verify_command.rb'
-    - 'lib/lutaml/qea/factory/base_transformer.rb'
-    - 'lib/lutaml/qea/models/ea_datatype.rb'
-    - 'lib/lutaml/qea/validation/validation_engine.rb'
+    - 'lib/lutaml/uml/model_helpers.rb'
     - 'lib/lutaml/uml_repository/queries/package_query.rb'
-    - 'lib/lutaml/uml_repository/static_site/configuration.rb'
-    - 'lib/lutaml/uml_repository/static_site/search_index_builder.rb'
 
 # Offense count: 4
 # Configuration parameters: AllowComments, AllowEmptyLambdas.
@@ -89,6 +98,13 @@ Lint/MissingSuper:
   Exclude:
     - 'lib/lutaml/uml_repository/lazy_repository.rb'
 
+# Offense count: 2
+# This cop supports safe autocorrection (--autocorrect).
+Lint/RedundantRequireStatement:
+  Exclude:
+    - 'lib/lutaml/qea/factory/generalization_builder.rb'
+    - 'lib/lutaml/uml_repository/static_site/serializers/inheritance_resolver.rb'
+
 # Offense count: 1
 # This cop supports safe autocorrection (--autocorrect).
 # Configuration parameters: AllowUnusedKeywordArguments, IgnoreEmptyMethods, IgnoreNotImplementedMethods, NotImplementedExceptions.
@@ -97,62 +113,45 @@ Lint/UnusedMethodArgument:
   Exclude:
     - 'lib/lutaml/cli/uml/export_command.rb'
 
-# Offense count: 8
+# Offense count: 2
+Lint/UselessConstantScoping:
+  Exclude:
+    - 'lib/lutaml/cli/interactive_shell.rb'
+
+# Offense count: 52
 # Configuration parameters: AllowedMethods, AllowedPatterns, CountRepeatedAttributes, Max.
 Metrics/AbcSize:
-  Exclude:
-    - 'lib/lutaml/converter/xmi_to_uml.rb'
-    - 'lib/lutaml/model_transformations/parsers/base_parser.rb'
-    - 'lib/lutaml/qea/database.rb'
-    - 'lib/lutaml/uml_repository/index_builder.rb'
-    - 'lib/lutaml/uml_repository/queries/class_query.rb'
-    - 'lib/lutaml/uml_repository/queries/inheritance_query.rb'
-    - 'lib/lutaml/xmi/parsers/xmi_base.rb'
+  Enabled: false
 
-# Offense count: 1
+# Offense count: 4
 # Configuration parameters: CountComments, CountAsOne, AllowedMethods, AllowedPatterns, inherit_mode.
 # AllowedMethods: refine
 Metrics/BlockLength:
-  Max: 28
+  Max: 53
 
-# Offense count: 11
+# Offense count: 37
 # Configuration parameters: AllowedMethods, AllowedPatterns, Max.
 Metrics/CyclomaticComplexity:
-  Exclude:
-    - 'lib/lutaml/cli/tree_view_formatter.rb'
-    - 'lib/lutaml/converter/xmi_to_uml.rb'
-    - 'lib/lutaml/qea/database.rb'
-    - 'lib/lutaml/qea/factory/enum_transformer.rb'
-    - 'lib/lutaml/uml_repository/index_builder.rb'
-    - 'lib/lutaml/uml_repository/queries/class_query.rb'
-    - 'lib/lutaml/uml_repository/queries/inheritance_query.rb'
-    - 'lib/lutaml/uml_repository/queries/search_query.rb'
-    - 'lib/lutaml/xmi/parsers/xmi_base.rb'
+  Enabled: false
 
-# Offense count: 11
+# Offense count: 65
 # Configuration parameters: CountComments, CountAsOne, AllowedMethods, AllowedPatterns.
 Metrics/MethodLength:
-  Max: 27
+  Max: 62
 
-# Offense count: 8
+# Offense count: 29
 # Configuration parameters: AllowedMethods, AllowedPatterns, Max.
 Metrics/PerceivedComplexity:
-  Exclude:
-    - 'lib/lutaml/converter/xmi_to_uml.rb'
-    - 'lib/lutaml/qea/database.rb'
-    - 'lib/lutaml/qea/factory/enum_transformer.rb'
-    - 'lib/lutaml/uml_repository/index_builder.rb'
-    - 'lib/lutaml/uml_repository/queries/class_query.rb'
-    - 'lib/lutaml/uml_repository/queries/inheritance_query.rb'
-    - 'lib/lutaml/xmi/parsers/xmi_base.rb'
+  Enabled: false
 
