Turn the Codacy tool toggles on, with every baseline measured

.bandit

@@ -0,0 +1,49 @@
+# Bandit — Codacy toggle. INI. Read with `bandit --ini .bandit <targets>`.
+#
+# NOT `-c .bandit`: that flag parses YAML and dies on line 12 with
+# "expected '<document start>', but found '<scalar>'". And there is no
+# auto-discovery — plain `bandit -r .` from this directory never reads this
+# file. An earlier version of this header said INI "is the form bandit reads
+# from a file named .bandit", which skipped the part that matters: WHICH flag.
+# Measured on bandit 1.9.4.
+#
+# No `skips`: every test bandit enables by default runs.
+#
+# MEASURED — 156 findings over 136 files / 26,238 LOC, with the exclusion
+# below actually working:
+#
+#     0 HIGH · 13 MEDIUM · 143 LOW
+#    47 B603 subprocess_without_shell_equals_true
+#    30 B404 blacklist (import subprocess)
+#    29 B607 start_process_with_partial_path
+#    23 B101 assert_used
+#     7 B310 urlopen audit · 6 B105 hardcoded_password_string
+#
+# B404/B603 lead, as predicted — this repo drives git and uv through
+# subprocess. Those are probably fine (literal argument lists, never shell
+# strings), but that is a judgement to record per call site with
+# `# nosec B603 - reason`, not to assume repo-wide. The 13 MEDIUMs are worth
+# a real look: B310 urlopen without scheme restriction in wayback_audit.py,
+# janitor_sweep.py and obsidian_rest_api_client.py; B314 XML parsing in
+# build_knowledge_graph.py; B108 temp-file usage in codex_work_guard.py;
+# B104 bind-all-interfaces in main.py.
+#
+# THE EXCLUDE FORM IS LOAD-BEARING. Bare directory names DO NOT MATCH.
+# Measured over the same tree:
+#
+#     -x .venv        ->  987 findings, 831 of them inside .venv   (inert)
+#     -x ./.venv      ->  156 findings, 0 inside .venv             (works)
+#     -x '*/.venv/*'  ->  156 findings, 0 inside .venv             (works)
+#
+# This file previously read `exclude = THE-GEMSTONE,node_modules,.venv,...`,
+# which excluded nothing: 84% of the findings came from .venv, the very
+# directory it named. The other four names looked like they worked only
+# because none of them contains any Python. Globs are used here rather than
+# `./` prefixes so the match holds however bandit is invoked.
+#
+# `.git` is dropped from the list — bandit excludes it by default, along with
+# .svn, CVS, .bzr, .hg, __pycache__, .tox, .eggs and *.egg. Naming it here
+# added nothing and made the list look more load-bearing than it was.
+
+[bandit]
+exclude = */THE-GEMSTONE/*,*/node_modules/*,*/.venv/*,*/.uv-cache/*

.checkov.yaml

@@ -0,0 +1,47 @@
+# Checkov — Codacy toggle. `skip-check: []` suppresses nothing, and keeps the
+# file a valid mapping.
+#
+# TWO SURFACES, not one. An earlier version of this file said workflows were
+# the only one — written without looking:
+#
+#   .github/workflows/   CKV_GHA_* checks
+#   Dockerfile           root, FROM python:3.13-slim, built by
+#                        .github/workflows/cloud-run-deploy.yml
+#
+# The workflow surface is already guarded twice, by
+# .github/workflows/action-pin-policy.yml and by CodeQL's `actions` analysis.
+# When the three disagree, the repo's own policy workflow wins — it is the one
+# that gates merges. The Dockerfile surface is guarded by nothing else, which
+# makes it the part of this toggle that actually earns its keep.
+#
+# MEASURED — checkov 3.3.10, both surfaces, with this config:
+#
+#   .github/workflows/    1039 passed, 25 failed
+#                           16  CKV2_GHA_1  top-level permissions set to
+#                                           write-all
+#                            9  CKV_GHA_7   build output can be affected by
+#                                           user parameters
+#   Dockerfile              51 passed,  1 failed
+#                            1  CKV_DOCKER_2  no HEALTHCHECK instruction
+#
+# The 16 write-all findings are the ones to look at first, and they are the
+# kind the two existing workflow guards do not catch: action-pin-policy.yml
+# checks SHA pinning, not permission scope.
+#
+# NOTE ON INVOCATION: `-d .github/workflows -f Dockerfile` in one run silently
+# reports only the github_actions framework — the Dockerfile is dropped without
+# a word. The two numbers above come from two separate runs. A single combined
+# run would have looked complete and quietly omitted half the surface.
+#
+# An earlier version of this note said checkov "could not be obtained in the
+# environment this was written in." It could: the pip install fails only
+# because it cannot uninstall a system PyJWT, and a venv sidesteps that
+# entirely. The obstacle was real and thirty seconds deep; recording it as an
+# unknown baseline made a gap look like a finding (AGENTS.md, "Fix Errors - Do
+# NOT Disable").
+#
+# `check:` is exclusive, not additive: setting one id disables every other
+# check while reading like you enabled something. `skip-check:` is the additive
+# one.
+
+skip-check: []

.eslintrc.js

@@ -0,0 +1,130 @@
+/* global module */
+//
+// Codacy does not read this repository's ESLint config. Its CLI prints
+// "ESLint configuration created based on Codacy settings" and generates its own
+// from the Code patterns page, so the `sourceType: "commonjs"` and
+// `globals.node` declared in eslint.config.js never reach Codacy's run. These
+// files really are CommonJS, so Codacy's generated config drew no-undef on
+// `module` and `require`. Reproduced locally with codacy-cli-v2: exactly the
+// four alerts code scanning reported, same files, same lines.
+//
+// The directive above states a fact rather than silencing a rule -- both are
+// Node CommonJS modules and both globals exist at run time. `/* global */` is
+// honoured by every ESLint config including a generated one; `eslint-env node`
+// would not be, having been removed in ESLint 9.
+
+// ESLint legacy config — NOT MERELY INERT. IT BREAKS MODERN ESLINT RUNS.
+//
+// Measured on eslint 10.8.1 (pinned in package.json): eslint.config.js is the
+// only format read. Move it aside and ESLint refuses to run — "couldn't find
+// an eslint.config.(js|mjs|cjs) file" — rather than falling back here. The
+// ESLINT_USE_FLAT_CONFIG=false escape hatch is gone, and `eslint --help` lists
+// no eslintrc options.
+//
+// THE COST IS NOT ZERO, and an earlier version of this header said it was.
+// "Inert" is only true while nothing points ESLint at this file. The moment
+// something does, the whole run dies:
+//
+//     $ eslint --config .eslintrc.js <anything>
+//     A config object is using the "root" key, which is not supported in
+//     flat config system.
+//
+// Not one bad key, either — removing `root` moves the error to `env`, and
+// after that would come `extends`, `overrides`, `ignorePatterns`. This is an
+// eslintrc file; ESLint 10 cannot load it at all, by design.
+//
+// This is not hypothetical. CodeRabbit's ESLint integration detects this file,
+// points ESLint 10.8.1 at it, and fails — so its ESLint tool currently reports
+// nothing on this repo, on every PR, because this file exists. Reproduced
+// locally with the exact error above.
+//
+// WHY THE FILE STAYS ANYWAY. Codacy runs two separate ESLint tools, and each
+// reads a different filename:
+//
+//     Codacy ESLint 8.57.0  ->  .eslintrc.js, .eslintrc.cjs, .eslintrc.{yaml,yml,json}
+//     Codacy ESLint 9.39.5  ->  eslint.config.js, eslint.config.mjs, eslint.config.cjs
+//
+// So this file is the config for a toggle that is available to enable, not a
+// relic. An earlier version of this header argued the opposite — that upstream
+// ESLint 8 going EOL in October 2024 made the file dead weight. That is a fact
+// about upstream and says nothing about which tools Codacy offers; deleting
+// the file would silently remove one of the two options.
+//
+// Note also that Codacy's v9 is 9.39.5, NOT the 10.8.1 pinned in package.json.
+// eslint.config.js is verified against 9.39.5 as well: it loads, applies
+// js.configs.recommended, and correctly leaves `document` undefined outside
+// .obsidian/plugins/** — checked against fixtures, since a clean exit and "no
+// files matched" produce identical output.
+//
+// The CodeRabbit breakage is therefore not an argument for deleting this file.
+// It is an argument for telling CodeRabbit not to run its own ESLint, which is
+// duplicating Codacy and currently reporting nothing:
+//
+//     # .coderabbit.yaml
+//     reviews:
+//       tools:
+//         eslint:
+//           enabled: false
+//
+// (`reviews.tools.eslint.enabled` confirmed against CodeRabbit's published
+// schema.v2.json.) That change belongs in .coderabbit.yaml, a shared surface,
+// and has not been made here.
+//
+// Which of the two files governs therefore depends on which ESLint tool is
+// enabled on the Code patterns page, not on a version guess. Both are present
+// so either choice finds a config, and a rule added here but not to
+// eslint.config.js affects nothing when the v9 tool is the one enabled.
+//
+// This file is verified against the tool it exists for. eslint 8.57.0 loads it
+// and reports through it:
+//
+//     $ eslint@8.57.0 --no-eslintrc -c .eslintrc.js broken.js
+//       1:13  error  'undefinedThing' is not defined         no-undef
+//       2:5   error  'x' is assigned a value but never used  no-unused-vars
+//
+// including `env.es2024`, which a reviewer believed ESLint 8 did not define. A
+// clean run alone would not have settled that — an ignored key and an accepted
+// key look identical — so the control: the same file with `es2024` changed to
+// a bogus `es9999` fails hard with "Error: --config". ESLint 8.57.0 rejects
+// unknown environments, so es2024 passing means it is really in the table.
+//
+// It mirrors eslint.config.js so the two cannot disagree: `eslint:recommended`
+// is the eslintrc spelling of what @eslint/js provides there, and `env`
+// supplies what the `globals` package supplies there.
+
+module.exports = {
+  root: true,
+  env: { node: true, es2024: true },
+  parserOptions: { ecmaVersion: 2024, sourceType: "script" },
+  extends: ["eslint:recommended"],
+  ignorePatterns: [
+    "THE-GEMSTONE/",
+    "node_modules/",
+    ".venv/",
+    ".uv-cache/",
+  ],
+  overrides: [
+    {
+      // Electron renderer: browser globals ON TOP of node. Scoped here rather
+      // than set at the root, so a stray `window` in a non-plugin script is
+      // still reported. Mirrors the flat config's per-path globals block.
+      files: [".obsidian/plugins/**/*.js"],
+      env: { browser: true },
+    },
+    {
+      // Mirrors the flat config's ESM block; see eslint.config.js.
+      // Recursive, matching the flat config's glob exactly. The two select the
+      // same file today -- templates/ has no subdirectories -- so this is
+      // correct-by-construction rather than a live fix: it keeps the pair from
+      // silently diverging the first time a nested template lands.
+      files: [".codex/skills/codex-primary-runtime/slides/templates/**/*.js"],
+      parserOptions: { sourceType: "module" },
+      globals: {
+        __DECK_ID_JSON__: "readonly",
+        __OUT_DIR_JSON__: "readonly",
+        __REFERENCE_DIR_JSON__: "readonly",
+        __SLIDES_JSON__: "readonly",
+      },
+    },
+  ],
+};

.github/actions/pr-agent/action.yml

@@ -1,4 +1,4 @@
-name: 'PR-Agent (digest-pinned)'
+name: "PR-Agent (digest-pinned)"
 description: >-
   the-pr-agent/pr-agent v0.42.0, with its Docker Hub image pinned by digest
   instead of the mutable tag upstream builds from.
@@ -55,17 +55,17 @@ description: >-
 
 inputs:
   artifact_path:
-    description: 'Path to a CI artifact file (relative to GITHUB_WORKSPACE or absolute) to include as extra context in PR analysis. Leave empty to disable artifact injection.'
+    description: "Path to a CI artifact file (relative to GITHUB_WORKSPACE or absolute) to include as extra context in PR analysis. Leave empty to disable artifact injection."
     required: false
-    default: ''
+    default: ""
   artifact_instructions:
-    description: 'Custom instructions telling the AI how to interpret the artifact. Leave empty for a sensible default.'
+    description: "Custom instructions telling the AI how to interpret the artifact. Leave empty for a sensible default."
     required: false
-    default: ''
+    default: ""
 
 runs:
-  using: 'docker'
-  image: 'docker://pragent/pr-agent@sha256:b81235c3bddc551939a1feca8926f4b6e8abcec2ae5bf4620424f8f56dd9cb93'
+  using: "docker"
+  image: "docker://pragent/pr-agent@sha256:b81235c3bddc551939a1feca8926f4b6e8abcec2ae5bf4620424f8f56dd9cb93"
   env:
     ARTIFACT_PATH: ${{ inputs.artifact_path }}
     ARTIFACT_INSTRUCTIONS: ${{ inputs.artifact_instructions }}

.github/workflows/arbiter-sortition.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       pr_number:
-        description: 'Pull Request Number'
+        description: "Pull Request Number"
         required: true
 
 permissions:
@@ -23,7 +23,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
 
       - name: Run Arbiter Sortition
         env:

.github/workflows/claude-sign.yml

@@ -80,7 +80,7 @@
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.target_branch }}
-          fetch-depth: 0  # full history for re-sign operations
+          fetch-depth: 0 # full history for re-sign operations
 
       # 1Password load — same pattern as .github/workflows/1password-secret-template.yml.
       # * Vault + item for the Claude signing key are LOGAN's to name. Verified
@@ -98,15 +98,15 @@
         with:
           export-env: true
         env:
-          CLAUDE_SSH_SIGNING_KEY: op://Vault/claude-code-signing-key/private-key  # *
-          CLAUDE_BOT_NAME: op://Vault/claude-bot-identity/bot-name                 # *
-          CLAUDE_BOT_EMAIL: op://Vault/claude-bot-identity/bot-email               # *
+          CLAUDE_SSH_SIGNING_KEY: op://Vault/claude-code-signing-key/private-key # *
+          CLAUDE_BOT_NAME: op://Vault/claude-bot-identity/bot-name # *
+          CLAUDE_BOT_EMAIL: op://Vault/claude-bot-identity/bot-email # *
 
       - name: Configure git SSH commit signing
         if: env.OP_SERVICE_ACCOUNT_TOKEN != ''
         run: |
           umask 077
           key_path="$RUNNER_TEMP/signing-key"
           printf '%s\n' "$CLAUDE_SSH_SIGNING_KEY" > "$key_path"
           chmod 600 "$key_path"
           git config user.name "$CLAUDE_BOT_NAME"

.github/workflows/codacy.yml

@@ -12,10 +12,10 @@ name: Codacy Security Scan
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ["main"]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ "main" ]
+    branches: ["main"]
 
 permissions:
   contents: read

.github/workflows/pr-agent.yml

@@ -112,7 +112,7 @@
         env:
           # TODO(logan): confirm the exact op:// ref for the OpenRouter API key
           # (placeholder namespace mirrors 1password-secret-template.yml).
           OPENROUTER_API_KEY: op://vault-operations/openrouter-api-key/credential
 
       - name: Skip when 1Password token is missing
         if: env.OP_SERVICE_ACCOUNT_TOKEN == ''
@@ -139,7 +139,7 @@
           # service-account token would be handed to third-party code that has
           # no use for it. Blanked here only; the guard and load steps above
           # still read the job-level value.
-          OP_SERVICE_ACCOUNT_TOKEN: ''
+          OP_SERVICE_ACCOUNT_TOKEN: ""
           # `OPENAI_KEY` — single underscore. `run_action` in
           # pr_agent/servers/github_action_runner.py:87 reads
           # `OPENAI_KEY` or `OPENAI.KEY` and nothing else; the nested