@critiq/rules 0.2.0 → 0.4.0

package/rules/php/php.correctness.todo-fixme-marker.rule.yaml

@@ -0,0 +1,36 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.todo-fixme-marker
+  title: Resolve TODO or FIXME markers
+  summary: TODO, FIXME, XXX, and HACK comments mark unfinished or risky work.
+  rationale: Tracked markers in production code often hide deferred fixes that should be ticketed or resolved before merge.
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.todo-fixme-marker
+    bind: issue
+emit:
+  finding:
+    category: correctness.maintainability
+    severity: low
+    confidence: 0.95
+    tags:
+      - correctness
+      - php
+  message:
+    title: Resolve TODO or FIXME markers
+    summary: "`${captures.issue.text}` matches php.correctness.todo-fixme-marker."
+  remediation:
+    summary: Tracked markers in production code often hide deferred fixes that should be ticketed or resolved before merge.

package/rules/php/php.correctness.trait-as-attribute.rule.yaml

@@ -0,0 +1,38 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.trait-as-attribute
+  title: Traits cannot be used as attributes
+  summary: Traits cannot be used as attributes
+  rationale: Traits cannot be used as attributes
+  aliases:
+    - PHP-W1016
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.trait-as-attribute
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: critical
+    confidence: 0.9
+    tags:
+      - correctness
+      - php
+  message:
+    title: Traits cannot be used as attributes
+    summary: "`${captures.issue.text}` matches php.correctness.trait-as-attribute."
+  remediation:
+    summary: Traits cannot be used as attributes

package/rules/php/php.correctness.trait-class-constant.rule.yaml

@@ -0,0 +1,38 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.trait-class-constant
+  title: Avoid class constants inside traits
+  summary: Avoid class constants inside traits
+  rationale: Avoid class constants inside traits
+  aliases:
+    - PHP-E1113
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.trait-class-constant
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: critical
+    confidence: 0.9
+    tags:
+      - correctness
+      - php
+  message:
+    title: Avoid class constants inside traits
+    summary: "`${captures.issue.text}` matches php.correctness.trait-class-constant."
+  remediation:
+    summary: Avoid class constants inside traits

package/rules/php/php.correctness.undefined-constant-reference.rule.yaml

@@ -0,0 +1,38 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.undefined-constant-reference
+  title: Reference only defined constants
+  summary: Reference only defined constants
+  rationale: Reference only defined constants
+  aliases:
+    - PHP-W1038
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.undefined-constant-reference
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: critical
+    confidence: 0.9
+    tags:
+      - correctness
+      - php
+  message:
+    title: Reference only defined constants
+    summary: "`${captures.issue.text}` matches php.correctness.undefined-constant-reference."
+  remediation:
+    summary: Reference only defined constants

package/rules/php/php.correctness.undefined-function.rule.yaml

@@ -0,0 +1,40 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.undefined-function
+  title: Undefined function call detected
+  summary: Calling a function that is not defined in the current file and is not a known PHP built-in function will cause a runtime fatal error.
+  aliases:
+    - PHP-E1000
+  rationale: "PHP raises a fatal error when calling an undefined function. Single-file heuristic checks for functions not defined in the current file and not in the built-in function registry. Functions in included files may cause false positives; confidence is set accordingly."
+  detection:
+    kind: pattern
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: experimental
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.undefined-function
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: critical
+    confidence: 0.60
+    tags:
+      - correctness
+      - php
+  message:
+    title: Call to undefined function ${captures.issue.text}
+    summary: "Function ${captures.issue.text}() is called but is not defined in the current file and is not a known PHP built-in function."
+  remediation:
+    summary: Ensure the function is defined (via a manual include check) or correct the function name to match an existing function.

package/rules/php/php.correctness.undefined-method.rule.yaml

@@ -0,0 +1,40 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.undefined-method
+  title: Undefined method call detected
+  summary: "Calling a method on $this, self::, or static:: that is not declared in the enclosing class will cause a runtime error."
+  aliases:
+    - PHP-E1002
+  rationale: "PHP raises an error when calling a method that does not exist on the class. Single-file heuristic checks the enclosing class body for declared methods. Classes extending other classes are skipped to avoid false positives from inherited methods."
+  detection:
+    kind: pattern
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: experimental
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.undefined-method
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: critical
+    confidence: 0.55
+    tags:
+      - correctness
+      - php
+  message:
+    title: Call to undefined method ${captures.issue.text}
+    summary: "Method ${captures.issue.text}() is called via $this->, self::, or static:: but is not declared in the enclosing class."
+  remediation:
+    summary: Declare the method on the class or correct the method name to reference an existing method.

