[M12] Ship a bounded evidence-backed Workshop stability rule set

[Teakowa]

Parent: #89
Depends on: #97, #98

Goal

Deliver a small, high-value first-party lint/stability rule set that demonstrates Wright's tooling-first product value without turning community advice into hard-coded correctness doctrine.

Context

Wright already has min-wait-loop, duplicate-condition, and expensive-loop-check. M12 should extend this only where real Workshop/corpus evidence supports low-noise static findings. Rules must distinguish exact/static evidence from heuristics and must document known limitations.

The first real wrightkit/agent-lab integration produced direct consumer evidence for a missing no-yield-loop analysis (#103). This is exactly the kind of product-driven rule expansion M12 should absorb: it blocks a real deterministic consumer and concerns a high-value Workshop stability pattern, rather than expanding rules for symmetry.

Work items

• [M12] Detect no-yield loops with bounded evidence classification #103 — Detect no-yield loops with bounded evidence classification.

Additional rules may be selected from corpus evidence, but M12 does not require a large rule count.

Scope

• Audit existing corpus/fixtures and current resource/cost analysis for recurring high-value Workshop stability/performance patterns.
• Select a bounded first-party rule set; prefer repeated/expensive evaluation, hot-loop/timing, and duplicated semantic work where Wright can reason statically with acceptable false-positive risk.
• Reuse the [M12] Establish lint rule registry and configuration contract #97 registry and [M12] Add first-class lint CLI and shared structured results #98 lint/tooling surface.
• Give every shipped rule a stable ID, default severity, rationale, evidence classification, known limitations, and positive/negative fixtures.
• Include at least one real-project/corpus evidence case for each shipped rule where such evidence exists; otherwise explicitly document why synthetic validation is sufficient.
• Reuse exact resource/cost data when claims are exact; label static indicators and heuristics distinctly.
• For [M12] Detect no-yield loops with bounded evidence classification #103 specifically, distinguish the static fact that a repeating path has no yield from boundedness and runtime-risk classification; do not equate a small statically bounded loop with an obviously unbounded loop.

Non-goals

• Treating Workshop.Codes Wiki or community "anti-crash" recommendations as guaranteed-safe rules.
• Claiming precise runtime/server CPU cost from static evidence alone.
• Automatically rewriting code to satisfy stability rules.
• Large rule-count targets.
• Third-party plugin loading or [v0.2 workshop-rs] Define Workshop catalog, locale, extension, and version boundaries #96 content-pack work.
• OPY/OSTW compatibility expansion merely to increase lint coverage.

Acceptance criteria

• [M12] Detect no-yield loops with bounded evidence classification #103 is implemented and validated through the M12 registry and wright lint path.
• A bounded PM-approved set of any additional first-party stability/performance rules ships only where current evidence justifies them.
• Every new rule has stable ID, documentation/rationale, known limitations, positive/negative fixtures, and explicit evidence classification.
• Real-project/corpus evidence is linked where available.
• Heuristic findings are explicitly identifiable as heuristics and avoid high-noise defaults.
• Resource/cost claims do not overstate what static analysis can prove.
• Existing rules remain compatible unless a separately justified correction is recorded.
• Current CI is green at acceptance.

Relationships

• Parent: [M12] Tooling-first lint and Workshop stability analysis platform #89.
• Depends on [M12] Establish lint rule registry and configuration contract #97 and [M12] Add first-class lint CLI and shared structured results #98.
• [M12] Detect no-yield loops with bounded evidence classification #103 is a concrete M12 work item discovered through wrightkit/agent-lab#68.
• [v0.2 workshop-rs] Define Workshop catalog, locale, extension, and version boundaries #96 is non-blocking and out of implementation scope.

[Teakowa]

Issue #99 independent QA verification report

related_issue: "#99"
freshness: snapshot
as_of_commit: 3f3deee
status: verification
owner: QA

Independent verification of issue #99 ("[M12] Ship a bounded evidence-backed
Workshop stability rule set") implementation of the repeated-value and
while-without-wait lint rules against SPEC-99-stability-rules (REQ-001..
REQ-007, Q-001 RESOLVED) and the issue's acceptance criteria. Implementation
commit 54f68a37c9ce2382fbb3bb426e924e377ded074b; verified at current HEAD
3f3deee (three docs-only commits on top; git diff 54f68a3..HEAD -- crates/
is empty, so the rule code is byte-identical to the implementation
commit). Working tree clean before and after. Report only — no code, test,
fixture, doc, or GitHub changes made. Every fact below was re-derived from
the current checkout, freshly rebuilt binaries, fixture/corpus artifacts, and
CI data; nothing was taken from the Engineer report or the issue on trust.

