| Rule | Category |
Py complex-postgres-query-requires-architecture-review Complex executable PostgreSQL query shapes require architecture review. | architecture |
Py defect-xfail-requires-explicit-strict A deterministic known-defect `xfail` must set literal `strict=True` so XPASS fails the suite. | testing |
Py docstring-args-restate-signature Remove a wholly redundant Google-style Args section when every entry only repeats the function signature. | maintainability |
Py docstring-returns-restate-signature Google-style Returns and Yields documentation must add facts beyond the corresponding annotated result type. | maintainability |
Py excessive-commentary Long standalone implementation commentary — make the code self-documenting and retain only durable constraints. | maintainability |
Py fakes-in-shared-location Review named top-level test doubles for shared-support ownership unless they are intentionally scenario-local. | testing |
Py fastapi-class-router-contract FastAPI routers use injected `*Router.build()` owners and explicit named object response models. | architecture |
Py fastapi-explicit-openapi-contract Visible FastAPI operations pin locally reviewable metadata and avoid statically provable OpenAPI gaps. | correctness |
Py iac-source-coupled-test Test uses raw Terraform/HCL text as an infrastructure-behavior oracle. | testing |
Py invalid-pydantic-field-default Require literal Pydantic model-field defaults to satisfy their resolved contract. | correctness |
Py mock-without-spec Unrestricted mock permits attributes outside the collaborator contract. | testing |
Py named-record-at-boundaries Public Python API returns an unnamed fixed-shape record. | architecture |
Py negative-only-http-status-assertion HTTP test assertion only excludes a server error instead of identifying the intended response. | testing |
Py no-analytical-aggregation-in-postgres-store Potentially analytical PostgreSQL store queries require review. | architecture |
Py no-any-mapping-types String-keyed mapping types must not erase their values with `Any`. | correctness |
Py no-bare-test-phase-comments Test files must not use bare phase comments such as Arrange, Act, Assert, Given, When, or Then. | testing |
Py no-comment-cruft Commented-out code, mechanical narration, decorative banner, or untracked work marker. | maintainability |
Py no-conftest-test-module-import Do not import individual test modules from conftest.py. | testing |
Py no-copied-inherited-docstring An override repeats the documentation of the single local base method it actually overrides. | maintainability |
Py no-cors-wildcard-with-credentials Credentialed CORS must not allow a wildcard origin. | security |
Py no-delete-statement Avoid `del` statements; prefer constructing an immutable replacement value. | maintainability |
Py no-docstring-type-restatement A docstring type label repeats an annotation from the fully typed signature. | maintainability |
Py no-dunder-all modules should not define or mutate `__all__` | maintainability |
Py no-duplicate-dunder-all-entry static module `__all__` declarations should list each exported name once | correctness |
Py no-excessive-cognitive-complexity Error on cognitive complexity above 20; scores up to 20 pass. | maintainability |
Py no-fastapi-on-event Deprecated FastAPI or Starlette on_event lifecycle registration. | correctness |
Py no-file-level-escape-hatch-suppression File-level Ruff suppression disables an escape-hatch rule across the entire file. | maintainability |
Py no-first-party-private-import A first-party consumer imports a private name or private module across its package boundary. | architecture |
Py no-frozen-after-validator-field-write Do not assign declared fields in after-validators on frozen Pydantic models. | correctness |
Py no-generic-single-export-module A generic module name should not conceal a single-definition responsibility. | architecture |
Py no-hidden-constructor-fallback Constructor option silently falls back to application settings when omitted. | architecture |
Py no-invalid-argument-name-suppression External parameter spelling must use framework aliases instead of disabling snake_case naming. | maintainability |
Py no-nested-pydantic-field-validator Outer-model Pydantic field validator is owned by a nested helper class. | correctness |
Py no-offset-pagination Potentially unbounded `OFFSET` pagination in store SQL. | performance |
Py no-positional-psycopg-row-escape A positional Psycopg record must not escape its function unchanged. | correctness |
