chore(cora): silence validated false-positive rules and guard tole-core stdout

[ajianaz]

What

Tune the deterministic cora rules for this repo after a full cora scan --no-llm with cora 0.19.0.

Why

cora scan now runs the rules engine, so it reported 457 deterministic findings (1 critical). Each rule family was validated against the code before anything was silenced; almost all of it was noise that would bury real findings.

Changes

• .cora.yaml ignore.rules (every entry documents why):
  • bug-todo: matches the word "todo" (the todo_write/TodoState feature); 22 of 22 hits were false positives.
  • qual-clone: 306 info hits, the intended Arc/String ownership model.
  • bug-expect: 37 hits, each stating a local invariant (expect("stdout piped above"), lock and runtime expects).
  • bug-println: the CLI's stdout is its interface and eprintln! is the diagnostics channel.
• New custom rule core-no-stdout (rules_engine.custom): println!/print! (not eprintln!) in tole-core is a major finding, so the design rule that the core never writes to stdout stays enforced after bug-println is silenced. Excludes crates/tole-cli/**, evals/** and tests. It currently matches nothing in the repo.
• Two single-site inline markers, each with its reason on the line above: openai.rs ENV_API_KEY (an env var name, the only critical finding, sec-hardcoded-secret) and approver.rs (a prompt flush, qual-error-ignore).
• Result: 457 findings down to 6, all valid bug-unwrap minors left visible (3 WebSearchTool::from_env().unwrap() calls guarded by an is_some() check, 3 in the evals replay tool).

Notes

• rules_engine.custom takes languages as file extensions (["rs"]) and requires exclude; rules: must stay a list of strings in this version. The 0.19.0 docs and changelog describe both differently, so the config was verified empirically (a probe tree with println!/eprintln!/print! in core and cli).
• Marker syntax: the whole rest of the line is parsed as the comma-separated rule list, so the explanation goes on its own line above.

Testing

• cora scan --no-llm before and after (457 to 6); cora config validate passes.
• fmt, clippy -D warnings, cargo test --workspace pass; cora review --staged clean.

Refs the cora 0.19.0 agent-reviewer trial

[github-actions]

🔍 Cora AI Code Review

✅ No issues found. Code looks good!

---

Review powered by cora-code · BYOK · MIT