[wakemeup0]

Summary

Repair Python S5332 protocol-identification argument handling. Click's url.startswith(("http://", "https://")) no longer reports a cleartext endpoint. Unsafe bare values, Requests adapter registration and Werkzeug HTTP-server findings remain reportable. Live reference controls also verify bytes/local-return owner proof and function, class and lambda shadowing. A stack overflow discovered on Click _compat.py is repaired through bounded local attribute-owner resolution, with committed self/mutual alias and unsafe endpoint regressions.

Change type and scope

Bug fix in Python cleartext_protocols.rs with committed unit and CLI regressions. Applies to strict and sonar-parity, native JSON and Sonar Generic output. Exempts only the selected regular positional pattern for startswith, replace, removeprefix and removesuffix, through tuples/parentheses. Proven non-string owners retain findings. Source ownership is limited to the detector and its dedicated CLI regression file.

Related issues

Direct user request: broad real OSS / real SonarQube smoke testing, then fix findings and publish. Retains the historical #642 / PR #705 unsafe bare-scheme contract. This focused package does not claim closure of the entire S5332 row or unrelated campaign findings; it contains no issue-closing directive.

Verification

Independent source and frozen-evidence review approved this exact signed head without actionable findings. The review verified signed source inventories, unchanged committed regression bytes, executed behavioral red/green evidence, complete ordered report comparisons and fresh CLI witnesses. Independent review receipt SHA256: 4926ab79bdd446831d27a502ec254ff2c69957e5e4af5e9ee6dfc4204666e544. All 21 exact-head hosted checks and dependency-base restoration remain publication gates.

Verified source 8aa153968749dacdef9138f596a9aaac1df2cf58 (tree 7fcce682ceda9c851690b5a1adda6bbd475d53c7), based on 8ee27b7d9d48d5b7884fc7d03733515d6538edc7. The final CLI SHA256 is bfb71c75594a9055d07f0889cd56cb077faf93e142ffefaacc32cd3bee24863e; it is copied from the exact successful locked-build JSON compiler artifact. Source is clean and unchanged for every captured command.

• Full Python all-targets/all-features: 1,376 passed, none failed, ignored or filtered.
• Dedicated python_s5332_protocol_identification CLI file: 11 passed, none failed, ignored or filtered. All original controls, cache transitions, four live-project tests and four cyclic-owner regression sources complete in both profiles/formats; the cyclic test executes all 16 children before assertions.
• All 14 existing Python CLI targets: 76 passed, none failed, ignored or filtered.
• Strict Python+CLI all-targets/all-features Clippy with -D warnings, cargo fmt --all --check, and base-to-head diff check: passed.
• Pinned signed released Hoonarqube 0.3.1 dogfood over full crates and xtask, implicit profile, offline readonly Linux runner: zero Rust S3776, gate passed; existing JS 5 / TS 13 retained.
• 136/136 original complete-document projections pass, including 12 complete real OSS reports over 88 original Python files, 28 controls across profiles/formats, 8 incomplete streams with exit 2/diagnostics, and 12 cache stages with exact 0→1→0 / byte restoration. Requests and Werkzeug complete stdout bytes remain unchanged.
• 29 separately live-scanned sources, replayed in 16 project processes: 116/116 exact rule/file/message/range case identities match. 16/16 complete non-target documents are unchanged under the frozen explicit target projections. The lambda projection admits exactly the expected target S5332 descriptor addition; unrelated descriptors, metadata and every other field remain exact.

Committed regression and genuine red/green mapping:

