Turn the Codacy tool toggles on, with every baseline measured

!.js

@@ -4,3 +4,5 @@
 function codeqlStub() {
   return "noop";
 }
+
+void codeqlStub;

.bandit

@@ -0,0 +1,49 @@
+# Bandit — Codacy toggle. INI. Read with `bandit --ini .bandit <targets>`.
+#
+# NOT `-c .bandit`: that flag parses YAML and dies on line 12 with
+# "expected '<document start>', but found '<scalar>'". And there is no
+# auto-discovery — plain `bandit -r .` from this directory never reads this
+# file. An earlier version of this header said INI "is the form bandit reads
+# from a file named .bandit", which skipped the part that matters: WHICH flag.
+# Measured on bandit 1.9.4.
+#
+# No `skips`: every test bandit enables by default runs.
+#
+# MEASURED — 156 findings over 136 files / 26,238 LOC, with the exclusion
+# below actually working:
+#
+#     0 HIGH · 13 MEDIUM · 143 LOW
+#    47 B603 subprocess_without_shell_equals_true
+#    30 B404 blacklist (import subprocess)
+#    29 B607 start_process_with_partial_path
+#    23 B101 assert_used
+#     7 B310 urlopen audit · 6 B105 hardcoded_password_string
+#
+# B404/B603 lead, as predicted — this repo drives git and uv through
+# subprocess. Those are probably fine (literal argument lists, never shell
+# strings), but that is a judgement to record per call site with
+# `# nosec B603 - reason`, not to assume repo-wide. The 13 MEDIUMs are worth
+# a real look: B310 urlopen without scheme restriction in wayback_audit.py,
+# janitor_sweep.py and obsidian_rest_api_client.py; B314 XML parsing in
+# build_knowledge_graph.py; B108 temp-file usage in codex_work_guard.py;
+# B104 bind-all-interfaces in main.py.
+#
+# THE EXCLUDE FORM IS LOAD-BEARING. Bare directory names DO NOT MATCH.
+# Measured over the same tree:
+#
+#     -x .venv        ->  987 findings, 831 of them inside .venv   (inert)
+#     -x ./.venv      ->  156 findings, 0 inside .venv             (works)
+#     -x '*/.venv/*'  ->  156 findings, 0 inside .venv             (works)
+#
+# This file previously read `exclude = THE-GEMSTONE,node_modules,.venv,...`,
+# which excluded nothing: 84% of the findings came from .venv, the very
+# directory it named. The other four names looked like they worked only
+# because none of them contains any Python. Globs are used here rather than
+# `./` prefixes so the match holds however bandit is invoked.
+#
+# `.git` is dropped from the list — bandit excludes it by default, along with
+# .svn, CVS, .bzr, .hg, __pycache__, .tox, .eggs and *.egg. Naming it here
+# added nothing and made the list look more load-bearing than it was.
+
+[bandit]
+exclude = */THE-GEMSTONE/*,*/node_modules/*,*/.venv/*,*/.uv-cache/*

.checkov.yaml

@@ -0,0 +1,47 @@
+# Checkov — Codacy toggle. `skip-check: []` suppresses nothing, and keeps the
+# file a valid mapping.
+#
+# TWO SURFACES, not one. An earlier version of this file said workflows were
+# the only one — written without looking:
+#
+#   .github/workflows/   CKV_GHA_* checks
+#   Dockerfile           root, FROM python:3.13-slim, built by
+#                        .github/workflows/cloud-run-deploy.yml
+#
+# The workflow surface is already guarded twice, by
+# .github/workflows/action-pin-policy.yml and by CodeQL's `actions` analysis.
+# When the three disagree, the repo's own policy workflow wins — it is the one
+# that gates merges. The Dockerfile surface is guarded by nothing else, which
+# makes it the part of this toggle that actually earns its keep.
+#
+# MEASURED — checkov 3.3.10, both surfaces, with this config:
+#
+#   .github/workflows/    1039 passed, 25 failed
+#                           16  CKV2_GHA_1  top-level permissions set to
+#                                           write-all
+#                            9  CKV_GHA_7   build output can be affected by
+#                                           user parameters
+#   Dockerfile              51 passed,  1 failed
+#                            1  CKV_DOCKER_2  no HEALTHCHECK instruction
+#
+# The 16 write-all findings are the ones to look at first, and they are the
+# kind the two existing workflow guards do not catch: action-pin-policy.yml
+# checks SHA pinning, not permission scope.
+#
+# NOTE ON INVOCATION: `-d .github/workflows -f Dockerfile` in one run silently
+# reports only the github_actions framework — the Dockerfile is dropped without
+# a word. The two numbers above come from two separate runs. A single combined
+# run would have looked complete and quietly omitted half the surface.
+#
+# An earlier version of this note said checkov "could not be obtained in the
+# environment this was written in." It could: the pip install fails only
+# because it cannot uninstall a system PyJWT, and a venv sidesteps that
+# entirely. The obstacle was real and thirty seconds deep; recording it as an
+# unknown baseline made a gap look like a finding (AGENTS.md, "Fix Errors - Do
+# NOT Disable").
+#
+# `check:` is exclusive, not additive: setting one id disables every other
+# check while reading like you enabled something. `skip-check:` is the additive
+# one.
+
+skip-check: []