Scope

• Implementation commit 54f68a3 changes: wright-analyzer (analysis.rs
  +381/-1 refactor chunk, registry.rs +71, tests/analysis.rs +214,
  tests/registry.rs, tests/service.rs, fixtures README, 10 new fixtures),
  wright-cli (tests/cli.rs count pins), wright-driver (tests/driver.rs
  count pins), docs/cli.md. No Cargo.toml/Cargo.lock changes, no plugin/[v0.2 workshop-rs] Define Workshop catalog, locale, extension, and version boundaries #96
  work.
• The only removed code in the implementation diff is (a) the visit_value→
  visit_value_children extraction refactor in analysis.rs and (b) the
  Severity import line in tests/analysis.rs; the only removed metadata text
  is the "three first-party rules" doc comments and import list. Existing
  rule entries' fields are untouched (verified via diff).
• Test-file changes in driver/cli/service are exclusively 3→5 rule-count
  pins (assert_eq!(rules.len(), 3 → 5)) — the REQ-003 contract-pinning
  update. No existing assertion was weakened.
• Issue [M12] Ship a bounded evidence-backed Workshop stability rule set #99 is currently CLOSED (state_reason "completed", closed
  2026-08-14T12:04:41Z by Teakowa) while SPEC-99-stability-rules remains
  status: in-progress and [M12] Detect no-yield loops with bounded evidence classification #103 (an issue AC item) is still OPEN. Recorded
  as a process observation (see Findings); it does not change the shipped
  rule-set verification below.

AC verdicts

AC	Verdict	Evidence summary
Bounded PM-approved rule set ships through M12 registry and wright lint path	PASS	exactly five first-party rules, canonical order, wright lint path verified CLI + tool-service; no extra rules
Every new rule: stable ID, documentation/rationale, known limitations, positive/negative fixtures, explicit evidence classification	PASS	registry metadata non-empty for all five; repeated-value exact, while-without-wait static-indicator; 10 new fixtures with provenance
Real-project/corpus evidence linked where available	PASS	santa/parabola pinned evidence re-derived; while-without-wait synthetic justification + corpus-negative scan recorded, no corpus-positive claimed
Heuristic findings explicitly identifiable, low-noise defaults	PASS	expensive-loop-check still heuristic/info; no new heuristic rules; 10-finding cake density (Q-001) reproduced exactly
Resource/cost claims do not overstate static analysis	PASS	message/doc register hedged; no numeric server-cost claims; no measured-cost or guaranteed-crash claims
Existing rules remain compatible	PASS	min-wait-loop 1 finding at 54:5 unchanged; duplicate-condition/expensive-loop fixtures fire unchanged; check/analyze envelope shape intact
Current CI green at acceptance	PASS	runs 31794492708 + 31794149764 (54f68a3) and 31798639219 (3f3deee): all six jobs success, none skipped

REQ verdicts

Requirement	Verdict	One-line evidence
REQ-001 (repeated-value contract)	PASS	fixtures 2/2/3/0 counts exact; cake 10 findings at documented spans; ≥2-call filter + maximal subsumption verified in code and behavior
REQ-002 (while-without-wait contract)	PASS	positive 1 finding on While action; negative 0; interplay min-wait-loop on literal wait
REQ-003 (registry integration/compatibility)	PASS	five rules canonical order; severity/evidence correct; CLI+API config verified on both new rules; existing three unchanged
REQ-004 (positive/negative fixtures)	PASS	10 fixtures present, .opy/.json consistent, provenance notes, tests pin exact findings
REQ-005 (corpus evidence linkage)	PASS	santa AB=3/AD=3, parabola Distance=2/Subtract=6 re-derived from pinned oracle.json; provenance verified; while-without-wait corpus-negative scan re-derived
REQ-006 (documentation and evidence labeling)	PASS	docs/cli.md five-rule coverage; hedged register; known_limits cover all documented limits
REQ-007 (CI and regression gate)	PASS	workspace 378 tests green, clippy/fmt clean, CI all-green, existing-rule regression clean