package/rules/php/php.correctness.undefined-property.rule.yaml

@@ -0,0 +1,51 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.undefined-property
+  title: Undefined property access via $this->
+  summary: Accessing a property via $this-> that is not declared on the class will cause a runtime notice.
+  aliases:
+    - PHP-W1033
+  rationale: >-
+    PHP emits a warning when accessing an undefined instance property. Single-file
+    heuristic checks the enclosing class body for declared properties, including
+    typed properties and constructor-promoted properties. Classes with extends are
+    skipped to avoid false positives from inherited properties. Classes with __get
+    or __set magic methods are also skipped. Dynamically assigned properties (common
+    in Laravel Eloquent) are not detected, which may produce false negatives.
+  detection:
+    kind: pattern
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: experimental
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.undefined-property
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.55
+    tags:
+      - correctness
+      - php
+  message:
+    title: Access to undefined property ${captures.issue.text}
+    summary: >-
+      ${captures.issue.text} accesses a property via $this-> that is not declared
+      on the enclosing class — PHP will raise a warning.
+  remediation:
+    summary: >-
+      Declare the property on the class with the appropriate visibility and type,
+      or correct the property name. If dynamic properties are intended, declare
+      __get/__set magic methods on the class.

package/rules/php/php.correctness.undefined-static-property.rule.yaml

@@ -0,0 +1,41 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.undefined-static-property
+  title: Do not access undefined static properties
+  summary: Accessing a static property that is not declared on the target class will produce a runtime notice and return null.
+  aliases:
+    - PHP-W1034
+    - PHP-E1007
+  rationale: PHP raises an undefined property notice when accessing a static property that was never declared on the class. This is a common mistake when class APIs evolve or when property names are mistyped. The fix is to declare the static property or correct the access.
+  detection:
+    kind: pattern
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: experimental
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.undefined-static-property
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: critical
+    confidence: 0.80
+    tags:
+      - correctness
+      - php
+  message:
+    title: Static property ${captures.issue.text} is not defined on the target class
+    summary: "${captures.issue.text} is accessed via static property syntax but the declaring class has no static property with that name."
+  remediation:
+    summary: Ensure the static property is declared on the class with the correct name, or fix the static access to reference an existing property.

package/rules/php/php.correctness.undefined-variable.rule.yaml

@@ -0,0 +1,48 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.undefined-variable
+  title: Variable is used but not defined
+  summary: Using a variable that has not been defined in scope will cause a runtime notice.
+  aliases:
+    - PHP-W1066
+  rationale: >-
+    PHP emits a warning when reading an undefined variable. Single-file heuristic checks
+    function and method bodies for use-before-define, $this in static context, and
+    post-unset variable references. Nested closures, extract(), compact(), and cross-file
+    scopes are not analyzed, which may produce false negatives.
+  detection:
+    kind: pattern
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: experimental
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.undefined-variable
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.55
+    tags:
+      - correctness
+      - php
+  message:
+    title: Variable ${captures.issue.text} is used but may not be defined in scope
+    summary: >-
+      ${captures.issue.text} is referenced but was not found to be defined before
+      this point in the function scope.
+  remediation:
+    summary: >-
+      Declare and assign the variable before its first use, or ensure the variable
+      was initialized in all code paths before this reference.

package/rules/php/php.correctness.uninitialized-typed-property.rule.yaml

@@ -0,0 +1,38 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.uninitialized-typed-property
+  title: Initialize typed properties
+  summary: Typed class properties without a default value should be initialized in the constructor.
+  aliases:
+    - PHP-E1008
+  rationale: Accessing a typed property before initialization causes a runtime TypeError.
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: experimental
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.uninitialized-typed-property
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.55
+    tags:
+      - correctness
+      - php
+  message:
+    title: Initialize typed property in constructor or with default value
+    summary: "`${captures.issue.text}` is a typed property without a default value and may not be initialized before access."
+  remediation:
+    summary: Assign a default value at declaration or initialize the property in the class constructor.

package/rules/php/php.correctness.unknown-magic-method.rule.yaml

@@ -0,0 +1,38 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.unknown-magic-method
+  title: Use only supported magic methods
+  summary: PHP recognizes a fixed set of double-underscore magic methods.
+  aliases:
+    - PHP-W1081
+  rationale: Unknown magic methods are never invoked by the runtime and usually indicate typos or dead code.
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.unknown-magic-method
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: medium
+    confidence: 0.95
+    tags:
+      - correctness
+      - php
+  message:
+    title: Use only supported magic methods
+    summary: "`${captures.issue.text}` matches php.correctness.unknown-magic-method."
+  remediation:
+    summary: Unknown magic methods are never invoked by the runtime and usually indicate typos or dead code.

