audit: Wave 2 Batch 2 — rule-traversal + rule-sql + rule-crypto by Fieldnote-Echo · Pull Request #61 · Project-Navi/grippy-code-review

Nelson Spence (Fieldnote-Echo) · 2026-03-14T02:20:19Z

Summary

Regex stress test batch: three rules with increasingly complex patterns, testing whether SR-02 (ReDoS safety) evidence production scales to patterns with real backtracking risk
Primary target: _PERCENT_SQL and _CONCAT_SQL in rule-sql use .*\b...\b.* structure — the adversarial evidence supports the pattern-safety argument (all pass under 5s timeout with 100K-char inputs)
15/30 units now CURRENT — halfway milestone reached

What changed

Commit 1: Tests (evidence generation)

18 new tests across 3 files (54 total for these rules)
ReDoS adversarial tests: 2 for rule-traversal, 4 for rule-sql (including near-miss and keyword-no-trail shapes), 1 for rule-crypto
1MB long-line tolerance tests for all 3 rules
SR-01 gap closure for rule-crypto: RC4, ARC4, Blowfish, random.random/choice/getrandbits now tested
Safe-negative specificity anchors for rule-crypto: AES-GCM and secrets.token_bytes

Commits 2-4: Scorecards

Unit	Score	Dim 4	Finding	Key observation
rule-traversal	7.4/10	6	F-TRV-001 (LOW): edge-case file types	Direct iteration vs `ctx.added_lines_for()` — design note, not drift
rule-sql	7.4/10	6	F-SQL-001 (LOW): near-miss negatives	SR-02 primary stress test passed — `.\b...\b.` does not backtrack
rule-crypto	7.5/10	6	F-CRY-001 (LOW): context-sensitive negatives	`_in_tests_dir()` confirmed as 3-rule convention, not ownership drift

Commit 5: FRESHNESS.md

3 units NEVER → CURRENT
Cross-unit audit entry added

Calibration checkpoint

SR-02 transferred cleanly — adversarial evidence supports pattern safety for the hardest regexes in the codebase
Dim 4 stayed honest at 6 — consistent with Batch 1, no inflation despite strong ReDoS suites
SR-09 scored independently — each verdict references full fixture matrix categories, not just ReDoS
_in_tests_dir() grounded — established convention across 3 rules (weak_crypto, secrets, creds), not engine-level concern

Test plan

uv run ruff check src/grippy/ tests/ — all clean
uv run ruff format --check src/grippy/ tests/ — all clean
uv run mypy src/grippy/ — 0 issues
uv run pytest tests/ -v — 1075 passed, 0 failures
uv run pre-commit run --all-files — all passed
FRESHNESS.md unit count = 30 (15 CURRENT + 15 NEVER)

🤖 Generated with Claude Code

Closes SR-02 gaps with Tier A evidence for rule-traversal (3 regexes), rule-sql (4 patterns incl. _PERCENT_SQL/_CONCAT_SQL primary targets), and rule-crypto (random pattern). Closes SR-01 gap for rule-crypto (RC4, ARC4, Blowfish, random.random/choice/getrandbits now tested). Adds 1MB long-line tolerance tests and safe-negative specificity anchors. All SQL ReDoS tests pass — no backtracking vulnerability found. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

SR checklist: 7/9 PASS, 1 N/A (SR-06), 1 Partial (SR-09). Overall: 7.4/10 Adequate (provisional). One LOW finding (F-TRV-001): fixture matrix edge-case gaps. Dim 4 at 6 — ReDoS proven on 2 quantifier-bearing patterns, _TRAVERSAL_RE structurally immune (no quantifiers). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

SR checklist: 7/9 PASS, 1 N/A (SR-06), 1 Partial (SR-09). Overall: 7.4/10 Adequate (provisional). One LOW finding (F-SQL-001): fixture matrix missing near-miss negatives. SR-02 PRIMARY STRESS TEST PASSED: _PERCENT_SQL and _CONCAT_SQL with .*\b...\b.* structure do not exhibit catastrophic backtracking. Dim 4 at 6 — strongest adversarial suite in batch (5 tests) but coverage is narrow (ReDoS only). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