Commands re-run at HEAD 3f3deee (all green unless noted)

Build and static checks

• git status clean; HEAD 3f3deee323729f365ad8479a49d0c8bfeed46eb1.
• git diff 54f68a3..HEAD -- crates/ → 0 lines (rule code unchanged).
• cargo clean -p wright-analyzer -p wright-cli -p wright-driver (removed
  38468 files, 1.8 GiB) then cargo build -p wright-cli -p wright-analyzer -p wright-driver → fresh binaries. Freshness: wright binary mtime
  1786709434 > newest source mtime 1786704022; no source newer than binary.
• cargo test -p wright-analyzer -p wright-driver -p wright-cli → 129
  passed, 0 failed (analyzer: analysis 17, cfg 7, registry 19,
  semantic_index 6, service 11, workshop_integration 5; cli: cli 20,
  serve 5; driver: lib 6, driver 26, service 7).
• cargo test --workspace → 378 passed, 0 failed, 0 failed suites, 30 test
  binaries.
• cargo clippy --workspace --all-targets --all-features -- -D warnings →
  clean (0 warnings).
• cargo fmt --all -- --check → clean.
• MSRV: cargo +1.85.0 test -p wright-analyzer -p wright-driver -p wright-cli → all suites ok, 0 failures (local toolchain 1.85.0 installed);
  plus CI "Rust quality (1.85.0)" job success.

Rule behavior via wright lint -f json on the fixtures

• repeated-value-santa.opy → exit 0; exactly 2 repeated-value
  findings, distinct spans 32:36-32:137 and 33:36-33:141, each message
  "this value expression is evaluated 3 times within the same loop scope",
  severity warning, evidence exact.
• repeated-value-parabola.opy → exactly 2 findings: "evaluated 2
  times" (30:15) and "evaluated 3 times" (30:120); plus 2
  expensive-loop-check (interplay, expected).
• repeated-value-shapes.opy → exactly 3 findings (22:15, 28:15,
  31:15) — maximal-shape subsumption (1 in rule 1) + per-scope (2 in rule 2);
  plus 12 expensive-loop-check (interplay).
• repeated-value-negative.opy → 0 repeated-value findings (all
  seven negative classes); 7 expensive-loop-check interplay from the
  distance() negative cases (not repeated-value).
• while-without-wait-positive.opy → exactly 1 finding on the While
  action (span 18:5), warning, static-indicator.
• while-without-wait-negative.opy → 0 while-without-wait findings;
  the literal-wait case fires min-wait-loop at 20:5 (expected interplay).
• Envelope field-by-field (santa): input_identity
c3f19b02…6715 = shasum -a 256 of input bytes (re-derived, match);
  findings carry code/severity/evidence/span{path,start,end}/
  message-with-occurrence-count; rule entries carry id/defaultSeverity/
  effectiveSeverity/enabled/evidence/tags/knownLimits, all non-empty.
• Determinism: santa, while-positive, and overpy-cake JSON byte-identical
  across repeated runs (cmp).

Configuration (REQ-003) — CLI and API

• --disable-rule repeated-value on santa → 0 repeated-value findings,
  rule reports enabled: false, config.rules.repeated-value.enabled
  false. Same for --disable-rule while-without-wait.
• --rule-severity repeated-value:info → effectiveSeverity: info AND the
  firing findings report severity: info; config agrees. Same for
  while-without-wait:info.
• API layer (tool service): printf '{"op":"lintRules"}\n{"op":"lint"}\n' | wright-serve --transport stdio <fixture> → lintRules ids
  [min-wait-loop, duplicate-condition, expensive-loop-check, repeated-value, while-without-wait] (canonical order), config.rules
  covers all five, repeated-value evidence exact, findings carry their
  evidence class; inputIdentity present. Registry tests
  (disabled_rule_produces_no_findings,
  all_rules_disabled_produces_empty_findings,
  severity_override_replaces_finding_severity) pass on the five-rule set.
• Usage errors preserved: check --disable-rule and analyze --rule-severity exit 2 with the documented stderr messages.