-# Offense count: 2
+# Offense count: 3
 # Configuration parameters: MinNameLength, AllowNamesEndingInNumbers, AllowedNames, ForbiddenNames.
 # AllowedNames: as, at, by, cc, db, id, if, in, io, ip, of, on, os, pp, to
 Naming/MethodParameterName:
   Exclude:
     - 'lib/lutaml/cli/tree_view_formatter.rb'
     - 'lib/lutaml/uml_repository/static_site/generator.rb'
+    - 'spec/lutaml/parsers/serialize_xmi_to_liquid_spec.rb'
 
 # Offense count: 1
 # Configuration parameters: Mode, AllowedMethods, AllowedPatterns, AllowBangMethods, WaywardPredicates.
@@ -162,14 +161,13 @@ Naming/PredicateMethod:
   Exclude:
     - 'lib/lutaml/qea/factory/document_builder.rb'
 
-# Offense count: 5
+# Offense count: 3
 # Configuration parameters: MinSize.
 Performance/CollectionLiteralInLoop:
   Exclude:
-    - 'lib/lutaml/xmi/parsers/xmi_base.rb'
+    - 'lib/lutaml/xmi/parsers/xmi_connector.rb'
     - 'spec/lutaml/qea/infrastructure/table_reader_spec.rb'
     - 'spec/lutaml/uml_repository/index_builder_spec.rb'
-    - 'spec/lutaml/uml_repository/queries/inheritance_query_spec.rb'
 
 # Offense count: 2
 Performance/MapMethodChain:
@@ -211,10 +209,10 @@ RSpec/ContextWording:
 RSpec/DescribeClass:
   Enabled: false
 
-# Offense count: 657
+# Offense count: 649
 # Configuration parameters: CountAsOne.
 RSpec/ExampleLength:
-  Max: 108
+  Max: 30
 
 # Offense count: 7
 # This cop supports safe autocorrection (--autocorrect).
@@ -241,20 +239,6 @@ RSpec/IndexedLet:
     - 'spec/lutaml/qea/repositories/base_repository_spec.rb'
     - 'spec/lutaml/qea/repositories/object_repository_spec.rb'
 
-# Offense count: 48
-# Configuration parameters: AssignmentOnly.
-RSpec/InstanceVariable:
-  Exclude:
-    - 'spec/lutaml/parsers/parse_xmi_spec.rb'
-    - 'spec/lutaml/qea/verification/comprehensive_equivalence_spec.rb'
-
-# Offense count: 2
-# This cop supports safe autocorrection (--autocorrect).
-RSpec/IteratedExpectation:
-  Exclude:
-    - 'spec/lutaml/ea/diagram/layout_engine_spec.rb'
-    - 'spec/lutaml/uml_repository/queries/inheritance_query_spec.rb'
-
 # Offense count: 15
 RSpec/LeakyConstantDeclaration:
   Exclude:
@@ -279,19 +263,19 @@ RSpec/MessageSpies:
     - 'spec/lutaml/uml_repository/presenters/diagram_presenter_spec.rb'
     - 'spec/lutaml/uml_repository/repository_spec.rb'
 
-# Offense count: 946
+# Offense count: 35
 RSpec/MultipleExpectations:
-  Max: 26
+  Max: 6
 
-# Offense count: 130
+# Offense count: 151
 # Configuration parameters: AllowSubject.
 RSpec/MultipleMemoizedHelpers:
   Max: 11
 
-# Offense count: 29
+# Offense count: 35
 # Configuration parameters: AllowedGroups.
 RSpec/NestedGroups:
-  Max: 5
+  Max: 4
 
 # Offense count: 2
 # Configuration parameters: AllowedPatterns.
@@ -301,13 +285,12 @@ RSpec/NoExpectationExample:
     - 'spec/lutaml/qea/verification/comprehensive_equivalence_spec.rb'
     - 'spec/lutaml/uml_repository/static_site/generator_spec.rb'
 
