code-standards 8.104.1__tar.gz → 8.105.0__tar.gz

{code_standards-8.104.1 → code_standards-8.105.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code-standards
-Version: 8.104.1
+Version: 8.105.0
 Summary: One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy.
 Project-URL: Homepage, https://code-standards.sarj.ai/
 Project-URL: Documentation, https://code-standards.sarj.ai/cli/
@@ -30,10 +30,10 @@ Requires-Dist: pyyaml==6.0.3
 Requires-Dist: referencing==0.37.0
 Requires-Dist: repo-standards==6.11.0
 Requires-Dist: ruff==0.17.0
-Requires-Dist: sarj-iac-lint==0.24.1
-Requires-Dist: sarj-python-lint==1.63.1
+Requires-Dist: sarj-iac-lint==0.25.0
+Requires-Dist: sarj-python-lint==1.64.0
 Requires-Dist: sarj-rule-contracts==0.2.5
-Requires-Dist: sarj-sql-lint==0.22.4
+Requires-Dist: sarj-sql-lint==0.23.0
 Requires-Dist: shellcheck-py==0.11.0.1; (sys_platform == 'darwin' and platform_machine == 'arm64') or (sys_platform == 'darwin' and platform_machine == 'x86_64') or (sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')
 Requires-Dist: typer==0.27.3
 Description-Content-Type: text/markdown
@@ -67,7 +67,9 @@ Use repeatable `check --rule ENGINE:ID` selectors to select native rules, ESLint
 
 Selected ESLint checks apply live inline suppressions and validate selected bulk suppression counts. The complete lint gate owns unused inline-directive and inline-configuration checks: a partial run cannot establish whether an unselected rule's directive is needed.
 
-The complete Standards gate enforces Ruff's ban on `typing.cast` and `typing_extensions.cast` even when source comments, consumer Ruff configuration or manifest rule exceptions suppress `banned-api`; these cast findings cannot enter or consume the diagnostic baseline. Wildcard imports and literal `getattr` access to a proven typing module retain the same ban. Other banned APIs retain their existing exception policy. Prefer discriminated unions, explicit narrowing and typed contracts. The warning `python:no-dual-shape-model-field-reader` (SARJ522) identifies private helpers that read the same declared Pydantic fields through model `getattr` and mapping lookup branches, returning `object` or `Any`. Normalize raw input once and read typed attributes. Opaque inputs, raw validators and genuinely dynamic reflection remain supported. Review changes to missing-field handling, coercion, generated defaults and validation errors; there is no autofix.
+The complete Python and JavaScript/TypeScript source gate requires named, line-local exceptions with concrete reasons. SARJ523 rejects blanket Python waivers, scoped Ruff file/range disables and weakened Pyright source settings; SARJ419 also rejects missing explanations. Bare sarj-noqa markers cannot waive Python, SQL or IaC findings. Required Ruff blanket-ignore checks and an independent ESLint suppression-policy pass remain active despite source disables, consumer rule configuration, rule exclusions and diagnostic baselines. The ESLint pass bans file/range disables, ts-ignore and ts-nocheck while retaining described local ts-expect-error exceptions. Generated-source headers cannot authorize their own waiver; explicit whole-path exclusions retain that boundary. A reason is not proof that an exception is justified. Native parse/read/size failures make checks incomplete. Explicit tool delegation, partial and own-CI options retain their declared scope and coverage notices.
+
+The complete Standards gate enforces Ruff's ban on `typing.cast` and `typing_extensions.cast` even when source comments, consumer Ruff configuration or manifest rule exceptions suppress `banned-api`; these cast findings cannot enter or consume the diagnostic baseline. Wildcard imports, bounded literal `getattr` names and proven read-only typing module namespace lookups through `__dict__`, `vars` and `__getattribute__` retain the same ban. Other banned APIs retain their existing exception policy. Prefer discriminated unions, explicit narrowing and typed contracts. The warning `python:no-dual-shape-model-field-reader` (SARJ522) identifies private helpers that read the same declared Pydantic fields through model `getattr` and mapping lookup branches, returning `object` or `Any`. Normalize raw input once and read typed attributes. Opaque inputs, raw validators and genuinely dynamic reflection remain supported. Review changes to missing-field handling, coercion, generated defaults and validation errors; there is no autofix.
 