Corpus smoke check (REQ-001 acceptance + Q-001 density) — overpy-cake

• wright lint compatibility/fixtures/real-world/overpy-cake/source.opy -f json → exit 0; 11 findings: 1 min-wait-loop at 54:5
  (unchanged) + 10 repeated-value: 32:31 (value 138),
  38:9 ×2 (values 201, 209), 39:9, 40:9, 41:9, 42:9, 43:9,
  44:9, 49:13 (value 398) — every message "evaluated 2 times".
  Byte-deterministic across runs.
• 38:9 pair: two findings with distinct value ids (201, 209). Because
  the implementation reports exactly one finding per distinct structural
  family, distinct value ids at the same span prove two distinct shapes —
  the cakePos[0] and cakePos[1] corner families from the #!define cakeBeam(start, end, yPos) macro (source line 16) whose inlined
  start+vect(0,yPos,0)/end+vect(0,yPos,0) values collide on the
  call-site span (PM Decision A, REQ-001/Q-001). Not duplicates.
• No same-shape identical-span duplicates: every repeated-value finding's
  value id is unique; spans have exactly the documented multiplicity.
• No bare single-call array-read findings: the ≥2 Call non-trivial filter
  (call_count(…, family[0]) >= 2 in duplicated_shapes) is enforced in
  the implementation, the negative fixture proves bare reads never fire,
  and the cake's cakePos[N]/candlePos[i2] bare reads do not appear in
  the findings.

Corpus evidence linkage (REQ-005) — independently re-derived

• overpy-santa oracle.json compile.workshop (483 lines): For Global Variable(i, 0, Count Of(Global.rectangleChimneys), 1); at line 108;
  four Modify Global Variable actions at 109-112. Whitespace-normalized
  structural counts: AB family = 3 occurrences (line 109 ×1, line 111
  ×2), AD family = 3 (line 110 ×1, line 112 ×2); 6 Vector Towards
  occurrences total across the two families.
• overpy-parabola oracle.json (116 lines): For Global Variable(I, 0, 25, 1); at line 79; the single Create In-World Text action (lines 80-81)
  contains the identical Distance Between(Eye Position(Local Player), Value In Array((Local Player).textPos, Evaluate Once(Global.I))) 2
  times and the identical Subtract((Local Player).time, Value In Array( (Local Player).timeOffsets, Evaluate Once(Global.I))) 6 times
  (whitespace-normalized counts).
• Provenance (fixture.json both projects): kind imported-example,
  license GPL-3.0-only, redistributable: true, pinned to Zezombye/overpy
  commit eea67adbcf6926c4004e35e25ab4be072624a44e (licenseUrl/sourceUrl).
• Registry documentation for repeated-value cites these cases with the
  pinned commit + license and does not claim a firing path or overstate:
  it describes structural evidence. Source citations santa.opy:72-77 and
  parabola.opy:45-51 were spot-checked against the checked-in sources and
  match the shape-bearing blocks.
• while-without-wait evidence status: re-derived the corpus-negative scan
  — 13 real-world fixtures; While loops only in overpy-cake (workshop
  line 46, with Wait(0.016, Ignore Condition) at line 48 inside the body)
  and overpy-client-to-server (workshop line 54, with Wait(0.016, Ignore Condition) at line 58 inside the body). Both contain waits; no corpus
  positive is claimed; the rule documentation states the synthetic
  justification and the corpus-negative scan explicitly.
• Fixture provenance: tests/fixtures/README.md documents the pinned
  adapter regeneration (adapter/bin/wright-adapter.js, adapter 0.1.0 /
  overpy@9.7.10) and that all sources/payloads are Wright-authored
  (AGPL-3.0-or-later). Each new .opy header states the same. .opy/.json
  correspondence verified via matching source span line references in the
  pinned payloads (e.g. santa rule span line 29 ↔ .opy line 29).

Documentation and wording (REQ-006)

• docs/cli.md documents all five rule IDs in the --disable-rule example
  and the lint envelope example lists all five rules with severity and
  evidence.
• Messages: repeated-value states only the statically known occurrence
  count ("evaluated N times within the same loop scope"); while-without-wait
  states the static fact ("loop body contains no wait call; the loop cannot
  yield while its condition holds"). No numeric server-cost, no measured
  runtime-cost, no guaranteed-crash claim anywhere in messages or
  documentation (register is hedged: "may degrade", "can accumulate",
  "runs as fast as the Workshop server executes it", "the finding may not
  indicate a defect").
• known_limits coverage verified for: rule-local structural detection with
  no value-flow; cross-action re-scheduling vs result-equality; per-shape
  reporting + maximal subsumption + ≥2-call filter (bare array reads never
  flagged); non-deterministic sub-expression caveat; While + For Global Variable-only loop coverage; Evaluate Once-wrapped reads note;
  while-without-wait boundedness non-distinction (constant-true vs
  data-dependent) and wait-outside-body non-suppression.