-# Offense count: 16
+# Offense count: 12
 RSpec/RepeatedExample:
   Exclude:
     - 'spec/lutaml/cli/package_commands_spec.rb'
     - 'spec/lutaml/ea/diagram/svg_renderer_spec.rb'
     - 'spec/lutaml/qea/validation/validation_engine_spec.rb'
-    - 'spec/lutaml/uml_repository/presenters/diagram_presenter_spec.rb'
     - 'spec/lutaml/uml_repository/static_site/data_transformer_spec.rb'
 
 # Offense count: 2
@@ -315,7 +298,7 @@ RSpec/RepeatedExampleGroupDescription:
   Exclude:
     - 'spec/lutaml/uml/parsers/dsl_spec.rb'
 
-# Offense count: 6
+# Offense count: 5
 # Configuration parameters: CustomTransform, IgnoreMethods, IgnoreMetadata, InflectorPath, EnforcedInflector.
 # SupportedInflectors: default, active_support
 RSpec/SpecFilePathFormat:
@@ -323,34 +306,18 @@ RSpec/SpecFilePathFormat:
     - 'spec/express/parsers/exp_spec.rb'
     - 'spec/lutaml/parser_qea_spec.rb'
     - 'spec/lutaml/parsers/parse_xmi_spec.rb'
-    - 'spec/lutaml/parsers/serialize_generalization_by_name_spec.rb'
     - 'spec/lutaml/parsers/serialize_xmi_to_liquid_spec.rb'
     - 'spec/lutaml/uml_repository/web_ui/app_spec.rb'
 
-# Offense count: 6
-RSpec/UnspecifiedException:
-  Exclude:
-    - 'spec/lutaml/model_transformations/parsers/qea_parser_spec.rb'
-    - 'spec/lutaml/model_transformations/parsers/xmi_parser_spec.rb'
-    - 'spec/lutaml/model_transformations_spec.rb'
-    - 'spec/lutaml/parser_qea_spec.rb'
-    - 'spec/lutaml/qea/integration/full_parsing_spec.rb'
-
-# Offense count: 212
-# Configuration parameters: IgnoreNameless, IgnoreSymbolicNames.
-RSpec/VerifiedDoubles:
-  Enabled: false
-
 # Offense count: 3
 Security/Eval:
   Exclude:
     - 'spec/lutaml/cli/uml/search_command_spec.rb'
 
-# Offense count: 4
+# Offense count: 2
 Security/MarshalLoad:
   Exclude:
     - 'lib/lutaml/uml_repository/package_loader.rb'
-    - 'spec/lutaml/uml_repository/package_exporter_spec.rb'
 
 # Offense count: 2
 # This cop supports safe autocorrection (--autocorrect).
@@ -369,11 +336,18 @@ Style/EvalWithLocation:
   Exclude:
     - 'spec/lutaml/cli/uml/search_command_spec.rb'
 
+# Offense count: 1
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: AllowMethodComparison, ComparisonsThreshold.
+Style/MultipleComparison:
+  Exclude:
+    - 'lib/lutaml/cli/interactive_shell.rb'
+
 # Offense count: 1
 # This cop supports unsafe autocorrection (--autocorrect-all).
 Style/PartitionInsteadOfDoubleSelect:
   Exclude:
-    - 'lib/lutaml/qea/factory/class_transformer.rb'
+    - 'lib/lutaml/qea/factory/generalization_builder.rb'
 
 # Offense count: 3
 # Configuration parameters: Max.
@@ -381,3 +355,19 @@ Style/SafeNavigationChainLength:
   Exclude:
     - 'lib/lutaml/qea/validation/attribute_validator.rb'
     - 'lib/lutaml/qea/validation/operation_validator.rb'
+
+# Offense count: 1
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EnforcedStyleForMultiline.
+# SupportedStylesForMultiline: comma, consistent_comma, diff_comma, no_comma
+Style/TrailingCommaInArguments:
+  Exclude:
+    - 'lib/lutaml/qea/factory/class_transformer.rb'
+
+# Offense count: 2
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EnforcedStyleForMultiline.
+# SupportedStylesForMultiline: comma, consistent_comma, diff_comma, no_comma
+Style/TrailingCommaInHashLiteral:
+  Exclude:
+    - 'lib/lutaml/cli/interactive_shell.rb'

