`import-resolver` follows @import targets; a path written in ordinary prose
was checked by nothing. CA-CML-013 resolves those too — one finding per file,
severity low, against both the CLAUDE.md's own directory and the scan root,
because a nested file may legitimately write repo-root-relative paths.
The design work here is the SILENCE list, and every entry on it was measured
against 407 real CLAUDE.md files rather than argued for:
- Bare filenames excluded: admitting them tripled the output (2350 vs 810),
led by name-drops of tools that exist elsewhere on the machine.
- Org/repo slugs, npm packages, pytest node ids and prose enumerations
excluded: 111 fires, inspected, all false positives.
- Bare folder names excluded on the same reasoning one level up: 183 of the
remaining 699 fires (26%), led by `open/` — a Forgejo remote namespace
prefix, not a directory. This one overturned a premise the fasit had
asserted without measuring; the deviation is recorded rather than the
prediction quietly edited.
- Containment is checked against the scan root, not the file's own dir: a
base a `..` chain can escape is not a base. Measured — without it,
`../../../../etc/passwd` resolved to the real file and silenced its own
finding, while a legitimate `../docs/x.md` still resolves.
Rule ORDER is the reported reason (first match wins), so `npm test` is
silenced as a command rather than as a bare token, and two silences with
different causes keep their own fixtures. Twelve classes, pinned by name.
Both load-bearing rules were seen RED against their own defect: deleting
containment fails 1 test, deleting the slug rule fails 6.
Dogfooded through the argv the command template itself constructs, which
found a true positive in our own CLAUDE.md — `lib/humanizer.mjs` where the
file is `scanners/lib/humanizer.mjs`. Fixed here.
Suite 1662 -> 1701, 0 failing. Frozen v5.0.0 and default-output baselines:
0 changed files.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HJbfM3N8zWQ1wA2voTrZxz
Kjell Tore Guttormsen
dbb6a6a3cf