 Python boolean traps are owned by Ruff FBT001, FBT002 and FBT003: positional boolean annotations, defaults and literal arguments are checked; keyword-only inputs, named arguments and the existing test exemptions remain allowed. The typed ESLint policy uses `@sarj/no-boolean-selector-parameter` at warning severity. This adapter retains maintained SonarJS S2301 detection and adds concise-arrow conditional dispatch. Prefer separate intention-revealing operations or an explicit string-literal mode. Boolean data, syntactic value mappings, stable same-operation data choices, setters and independently declared callback or inherited contracts remain allowed. Independent JSX helpers are checked; types and references establish callback contracts. It requires type information and a direct broad-boolean parameter condition. Multi-statement bodies, short-circuit guards, nullable or literal-only inputs and indirect predicates remain outside its scope. The inherited upstream block-body `onX` property exemption remains a documented blind spot. Use `code-standards check --rule eslint:no-boolean-selector-parameter` to inspect it. Noncomputed property reads count as data without proving getter effects; computed reads, including literal keys, remain outside that exemption. API changes require manual review; the rule provides no automatic rewrite.
 

{code_standards-8.104.1 → code_standards-8.105.0}/README.md

@@ -27,7 +27,9 @@ Use repeatable `check --rule ENGINE:ID` selectors to select native rules, ESLint
 
 Selected ESLint checks apply live inline suppressions and validate selected bulk suppression counts. The complete lint gate owns unused inline-directive and inline-configuration checks: a partial run cannot establish whether an unselected rule's directive is needed.
 
-The complete Standards gate enforces Ruff's ban on `typing.cast` and `typing_extensions.cast` even when source comments, consumer Ruff configuration or manifest rule exceptions suppress `banned-api`; these cast findings cannot enter or consume the diagnostic baseline. Wildcard imports and literal `getattr` access to a proven typing module retain the same ban. Other banned APIs retain their existing exception policy. Prefer discriminated unions, explicit narrowing and typed contracts. The warning `python:no-dual-shape-model-field-reader` (SARJ522) identifies private helpers that read the same declared Pydantic fields through model `getattr` and mapping lookup branches, returning `object` or `Any`. Normalize raw input once and read typed attributes. Opaque inputs, raw validators and genuinely dynamic reflection remain supported. Review changes to missing-field handling, coercion, generated defaults and validation errors; there is no autofix.
+The complete Python and JavaScript/TypeScript source gate requires named, line-local exceptions with concrete reasons. SARJ523 rejects blanket Python waivers, scoped Ruff file/range disables and weakened Pyright source settings; SARJ419 also rejects missing explanations. Bare sarj-noqa markers cannot waive Python, SQL or IaC findings. Required Ruff blanket-ignore checks and an independent ESLint suppression-policy pass remain active despite source disables, consumer rule configuration, rule exclusions and diagnostic baselines. The ESLint pass bans file/range disables, ts-ignore and ts-nocheck while retaining described local ts-expect-error exceptions. Generated-source headers cannot authorize their own waiver; explicit whole-path exclusions retain that boundary. A reason is not proof that an exception is justified. Native parse/read/size failures make checks incomplete. Explicit tool delegation, partial and own-CI options retain their declared scope and coverage notices.
+
+The complete Standards gate enforces Ruff's ban on `typing.cast` and `typing_extensions.cast` even when source comments, consumer Ruff configuration or manifest rule exceptions suppress `banned-api`; these cast findings cannot enter or consume the diagnostic baseline. Wildcard imports, bounded literal `getattr` names and proven read-only typing module namespace lookups through `__dict__`, `vars` and `__getattribute__` retain the same ban. Other banned APIs retain their existing exception policy. Prefer discriminated unions, explicit narrowing and typed contracts. The warning `python:no-dual-shape-model-field-reader` (SARJ522) identifies private helpers that read the same declared Pydantic fields through model `getattr` and mapping lookup branches, returning `object` or `Any`. Normalize raw input once and read typed attributes. Opaque inputs, raw validators and genuinely dynamic reflection remain supported. Review changes to missing-field handling, coercion, generated defaults and validation errors; there is no autofix.
 