data/TODO.cleanups/01-resolve-production-todos.md

@@ -0,0 +1,65 @@
+# 01 — Resolve 7 production TODOs
+
+## Problem
+
+Seven `TODO`/`FIXME` comments in `lib/` represent incomplete features, missing validation, or known tech debt. They risk silent data loss or incorrect behavior.
+
+## Items
+
+### 1. `lib/lutaml/qea/factory/diagram_transformer.rb:28`
+```ruby
+# TODO: Fix diagram_type assignment -
+# lutaml-model compatibility issue
+# diagram.diagram_type = ea_diagram.diagram_type
+```
+**Impact**: Diagram type is silently dropped during QEA→UML transformation. The `diagram_type` attribute exists on `Lutaml::Uml::Diagram` but is never populated from QEA.
+**Fix**: Investigate lutaml-model compatibility (likely a type mismatch or missing attribute). Either fix the assignment or document why it's intentionally omitted.
+
+### 2. `lib/lutaml/qea/factory/package_transformer.rb:32`
+```ruby
+# TODO: Fix tagged_values assignment - temporarily commented out
+# pkg.tagged_values = load_tagged_values(ea_package.ea_guid)
+```
+**Impact**: Tagged values (metadata/annotations) are silently dropped from packages during QEA→UML transformation. This causes XMI/QEA equivalence mismatches.
+**Fix**: Check if `load_tagged_values` returns correct type. Likely needs the same serialization pattern used in class_transformer.
+
+### 3. `lib/lutaml/formatter/graphviz.rb:56`
+```ruby
+# TODO: set rankdir
+# @graph['rankdir'] = 'BT'
+```
+**Impact**: Graph direction can't be configured. The value is commented out.
+**Fix**: Either expose as configurable option or remove dead code.
+
+### 4. `lib/lutaml/uml/node/class_node.rb:19`
+```ruby
+@modifier = value.to_s # TODO: Validate?
+```
+**Impact**: No validation on modifier values — invalid strings accepted silently.
+**Fix**: Add enum validation for known modifiers (`public`, `private`, `protected`, etc.) or remove the TODO if validation isn't needed.
+
+### 5. `lib/lutaml/uml/node/attribute.rb:27`
+```ruby
+@access = value.to_s # TODO: Validate?
+```
+**Impact**: Same as #4 but for access modifiers on attributes.
+**Fix**: Same as #4 — validate or remove TODO.
+
+### 6. `lib/lutaml/uml/node/class_node.rb:24`
+```ruby
+type = member.to_a[0][0] # TODO: This is dumb
+```
+**Impact**: Fragile parsing of member data structure. The `TODO: This is dumb` indicates the developer knew it was wrong but shipped it.
+**Fix**: Replace with structured member parsing using named access.
+
+### 7. `lib/lutaml/uml/has_members.rb:8`
+```ruby
+# TODO: move to Parslet::Transform
+```
+**Impact**: Member type logic is in the model instead of the parser layer.
+**Fix**: Evaluate whether moving to Parslet::Transform is still desirable. If not, remove the TODO.
+
+## Verification
+
+- `grep -rn "TODO\|FIXME" lib/ --include="*.rb"` should return 0 results (or only intentional ones)
+- Full test suite passes: `bundle exec rspec`