Compatibility (REQ-007)

• wright check on a fixture → exit 0, check: ok, warning rendered to
  stderr (unchanged behavior). wright analyze -f json on overpy-cake →
  envelope shape unchanged (command/ok/exit/result{findings,program}),
  findings additive only (10 new repeated-value + unchanged min-wait-loop).
• Existing rules: duplicate-condition.opy → 1 finding (warning/exact,
  7:10); expensive-loop.opy → 1 finding (info/heuristic, 6:12); cake
  min-wait-loop exactly 1 at 54:5. All unchanged.

CI evidence (REQ-007)

• Implementation commit 54f68a3:
  • run 31794492708 (push) → success; jobs: Rust quality (stable),
    Rust quality (1.85.0), v1 release gates, OverPy compatibility oracle,
    OverPy-to-HIR adapter, Native-vs-reference differential — all
    completed | success, none skipped.
  • run 31794149764 (push) → success; same six jobs, all
    completed | success, none skipped.
• HEAD 3f3deee: run 31798639219 (push) → success; same six jobs,
  all completed | success, none skipped.
• Note: gh run list --commit 3f3deee returned an empty list (GitHub API
  filter quirk); the run was verified directly via gh run view 31798639219 (headSha 3f3deee…, conclusion success). Not blocked
  evidence.
• MSRV: "Rust quality (1.85.0)" job success in all three runs + local
  cargo +1.85.0 test on the three affected crates all green.

Findings and nuances

1. [informational — process] Issue [M12] Ship a bounded evidence-backed Workshop stability rule set #99 is CLOSED (state_reason
   "completed", 2026-08-14T12:04:41Z) while the spec is still
   status: in-progress and the issue's own AC item "[M12] Detect no-yield loops with bounded evidence classification #103 is implemented
   and validated through the M12 registry and wright lint path" is not
   met ([M12] Detect no-yield loops with bounded evidence classification #103 OPEN). The shipped two-rule set itself is complete and fully
   verified; the closure/state decision is PM-owned. [M12 acceptance] Verify tooling-first lint and stability platform #100 (OPEN, the M12
   acceptance gate) re-verifies [M12] Ship a bounded evidence-backed Workshop stability rule set #99/[M12] Detect no-yield loops with bounded evidence classification #103 together and is the correct place
   for the combined acceptance. Not a [M12] Ship a bounded evidence-backed Workshop stability rule set #99 verification failure.
2. [informational] gh run list --commit 3f3deee returned []; the
   HEAD run was verified directly by ID. No CI evidence is missing.
3. [informational — precision] Registry documentation cites santa
   "workshop lines 108-112" where the spec REQ-005 says "108-113"; the
   actual occurrence-bearing lines are 109-112 (For header at 108, End at
   113). Parabola: the Create In-World Text action text spans workshop
   lines 80-81 (spec/doc say "79-80", which covers the For header + action
   start). Both ranges cover the evidence block; occurrence counts are
   exact. No factual error in the evidence claims.
4. [informational] The parabola, shapes, and repeated-value-negative
   fixtures also fire expensive-loop-check (the pre-existing heuristic
   rule) because their distance() shapes sit inside loops. This is
   expected cross-rule interplay, not part of the repeated-value contract.
5. [informational] Tool-service (wright-serve) finding spans carry
   file but no path (identical to the [M12] Add first-class lint CLI and shared structured results #98 precedent); inputIdentity
   is present at the response level. Not a [M12] Ship a bounded evidence-backed Workshop stability rule set #99 regression.
6. [correctness] None found. All requirements and acceptance criteria
   are supported by exact evidence (fixture counts, envelope fields,
   re-derived corpus counts, byte-determinism, CI job conclusions).

Verdict

VERIFIED at 3f3deee323729f365ad8479a49d0c8bfeed46eb1 (rule code
identical to implementation commit 54f68a3). REQ-001..REQ-007 PASS;
all issue acceptance criteria PASS. No correctness findings. Process
observation (issue #99 closed while #103 is open and the spec is
in-progress) is routed to PM for the #100 acceptance gate.

Next authoritative role: PM (issue #99 acceptance / #100 gate).