 Python boolean traps are owned by Ruff FBT001, FBT002 and FBT003: positional boolean annotations, defaults and literal arguments are checked; keyword-only inputs, named arguments and the existing test exemptions remain allowed. The typed ESLint policy uses `@sarj/no-boolean-selector-parameter` at warning severity. This adapter retains maintained SonarJS S2301 detection and adds concise-arrow conditional dispatch. Prefer separate intention-revealing operations or an explicit string-literal mode. Boolean data, syntactic value mappings, stable same-operation data choices, setters and independently declared callback or inherited contracts remain allowed. Independent JSX helpers are checked; types and references establish callback contracts. It requires type information and a direct broad-boolean parameter condition. Multi-statement bodies, short-circuit guards, nullable or literal-only inputs and indirect predicates remain outside its scope. The inherited upstream block-body `onX` property exemption remains a documented blind spot. Use `code-standards check --rule eslint:no-boolean-selector-parameter` to inspect it. Noncomputed property reads count as data without proving getter effects; computed reads, including literal keys, remain outside that exemption. API changes require manual review; the rule provides no automatic rewrite.
 

{code_standards-8.104.1 → code_standards-8.105.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "code-standards"
-version = "8.104.1"
+version = "8.105.0"
 description = "One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -31,9 +31,9 @@ dependencies = [
   "repo-standards==6.11.0",
   "ruff==0.17.0",
   "shellcheck-py==0.11.0.1; (sys_platform == 'darwin' and platform_machine == 'arm64') or (sys_platform == 'darwin' and platform_machine == 'x86_64') or (sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')",
-  "sarj-iac-lint==0.24.1",
-  "sarj-python-lint==1.63.1",
-  "sarj-sql-lint==0.22.4",
+  "sarj-iac-lint==0.25.0",
+  "sarj-python-lint==1.64.0",
+  "sarj-sql-lint==0.23.0",
   "typer==0.27.3",
 ]
 

{code_standards-8.104.1 → code_standards-8.105.0}/src/sarj_standards/api.py

@@ -324,33 +324,15 @@ class Standards:
             return _with_coverage(
                 _without_baselined_diagnostics(native, baseline_counts, changed_scope=changed_scope), coverage
             )
-        if selected_groups.typescript and adopted is not None and "eslint" not in adopted.configs:
-            coverage.append(
-                CoverageNotice(
-                    "eslint",
-                    "disabled by repository capabilities",
-                    len(selected_groups.typescript),
-                    CoverageDisposition.NOT_REQUESTED,
-                )
-            )
-        elif selected_groups.typescript and not eslint:
-            coverage.append(
-                CoverageNotice(
-                    "eslint",
-                    "ESLint is left to the repository's own CI",
-                    len(selected_groups.typescript),
-                    CoverageDisposition.NOT_REQUESTED,
-                )
-            )
-        if selected_groups.python and not python_type_check:
-            coverage.append(
-                CoverageNotice(
-                    "basedpyright",
-                    "Python type checking is left to the repository's own CI",
-                    len(selected_groups.python),
-                    CoverageDisposition.NOT_REQUESTED,
-                )
+        coverage.extend(
+            _source_analyzer_coverage(
+                selected_groups,
+                adopted,
+                full=rule_selection is None and not upstream_rules.ids,
+                python_type_check=python_type_check,
+                eslint=eslint,
             )
+        )
 
         def external_analysis() -> tuple[ToolReport, ...]:
             return _selected_external_analysis(
@@ -573,6 +555,57 @@ def _operation_result(
     return Result(status, findings, changes, exit_code)
 