data/TODO.cleanups/02-reduce-metrics-offenses.md

@@ -0,0 +1,37 @@
+# 02 — Reduce Metrics/AbcSize and method complexity (212 + 130 + 11 + 11 + 8 offenses)
+
+## Problem
+
+5 Metrics cops account for **372 offenses** across production code. The worst offenders are large methods that do too much, making them hard to test, debug, and maintain.
+
+## Top targets by file
+
+| File | AbcSize | MethodLength | Cyclomatic | Perceived | Lines |
+|------|---------|-------------|------------|-----------|-------|
+| `lib/lutaml/xmi/parsers/xmi_base.rb` | Yes | — | Yes | Yes | 1047 |
+| `lib/lutaml/converter/xmi_to_uml.rb` | Yes | — | Yes | Yes | 474 |
+| `lib/lutaml/uml_repository/index_builder.rb` | Yes | — | Yes | Yes | 480 |
+| `lib/lutaml/qea/database.rb` | Yes | — | Yes | Yes | 477 |
+| `lib/lutaml/uml_repository/queries/class_query.rb` | Yes | — | Yes | Yes | 151 |
+| `lib/lutaml/uml_repository/queries/inheritance_query.rb` | Yes | — | Yes | Yes | — |
+| `lib/lutaml/model_transformations/parsers/base_parser.rb` | Yes | — | — | — | — |
+| `lib/lutaml/qea/factory/enum_transformer.rb` | — | — | Yes | Yes | — |
+| `lib/lutaml/uml_repository/queries/search_query.rb` | — | — | Yes | — | — |
+| `lib/lutaml/cli/tree_view_formatter.rb` | — | — | Yes | — | — |
+
+## Approach
+
+Extract helper methods from god methods. Common patterns:
+
+1. **xmi_base.rb** — The 1047-line file has massive parsing methods. Extract per-element-type parsing into separate methods (already partially done).
+2. **converter/xmi_to_uml.rb** — The `build_*` methods handle too many concerns. Extract mapping logic per element type.
+3. **index_builder.rb** — The single-pass `build_all` is better than before but individual index builders can be further split.
+4. **database.rb** — The `build_lookup_indexes` method builds all indexes at once; split into per-index methods.
+
+**Do NOT**: Increase Max thresholds in `.rubocop_todo.yml`. Instead, refactor to reduce actual complexity.
+
+## Verification
+
+- `bundle exec rubocop --only Metrics` shows reduced offense counts
+- `bundle exec rspec` passes
+- No functional changes — pure refactoring

data/TODO.cleanups/03-reduce-rspec-multiple-expectations.md

@@ -0,0 +1,54 @@
+# 03 — Reduce RSpec/MultipleExpectations (946 offenses)
+
+## Problem
+
+946 test examples have more than 1 expectation. This is the single largest rubocop offense. It makes tests brittle (failures stop at the first failed expectation, masking other issues) and harder to understand what's being verified.
+
+## Approach
+
+Split multi-expectation examples into focused single-expectation examples:
+
+```ruby
+# BEFORE:
+it "validates the widget" do
+  expect(widget.name).to eq("Test")
+  expect(widget.size).to eq(10)
+  expect(widget.active).to be true
+end
+
+# AFTER:
+it { expect(widget.name).to eq("Test") }
+it { expect(widget.size).to eq(10) }
+it { expect(widget.active).to be true }
+```
+
+For cases where multiple expectations are genuinely related (e.g., checking a hash structure), use compound matchers:
+
+```ruby
+expect(result).to include("name" => "Test", "size" => 10, "active" => true)
+```
+
+Or aggregate failures with `aggregate_failures` when the expectations are about the same concern:
+
+```ruby
+it "has correct address fields" do
+  aggregate_failures do
+    expect(address.street).to eq("Main St")
+    expect(address.city).to eq("London")
+  end
+end
+```
+
+## Priority files (highest offense density)
+
+Run `bundle exec rubocop --only RSpec/MultipleExpectations` to see the full list. Focus on:
+1. `spec/lutaml/qea/verification/comprehensive_equivalence_spec.rb`
+2. `spec/lutaml/qea/verification/equivalence_integration_spec.rb`
+3. `spec/lutaml/cli/` command specs
+4. `spec/lutaml/uml_repository/` specs
+
+## Verification
+
+- `bundle exec rubocop --only RSpec/MultipleExpectations` shows reduced count
+- `bundle exec rspec` passes
+- Reduce Max from 26 toward 5 (default)

data/TODO.cleanups/04-reduce-rspec-example-length.md

@@ -0,0 +1,45 @@
+# 04 — Reduce RSpec/ExampleLength (657 offenses)
+
+## Problem
+
+657 test examples exceed the default 5-line limit (current Max: 108). Long examples are hard to read, hide intent, and often combine setup + action + multiple assertions.
+
+## Approach
+
+Common patterns to fix:
+
+1. **Extract test data into `let`/`let!`** — Move setup out of `it` blocks:
+```ruby
+# BEFORE:
+it "parses correctly" do
+  result = described_class.parse(fixture_content)
+  expect(result.name).to eq("Test")
+end
+
+# AFTER:
+let(:result) { described_class.parse(fixture_content) }
+it { expect(result.name).to eq("Test") }
+```
+
+2. **Extract shared setup into `before` blocks** — If multiple examples repeat the same setup.
+
+3. **Use subject with one-liner syntax** — Where the subject is the tested value:
+```ruby
+subject { described_class.new(attrs) }
+it { is_expected.to be_valid }
+```
+
+4. **Extract helper methods** — Complex assertions that span many lines can become custom matchers or helper methods in `spec/support/`.
+
+## Priority
+
+Focus on the longest examples first — run `bundle exec rubocop --only RSpec/ExampleLength` and sort by severity. Files with the worst examples:
+- `spec/lutaml/qea/` verification and factory specs
+- `spec/lutaml/uml_repository/` static site specs
+- `spec/lutaml/cli/` command specs
+
+## Verification
+
+- `bundle exec rubocop --only RSpec/ExampleLength` shows reduced count
+- Reduce Max from 108 toward 10
+- `bundle exec rspec` passes

