refactor: align review ruleset with Hermes and reduce false positives #6

Merged

speedi57 merged 10 commits from ruleset-v2-hermes-review into main

2026-09-04 08:54:02 +00:00

hermes commented

2026-09-04 08:16:32 +00:00

Owner

Goal

Align the repository with its actual consumer: Hermes, which uses these Kodus-style rules to review code.

Changes

clarify in README that Hermes is the review engine/consumer;
add docs/HERMES_REVIEW_CONTRACT.md with an evidence gate, confidence requirements, deduplication rules and anti-false-positive behaviour;
establish that blocking findings require concrete evidence and high confidence;
make architecture/maintainability/style advisory by default unless project context explicitly promotes them;
harden the rule-id schema and clean up schema descriptions;
require non-empty exceptions/remediation and unique inheritance entries;
downgrade documentation-only findings from high to low and scope stale-docstring checks to the diff;
remove the duplicate prefer-specific-types-over-any rule and keep a single, narrower explicit-any rule;
make the remaining TypeScript any rule diff-scoped and advisory;
update the manifest rule count/version.

Why

The previous ruleset mixed demonstrable defects with conventions and architectural preferences. For an LLM reviewer this can produce duplicate, speculative or disproportionately blocking findings. The new contract prioritizes security/correctness/reliability signal and requires Hermes to prove a finding before emitting it.

Follow-up

A separate PR should add the missing high-value semantic rules identified during review: IDOR/BOLA, authorization, mass assignment, file/path traversal, command injection, unsafe deserialization, CORS+credentials, HTTP timeouts, frontend-only authorization, SQLAlchemy session/transaction races, and related correctness/security checks. Keeping those additions separate makes this policy/calibration change reviewable first.

## Goal Align the repository with its actual consumer: **Hermes**, which uses these Kodus-style rules to review code. ## Changes - clarify in README that Hermes is the review engine/consumer; - add `docs/HERMES_REVIEW_CONTRACT.md` with an evidence gate, confidence requirements, deduplication rules and anti-false-positive behaviour; - establish that blocking findings require concrete evidence and high confidence; - make architecture/maintainability/style advisory by default unless project context explicitly promotes them; - harden the rule-id schema and clean up schema descriptions; - require non-empty exceptions/remediation and unique inheritance entries; - downgrade documentation-only findings from `high` to `low` and scope stale-docstring checks to the diff; - remove the duplicate `prefer-specific-types-over-any` rule and keep a single, narrower explicit-`any` rule; - make the remaining TypeScript `any` rule diff-scoped and advisory; - update the manifest rule count/version. ## Why The previous ruleset mixed demonstrable defects with conventions and architectural preferences. For an LLM reviewer this can produce duplicate, speculative or disproportionately blocking findings. The new contract prioritizes security/correctness/reliability signal and requires Hermes to prove a finding before emitting it. ## Follow-up A separate PR should add the missing high-value semantic rules identified during review: IDOR/BOLA, authorization, mass assignment, file/path traversal, command injection, unsafe deserialization, CORS+credentials, HTTP timeouts, frontend-only authorization, SQLAlchemy session/transaction races, and related correctness/security checks. Keeping those additions separate makes this policy/calibration change reviewable first.

hermes added 8 commits

2026-09-04 08:16:32 +00:00

docs: define Hermes as ruleset consumer dc59e4f1f2

docs: add Hermes review execution contract 5451b523c7

schema: harden rule identifiers and document Hermes consumer 85e7f40efb

rules: downgrade documentation-only finding severity 83f06b45db

rules: recalibrate stale docstring severity 586c5bbb7b

rules: remove duplicate explicit-any rule cb3b9845d0

rules: make explicit-any finding advisory and diff-scoped 446dbbe448

chore: update ruleset manifest after deduplication

Validate rules / validate (pull_request) Failing after 7m20s

Details