sudo: the rule the classification killed, and the marker it could not read

The other 163 OpenSPP findings are now classified, which is all 268. One rule
was 106 of them, every one critical, and reading them put it at 6 true and 97
false. That is not a tuning problem. Its own sentence is that sudo "drops
ir.rule filtering" and the regex could see the sudo and never the filtering:
73 fired on models the tree gives no ir.rule at all, and 10 more on
spp.vocabulary.code, whose single rule is [(1,'=',1)] and filters nothing.

So context.tree_facts now reads every <record model="ir.rule"> in the walk,
and the rule is an AST pass that fires only where a filtering rule exists. The
trigger only ever suppresses: an unwalked tree, a partial walk, or a model the
walk never saw declared each read UNKNOWN and the finding stands, so `nexa
check` on one file behaves as it did before.

That last clause is there because the first version did not have it and cost
three true positives. A walk of an addons tree sees the addons' rules and not
Odoo's own, so product.template -- which carries core's company rule from the
`product` module -- read as ABSENT, and a paginated API listing every company's
products stopped being reported. Silence about a model nobody declared is
UNKNOWN. The docstring that claimed a parse miss fails safe was true before
that change and false after it, and now says which way it actually falls.

Separately, and the reason the rule was so loud: 105 of those 106 findings
carried a `# nosemgrep:` about that exact construct and not one shared a line
with it. The call is chained across four lines; the checker anchors on
`.sudo()` and the marker sits above. scan_source now reads a marker across the
simple statement it sits in and the line above -- where semgrep, ruff and
pylint all document their own markers as belonging. Compound statements stay
out: a marker on an `if` header covering the block is the mute button this
project will not build, and this still cannot reach the next statement.

Measured on OpenSPP: 268 live findings to 162, 1.18 per kloc to 0.71, sudo 106
to 2. All 6 classified true positives kept, which is the only thing that makes
the rest of it safe.

Re-measured on OCA, because changing a checker invalidates every number it
produced. 102 hits, 3.0 per kloc, 79 true, 10 false, 13 undecidable. Three
findings are new -- the AST pass also sees .sudo().search_count( and
.sudo().search_read( -- and all three are false. One false positive left, a
sql-needs-query-parameters carrying a marker on the line above it. All 79 true
positives survived both changes. The Python field test is unmoved at 0.3.

recall --aim re-run: 13 on-target of 44, still the best-aimed rule in the
corpus by a distance. Like ondelete's, that grade is what the rule is worth
WITHOUT its trigger, because recall.py builds no tree_facts and every trigger
reads UNKNOWN there. The trigger only suppresses, so it is a floor.

Named and not fixed: float-comparison-needs-float-utils is 2 true and 5 false,
and all five compare an integer to zero -- search_count, a read_group _count,
SELECT COUNT(*) -- which the regex cannot see because it matches on the
variable's name. That needs assignment tracing, so it is written down rather
than quietly left out.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -114,11 +114,18 @@ half of the wrapper.
 | `check-company-on-relations` | A record in one company pointing at another's. A UI `domain` constrains a dropdown and enforces nothing. |
 
 Measured against **reviewed, merged** OCA code — 33,960 lines that passed human review
-and shipped — the corpus produces 2.9 findings per thousand lines. All of them
-classified by hand: **79 true positives, 8 false, 13 undecidable from a single file.**
+and shipped — the corpus produces 3.0 findings per thousand lines. All of them
+classified by hand: **79 true positives, 10 false, 13 undecidable from a single file.**
 Every verdict is in `classification-oca-2026-09.json`, so the number can be re-opened
 rather than taken on trust.
 
+On 226,937 lines of OpenSPP the rate is 0.7, and those findings have been read too:
+**138 true, 124 false, 6 undecidable** across `classification-openspp-2026-09.json` and
+`classification-openspp-rest-2026-09.json`. One rule accounts for 97 of those false
+positives and has been rewritten because of it — that story is
+[below](#the-rule-that-classification-killed), and it is the more useful half of
+publishing a classification.
+
 ## What it is not
 
 **Not a general linter.** 43 rules. It will not replace `pylint-odoo`, and after the
@@ -424,16 +431,18 @@ Same principle as `z.infer<typeof Schema>`: one definition, derived artifacts, n
 |---|---|
 | Rules | 43 — 19 Odoo, 10 TypeScript, 8 Python, 6 JavaScript |
 | Critical | 17 |
-| Machine-checkable | 40 (93%) — 31 by pattern, 9 by AST |
+| Machine-checkable | 40 (93%) — 30 by pattern, 10 by AST |
 | Traceable to upstream docs | 41 (95%), each audited for topic fit |
 | Pattern false positives | 0 cross-hits across the corpus |
 | Recall under meaning-preserving rewrite | 99/99 |
-| Satisfied patterns bypassable by a comment | 0 of 14 |
+| Satisfied patterns bypassable by a comment | 0 of 13 |
 | Retrievable by their own probe | 43 of 43, at top 3 |
-| Hit rate on 33,960 lines of reviewed OCA code | 2.9 per 1000 lines |
-| Those 100 hits, classified by hand | **79 true positives**, 8 false, 13 undecidable from one file |
-| Hit rate on 226,937 lines of OpenSPP (Odoo 19) | 1.2 per 1000 lines, +26 another tool had already flagged, +71 advisory |
-| The two `depends`/`constrains` rules on OpenSPP, classified by hand | **87 true positives**, 15 false, 3 undecidable — 85% |
+| Hit rate on 33,960 lines of reviewed OCA code | 3.0 per 1000 lines |
+| Those 102 hits, classified by hand | **79 true positives**, 10 false, 13 undecidable from one file |
+| Hit rate on 226,937 lines of OpenSPP (Odoo 19) | 0.7 per 1000 lines, +68 another tool had already flagged, +71 advisory |
+| Every one of those findings, classified by hand | **138 true positives**, 124 false, 6 undecidable |
+| …the two `depends`/`constrains` rules alone | **87 true**, 15 false, 3 undecidable — 85% |
+| …`sudo-bypasses-record-rules` alone, before it was narrowed | 6 true, 97 false — 5.8%, and the reason it is now an AST pass |
 | Hit rate on 73,762 lines of TypeScript (hono, trpc) | 3.8 per 1000 lines — **measured, not yet classified** |
 | Hit rate on 9,304 lines of Odoo frontend JavaScript | 4.6 per 1000 lines — 21 true positives, 22 false |
 | Hit rate on 10,225 lines of Python (llm-router) | 0.3 per 1000 lines |
@@ -490,7 +499,7 @@ This runs as part of `nexa build`. A checker that has never been attacked is a c
 nobody has tested.
 
 The probes hold the corpus to a measured standard, and it currently meets all three:
-**64/64** rewrites still caught, **0 of 12** satisfied patterns bypassable by a
+**99/99** rewrites still caught, **0 of 13** satisfied patterns bypassable by a
 comment, **0** contradictions between rules. Those numbers are regenerated on every
 build, so a checker cannot quietly weaken.
 
@@ -526,11 +535,20 @@ own denominator. Under the old counter today's tree reads 34,566 against that
 honest.
 
 All 100 were then read by hand — **79 true positives, 8 false, 13 undecidable from a
-single file** — and every verdict is in `classification-oca-2026-09.json`. The 8 is
+single file** — and every verdict is in `classification-oca-2026-09.json`. The 8 was
 down from 24 on the first pass: classifying them produced a worklist, and four of the
 seven classes turned out to be one predicate each on evidence already in the file. All
 79 true positives survived that narrowing, which is the only thing that makes it safe.
 
