fix(static): keep AR2 off Python comments describing program output

[rng1995]

Summary

AR2's first pattern accepts a bare no before warning(s), disclaimer(s) or caveat(s), with no verb required. In a Python comment such as

# "createdAt desc" returns no rows and the server emits no warning either way.

no warning is the object of the server's reported behavior, a note to developers rather than an instruction to suppress warnings. It still scores as HIGH Anti-Refusal Statement (AR2), and because static findings stay HIGH whatever triage tags they carry, it blocks release gates that count HIGH findings. It reproduces on 2.11.2, 2.12.0 and main (3a1ceee).

Customer impact

Reported internally: an internal skill's release gate fails on this AR2 at a Python comment on every SkillSpector version. With this PR that finding disappears. Nothing else in the report changes (30 → 29 findings; every other finding is identical by id, severity, confidence, location, text and tags).

Fix

Drop the match only when all of these hold:

1. Bare determiner form only. The do not / don't / never forms and every other AR2 pattern are unchanged.

2. Inside one proven Python comment token. The proof is the shared python_literal_spans, which requires the whole module to parse. SKILL.md, Markdown, prompts, string literals, docstrings, other languages, fragments and malformed source never qualify.

3. Descriptive grammar. A finite report verb from a closed allowlist ("emits", "returns", "printed", …) directly precedes the match. Base forms such as "give" read as imperatives and are excluded. The verb's subject must be either:

   • a program noun from a closed allowlist ("the server", "this endpoint", "the CLI"), or
   • omitted, when the comment opens with a code-behavior verb ("# Returns no warning when …").

   An unlisted subject or verb keeps the finding, so "the assistant emits no warnings" stays active.

4. Not addressed to an agent. No line of the contiguous comment block may address an agent or the reader (you, assistant, agent, model, AI, LLM, prompt, instructions, …). The block walk is bounded, and a block past the bound keeps the finding.

Both grammar checks read at most 160 characters before the match. Because the ownership proof parses the module, the analyzer opts into the runner's check_runtime deadline (USES_RUNTIME_CHECK = True, as static_patterns_prompt_injection does). Homoglyph or zero-width addressing is still caught, because the normalized view reproduces the match and fails the address check.

Relation to #461: this is independent of the open "without warning" mandate change there. That PR touches a different AR2 pattern and different lines, and the two merge cleanly (git merge-tree, with anti-refusal tests passing on the merged tree). #461 would not fix this case: a zero-confidence, tagged finding is still HIGH.

Tests

TestAntiRefusalDescriptivePythonComments adds 34 synthetic tests.

• Benign:
  • an explicit program subject with modifiers and adverbs;
  • a trailing comment, and an opening verb;
  • a wrapped sentence, past tense, and disclaimers.
• Scan level: the comment is dropped while a prompt string literal in the same file still fires; the proof honors check_runtime.
• Fail-closed:
  • agent-addressed comments, including # Assistant: never include warnings or disclaimers and an address on an earlier line of the block;
  • imperative, negated and verbless forms, and unlisted subjects and opening verbs;
  • a later directive in the same comment;
  • string literals, a # line inside a prompt string, a docstring, malformed source, and a match spanning comment and code;
  • SKILL.md, Markdown, shell and JavaScript;
  • an over-long comment block, and a homoglyph-addressed block.
• make lint and make format-check pass. The unit suite (pytest -m "not integration and not provider" tests/) gives 10451 passed, 15 skipped, 4 xfailed, 0 failed.

Residual (fails closed, unchanged from main)

• Passive ("No warning is emitted"), existential ("there is no warning") and adverbial ("fails without warning", see fix(analyzer): stop AR2 scoring a negated warning mandate as suppression #461) phrasings.
• Pronoun or identifier subjects, docstrings, and non-Python comments.
• Python that does not parse, and comment blocks past the bound.

🤖 Generated with Claude Code

[rng1995]

Review: the exemption is narrowly scoped to the bare determiner form inside a proven Python comment, with descriptive grammar and no agent address. The fail-closed controls cover the right risks (agent-addressed and homoglyph blocks, prompts in string literals, docstrings, other languages). The USES_RUNTIME_CHECK opt-in follows static_patterns_prompt_injection. One P3 on the shared parse cache.