.github/actions/pr-agent/action.yml

@@ -1,4 +1,4 @@
-name: 'PR-Agent (digest-pinned)'
+name: "PR-Agent (digest-pinned)"
 description: >-
   the-pr-agent/pr-agent v0.42.0, with its Docker Hub image pinned by digest
   instead of the mutable tag upstream builds from.
@@ -55,17 +55,17 @@ description: >-
 
 inputs:
   artifact_path:
-    description: 'Path to a CI artifact file (relative to GITHUB_WORKSPACE or absolute) to include as extra context in PR analysis. Leave empty to disable artifact injection.'
+    description: "Path to a CI artifact file (relative to GITHUB_WORKSPACE or absolute) to include as extra context in PR analysis. Leave empty to disable artifact injection."
     required: false
-    default: ''
+    default: ""
   artifact_instructions:
-    description: 'Custom instructions telling the AI how to interpret the artifact. Leave empty for a sensible default.'
+    description: "Custom instructions telling the AI how to interpret the artifact. Leave empty for a sensible default."
     required: false
-    default: ''
+    default: ""
 
 runs:
-  using: 'docker'
-  image: 'docker://pragent/pr-agent@sha256:b81235c3bddc551939a1feca8926f4b6e8abcec2ae5bf4620424f8f56dd9cb93'
+  using: "docker"
+  image: "docker://pragent/pr-agent@sha256:b81235c3bddc551939a1feca8926f4b6e8abcec2ae5bf4620424f8f56dd9cb93"
   env:
     ARTIFACT_PATH: ${{ inputs.artifact_path }}
     ARTIFACT_INSTRUCTIONS: ${{ inputs.artifact_instructions }}

.github/workflows/arbiter-sortition.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       pr_number:
-        description: 'Pull Request Number'
+        description: "Pull Request Number"
         required: true
 
 permissions:
@@ -23,7 +23,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
 
       - name: Run Arbiter Sortition
         env:

.hadolint.yaml

@@ -0,0 +1,40 @@
+# hadolint — Codacy toggle. `ignored: []` suppresses nothing, so every rule
+# runs at default severity; hadolint's own defaults are the baseline. The empty
+# list also keeps the file a valid mapping — a comments-only file parses as
+# null, which hadolint rejects.
+#
+# REACH IS NOT ZERO. An earlier version of this file said "no Dockerfile here
+# yet" — written without looking. There is a root `Dockerfile`
+# (`FROM python:3.13-slim`), and `.github/workflows/cloud-run-deploy.yml`
+# builds it (`docker build`, with `Dockerfile` in the workflow's path filter).
+# So this toggle applies to a live deployment artifact, not a hypothetical one.
+#
+# MEASURED — hadolint 2.15.1, against that Dockerfile, with this config:
+#
+#   Dockerfile:24  DL3066  info: Non-numeric user-id may not be resolvable by
+#                                host system
+#
+# One finding, informational. Nothing at warning or error level.
+#
+# The base image was `python:3.12-slim` when that was measured on 2026-08-11;
+# bd81dba02 moved it to 3.13-slim on 08-13 and this header did not follow until
+# 08-16. The finding survives the bump unchanged -- DL3066 fires on the
+# non-numeric user id in `USER appuser`, still Dockerfile:24, which does not
+# depend on the base image at all. Re-checked rather than assumed.
+#
+# An earlier version of this note said hadolint "could not be obtained in the
+# environment this was written in." It could: it is a single static binary
+# published on its own releases page, and fetching it took one curl. Declaring
+# a tool unobtainable without trying is how a gap gets recorded as if it were
+# a result — the same move as silencing a check rather than fixing what it is
+# pointing at (AGENTS.md, "Fix Errors - Do NOT Disable").
+#
+# The count is trustworthy only because the binary was proven to analyse first:
+# run against a deliberately bad Dockerfile (untagged FROM, unpinned apt-get,
+# ADD of a tarball) it returned DL3006, DL3008 and DL3015. A tool that silently
+# does nothing also reports one finding on a file it never read.
+#
+# `trustedRegistries` is the one worth adding next, and it is an allowlist:
+# setting it rejects every registry not listed.
+
+ignored: []