Py no-positional-tuple-record Fixed tuple return records should use named fields instead of positional slots. | maintainability |
Py no-provably-dead-mock-configuration Remove mock behavior configuration proven unable to affect a test. | testing |
Py no-psycopg-execution-outside-injected-owner Psycopg execution occurs outside a constructor-injected persistence owner. | architecture |
Py no-random-uuid-in-sql Embedded SQL generates a random UUIDv4 instead of a time-ordered UUIDv7. | performance |
Py no-raw-connection-in-tests Do not acquire raw database connections in tests. | testing |
Py no-raw-source-text-test-oracle Test uses raw text from a source-like project path as its oracle. | testing |
Py no-redundant-module-alias-exports Do not manufacture public APIs from private names or replace the current module. | maintainability |
Py no-repeated-structured-string-literal Exact SQL or route literals repeated across callable scopes should share one named binding. | maintainability |
Py no-repeated-test-body Substantial sibling pytest tests repeat the same structural body. | testing |
Py no-repeated-unseeded-stdlib-random-in-test A collected test may repeatedly sample an unseeded standard-library PRNG. | testing |
Py no-restated-closed-domain-description Do not restate a string Literal or local string Enum domain in its Pydantic description. | maintainability |
Py no-restated-comment Short standalone comment lexically restates the immediately following simple action. | maintainability |
Py no-secret-in-log A direct credential-like reference is passed to a recognized logging call. | security |
Py no-select-star SQL SELECT projections should list explicit result columns instead of wildcards. | maintainability |
Py no-service-behavior-in-settings Settings and configuration types should not orchestrate injected collaborators. | architecture |
Py no-statically-truthy-assertion A bare assertion condition is statically truthy. | testing |
Py no-string-concat-in-loop Avoid repeatedly growing a proven string accumulator across a loop backedge. | performance |
Py no-trailing-numeric-unit-assignment-comment A trailing comment redundantly labels a numeric assignment with its value and unit. | maintainability |
Py no-unique-violation-message-match Do not make unique-violation control flow depend on rendered exception text. | correctness |
Py no-unnecessary-docstring No docstring consumer detected — delete it; make author-controlled names, types, and structure explain the code. | maintainability |
Py no-unused-value-marker Do not use standalone assignments to `_` to discard values. | maintainability |
Py no-vague-suppression-description Generic suppression descriptions do not make the exception auditable. | maintainability |
Py no-whole-request-response-payload-in-log Whole request or response payloads passed to logging calls require review. | security |
Py opaque-parametrize-case-needs-id Opaque static pytest parameter cases rely on argument-name-and-index fallback IDs. | testing |
Py over-mocked-test Tests should not use more than five independently rooted test doubles or collaborator substitutions. | testing |
Py prefer-class-row Avoid fetching a Psycopg dictionary row only to construct the same model manually. | maintainability |
Py prefer-collection-comprehension Single-purpose fresh collection builder loop — prefer a direct comprehension. | style |
Py prefer-constant-time-secret-compare Externally supplied authenticators are compared with timing-sensitive equality. | security |
Py prefer-fstring-over-concat Prefer f-strings for short human-readable interpolation when they make the result clearer. | style |
Py prefer-immutable-module-constant Nonempty uppercase module collections allow top-level membership or keys to change at runtime. | maintainability |
Py prefer-injected-dependency-over-monkeypatch Tests should inject dependencies instead of replacing attributes through ambient patching. | testing |
Py prefer-library-fake Prefer a maintained fake, emulator, recorder, or test service for substantial third-party protocols. | testing |
Py prefer-match-assert-never Typed enum dispatch must not silently ignore unhandled members. | correctness |
Py prefer-match-exception-dispatch Prefer guarded match/case for refined exception type dispatch. | maintainability |
Py prefer-match-type-dispatch Prefer `match` for structural runtime type dispatch. | maintainability |
Py prefer-match-value-dispatch Prefer match/case for repeated dispatch on one value with a fallback. | maintainability |
Py prefer-module-level-constant Hoist repeatedly read static values when an immutable module representation preserves behavior. | performance |
