A past review pass over the Tier 2 signatures found 11 real false positives caused by generic patterns shared across an ecosystem (app.get( misattributing Fastify to Express, .upsert( misattributing Prisma to a vector database, toMatchSnapshot( misattributing Vitest to Jest). Those specific ones are fixed, and docs/signatures.md's "Pattern discipline" section documents the lesson. This issue is the standing invitation to keep hunting.
The ask
Pick any Tier 2 signature file in signatures/ and try to construct a realistic near-miss: a diff that mentions the library or looks adjacent to it but should NOT match (a comment, a docs line, a string literal, a similarly named API from a different library). If the signature wrongly matches it, that's a real false positive: open a PR that tightens the pattern AND adds your near-miss as a permanent negative fixture. If the signature correctly rejects it, adding the near-miss as a negative fixture is still valuable: it pins the behavior forever.
This is the "help harden the evidence" contribution CONTRIBUTING.md asks for, in its most concrete form. The test suite enforces that negative fixtures are genuine near-misses (they must mention the library by name), so rubber-stamp fixtures won't pass.
Definition of done (per PR)
A past review pass over the Tier 2 signatures found 11 real false positives caused by generic patterns shared across an ecosystem (
app.get(misattributing Fastify to Express,.upsert(misattributing Prisma to a vector database,toMatchSnapshot(misattributing Vitest to Jest). Those specific ones are fixed, anddocs/signatures.md's "Pattern discipline" section documents the lesson. This issue is the standing invitation to keep hunting.The ask
Pick any Tier 2 signature file in
signatures/and try to construct a realistic near-miss: a diff that mentions the library or looks adjacent to it but should NOT match (a comment, a docs line, a string literal, a similarly named API from a different library). If the signature wrongly matches it, that's a real false positive: open a PR that tightens the pattern AND adds your near-miss as a permanent negative fixture. If the signature correctly rejects it, adding the near-miss as a negative fixture is still valuable: it pins the behavior forever.This is the "help harden the evidence" contribution CONTRIBUTING.md asks for, in its most concrete form. The test suite enforces that negative fixtures are genuine near-misses (they must mention the library by name), so rubber-stamp fixtures won't pass.
Definition of done (per PR)
npm testgreenCHANGELOG.mdline under[Unreleased]