+**Re-measured after the sudo rewrite below: 102 hits, 3.0 per 1000 lines, 79 true, 10
+false, 13 undecidable.** Two changes moved it in opposite directions and both are worth
+naming. The AST pass also sees `.sudo().search_count(` and `.sudo().search_read(`, which
+the regex could not, so three findings are new — and all three are false, one of them the
+same `registry-model` class the original classification already had. Against that, one
+false positive left, a `sql-needs-query-parameters` carrying a marker on the line above
+it that suppression now reads. **All 79 true positives survived both changes**, which is
+again the only thing that makes the rest of it safe.
+
 ### The same treatment on a second ecosystem
 
 A precision number from one ecosystem is a precision number for that ecosystem. The two
@@ -558,6 +576,55 @@ Odoo rejects a non-stored field in `@api.constrains` with *"parameter is not wri
 The gap the finding points at is real; the fix it names cannot be applied. OpenSPP hit
 that same Odoo behaviour themselves and removed an `@api.constrains("age")` over it.
 
+### The rule that classification killed
+
+The other 163 findings were read the same way, and one rule accounted for most of what
+was wrong with the output. `sudo-bypasses-record-rules` was a regex for `.sudo().search(`
+and made **106 of the 268 live findings, every one marked critical**. Classified:
+**6 true, 97 false, 3 undecidable — 5.8%.**
+
+That is not a rule that needs tuning. It was asking half a question. Its own sentence is
+that sudo "drops ir.rule filtering", and the regex could see the `sudo` and never the
+filtering:
+
+- **73** were on models the tree gives **no `ir.rule` at all**, so there was nothing to drop.
+- **10** more on `spp.vocabulary.code`, whose single rule is `[(1, '=', 1)]` — a grant
+  that matches every row and filters nothing.
+- **14** re-applied scoping by hand, in a spelling the rule did not recognise because it
+  named only `company_id`.
+
+So it is now an AST pass that asks the tree the second half: `context.tree_facts` reads
+every `<record model="ir.rule">` in the walk and the checker fires only where a filtering
+rule exists. **The trigger only ever suppresses.** A tree that was not walked, a partial
+walk, a model the walk never saw declared — each reads UNKNOWN and the finding stands,
+so `nexa check` on a single file behaves exactly as it did before.
+
+That last clause was learned the hard way, in the first version of this trigger. A walk
+of an addons tree sees the addons' rules and not Odoo's own, so `product.template` — which
+carries core's company rule from the `product` module — read as ABSENT and **three true
+positives disappeared**: a paginated API listing every company's products. Silence about a
+model nobody declared is UNKNOWN, not "no rule".
+
+| | before | after |
+|---|---|---|
+| `sudo-bypasses-record-rules`, live | 106 | **2** |
+| All live findings on OpenSPP | 268 | **162** |
+| Per 1000 lines | 1.18 | **0.71** |
+| Of the 6 classified true positives, kept | — | **6** |
+
+The last row is the only one that makes the others safe.
+
+### What is still wrong, named
+
+`float-comparison-needs-float-utils` is next at **2 true, 5 false**. All five compare an
+*integer* to zero — `search_count`, a `read_group` `_count`, `SELECT COUNT(*)` — and the
+regex cannot see it because it matches on the variable's name, not its value. Fixing that
+means tracing the assignment, so it is written down here rather than quietly left out.
+
+`onchange-is-not-validation` is **4 true, 3 false**, and all three false ones are an
+onchange that sets a field rather than enforcing anything — which the rule's existing
+narrowing was supposed to exclude and does not catch when the write is to a Many2one.
+
 What the first run found:
 
 - **`onchange-is-not-validation`** fired on all 16 `@api.onchange` declarations that
@@ -732,9 +799,27 @@ person who had already decided.
 
 They do not anchor to the same line, though, and that is worth knowing. Semgrep matches
 the whole loop and its marker sits on the `for`; this checker reports the `commit()` ten
-lines inside it. `scan_source` only reads a marker on the finding's own line, so it does
-not carry across — deliberately, because a marker that silences findings it was not
-written about is the mute button this project will not build.
+lines inside it, so the marker does not carry across. A marker that silences findings it
+was not written about is the mute button this project will not build.
+
+**Reading a marker only on the finding's own line was too strict, and there is now a
+number on it.** Of the 106 `.sudo().search(` findings on OpenSPP, **105 carried a
+`# nosemgrep:` about that exact construct and not one shared a line with it** — the call
+is chained across four lines and the checker anchors on `.sudo()` while the marker sits
+above it. A hundred and five sites somebody had already read and justified were being
+re-reported as fresh critical findings.
+
+So `scan_source` now reads a marker across the **statement** it sits in, and the line
+immediately above it — which is where semgrep, ruff and pylint all document their own
+markers as belonging. The unit is a *simple* statement, one with no body of its own:
+compound statements are deliberately excluded, because letting a marker on an `if`
+header cover the whole block is the mute button again. It is the same principle read
+more carefully, not a weaker one — and it still cannot reach the next statement.
+
+On its own that took OpenSPP's suppressed count from 26 to 133. It reads 68 now, because
+the rule that produced most of those markers was narrowed in the same pass and no longer
+makes the findings at all — see below. Both changes were worth making: one stops
+re-reporting what somebody has already read, the other stops asking the wrong question.
 
 ### Every version claim is checked against two kinds of evidence
 

bin/context.py

@@ -31,6 +31,23 @@ MANIFEST_NAMES = ("__manifest__.py", "__openerp__.py")
 MAX_WALK_UP = 6
 
 _VERSION_RE = re.compile(r"[\"']version[\"']\s*:\s*[\"']([0-9.]+)[\"']")
+
+# An <record model="ir.rule"> and the two fields that decide whether it filters
+# anything. Attribute order is not fixed -- one OpenSPP file writes ref= before
+# name= on every row, which is 10 of that tree's 239 rules -- so model_id is
+# matched without assuming which attribute comes first.
+_IR_RULE_RE = re.compile(
+    r"<record[^>]*\bmodel=[\"']ir\.rule[\"'][^>]*>(.*?)</record>", re.S)
+_RULE_MODEL_RE = re.compile(
+    r"<field\b(?=[^>]*\bname=[\"']model_id[\"'])[^>]*\bref=[\"']([\w.]+)[\"']")
+_RULE_DOMAIN_RE = re.compile(
+    r"<field\b[^>]*\bname=[\"']domain_force[\"'][^>]*>(.*?)</field>", re.S)
+
+# A domain that matches every row filters nothing, so sudo cannot drop it. This
+# is the whole of `[(1, '=', 1)]` in any spacing; anything else is treated as a
+# real filter, because deciding that a domain is vacuous in general means
+# evaluating it.
+_VACUOUS_DOMAIN = re.compile(r"^\[\s*\(\s*1\s*,\s*[\"']=[\"']\s*,\s*1\s*\)\s*\]$")
 _NAME_RE = re.compile(r"[\"']name[\"']\s*:\s*[\"']([^\"']+)[\"']")
 _MODEL_RE = re.compile(r"^\s*_(?:name|inherit)\s*=\s*[\"']([a-z0-9_.]+)[\"']", re.M)
 _ODOO_IMPORT_RE = re.compile(r"^\s*from\s+odoo[\w.]*\s+import\s+(.+)$", re.M)
@@ -273,6 +290,7 @@ def tree_facts(paths, complete=True):
 
     declared, deleted = set(), set()
     unlink_tokens = set()
+    ruled = set()
     multi_company = False
     seen = 0
     # Every series the manifests in this walk name. Kept as a set because
@@ -305,6 +323,8 @@ def tree_facts(paths, complete=True):
             if not multi_company and any(m in body for m in
                                          semantics.MULTI_COMPANY_MARKERS):
                 multi_company = True
+            if "ir.rule" in body:
+                ruled |= _models_with_a_filtering_rule(body)
 
     # Access tokens are matched FORWARDS, from each declared model to the token
     # it would have. Parsing `model_sale_order_line` back into a dotted name is
@@ -318,10 +338,85 @@ def tree_facts(paths, complete=True):
     pinned = {v for v in series_seen if v}
     return {"walked": True, "complete": complete, "files": seen,
             "models_declared": declared, "models_deleted": deleted,
+            "models_record_ruled": ruled,
             "multi_company": multi_company,
             "odoo_series": pinned.pop() if len(pinned) == 1 else None}
 
 
+def _models_with_a_filtering_rule(body):
+    """Models this XML gives an ir.rule that actually filters something.
+
+    A rule whose domain_force is `[(1, '=', 1)]` is a grant, not a filter: it
+    exists to widen access for a group and matches every row. sudo() drops it
+    and nothing changes, so a model whose only rules are those is no different
+    from a model with none.
+
+    Measured on OpenSPP, that distinction is most of this trigger's value: of
+    the 30 `.sudo().search(` findings sitting on a model with any rule at all,
+    10 were on spp.vocabulary.code, whose single rule is exactly that.
+
+    The ref is turned into a dotted name forwards -- `model_spp_area` becomes
+    spp.area -- which is ambiguous for a model whose own name contains an
+    underscore. That is the same ambiguity _models_granted_unlink avoids by
+    matching forwards from declared models, and it is not avoidable here
+    because the rule names the model and nothing else does.
+
+    A rule this fails to read therefore reads as "no rule", and for a model the
+    tree declares that SUPPRESSES a finding -- the unsafe direction, and the one
+    thing in this trigger worth being careful about. Two things hold it down:
+    the parse is deliberately loose about attribute order, because one OpenSPP
+    file writes `ref=` before `name=` on all ten of its rules and a stricter
+    pattern silently lost them; and a model whose rules are all unreadable is a
+    model nobody can show is protected, which is a finding worth making anyway.
+    """
+    found = set()
+    for block in _IR_RULE_RE.findall(body):
+        ref = _RULE_MODEL_RE.search(block)
+        if not ref:
+            continue
+        token = ref.group(1).rsplit(".", 1)[-1]
+        if not token.startswith("model_"):
+            continue
+        domain = _RULE_DOMAIN_RE.search(block)
+        text = " ".join(domain.group(1).split()) if domain else ""
+        if text and _VACUOUS_DOMAIN.match(text):
+            continue
+        found.add(token[len("model_"):].replace("_", "."))
+    return found
+
+
+def model_is_record_ruled(facts, model):
+    """Would sudo() on this model actually drop a filter?
+
+    PRESENT if the tree declares an ir.rule for it that filters. ABSENT if a
+    whole tree was walked, the tree DECLARES the model, and no filtering rule
+    came with it. UNKNOWN otherwise.
+
+    The rule this backs says sudo "drops ir.rule filtering". Where there is no
+    filtering to drop, the finding describes something that cannot happen, and
+    on OpenSPP that was 83 of 106 findings.
+
+    The model must be declared here for ABSENT to mean anything, and getting
+    that wrong is measurable rather than theoretical. A walk of an addons tree
+    sees the addons' rules and not Odoo's own: product.template carries core's
+    company rule, which lives in the `product` module and not in the tree being
+    read. Answering ABSENT from that silence dropped three true positives in
+    spp_api_v2_products on the first run of this trigger -- a sudo lookup of
+    every company's products, which is exactly the leak the rule is about.
+
+    So silence about a model nobody declared is UNKNOWN, and the finding
+    stands. The tree can say "we declare this and give it no rule". It cannot
+    say anything about a model it never saw.
+    """
+    if not facts or not facts.get("walked") or not model:
+        return UNKNOWN
+    if model in facts.get("models_record_ruled", ()):
+        return PRESENT
+    if not facts.get("complete"):
+        return UNKNOWN
+    return ABSENT if model in facts.get("models_declared", ()) else UNKNOWN
+
+
 def _models_granted_unlink(body):
     """The `model_id:id` tokens an ir.model.access.csv grants perm_unlink on."""
     rows = list(csv.reader(io.StringIO(body)))

bin/layers.py

@@ -39,6 +39,7 @@ not-run rather than silently passing them.
 
 Stdlib only.
 """
+import ast
 import io
 import json
 import os
@@ -266,6 +267,52 @@ SUPPRESSION_MARKERS = ("noqa", "nosemgrep", "nosec", "pylint: disable",
                        "pylint:disable", "type: ignore", "eslint-disable",
                        "@ts-ignore", "@ts-expect-error")
 
+# Statement kinds a marker is allowed to reach across. Every one of these is a
+# SIMPLE statement: it has no body of its own, so its line span is the span of
+# one expression and nothing else can hide inside it. Compound statements are
+# deliberately absent -- letting a marker on an `if` header cover the whole
+# block is exactly the mute button this project will not build.
+_SIMPLE_STMTS = (ast.Assign, ast.AnnAssign, ast.AugAssign, ast.Expr,
+                 ast.Return, ast.Raise, ast.Assert, ast.Delete)
+
+
+def _simple_statement_spans(body):
+    """(start, end) for every simple statement in a Python source, widest last.
+
+    A finding anchors on one line, and a suppression marker written about that
+    finding may sit on another line of the SAME expression. Measured on
+    OpenSPP: 105 of 106 `.sudo().search(` findings carry a `# nosemgrep:` about
+    that exact construct, and not one of them shares a line with it, because
+    the call is chained across four lines and the checker anchors on `.sudo()`
+    while the marker sits above it.
+
+    Reading the marker only on the finding's own line therefore reported 106
+    critical findings at sites somebody had already read and justified. Reading
+    it anywhere nearby would be worse: a marker three lines up belongs to
+    whatever it was written about, which may be a different statement entirely.
+
+    The statement is the honest unit. A marker inside an expression is about
+    that expression, and it cannot reach the next one.
+    """
+    tree, _ = semantics.parse_python(body)
+    if tree is None:
+        return []
+    spans = []
+    for node in ast.walk(tree):
+        if isinstance(node, _SIMPLE_STMTS):
+            start = getattr(node, "lineno", None)
+            end = getattr(node, "end_lineno", None)
+            if start and end:
+                # start - 1 is the comment line immediately above the statement.
+                # Every analyser whose markers this reads -- semgrep, ruff,
+                # pylint -- documents that position as belonging to the line
+                # below it, and that is where most of these markers are written:
+                # 36 of OpenSPP's 105 sit there, above a statement that fits on
+                # one line and has no room for anything else. Reading the same
+                # convention the marker was written under is not obeying it.
+                spans.append((max(1, start - 1), end))
+    return spans
+
 
 class SourceHit(object):
     """One checker firing on a source file: what, where, and two things about
@@ -343,9 +390,30 @@ def scan_source(body, rules, stack, errors=None, facts=None, gaps=None):
     # very markers this looks for.
     rows = body.splitlines()
 
+    # Spans are computed once per file, and only for Python: the other stacks
+    # have no parser here, so a marker there still reaches its own line only.
+    # That asymmetry is stated rather than hidden -- a JS finding on a chained
+    # call will read as unsuppressed when a person had in fact marked it.
+    spans = _simple_statement_spans(body) if comment_kind(stack) == "python" else []
+
+    def _has_marker(text):
+        return any(marker in text for marker in SUPPRESSION_MARKERS)
+
     def marked(line):
         text = rows[line - 1] if 0 < line <= len(rows) else ""
-        return any(marker in text for marker in SUPPRESSION_MARKERS)
+        if _has_marker(text):
+            return True
+        # The smallest simple statement containing this line, if any: a marker
+        # written inside one expression covers that expression and stops there.
+        best = None
+        for start, end in spans:
+            if start <= line <= end and (best is None or
+                                         (end - start) < (best[1] - best[0])):
+                best = (start, end)
+        if best is None:
+            return False
+        return any(_has_marker(rows[n - 1]) for n in range(best[0], best[1] + 1)
+                   if 0 < n <= len(rows))
 
     # One parse for the whole file, before any semantic checker runs, so that
     # "nothing to say" and "could not read it" stop being the same output. Only

bin/semantics.py

@@ -1837,8 +1837,102 @@ def declares_multi_company(code):
     return any(marker in view for marker in MULTI_COMPANY_MARKERS)
 
 
+def sudo_search_drops_a_real_rule(code, facts=None):
+    """odoo.sudo-bypasses-record-rules
+
+    Fires on `<model>.sudo().search(...)` where the model actually carries an
+    ir.rule that filters something, and the domain does not re-apply company
+    scoping by hand.
+
+    The regex this replaces asked only the first half of the question -- is
+    there a `.sudo().search(` -- and on OpenSPP that was 106 findings of which
+    6 were the thing the rule describes. The rule's own sentence is that sudo
+    "drops ir.rule filtering". Where the tree declares no filtering rule for
+    that model, there is nothing to drop and the finding is about a mechanism
+    that does not exist here. Classified by hand, that was 83 of the 106:
+    73 on models with no rule at all, and 10 on spp.vocabulary.code, whose
+    single rule is `[(1, '=', 1)]` and filters nothing.
+
+    The trigger only ever SUPPRESSES. A model the walk could not name, a tree
+    that was not walked, a partial walk -- each reads UNKNOWN and the finding
+    stands, because "no rule was found" and "nobody looked" must not be the
+    same answer on a critical rule. `nexa check` on one file therefore behaves
+    exactly as it did before this trigger existed.
+
+    What it still over-reports, measured and not yet fixed: 14 of the remaining
+    20 constrain the search to records the caller had already identified -- a
+    group id, a partner id, an area -- which is the rule's advice followed in a
+    spelling the rule does not recognise, since it names only company_id. That
+    is a worklist entry rather than a narrowing, because deciding in general
+    that a domain is already scoped means evaluating it, and a narrowing that
+    guesses would cost the 6 true positives this keeps.
+    """
+    tree, _ = parse_python(code)
+    if tree is None:
+        return []
+
+    findings = []
+    for node in ast.walk(tree):
+        if not isinstance(node, ast.Call):
+            continue
+        if not isinstance(node.func, ast.Attribute):
+            continue
+        if node.func.attr not in ("search", "search_count", "search_read"):
+            continue
+        inner = node.func.value
+        if not (isinstance(inner, ast.Call) and isinstance(inner.func, ast.Attribute)
+                and inner.func.attr == "sudo"):
+            continue
+
+        # The rule's own correct sample re-applies company filtering inside the
+        # domain, so a domain naming company_id is the rule satisfied. Read off
+        # the call's own arguments rather than the file, because a company_id
+        # anywhere else in a module said nothing about THIS search.
+        try:
+            call_src = ast.unparse(node)
+        except Exception:                                   # pragma: no cover
+            call_src = ""
+        if "company_id" in call_src:
+            continue
+
+        model = _env_model_of(inner.func.value)
+        if context.model_is_record_ruled(facts, model) == context.ABSENT:
+            continue
+
+        where = " on {0}".format(model) if model else ""
+        findings.append((
+            node.lineno,
+            "sudo().{0}(){1} runs with record rules off -- ir.rule filtering, "
+            "including multi-company isolation, does not apply and the result "
+            "looks correct in single-company testing".format(node.func.attr, where),
+            None))
+    return findings
+
+
+def _env_model_of(node):
+    """The model name at the head of a chained call, or None.
+
+    Resolves `self.env["res.partner"]` and `env["res.partner"]` through any
+    number of intervening attributes. A head that is a plain name -- the
+    `Partner` in `Partner.sudo().search(...)` -- is not resolvable without
+    following the assignment, so it returns None and the caller treats the
+    record-rule question as unanswered rather than answered no.
+    """
+    while isinstance(node, (ast.Call, ast.Attribute)):
+        node = node.func if isinstance(node, ast.Call) else node.value
+    if isinstance(node, ast.Subscript) and isinstance(node.slice, ast.Constant) \
+            and isinstance(node.slice.value, str):
+        target = node.value
+        name = target.attr if isinstance(target, ast.Attribute) else (
+            target.id if isinstance(target, ast.Name) else None)
+        if name == "env":
+            return node.slice.value
+    return None
+
+
 CHECKS = {
     "handler_order_shadows_a_subclass": handler_order_shadows_a_subclass,
+    "sudo_search_drops_a_real_rule": sudo_search_drops_a_real_rule,
     "check_company_missing_on_company_owned_relation":
         check_company_missing_on_company_owned_relation,
     "commit_inside_a_loop": commit_inside_a_loop,
@@ -1858,6 +1952,9 @@ CHECKS = {
 CONTEXT_CHECKS = frozenset([
     "ondelete_leaves_a_dangling_read",
     "check_company_missing_on_company_owned_relation",
+    # Reads models_record_ruled: whether sudo drops anything depends on whether
+    # the tree declares a rule that filters.
+    "sudo_search_drops_a_real_rule",
     # Reads odoo_series: whether a _sql_constraints block is a constraint at
     # all depends on which Odoo is going to load it.
     "prefer_sql_constraint_applies",