Py prefer-monkeypatch-for-process-state-in-test Test mutates process-wide state without a restoring test scope. | testing |
Py prefer-nominal-id-types Python boundaries should distinguish swappable identifier roles with nominal types. | correctness |
Py prefer-non-nullable-collection Avoid nullable list parameters that are immediately collapsed to an empty list. | maintainability |
Py prefer-or-pattern Merge adjacent `case` arms with identical bodies into one or-pattern. | maintainability |
Py prefer-pydantic-json-value Recursive JSON value alias duplicates `pydantic.JsonValue`. | correctness |
Py prefer-self-documenting-constant Encode a constant's units or HTTP status meaning in its name, type, or value. | maintainability |
Py prefer-self-type-annotation Prefer `Self` for self-returning methods and alternate constructors. | maintainability |
Py prefer-set-isdisjoint Prefer `set.isdisjoint` when a built-in set intersection is used only as a boolean predicate. | style |
Py prefer-str-enum Prefer `StrEnum` for application-owned string domains with explicit closed-set evidence. | maintainability |
Py prefer-struct-over-namedtuple Prefer typed declarations for static application-owned `collections.namedtuple` records. | maintainability |
Py prefer-walrus-awaited-none-guard Bind a compact awaited lookup in its immediately following terminal None guard. | style |
Py prefer-walrus-comprehension-filter The same call runs in a comprehension filter and its result. | performance |
Py prefer-walrus-regex-match A proven regex Match-or-None result is assigned only for the following condition. | style |
Py prefer-walrus-stream-loop Collapse a compact producer assignment and immediate sentinel break into a named-expression loop. | style |
Py production-derived-test-cases Warn when pytest membership-contract cases are derived only from the first-party production collection. | testing |
Py pytest-fixture-returns-bare-tuple Pytest fixture exposes a fixed positional record as an unnamed tuple. | testing |
Py redundant-class-docstring Undecorated base-free class docstring only repeats the class name. | maintainability |
Py redundant-docstring Function or plain-method docstring only repeats its declaration. | maintainability |
Py redundant-module-docstring Module docstring only repeats the filename and, optionally, its immediate parent package. | maintainability |
Py repeated-kwarg-heavy-call-in-test Tests repeat at least seven explicit keyword names across calls to the same callee. | testing |
Py repeated-static-call-cases Three same-shape literal call assertions may be independent parameter cases. | testing |
Py replay-contract-insert-requires-duplicate-policy A literal INSERT in a replay-named store callable must declare duplicate behavior. | correctness |
Py require-keyword-only-swap-prone-params Risky-name positional parameters sharing a primitive annotation may be confused. | correctness |
Py require-nodecode-for-splitting-settings-field Warn when an unconditional raw-string splitter lacks a pydantic-settings decoding policy. | correctness |
Py require-port-for-service Consider a consumer-owned port when visible service structure suggests a substitution boundary. | architecture |
Py require-pydantic-for-external-json Proven external JSON record fields are consumed before runtime schema validation. | correctness |
Py require-pydantic-for-structured-payload Structured nested FastAPI payloads must be parsed into a named Pydantic model before field access. | correctness |
Py require-pydantic-ordinal-lower-bound A Pydantic ordinal field maps its first position to N but accepts smaller integers. | correctness |
Py require-typed-http-test-response HTTP tests must validate JSON response bodies into named models before asserting fields. | testing |
Py restated-test-docstring Collected test docstring only repeats names and visible code. | testing |
Py stepdown A private helper used by one caller should be defined below that caller. | maintainability |
Py store-get-delegates-to-bulk-read A store singleton operation should reuse its equivalent bulk implementation. | maintainability |
Py timestamp-order-requires-tiebreaker Bounded store SQL whose final result-order key looks like a `*_at` timestamp should include a deterministic secondary key. | correctness |
Py typed-error-reasons Review joined exception strings for fixed reason identities versus dynamic context. | architecture |
Py unused-test-factory-option A private test factory exposes a literal option that visible callers never vary. | testing |