 
+def _source_analyzer_coverage(
+    selected_groups: GroupedPaths,
+    adopted: Manifest | None,
+    *,
+    full: bool,
+    python_type_check: bool,
+    eslint: bool,
+) -> list[CoverageNotice]:
+    coverage: list[CoverageNotice] = []
+    if full and selected_groups.python and adopted is not None:
+        requested_python_tools = ("ruff", "pyright") if python_type_check else ("ruff",)
+        coverage.extend(
+            CoverageNotice(
+                "basedpyright" if tool == "pyright" else tool,
+                "disabled by repository capabilities",
+                len(selected_groups.python),
+                CoverageDisposition.NOT_REQUESTED,
+            )
+            for tool in requested_python_tools
+            if tool not in adopted.enabled_capabilities
+        )
+    if selected_groups.typescript and not eslint:
+        coverage.append(
+            CoverageNotice(
+                "eslint",
+                "ESLint is left to the repository's own CI",
+                len(selected_groups.typescript),
+                CoverageDisposition.NOT_REQUESTED,
+            )
+        )
+    elif selected_groups.typescript and adopted is not None and "eslint" not in adopted.configs:
+        coverage.append(
+            CoverageNotice(
+                "eslint",
+                "disabled by repository capabilities",
+                len(selected_groups.typescript),
+                CoverageDisposition.NOT_REQUESTED,
+            )
+        )
+    if selected_groups.python and not python_type_check:
+        coverage.append(
+            CoverageNotice(
+                "basedpyright",
+                "Python type checking is left to the repository's own CI",
+                len(selected_groups.python),
+                CoverageDisposition.NOT_REQUESTED,
+            )
+        )
+    return coverage
+
+
 def _prepared_only_analysis(
     root: Path,
     adopted: Manifest | None,
@@ -820,7 +853,7 @@ def _with_library_policy(
 
 
 def _with_repository_analysis(root: Path, native: AnalysisReport, *, staged: bool) -> AnalysisReport:
-    from .libs.linting.repo_standards import (  # ruff: ignore[import-outside-top-level]
+    from .libs.linting.repo_standards import (  # ruff: ignore[import-outside-top-level] -- load libs.linting.repo_standards only when this selected operation executes.
         analyze as analyze_repository,
     )
 
@@ -926,7 +959,7 @@ def _rule_selection(values: Sequence[str | RuleSelector] | None) -> RuleSelectio
     from sarj_standards.libs.linting import (  # ruff: ignore[import-outside-top-level] -- load the upstream selectors with the catalog.
         security_tools,
     )
-    from sarj_standards.libs.repository import (  # ruff: ignore[import-outside-top-level]
+    from sarj_standards.libs.repository import (  # ruff: ignore[import-outside-top-level] -- load sarj_standards.libs.repository only when this selected operation executes.
         rule_catalog_artifact,
     )
 
@@ -953,7 +986,7 @@ def _rule_selection(values: Sequence[str | RuleSelector] | None) -> RuleSelectio
 
 
 def _routed_for_selection(grouped: object, selected: RuleSelection | None) -> set[str]:
-    from sarj_standards.libs.linting.runner import (  # ruff: ignore[import-outside-top-level]
+    from sarj_standards.libs.linting.runner import (  # ruff: ignore[import-outside-top-level] -- load sarj_standards.libs.linting.runner only when this selected operation executes.
         GroupedPaths,
     )
 
@@ -996,10 +1029,10 @@ def _filter_report_selectors(
 
 
 def _warning_rule_keys(mode: AnalysisMode, selected: RuleSelection | None) -> frozenset[RuleSelector]:
-    from sarj_standards.libs.linting.policy import (  # ruff: ignore[import-outside-top-level]
+    from sarj_standards.libs.linting.policy import (  # ruff: ignore[import-outside-top-level] -- load sarj_standards.libs.linting.policy only when this selected operation executes.
         warning_selectors,
     )
-    from sarj_standards.libs.linting.test_value import SELECTORS  # ruff: ignore[import-outside-top-level]
+    from sarj_standards.libs.linting.test_value import SELECTORS  # ruff: ignore[import-outside-top-level] -- load sarj_standards.libs.linting.test_value only when this selected operation executes.
 
     warnings = warning_selectors()
     if mode is AnalysisMode.OBSERVE and selected is not None:
@@ -1020,8 +1053,11 @@ def _with_warning_severity(
             tool,
             diagnostics=tuple(
                 replace(item, severity=Severity.WARNING)
-                if _selector_for_diagnostic(item) in selectors
-                or (tool.name == "eslint" and upstream_rules.warning_only and item.rule_id in upstream_rules.ids)
+                if "required-source-policy" not in item.tags
+                and (
+                    _selector_for_diagnostic(item) in selectors
+                    or (tool.name == "eslint" and upstream_rules.warning_only and item.rule_id in upstream_rules.ids)
+                )
                 else item
                 for item in tool.diagnostics
             ),