Acceptance	Unit symbol in cleartext_protocols.rs	CLI symbol in python_s5332_protocol_identification.rs
Identification patterns / original Click	s5332_protocol_identification_patterns_are_not_endpoint_values	python_s5332_protocol_identification_exempts_patterns_and_removes_descriptor
Bare values, arguments, owners and wrappers	s5332_protocol_identification_preserves_argument_and_owner_boundaries; s5332_protocol_identification_preserves_owner_and_wrapper_boundaries; existing s5332_requires_a_value_prefix_and_preserves_bare_schemes	python_s5332_protocol_identification_preserves_values_arguments_and_owner_boundaries
Aliases, subclasses, unknown / known non-string owners	s5332_protocol_identification_resolves_string_aliases_subclasses_and_unknown_methods; s5332_protocol_identification_keeps_known_nonstring_method_owners_unsafe	Original pattern and owner-boundary CLI groups
Secure/safe/prose/docstrings	s5332_protocol_identification_keeps_existing_clean_controls	python_s5332_protocol_identification_preserves_secure_safe_prose_and_docstrings
Unicode / CRLF coordinates	s5332_protocol_identification_unicode_crlf_retains_endpoint_coordinates	python_s5332_protocol_identification_unicode_crlf_keeps_coordinates
Malformed / incomplete input	Actual CLI regression	python_s5332_protocol_identification_malformed_inputs_remain_incomplete
Same-path cache transition	Actual CLI regression	python_s5332_protocol_identification_cached_context_changes_preserve_bare_values
Nine live result owners	s5332_protocol_identification_preserves_live_result_owner_boundaries	python_s5332_protocol_identification_preserves_live_result_owner_boundaries
Seven live function shadows	s5332_protocol_identification_preserves_live_shadowed_result_owners	python_s5332_protocol_identification_preserves_live_shadowed_result_owners
Seven live class shadows	s5332_protocol_identification_preserves_live_shadowed_class_owners	python_s5332_protocol_identification_preserves_live_shadowed_class_owners
Six live lambda boundaries	s5332_protocol_identification_preserves_live_lambda_owner_boundaries	python_s5332_protocol_identification_preserves_live_lambda_owner_boundaries
Original Click _compat.py, cyclic attribute owners and unsafe endpoint guard	Actual CLI regression; no new unit test claimed	python_s5332_protocol_identification_terminates_cyclic_attribute_owners

Six signed tests-only layers preserve genuine failures before production changes. Original checkpoint 469f4cc4 executed 15 unit tests with 4 intended failures and the exact Click CLI failure; earlier full six-test CLI red had 4 intended failures / 2 passes with identical original test bytes. Normalized result-owner checkpoint 21208870 exposes 4 misses among 9; function-shadow 50c242a1 exposes 4 extras among 7; class-shadow f8b6c69c exposes 5 extras among 7; lambda f19cf5f5 exposes 4 misses among 6. Each earlier supplemental CLI red is one actual strict/json project execution before the assertion stops. Cyclic-owner checkpoint ed00363a preserves all previous bytes and executes all four sources across both profiles and formats before asserting: all 16 children signal 6 before the fix and all 16 exit 0 after it. All six layers remain byte-preserved prefixes of the final tests; the complete final CLI test bytes match cyclic-owner tests-only checkpoint ed00363a, and the Python unit test bytes remain unchanged from the lambda checkpoint. Filtered tests are never counted as passes.

Detailed raw commands, exact exits, source/binary/environment bindings, failed attempts and acceptance mapping are retained under /Users/wakemeup/.codex/artifacts/hoonarqube-repairs-20261013/python-s5332-protocol-identification in qualification.json, acceptance-test-map.json, stack-final-regression-layer-preservation.json, REPORT.md, artifact-manifest.json and freeze-receipt.json. Hosted CI is pending coordinator publication; no hosted check or merge is claimed by this local handoff.

The PR initially targeted main to obtain all 21 successful checks from the repository’s GitHub default CodeQL setup. The intended dependency base is now restored to fix/smoke-python-s8786-boundaries-20261015. Publication verifies the unchanged signed head, full body and exact-head hosted check rollup against that base.

Compatibility and risks

The retained reference is SonarQube Community 26.9.0.129388 with Python plugin 5.31.0.36502. Original OSS scan evidence and exact installed semantics are distinct from the four coordinator-authorized live control scans. Only a proven receiver owner prevents the pattern exemption; parameters/imports/assignments/ambiguous bindings keep unknown behavior. Local function/lambda parameter inspection protects outer definitions without changing shared type inference. The original Click stack failure is fixed locally: only names reach the shared class resolver; attributes resolve owners through bounded recursion, with exhausted/cyclic owners left unknown. The failed 99-capture replay, 17-file Click isolation, four minimal native probes, committed 16-child red and final green remain retained evidence. No shared helper, catalog, lockfile, safe-host list or quickfix changes are included. Complete-report comparisons protect non-target findings, ranges, ordering, metrics, descriptors, metadata, completeness and diagnostics.

Limitations

The separate .example documentation-host discrepancy remains: endpoint = "http://api.internal.example/v1" is native 1/reference 0 for the installed host exemption. Versioned catalog metadata differences remain outside this repair. This package does not establish whole-rule, all-Python or full SonarQube parity. The coordinator owns independent final review, publication, exact-head protected CI and authorized merge/closure readback. No release or tag is requested by this fix publication.