classification-oca-2026-09.json

@@ -1,927 +1,948 @@
 {
-  "generated_utc": "2026-09-15",
-  "stack": "odoo",
-  "roots": [
-    "server-tools",
-    "account-financial-tools"
-  ],
-  "files": 606,
-  "lines": 33960,
-  "checkouts": {
-    "server-tools": "60cd54e5e",
-    "account-financial-tools": "e4c1b86aa"
-  },
-  "totals": {
-    "false": 8,
-    "true": 79,
-    "undecidable": 13
-  },
-  "classes": {
-    "registry-model": 4,
-    "advice-cannot-be-taken": 2,
-    "storedness-unknown": 13,
-    "wrong-construct": 2
-  },
-  "hits": [
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "path": "server-tools/attachment_delete_restrict/models/ir_attachment.py",
-      "line": 71,
-      "verdict": "false",
-      "class": "registry-model",
-      "why": "sudo() on ir.model, which has no company_id and so no tenant boundary",
-      "evidence": "models = self.env[\"ir.model\"].sudo().search([(\"model\", \"in\", res_models)])"
-    },
-    {
-      "rule": "odoo.ondelete-is-a-decision",
-      "path": "server-tools/attachment_synchronize/models/attachment_queue.py",
-      "line": 14,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "task_id declares no ondelete, so the ORM defaults it to 'set null' -- and task_id.filepath on line 37 reads through it, which yields False rather than raising once the parent is deleted, and this tree does delete attachment.synchronize.task"
-    },
-    {
-      "rule": "odoo.ondelete-is-a-decision",
-      "path": "server-tools/attachment_synchronize/models/attachment_synchronize_task.py",
-      "line": 64,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "backend_id declares no ondelete, so the ORM defaults it to 'set null' -- and backend_id.fs on line 166 reads through it, which yields False rather than raising once the parent is deleted"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "server-tools/auditlog/models/http_session.py",
-      "line": 29,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_display_name() reads 'user_id.name' but @api.depends does not declare it -- the stored value goes stale when 'user_id.name' changes"
-    },
-    {
-      "rule": "odoo.constrains-must-list-every-field-read",
-      "path": "server-tools/autovacuum_message_attachment/models/vacuum_rule.py",
-      "line": 100,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_check_inheriting_model() reads 'ttype' but @api.constrains declares only inheriting_model -- writing 'ttype' alone skips the check entirely"
-    },
-    {
-      "rule": "odoo.constrains-must-list-every-field-read",
-      "path": "server-tools/base_exception/models/exception_rule.py",
-      "line": 59,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "check_exception_type_consistency() reads 'method' but @api.constrains declares only code, domain, exception_type, model -- writing 'method' alone skips the check entirely"
-    },
-    {
-      "rule": "odoo.sql-needs-query-parameters",
-      "path": "server-tools/base_multi_image/hooks.py",
-      "line": 47,
-      "verdict": "false",
-      "class": "advice-cannot-be-taken",
-      "why": "a table or column name cannot be a query parameter; both sites already parameterise the values",
-      "evidence": "the query handed to cr.execute() is built by an f-string -- pass the values as the second argument so the driver quotes them"
-    },
-    {
-      "rule": "odoo.depends-must-not-name-unread-fields",
-      "path": "server-tools/base_multi_image/models/image.py",
-      "line": 103,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_show_technical() declares 'owner_id', 'owner_model' in @api.depends and never reads them -- the value recomputes on writes that cannot change it, and the decorator stops describing the method"
-    },
-    {
-      "rule": "odoo.sql-needs-query-parameters",
-      "path": "server-tools/database_autovacuum_tuning/models/database_autovacuum_tuning.py",
-      "line": 24,
-      "verdict": "false",
-      "class": "advice-cannot-be-taken",
-      "why": "a table or column name cannot be a query parameter; both sites already parameterise the values",
-      "evidence": "the query handed to cr.execute() is built by an f-string -- pass the values as the second argument so the driver quotes them"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "path": "server-tools/database_size/models/ir_model_size.py",
-      "line": 87,
-      "verdict": "false",
-      "class": "registry-model",
-      "why": "sudo() on ir.model, which has no company_id and so no tenant boundary",
-      "evidence": "model.model: model.name for model in self.env[\"ir.model\"].sudo().search([])"
-    },
-    {
-      "rule": "odoo.ondelete-is-a-decision",
-      "path": "server-tools/excel_import_export/models/xlsx_template.py",
-      "line": 108,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "result_model_id declares no ondelete, so the ORM defaults it to 'set null' -- and result_model_id.model on line 199 reads through it, which yields False rather than raising once the parent is deleted, and this tree does delete ir.model"
-    },
-    {
-      "rule": "odoo.ondelete-is-a-decision",
-      "path": "server-tools/fetchmail_attach_from_folder/models/fetchmail_server_folder.py",
-      "line": 25,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "server_id declares no ondelete, so the ORM defaults it to 'set null' -- and server_id.connect on line 139 reads through it, which yields False rather than raising once the parent is deleted"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "path": "server-tools/tracking_manager/models/ir_model.py",
-      "line": 34,
-      "verdict": "false",
-      "class": "registry-model",
-      "why": "sudo() on ir.model, which has no company_id and so no tenant boundary",
-      "evidence": "models = self.sudo().search([(\"active_custom_tracking\", \"=\", True)])"
-    },
-    {
-      "rule": "odoo.depends-must-not-name-unread-fields",
-      "path": "server-tools/tracking_manager/models/ir_model.py",
-      "line": 101,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_automatic_custom_tracking() declares 'active_custom_tracking' in @api.depends and never reads it -- the value recomputes on writes that cannot change it, and the decorator stops describing the method"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "server-tools/tracking_manager/models/ir_model.py",
-      "line": 135,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_automatic_custom_tracking_domain() reads 'model' but @api.depends does not declare it -- the stored value goes stale when 'model' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "server-tools/tracking_manager/models/ir_model_fields.py",
-      "line": 30,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_custom_tracking() reads 'model_id' but @api.depends does not declare it -- the stored value goes stale when 'model_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "server-tools/tracking_manager/models/ir_model_fields.py",
-      "line": 30,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_custom_tracking() reads 'model_id.automatic_custom_tracking' but @api.depends does not declare it -- the stored value goes stale when 'model_id.automatic_custom_tracking' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "server-tools/tracking_manager/models/ir_model_fields.py",
-      "line": 31,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_custom_tracking() reads 'model_id.automatic_custom_tracking_domain' but @api.depends does not declare it -- the stored value goes stale when 'model_id.automatic_custom_tracking_domain' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "server-tools/tracking_manager/models/ir_model_fields.py",
-      "line": 52,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_trackable() reads 'name' but @api.depends does not declare it -- the stored value goes stale when 'name' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_force_account/models/account_asset.py",
-      "line": 60,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_account_asset_id() reads 'state' but @api.depends does not declare it -- the stored value goes stale when 'state' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_force_account/models/account_asset.py",
-      "line": 64,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_account_asset_id() reads 'account_move_line_ids.account_id' but @api.depends does not declare it -- the stored value goes stale when 'account_move_line_ids.account_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_force_account/models/account_asset.py",
-      "line": 72,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_account_asset_id() reads 'profile_id.account_asset_id' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.account_asset_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_management/models/account_asset.py",
-      "line": 311,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_group_ids() reads 'profile_id.group_ids' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.group_ids' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_management/models/account_asset.py",
-      "line": 316,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_method() reads 'profile_id.method' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.method' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_management/models/account_asset.py",
-      "line": 324,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_method_number() reads 'profile_id.method_number' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.method_number' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_management/models/account_asset.py",
-      "line": 329,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_method_period() reads 'profile_id.method_period' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.method_period' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_management/models/account_asset.py",
-      "line": 340,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_method_progress_factor() reads 'profile_id.method_progress_factor' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.method_progress_factor' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_management/models/account_asset.py",