SR checklist: 7/9 PASS, 1 N/A (SR-06), 1 Partial (SR-09). Overall: 7.5/10 Adequate (provisional). One LOW finding (F-CRY-001): missing context-sensitive negatives. Dim 4 at 6 — all patterns structurally safe. Dim 5 at 7 — pattern-specific messages with remediation guidance. Dim 6 at 8 — strongest test coverage in batch (24 tests, all 7 entries + all 6 random variants proven). _in_tests_dir() confirmed as established convention (3 rules), not ownership drift — documented as Dim 7 design observation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Mark rule-traversal (7.4), rule-sql (7.4), rule-crypto (7.5) as CURRENT. Add cross-unit audit entry. 15/30 units now CURRENT — halfway mark reached. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

codecov · 2026-03-14T02:23:12Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Navi Bot (project-navi-bot)

All required CI checks passed. Auto-approved by navi-bot.

Navi Bot (project-navi-bot)

All required CI checks passed. Auto-approved by navi-bot.

github-actions · 2026-03-14T02:24:14Z

✅ Grippy Review — PASS

Score: 94/100 | Findings: 3

Delta: 3 new

_{Commit: 68e2fd1}

Navi Bot (project-navi-bot)

All required CI checks passed. Auto-approved by navi-bot.

Navi Bot (project-navi-bot)

All required CI checks passed. Auto-approved by navi-bot.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Nelson Spence (Fieldnote-Echo) and others added 5 commits March 13, 2026 21:10

docs(audit): update FRESHNESS.md for Wave 2 Batch 2

68e2fd1

Mark rule-traversal (7.4), rule-sql (7.4), rule-crypto (7.5) as CURRENT. Add cross-unit audit entry. 15/30 units now CURRENT — halfway mark reached. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nelson Spence (Fieldnote-Echo) requested a review from Copilot March 14, 2026 02:20

Nelson Spence (Fieldnote-Echo) self-assigned this Mar 14, 2026

Navi Bot (project-navi-bot) approved these changes Mar 14, 2026

View reviewed changes

github-actions Bot reviewed Mar 14, 2026

View reviewed changes

Comment thread docs/internals/audit/rule-traversal/SCORECARD.md

Comment thread docs/internals/audit/rule-sql/SCORECARD.md

Comment thread docs/internals/audit/rule-crypto/SCORECARD.md

Navi Bot (project-navi-bot) approved these changes Mar 14, 2026

View reviewed changes

Copilot AI reviewed Mar 14, 2026

View reviewed changes

Nelson Spence (Fieldnote-Echo) merged commit eeaa205 into main Mar 14, 2026
19 checks passed

Nelson Spence (Fieldnote-Echo) deleted the audit/wave-2-batch-2 branch March 14, 2026 12:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

audit: Wave 2 Batch 2 — rule-traversal + rule-sql + rule-crypto#61

audit: Wave 2 Batch 2 — rule-traversal + rule-sql + rule-crypto#61
Nelson Spence (Fieldnote-Echo) merged 5 commits intomainfrom
audit/wave-2-batch-2

Nelson Spence (Fieldnote-Echo) commented Mar 14, 2026

Uh oh!

codecov Bot commented Mar 14, 2026

Uh oh!

Navi Bot (project-navi-bot) left a comment

Uh oh!

Navi Bot (project-navi-bot) left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Mar 14, 2026

Uh oh!

Navi Bot (project-navi-bot) left a comment

Uh oh!

Navi Bot (project-navi-bot) left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Nelson Spence (Fieldnote-Echo) commented Mar 14, 2026

Summary

What changed

Commit 1: Tests (evidence generation)

Commits 2-4: Scorecards

Commit 5: FRESHNESS.md

Calibration checkpoint

Test plan

Uh oh!

codecov Bot commented Mar 14, 2026

Codecov Report

Uh oh!

Navi Bot (project-navi-bot) left a comment

Choose a reason for hiding this comment

Uh oh!

Navi Bot (project-navi-bot) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Mar 14, 2026

✅ Grippy Review — PASS

Uh oh!

Navi Bot (project-navi-bot) left a comment

Choose a reason for hiding this comment

Uh oh!

Navi Bot (project-navi-bot) left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants