Topic · code signal suppressions reviewed

Code signal suppressions reviewed

Gist

Code signal suppressions reviewed is whether a project-level analyzer exception still has a reason, a current expiry, and a path when the signal is a wildcard. An empty reason on http.* with no path is not that floor. Proof runs proof audit --check code_signal_suppressions_reviewed. CodeSignal is not that hop. Jama still authors.

proof audit --check code_signal_suppressions_reviewed

Keep OpenGrep if it already finds the call. Keep Jama if it already holds the shalls. Neither one asks whether the exception that hid the call is still narrow, reasoned, and time-bounded.

Request demo Last silent exception vs this hop

01 · The silent exception

A wildcard in proof.yaml is not a reviewed skip.

The analyzer stays quiet because the row hid the hit. This hop says the row still has to name why, until when, and on which path.

The check is code_signal_suppressions_reviewed. It is default-on at verify. It reads project.signals.suppressions in proof.yaml. No project, or an empty list, is a silent pass. Severity of a hygiene miss is warning, not fail.

Each row can name a signal_id or a rule_id, plus optional provider, path, obligation, reason, and expires. The hop warns when a row has no rationale, when expires is past or unparseable, or when a broad wildcard sits without a narrow path.

# proof.yaml
project:
  signals:
    suppressions:
      - signal_id: "http.*"
        expires: "2025-01-01"
# no reason
# no path
# warn: project.signals.suppressions[0](id=http.* path=<all-paths>) missing suppression rationale
# warn: expired at 2025-01-01
# warn: uses a broad wildcard signal/rule without a narrow path scope
# silent exception: OpenGrep is quiet. the skip was never reviewed

A wildcard is *, **, *.*, or any id that ends in *, including http.*. A path of *, **, **/*, /, /**, ./**, or ./**/* is still all-paths. Scope the row to a real file or directory, and the wildcard warning drops. Empty expires is allowed. The hop does not require a date. A date that is not RFC3339 or YYYY-MM-DD is invalid expiry, counted.

This is not the catalog skip. A class suppress with reason TODO stays on obligation suppression rationale. An error-severity catalog skip with no reviewer stays on obligation suppression reviewer. A SARIF hit whose owner never listed the class stays on code signal obligations reviewed. A draft class id that does not resolve stays on code signal unbindable.

Inspect the suppressed matrix before trusting a green summary. Then edit the row, not a Jama note.

proof signals matrix --status suppressed --format json
proof config get project.signals.suppressions
proof workflow check --stage verify --only code_signal_suppressions_reviewed --verbose
proof audit --check code_signal_suppressions_reviewed

Add a complete reason. Renew or remove the expired row. Put a path, a provider, and an obligation on a wildcard. Do not mint a new shall to carry the skip. CodeSignal is not this hop.

02 · The exhibit

Same http.* skip. A silent exception, or this hop.

One project-level row. One wildcard. No reason. Expired. No path. OpenGrep is quiet. Click the tabs.

The row

Ask did OpenGrep stay quiet on FetchPolicy
Stamp proof.yaml hides http.* with no reason, expired 2025-01-01, no path
Why a quiet analyzer never asks whether the skip is still narrow

Scanner quiet

This hop

Nobody asked whether the exception still has a reason, a date, and a path. A wildcard in proof.yaml is not a reviewed skip. The finding kind is this hop.

Row unread

The row

Keep the Jama shall. Keep the SARIF. That is not this hop.

Keep the record

Proof

Ask does http.* still have a reason, a current expiry, and a path
Out missing rationale, expired at 2025-01-01, broad wildcard without a path

Silent exception counted

Same http.* skip. A silent exception, or this hop. Click the tabs.

Surface	What they do	What Proof does	What we lose
CodeSignal	A coding-interview product named Code Signal.	Warn when a project-level analyzer exception is unreasoned, expired, or unscoped.	We do not run interviews. Bare "code signal" is that SERP, not this hop.
OpenGrep / SARIF	A cached analyzer hit, or quiet because a skip hid it.	A warning until the skip has a reason, a current date, and a path on wildcards.	We do not replace the analyzer. We have not scored a frozen OpenGrep pack.
obligation_suppression_rationale	Whether a catalog class suppress still has a long enough reason.	Whether a project.signals.suppressions row still has any reason.	Not the catalog skip. Length is not checked here. See obligation suppression rationale.
obligation_suppression_reviewer	Whether a high-severity catalog skip names a reviewer.	Whether this analyzer exception is still narrow and dated.	Not the unsigned catalog skip. See obligation suppression reviewer.
code_signal_obligations_reviewed	Whether a fresh signal still has a covering obligation.	Whether the skip that hid the signal is still reviewed.	The other direction. See code signal obligations reviewed.
Jama cell	A shall, and a note if you type it.	A warning the audit can name next to the unreasoned skip.	Not Jama's V&V. Jama still authors. We have not run a frozen Jama pack.

The teaching graph is still one http.* row whose analyzer is quiet and whose skip was never reviewed. Close it in proof.yaml. Do not treat a Jama note as this hop. Do not treat a quiet scanner as a reviewed exception.

proof audit --check code_signal_suppressions_reviewed --verbose
proof signals matrix --status suppressed --format json
proof workflow check --stage verify --verbose

The catalog-reason hop stays on obligation suppression rationale. The catalog-reviewer hop stays on obligation suppression reviewer. The untriaged-signal hop stays on code signal obligations reviewed. The draft-class hop stays on code signal unbindable. Jama still authors. Proof vs Jama.

03 · The honest loss

Proof names an unreasoned skip. It does not write the reason, and it does not prove the Go.

A quiet proof audit --check code_signal_suppressions_reviewed can still mean the list was empty. Jama still authors.

Warning, not fail. Promote once the corpus is clean. An empty suppressions list is a silent pass. Empty expires is allowed. A copied one-word reason still passes; this hop does not measure length. That length floor stays on obligation suppression rationale. The hop does not inspect SARIF contents. It does not write the reason. It does not prove the Go. An explicit opt-out reports skip, not pass. We have not scored this floor against a frozen Jama pack, a CodeSignal interview, or a frozen OpenGrep corpus. The loss is named, not scored.

The untriaged-signal hop stays on code signal obligations reviewed. The engagement stays on software correctness audit. Jama still authors.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What is code signal suppressions reviewed? Same question. Same URL.

Is this CodeSignal? No. Ads code signal is that interview product. A hosted kata is not this cell.

Is this obligation suppression rationale? No. That hop is a catalog class suppress whose reason is too short. This hop is a project-level analyzer exception. Length is not checked here. See obligation suppression rationale.

Is this obligation suppression reviewer? No. That hop is whether a high-severity catalog skip names a reviewer. This hop does not read reviewed_by. See obligation suppression reviewer.

Is this code signal obligations reviewed? No. That hop is whether a fresh signal still has a covering obligation. This hop is whether the skip that hid the signal is still reviewed. See code signal obligations reviewed.

Does an empty list fail? No. No suppressions declared is a silent pass.

Does a missing expiry fail? No. Empty expires is allowed. Past or unparseable dates warn.

Does a green hop prove the Go? No. The hop observes that declared skips still have a reason, a current date, and a path on wildcards. It does not prove the function is correct.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.