package/rules/php/php.correctness.unreachable-after-return.rule.yaml

@@ -4,6 +4,8 @@ metadata:
   id: php.correctness.unreachable-after-return
   title: Remove unreachable statements after return or throw
   summary: Code after `return` or `throw` in the same block never runs.
+  aliases:
+    - PHP-W1074
   rationale: Unreachable statements usually indicate dead code, incomplete refactors, or missing control-flow fixes.
   tags:
     - correctness

package/rules/php/php.correctness.unused-closure-use-variable.rule.yaml

@@ -0,0 +1,38 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.unused-closure-use-variable
+  title: Closure use variables must be referenced
+  summary: Closure use variables must be referenced
+  rationale: Closure use variables must be referenced
+  aliases:
+    - PHP-W1039
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.unused-closure-use-variable
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.9
+    tags:
+      - correctness
+      - php
+  message:
+    title: Closure use variables must be referenced
+    summary: "`${captures.issue.text}` matches php.correctness.unused-closure-use-variable."
+  remediation:
+    summary: Closure use variables must be referenced

package/rules/php/php.correctness.unused-constructor-parameter.rule.yaml

@@ -0,0 +1,38 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.unused-constructor-parameter
+  title: Remove unused constructor parameters
+  summary: Constructor parameters that are not referenced in the constructor body should be removed.
+  aliases:
+    - PHP-W1037
+  rationale: Unused constructor parameters are dead code that clutter the interface. They suggest incomplete refactoring or misunderstanding of the constructor signature. Promoting properties with `public`/`protected`/`private` implicitly creates and assigns the property, so they are excluded.
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.unused-constructor-parameter
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.75
+    tags:
+      - correctness
+      - php
+  message:
+    title: Remove unused constructor parameter
+    summary: "Parameter `${captures.issue.text}` is never referenced in the constructor body."
+  remediation:
+    summary: Remove the unused parameter or add a reference in the constructor body. Consider promoting with `public`/`protected`/`private` if the parameter should become a property.

package/rules/php/php.correctness.unused-import.rule.yaml

@@ -0,0 +1,38 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.unused-import
+  title: Remove unused import statements
+  summary: Remove unused import statements
+  rationale: Remove unused import statements
+  aliases:
+    - PHP-W1069
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.unused-import
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.9
+    tags:
+      - correctness
+      - php
+  message:
+    title: Remove unused import statements
+    summary: "`${captures.issue.text}` matches php.correctness.unused-import."
+  remediation:
+    summary: Remove unused import statements

package/rules/php/php.correctness.useless-post-increment.rule.yaml

@@ -0,0 +1,38 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.useless-post-increment
+  title: Remove useless post-increment statements
+  summary: Standalone post-increment statements with discarded results are usually mistakes.
+  aliases:
+    - PHP-W1090
+  rationale: Post-increment statements that do not feed a larger expression often indicate dead or accidental code.
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.useless-post-increment
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: low
+    confidence: 0.85
+    tags:
+      - correctness
+      - php
+  message:
+    title: Remove useless post-increment statements
+    summary: "`${captures.issue.text}` matches php.correctness.useless-post-increment."
+  remediation:
+    summary: Post-increment statements that do not feed a larger expression often indicate dead or accidental code.

package/rules/php/php.correctness.useless-unset.rule.yaml

@@ -0,0 +1,38 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: php.correctness.useless-unset
+  title: Remove useless unset calls
+  summary: Calling unset on literals or non-variables has no effect.
+  aliases:
+    - PHP-W1036
+  rationale: Useless unset calls add noise and suggest the author misunderstood PHP unset semantics.
+  tags:
+    - correctness
+    - php
+    - rules-catalog
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - php
+  paths:
+    include:
+      - "**/*.php"
+match:
+  fact:
+    kind: php.correctness.useless-unset
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: low
+    confidence: 0.9
+    tags:
+      - correctness
+      - php
+  message:
+    title: Remove useless unset calls
+    summary: "`${captures.issue.text}` matches php.correctness.useless-unset."
+  remediation:
+    summary: Useless unset calls add noise and suggest the author misunderstood PHP unset semantics.