-      "line": 345,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_method_time() reads 'profile_id.method_time' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.method_time' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_management/models/account_asset.py",
-      "line": 350,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_days_calc() reads 'profile_id.days_calc' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.days_calc' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_management/models/account_asset.py",
-      "line": 355,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_use_leap_years() reads 'profile_id.use_leap_years' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.use_leap_years' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_management/models/account_asset.py",
-      "line": 363,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_prorrata() reads 'profile_id.prorata' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.prorata' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_management/models/account_asset.py",
-      "line": 368,
-      "verdict": "undecidable",
-      "class": "storedness-unknown",
-      "why": "the compute's field is declared in another module, so storedness cannot be read here",
-      "evidence": "_compute_account_analytic_id() reads 'profile_id.account_analytic_id' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.account_analytic_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_management/models/account_asset.py",
-      "line": 373,
-      "verdict": "undecidable",
-      "class": "storedness-unknown",
-      "why": "the compute's field is declared in another module, so storedness cannot be read here",
-      "evidence": "_compute_analytic_distribution() reads 'profile_id.analytic_distribution' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.analytic_distribution' changes"
-    },
-    {
-      "rule": "odoo.constrains-must-list-every-field-read",
-      "path": "account-financial-tools/account_asset_management/models/account_asset.py",
-      "line": 398,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_check_profile_change() reads 'depreciation_line_ids' but @api.constrains declares only profile_id -- writing 'depreciation_line_ids' alone skips the check entirely"
-    },
-    {
-      "rule": "odoo.recursion-check-on-hierarchy",
-      "path": "account-financial-tools/account_asset_management/models/account_asset_group.py",
-      "line": 27,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "parent_id = fields.Many2one("
-    },
-    {
-      "rule": "odoo.ondelete-is-a-decision",
-      "path": "account-financial-tools/account_asset_management/models/account_move.py",
-      "line": 174,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "asset_profile_id declares no ondelete, so the ORM defaults it to 'set null' -- and asset_profile_id.account_asset_id on line 200 reads through it, which yields False rather than raising once the parent is deleted, and this tree does delete account.asset.profile"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_management/models/account_move.py",
-      "line": 192,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_asset_profile() reads 'account_id.asset_profile_id' but @api.depends does not declare it -- the stored value goes stale when 'account_id.asset_profile_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_asset_management/models/account_move.py",
-      "line": 195,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_asset_profile() reads 'asset_id.profile_id' but @api.depends does not declare it -- the stored value goes stale when 'asset_id.profile_id' changes"
-    },
-    {
-      "rule": "odoo.constrains-iterate-recordset",
-      "path": "account-financial-tools/account_asset_management/wizard/account_asset_remove.py",
-      "line": 80,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "@api.constrains(\"sale_value\", \"company_id\")"
-    },
-    {
-      "rule": "odoo.constrains-must-list-every-field-read",
-      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py",
-      "line": 130,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_check_deposit() reads 'company_id' but @api.constrains declares only cash_journal_id, currency_id -- writing 'company_id' alone skips the check entirely"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py",
-      "line": 203,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_is_reconcile() reads 'cash_journal_id' but @api.depends does not declare it -- the stored value goes stale when 'cash_journal_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py",
-      "line": 203,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_is_reconcile() reads 'cash_journal_id.default_account_id' but @api.depends does not declare it -- the stored value goes stale when 'cash_journal_id.default_account_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py",
-      "line": 203,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_is_reconcile() reads 'move_id.line_ids.account_id' but @api.depends does not declare it -- the stored value goes stale when 'move_id.line_ids.account_id' changes"
-    },
-    {
-      "rule": "odoo.float-comparison-needs-float-utils",
-      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py",
-      "line": 271,
-      "verdict": "false",
-      "class": "wrong-construct",
-      "why": "parent_id pointing at another model / == on an Integer / a commit on a separate cursor",
-      "evidence": "self.line_ids.filtered(lambda x: x.qty == 0).unlink()"
-    },
-    {
-      "rule": "odoo.recursion-check-on-hierarchy",
-      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py",
-      "line": 381,
-      "verdict": "false",
-      "class": "wrong-construct",
-      "why": "parent_id pointing at another model / == on an Integer / a commit on a separate cursor",
-      "evidence": "parent_id = fields.Many2one(\"account.cash.deposit\", ondelete=\"cascade\")"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py",
-      "line": 420,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_subtotal() reads 'cash_unit_id.total_value' but @api.depends does not declare it -- the stored value goes stale when 'cash_unit_id.total_value' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_cash_deposit/models/cash_unit.py",
-      "line": 114,
-      "verdict": "undecidable",
-      "class": "storedness-unknown",
-      "why": "the compute's field is declared in another module, so storedness cannot be read here",
-      "evidence": "_compute_display_name() reads 'total_value' but @api.depends does not declare it -- the stored value goes stale when 'total_value' changes"
-    },
-    {
-      "rule": "odoo.check-company-on-relations",
-      "path": "account-financial-tools/account_check_deposit/models/account_check_deposit.py",
-      "line": 41,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_check_deposit/models/account_check_deposit.py",
-      "line": 132,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_check_deposit() reads 'company_id.currency_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id.currency_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_check_deposit/models/account_check_deposit.py",
-      "line": 145,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_currency_id() reads 'company_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_check_deposit/models/account_check_deposit.py",
-      "line": 146,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_currency_id() reads 'journal_id.currency_id' but @api.depends does not declare it -- the stored value goes stale when 'journal_id.currency_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_check_deposit/models/account_check_deposit.py",
-      "line": 151,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_in_hand_check_account_id() reads 'journal_id.inbound_payment_method_line_ids' but @api.depends does not declare it -- the stored value goes stale when 'journal_id.inbound_payment_method_line_ids' changes"
-    },
-    {
-      "rule": "odoo.ondelete-is-a-decision",
-      "path": "account-financial-tools/account_dashboard_banner_mis_builder/models/account_dashboard_banner_cell.py",
-      "line": 17,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "mis_report_instance_id declares no ondelete, so the ORM defaults it to 'set null' -- and mis_report_instance_id.currency_id on line 105 reads through it, which yields False rather than raising once the parent is deleted"
-    },
-    {
-      "rule": "odoo.ondelete-is-a-decision",
-      "path": "account-financial-tools/account_dashboard_banner_mis_builder/models/account_dashboard_banner_cell.py",
-      "line": 35,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "mis_report_instance_period_id declares no ondelete, so the ORM defaults it to 'set null' -- and mis_report_instance_period_id.date_from on line 103 reads through it, which yields False rather than raising once the parent is deleted"
-    },
-    {
-      "rule": "odoo.constrains-must-list-every-field-read",
-      "path": "account-financial-tools/account_dashboard_banner_mis_builder/models/account_dashboard_banner_cell.py",
-      "line": 47,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_check_mis_builder() reads 'cell_type' but @api.constrains declares only mis_report_instance_id, mis_report_kpi_id -- writing 'cell_type' alone skips the check entirely"
-    },
-    {
-      "rule": "odoo.constrains-must-list-every-field-read",
-      "path": "account-financial-tools/account_dashboard_banner_mis_builder/models/account_dashboard_banner_cell.py",
-      "line": 74,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_check_mis_builder() reads 'mis_report_instance_period_id' but @api.constrains declares only mis_report_instance_id, mis_report_kpi_id -- writing 'mis_report_instance_period_id' alone skips the check entirely"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_journal_general_sequence/models/account_journal.py",
-      "line": 42,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_entry_number_sequence() reads 'company_id.name' but @api.depends does not declare it -- the stored value goes stale when 'company_id.name' changes"
