fix(standards): guard debt patterns against hyphenated identifiers (closes #2537) - #2622
Merged
Merged
Conversation
…2537) `-` is a regex word boundary, so GLOBAL_FRAGILE_DEBT/GLOBAL_PLANNED_DEBT's bare \b(...)\b alternations matched debt keywords EMBEDDED INSIDE hyphenated code identifiers -- COBOL data items (HACK-LEVEL, BUG-COUNT), COBOL/Lisp paragraph and symbol names (PROBE-TODO, probe-todo), css classes (.bug-icon) -- inflating tech-debt scoring from ordinary code in exactly the hyphenated- identifier ecosystems (COBOL/JCL, Lisp, css) where debt measurement matters most. Python's HACK_LEVEL was inert only by tokenization luck (_ is a word char). Fix: fixed-width lookaround guards on the SPACED alternation only -- (?<![A-Za-z0-9]-) / (?!-[A-Za-z0-9]) -- refusing a match glued to hyphen-plus-alphanumeric (an identifier continuing through the hyphen). Real markers keep counting, including hyphen-ADJACENT comment shapes whose neighbor is not alphanumeric: `-- TODO` (Ada/Haskell/SQL), glued `--TODO`, trailing `TODO--`. The DENSE CJK/RTL alternation is untouched (no hyphenated-identifier idiom). Golden masters re-blessed (both modes): 17 diffs, ALL tech-debt drops on verified identifier-embedded shapes -- cobol carddemo COACTUPC.cbl's `*Format xxx-xx-xxxx` SSN mask counted as XXX, shell ansible's `roles-path-bug` directory name (x4), m4 gnucobol's `bug-gnucobol@gnu.org` mail alias, dart flutter object.dart's "bug-prone" prose compound. No diffs outside tech-debt. Tests: cross-language regression on both shared patterns + ReDoS detonation (hyphen-heavy payload) in test_language_standards_strict.py; corpus-shaped repros in test_cobol_strict.py / test_scheme_strict.py. Full suite 7171 passed; audit_check all clear. Closes #2537 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BsVATdyMPhUoAUNBKbMUVi
squid-protocol
added
bug
Contributor
This was referenced Aug 31, 2026
squid-protocol
added a commit
that referenced
this pull request
Aug 31, 2026
…sweep) (#2623) Second §10 capstone after jcl.md's. Records the #2567 sweep's five-bucket decomposition: #2537/#2622 hyphenated-identifier debt fix, the comment-mass authoring re-baseline, the args clause-match morphology ledger entry, and the #2535/#2546-blocked residuals. Also annotates §3's debt-rule row with the new hyphen guard. Claude-Session: https://claude.ai/code/session_01BsVATdyMPhUoAUNBKbMUVi Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #2537 — the rosetta[cobol] sweep's (#2567) one real engine bug.
-is a regex wordboundary, so the two shared debt patterns (
GLOBAL_FRAGILE_DEBT/GLOBAL_PLANNED_DEBT)matched debt keywords embedded inside hyphenated code identifiers: COBOL
HACK-LEVEL/BUG-COUNTdata items,PROBE-TODOparagraph names, Lispprobe-todosymbols, css.bug-iconclasses. Ordinary code inflated tech-debt scoring in exactly the legacyecosystems where debt measurement matters most (
HACK_LEVELin python was inert onlybecause
_is a word char — tokenization luck, not design).The fix
Fixed-width lookaround guards on the SPACED (Latin/Cyrillic) alternation only:
(?<![A-Za-z0-9]-)/(?!-[A-Za-z0-9])— a match is refused when glued tohyphen-plus-alphanumeric (the shape of an identifier continuing through the hyphen).
Every real marker keeps counting, including hyphen-adjacent comment shapes whose neighbor
char is NOT alphanumeric:
-- TODO x(Ada/Haskell/SQL comments), glued--TODO, trailingTODO--,@todo. The DENSE CJK/RTL alternation is untouched (no hyphenated-identifieridiom to guard).
Golden-master re-bless (both modes) — diff shape verified before blessing
17 diffs, all tech-debt drops, each disputed source line read and confirmed as the FP
class (not a lost real marker):
COACTUPC.cbl*Format xxx-xx-xxxx— an SSN format mask counted asXXXansible-galaxy__runme.shroles-path-bugkebab directory name, 4 occurrencesconfigure.acbug-gnucobol@gnu.orgmail aliasobject.dartNo diffs outside tech-debt surfaces.
Tests
marker positives incl. the hyphen-adjacent comment family, ReDoS detonation with a
hyphen-heavy payload) in
tests/core_engine/test_language_standards_strict.py.test_cobol_strict.py/test_scheme_strict.py.crucible_check.pyPASS both venvs;audit_check.pyall clear.Cross-repo
fragile_debt 3→1/planned_debt 2→1and schemeplanned_debt 2→1, plus the rosetta[cobol]: cross-language consistency — 4 red / 8 amber metrics, 5 ledgered shapes #2567 sweep's authoring/ledgerwork) will run its CI against this PR via
ENGINE_REF=pull/<N>/head.rosetta-auditcheck is expected to FAIL until the corpus PR merges — thatis the pinned gate catching the drift at source, per docs/GATING.md choreography. Merge
order: this PR first (after corpus PR goes green against it), then corpus PR restores
ENGINE_REF=mainand merges, thenKEYWORD_ROSETTA_REFbumps to the new corpus SHA.🤖 Generated with Claude Code
https://claude.ai/code/session_01BsVATdyMPhUoAUNBKbMUVi