data/TODO.cleanups/05-replace-marshal-load.md

@@ -0,0 +1,37 @@
+# 05 — Replace Marshal.load with safe deserialization (4 offenses)
+
+## Problem
+
+`Marshal.load` is flagged by `Security/MarshalLoad` because deserializing untrusted data can lead to remote code execution. The gem uses it in the `.lur` package format (a ZIP file containing serialized Ruby objects).
+
+## Affected files
+
+```ruby
+# lib/lutaml/uml_repository/package_loader.rb:194
+Marshal.load(entry.get_input_stream.read)
+
+# lib/lutaml/uml_repository/package_loader.rb:210
+Marshal.load(entry.get_input_stream.read)
+
+# spec/lutaml/uml_repository/package_exporter_spec.rb:141
+expect { Marshal.load(serialized) }.not_to raise_error
+
+# spec/lutaml/uml_repository/package_exporter_spec.rb:171
+expect { Marshal.load(serialized) }.not_to raise_error
+```
+
+## Approach
+
+**Option A: Switch to JSON serialization** — Replace `Marshal.dump`/`Marshal.load` with `JSON.generate`/`JSON.parse` in `PackageExporter` and `PackageLoader`. This is safe but requires models to be JSON-serializable.
+
+**Option B: Use YAML with permitted classes** — `YAML.safe_load` with an explicit allowlist of classes. More flexible but still requires maintaining the class list.
+
+**Option C: Keep Marshal but document the trust boundary** — If `.lur` files are only ever created by the gem itself (trusted), the risk is mitigated. Add a clear comment at the load site and suppress the cop with justification.
+
+**Recommended**: Option A if feasible (cleanest), Option C as a minimal fix.
+
+## Verification
+
+- `bundle exec rubocop --only Security/MarshalLoad` shows 0 offenses
+- `.lur` package round-trip (export → load) works correctly
+- `bundle exec rspec` passes

data/TODO.cleanups/06-replace-eval-in-tests.md

@@ -0,0 +1,41 @@
+# 06 — Replace eval in tests with StringIO redirection (3 Security/Eval + 2 Style/EvalWithLocation + 2 Style/DocumentDynamicEvalDefinition)
+
+## Problem
+
+`spec/lutaml/cli/uml/search_command_spec.rb` uses `eval` to redirect `$stdout`/`$stderr` for capturing output. This triggers 7 rubocop offenses across Security and Style cops.
+
+## Affected code
+
+```ruby
+# spec/lutaml/cli/uml/search_command_spec.rb:61-65
+old_stream = eval(stream_var.to_s)
+eval("#{stream_var} = StringIO.new")
+# ...
+eval("#{stream_var} = old_stream") if defined?(old_stream) && old_stream
+```
+
+## Fix
+
+Replace with a standard output capture pattern:
+
+```ruby
+# Use RSpec's built-in output matcher:
+expect { command.run }.to output(/expected text/).to_stdout
+
+# Or use a capture helper:
+def capture_output
+  old_stdout = $stdout
+  $stdout = StringIO.new
+  yield
+  $stdout.string
+ensure
+  $stdout = old_stdout
+end
+```
+
+No `eval` needed — just use `$stdout` directly instead of dynamically resolving the variable name.
+
+## Verification
+
+- `bundle exec rubocop --only Security/Eval,Style/EvalWithLocation,Style/DocumentDynamicEvalDefinition` shows 0 offenses
+- `bundle exec rspec spec/lutaml/cli/uml/search_command_spec.rb` passes