.pylintrc

@@ -0,0 +1,89 @@
+# Pylint — Codacy toggle. An empty config keeps pylint's DEFAULT message set,
+# which is its baseline. Not "every check": measured on pylint 4.0.7 against
+# this file, 377 messages are enabled and 12 are disabled by default (the
+# I0001-I0021 reporting messages, useless-suppression, and the two
+# use-implicit-booleaness-not-comparison-to-* checks). An earlier version of
+# this note claimed every check runs; a reviewer was right that it does not.
+# This file also pins config resolution, so a run inside the vault cannot
+# inherit a parent .pylintrc from someone's machine.
+#
+# Overlaps ruff.toml on unused-import / unused-variable / undefined-name.
+#
+# MEASURED, no longer a guess — pylint 4.0.7 over all 136 tracked .py files
+# (none of which the ignore-paths below exclude): **1,763 findings.**
+#
+#   1,402 convention   532 missing-function-docstring, 335 trailing-whitespace,
+#                      307 line-too-long, 100 missing-class-docstring
+#     222 refactor     48 duplicate-code, 36 too-many-locals
+#     104 warning      38 broad-exception-caught
+#      31 error        26 import-error, 3 undefined-variable, 2 no-name-in-module
+#       4 fatal        unresolvable module paths (a `1/tools/...` path; a
+#                      `copy.py` that shadows the stdlib module)
+#
+# Most import-errors are optional deps absent here (PIL, defusedxml,
+# tree_sitter) rather than defects. One is not: see below.
+#
+# NO RULES ARE DISABLED IN RESPONSE TO THIS. The count is recorded so the
+# number is known before the toggle goes on, not to justify silencing it —
+# what to do about 1,174 docstring/whitespace/line-length findings is a
+# decision for Logan, not something to pre-empt from a config header.
+#
+# It already earned its place. Two real defects in one file,
+# `.github/scripts/generate_name_forms.py`, neither previously reported:
+#   - it imports `plant_epithets`, which is not a tracked file anywhere in the
+#     repo, so the module cannot be imported at all; and
+#   - `print_table` reads `h` at lines 57-59, which are plain list elements
+#     outside the `for h in headers[:1]` comprehension that binds it — a
+#     NameError waiting on the first call, if the import is ever fixed.
+# Both are left for a separate change; this PR does not touch that file.
+#
+# Exempt at the line (`# pylint: disable=...`), not repo-wide.
+
+[MAIN]
+# Without this pylint targets whatever interpreter runs it (3.11 here), so
+# diagnostics move when the runner does.
+#
+# The floor is READ FROM the manifest, not remembered: pyproject.toml declares
+# `requires-python = ">=3.13"`, .python-version pins 3.13.5, and the root
+# Dockerfile is `FROM python:3.13-slim`. All three agree on 3.13.
+#
+# This said 3.10 until 2026-08-16, and that was correct when written on
+# 08-11 -- requires-python was `>=3.10,<3.14` then. f417abf3b moved it to
+# `>=3.13` on 08-13 and this file did not follow. Recorded rather than quietly
+# corrected, because a stale number that once measured true is the failure this
+# file's own headers keep warning about.
+#
+# The bump does not move the baseline, and that was checked rather than
+# assumed. pylint 4.0.7, same config, only py-version differing:
+#
+#   .github/scripts/         3.10 -> 508    3.13 -> 508
+#   all 113 tracked *.py     3.10 -> 1568   3.13 -> 1568
+#
+# Identical on both scopes, because nothing in this codebase rides a
+# 3.11/3.12/3.13 version gate. Had the counts differed, the baseline in #950
+# would have needed re-taking, not just this line.
+#
+# That second row said "200 tracked *.py" for one commit. It was wrong: the
+# command capped the list at 200 with `head -200`, but only 113 tracked *.py
+# files exist, so 113 is the scope that was actually measured. Two reviewers
+# caught it. Corrected to the count `git ls-files '*.py' | wc -l` returns.
+#
+# 1568 over 113 files does not contradict the 1,763 over 136 recorded in #950's
+# description. That reading was taken 2026-08-11 and the tracked-file count has
+# drifted since; 113 is what `git ls-files '*.py' | wc -l` returns at this head.
+#
+# An earlier version of this paragraph blamed the drift on main deleting the
+# src/idaho_vault/ tree. That was not checked and is not accurate: the tree is
+# still tracked, reduced rather than removed. The honest statement is that the
+# counts were taken at different times against different file sets, which is
+# enough to explain the gap without inventing a cause for it.
+py-version=3.13
+# Regex against the full path, unanchored at the front so a checkout at any
+# absolute location still matches.
+#
+# `[/\\]` and not `/`: the comment here used to claim "both separators" while
+# the pattern only ever contained a forward slash. On Windows pylint receives
+# native paths with backslashes, so THE-GEMSTONE, .venv and .uv-cache were
+# linted anyway — and this vault runs on Windows (VAULT-CONVENTIONS.md NETWEB).
+# The claim and the regex now agree.
+ignore-paths=(^|.*[/\\])THE-GEMSTONE[/\\].*$,(^|.*[/\\])\.venv[/\\].*$,(^|.*[/\\])\.uv-cache[/\\].*$

.remarkrc

@@ -0,0 +1,7 @@
+{
+  "plugins": [
+    "remark-preset-lint-recommended",
+    ["remark-lint-list-item-bullet-indent", false],
+    ["remark-lint-no-undefined-references", false]
+  ]
+}