-    },
-    {
-      "rule": "odoo.check-company-on-relations",
-      "path": "account-financial-tools/account_loan/models/account_loan.py",
-      "line": 144,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "relation to account.journal with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.journal, and this codebase runs multi-company"
-    },
-    {
-      "rule": "odoo.check-company-on-relations",
-      "path": "account-financial-tools/account_loan/models/account_loan.py",
-      "line": 149,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
-    },
-    {
-      "rule": "odoo.check-company-on-relations",
-      "path": "account-financial-tools/account_loan/models/account_loan.py",
-      "line": 156,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
-    },
-    {
-      "rule": "odoo.check-company-on-relations",
-      "path": "account-financial-tools/account_loan/models/account_loan.py",
-      "line": 162,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
-    },
-    {
-      "rule": "odoo.check-company-on-relations",
-      "path": "account-financial-tools/account_loan/models/account_loan.py",
-      "line": 170,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
-    },
-    {
-      "rule": "odoo.depends-must-not-name-unread-fields",
-      "path": "account-financial-tools/account_loan/models/account_loan.py",
-      "line": 246,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_total_amounts() declares 'currency_id' in @api.depends and never reads it -- the value recomputes on writes that cannot change it, and the decorator stops describing the method"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_loan/models/account_loan_line.py",
-      "line": 132,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_rate() reads 'pending_principal_amount' but @api.depends does not declare it -- the stored value goes stale when 'pending_principal_amount' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_loan/models/account_loan_line.py",
-      "line": 139,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_interests_amount() reads 'pending_principal_amount' but @api.depends does not declare it -- the stored value goes stale when 'pending_principal_amount' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_loan/models/account_loan_line.py",
-      "line": 174,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_principal_amount() reads 'interests_amount' but @api.depends does not declare it -- the stored value goes stale when 'interests_amount' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_loan/models/account_loan_line.py",
-      "line": 174,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_principal_amount() reads 'payment_amount' but @api.depends does not declare it -- the stored value goes stale when 'payment_amount' changes"
-    },
-    {
-      "rule": "odoo.ondelete-is-a-decision",
-      "path": "account-financial-tools/account_move_line_purchase_info/models/account_move.py",
-      "line": 59,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "oca_purchase_line_id declares no ondelete, so the ORM defaults it to 'set null' -- and oca_purchase_line_id.order_id on line 84 reads through it, which yields False rather than raising once the parent is deleted"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_move_line_purchase_info/models/account_move.py",
-      "line": 84,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_purchase_id() reads 'oca_purchase_line_id.order_id' but @api.depends does not declare it -- the stored value goes stale when 'oca_purchase_line_id.order_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_move_line_purchase_info/models/account_move.py",
-      "line": 84,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_purchase_id() reads 'purchase_line_id.order_id' but @api.depends does not declare it -- the stored value goes stale when 'purchase_line_id.order_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_move_line_sale_info/models/sale_order_line.py",
-      "line": 17,
-      "verdict": "undecidable",
-      "class": "storedness-unknown",
-      "why": "the compute's field is declared in another module, so storedness cannot be read here",
-      "evidence": "_compute_display_name() reads 'order_id' but @api.depends does not declare it -- the stored value goes stale when 'order_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_move_line_sale_info/models/sale_order_line.py",
-      "line": 17,
-      "verdict": "undecidable",
-      "class": "storedness-unknown",
-      "why": "the compute's field is declared in another module, so storedness cannot be read here",
-      "evidence": "_compute_display_name() reads 'order_id.name' but @api.depends does not declare it -- the stored value goes stale when 'order_id.name' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_move_line_sale_info/models/sale_order_line.py",
-      "line": 17,
-      "verdict": "undecidable",
-      "class": "storedness-unknown",
-      "why": "the compute's field is declared in another module, so storedness cannot be read here",
-      "evidence": "_compute_display_name() reads 'product_id' but @api.depends does not declare it -- the stored value goes stale when 'product_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_move_line_sale_info/models/sale_order_line.py",
-      "line": 17,
-      "verdict": "undecidable",
-      "class": "storedness-unknown",
-      "why": "the compute's field is declared in another module, so storedness cannot be read here",
-      "evidence": "_compute_display_name() reads 'product_id.name' but @api.depends does not declare it -- the stored value goes stale when 'product_id.name' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_move_line_sale_info/models/sale_order_line.py",
-      "line": 18,
-      "verdict": "undecidable",
-      "class": "storedness-unknown",
-      "why": "the compute's field is declared in another module, so storedness cannot be read here",
-      "evidence": "_compute_display_name() reads 'order_id.state' but @api.depends does not declare it -- the stored value goes stale when 'order_id.state' changes"
-    },
-    {
-      "rule": "odoo.ondelete-is-a-decision",
-      "path": "account-financial-tools/account_move_line_tax_editable/models/account_move_line.py",
-      "line": 14,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "tax_line_id declares no ondelete, so the ORM defaults it to 'set null' -- and tax_line_id.refund_repartition_line_ids on line 27 reads through it, which yields False rather than raising once the parent is deleted"
-    },
-    {
-      "rule": "odoo.ondelete-is-a-decision",
-      "path": "account-financial-tools/account_move_template/models/account_move_template.py",
-      "line": 132,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "partner_id declares no ondelete, so the ORM defaults it to 'set null' -- and partner_id.category_id on line 206 reads through it, which yields False rather than raising once the parent is deleted"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_move_template/models/account_move_template.py",
-      "line": 206,
-      "verdict": "undecidable",
-      "class": "storedness-unknown",
-      "why": "the compute's field is declared in another module, so storedness cannot be read here",
-      "evidence": "_compute_analytic_distribution() reads 'partner_id.category_id' but @api.depends does not declare it -- the stored value goes stale when 'partner_id.category_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_move_template/models/account_move_template.py",
-      "line": 209,
-      "verdict": "undecidable",
-      "class": "storedness-unknown",
-      "why": "the compute's field is declared in another module, so storedness cannot be read here",
-      "evidence": "_compute_analytic_distribution() reads 'account_id.code' but @api.depends does not declare it -- the stored value goes stale when 'account_id.code' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_move_template/models/account_move_template.py",
-      "line": 210,
-      "verdict": "undecidable",
-      "class": "storedness-unknown",
-      "why": "the compute's field is declared in another module, so storedness cannot be read here",
-      "evidence": "_compute_analytic_distribution() reads 'template_id' but @api.depends does not declare it -- the stored value goes stale when 'template_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_move_template/models/account_move_template.py",
-      "line": 210,
-      "verdict": "undecidable",
-      "class": "storedness-unknown",
-      "why": "the compute's field is declared in another module, so storedness cannot be read here",
-      "evidence": "_compute_analytic_distribution() reads 'template_id.company_id' but @api.depends does not declare it -- the stored value goes stale when 'template_id.company_id' changes"
-    },
-    {
-      "rule": "odoo.check-company-on-relations",
-      "path": "account-financial-tools/account_payroll_sheet_import/models/payroll_import_mapping.py",
-      "line": 12,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "relation to account.journal with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.journal, and this codebase runs multi-company"
-    },
-    {
-      "rule": "odoo.check-company-on-relations",
-      "path": "account-financial-tools/account_payroll_sheet_import/models/payroll_import_mapping.py",
-      "line": 36,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_sequence_option/models/account_move.py",
-      "line": 53,
-      "verdict": "undecidable",
-      "class": "storedness-unknown",
-      "why": "the compute's field is declared in another module, so storedness cannot be read here",
-      "evidence": "_compute_name() reads 'create_date' but @api.depends does not declare it -- the stored value goes stale when 'create_date' changes"
-    },
-    {
-      "rule": "odoo.constrains-must-list-every-field-read",
-      "path": "account-financial-tools/account_spread_cost_revenue/models/account_move_line.py",
-      "line": 71,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_check_spread_account_balance_sheet() reads 'move_id' but @api.constrains declares only account_id, spread_id -- writing 'move_id' alone skips the check entirely"
-    },
-    {
-      "rule": "odoo.ondelete-is-a-decision",
-      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
-      "line": 22,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "template_id declares no ondelete, so the ORM defaults it to 'set null' -- and template_id.spread_type on line 310 reads through it, which yields False rather than raising once the parent is deleted, and this tree does delete account.spread.template"
-    },
-    {
-      "rule": "odoo.check-company-on-relations",
-      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
-      "line": 55,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
-    },
-    {
-      "rule": "odoo.check-company-on-relations",
-      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
-      "line": 62,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
-    },
-    {
-      "rule": "odoo.ondelete-is-a-decision",
-      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
-      "line": 113,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "invoice_line_id declares no ondelete, so the ORM defaults it to 'set null' -- and invoice_line_id.name on line 537 reads through it, which yields False rather than raising once the parent is deleted"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
-      "line": 218,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_all_posted() reads 'currency_id' but @api.depends does not declare it -- the stored value goes stale when 'currency_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
-      "line": 218,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_all_posted() reads 'currency_id.rounding' but @api.depends does not declare it -- the stored value goes stale when 'currency_id.rounding' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
-      "line": 268,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_journal_id() reads 'company_id.default_spread_expense_journal_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id.default_spread_expense_journal_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
-      "line": 270,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_journal_id() reads 'company_id.default_spread_revenue_journal_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id.default_spread_revenue_journal_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
-      "line": 280,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_debit_account_id() reads 'company_id.default_spread_revenue_account_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id.default_spread_revenue_account_id' changes"
-    },
-    {
-      "rule": "odoo.stored-compute-needs-complete-depends",
-      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
-      "line": 288,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "_compute_credit_account_id() reads 'company_id.default_spread_expense_account_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id.default_spread_expense_account_id' changes"
-    },
-    {
-      "rule": "odoo.check-company-on-relations",
-      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread_template.py",
-      "line": 20,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "relation to account.journal with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.journal, and this codebase runs multi-company"
-    },
-    {
-      "rule": "odoo.check-company-on-relations",
-      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread_template.py",
-      "line": 33,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
-    },
-    {
-      "rule": "odoo.check-company-on-relations",
-      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread_template.py",
-      "line": 41,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
-    },
-    {
-      "rule": "odoo.check-company-on-relations",
-      "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread_template.py",
-      "line": 176,
-      "verdict": "true",
-      "class": null,
-      "why": null,
-      "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "path": "account-financial-tools/purchase_unreconciled/wizards/purchase_unreconciled_exceeded.py",
-      "line": 14,
-      "verdict": "false",
-      "class": "registry-model",
-      "why": "sudo() on ir.model, which has no company_id and so no tenant boundary",
-      "evidence": "(m.model, m.name) for m in self.env[\"ir.model\"].sudo().search([])"
-    }
-  ]
+ "generated_utc": "2026-09-16T07:04:18+00:00",
+ "stack": "odoo",
+ "roots": [
+  "server-tools",
+  "account-financial-tools"
+ ],
+ "files": 606,
+ "lines": 33960,
+ "checkouts": {
+  "server-tools": "60cd54e5e",
+  "account-financial-tools": "e4c1b86aa"
+ },
+ "totals": {
+  "false": 10,
+  "true": 79,
+  "undecidable": 13
+ },
+ "classes": {
+  "storedness-unknown": 13,
+  "registry-model": 5,
+  "wrong-construct": 2,
+  "advice-cannot-be-taken": 1,
+  "no-record-rule-on-this-model": 1,
+  "scoped-by-hand": 1
+ },
+ "hits": [
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "server-tools/attachment_delete_restrict/models/ir_attachment.py",
+   "line": 71,
+   "verdict": "false",
+   "class": "registry-model",
+   "why": "sudo() on ir.model, which has no company_id and so no tenant boundary",
+   "evidence": "models = self.env[\"ir.model\"].sudo().search([(\"model\", \"in\", res_models)])"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "server-tools/attachment_synchronize/models/attachment_queue.py",
+   "line": 14,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "task_id declares no ondelete, so the ORM defaults it to 'set null' -- and task_id.filepath on line 37 reads through it, which yields False rather than raising once the parent is deleted, and this tree does delete attachment.synchronize.task"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "server-tools/attachment_synchronize/models/attachment_synchronize_task.py",
+   "line": 64,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "backend_id declares no ondelete, so the ORM defaults it to 'set null' -- and backend_id.fs on line 166 reads through it, which yields False rather than raising once the parent is deleted"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "server-tools/auditlog/models/http_session.py",
+   "line": 29,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_display_name() reads 'user_id.name' but @api.depends does not declare it -- the stored value goes stale when 'user_id.name' changes"
+  },
+  {
+   "rule": "odoo.constrains-must-list-every-field-read",
+   "path": "server-tools/autovacuum_message_attachment/models/vacuum_rule.py",
+   "line": 100,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_check_inheriting_model() reads 'ttype' but @api.constrains declares only inheriting_model -- writing 'ttype' alone skips the check entirely"
+  },
+  {
+   "rule": "odoo.constrains-must-list-every-field-read",
+   "path": "server-tools/base_exception/models/exception_rule.py",
+   "line": 59,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "check_exception_type_consistency() reads 'method' but @api.constrains declares only code, domain, exception_type, model -- writing 'method' alone skips the check entirely"
+  },
+  {
+   "rule": "odoo.depends-must-not-name-unread-fields",
+   "path": "server-tools/base_multi_image/models/image.py",
+   "line": 103,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_show_technical() declares 'owner_id', 'owner_model' in @api.depends and never reads them -- the value recomputes on writes that cannot change it, and the decorator stops describing the method"
+  },
+  {
+   "rule": "odoo.sql-needs-query-parameters",
+   "path": "server-tools/database_autovacuum_tuning/models/database_autovacuum_tuning.py",
+   "line": 24,
+   "verdict": "false",
+   "class": "advice-cannot-be-taken",
+   "why": "a table or column name cannot be a query parameter; both sites already parameterise the values",
+   "evidence": "the query handed to cr.execute() is built by an f-string -- pass the values as the second argument so the driver quotes them"
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "server-tools/database_size/models/ir_model_size.py",
+   "line": 87,
+   "verdict": "false",
+   "class": "registry-model",
+   "why": "sudo() on ir.model, which has no company_id and so no tenant boundary",
+   "evidence": "model.model: model.name for model in self.env[\"ir.model\"].sudo().search([])"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "server-tools/excel_import_export/models/xlsx_template.py",
+   "line": 108,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "result_model_id declares no ondelete, so the ORM defaults it to 'set null' -- and result_model_id.model on line 199 reads through it, which yields False rather than raising once the parent is deleted, and this tree does delete ir.model"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "server-tools/fetchmail_attach_from_folder/models/fetchmail_server_folder.py",
+   "line": 25,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "server_id declares no ondelete, so the ORM defaults it to 'set null' -- and server_id.connect on line 139 reads through it, which yields False rather than raising once the parent is deleted"
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "server-tools/tracking_manager/models/ir_model.py",
+   "line": 34,
+   "verdict": "false",
+   "class": "registry-model",
+   "why": "sudo() on ir.model, which has no company_id and so no tenant boundary",
+   "evidence": "models = self.sudo().search([(\"active_custom_tracking\", \"=\", True)])"
+  },
+  {
+   "rule": "odoo.depends-must-not-name-unread-fields",
+   "path": "server-tools/tracking_manager/models/ir_model.py",
+   "line": 101,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_automatic_custom_tracking() declares 'active_custom_tracking' in @api.depends and never reads it -- the value recomputes on writes that cannot change it, and the decorator stops describing the method"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "server-tools/tracking_manager/models/ir_model.py",
+   "line": 135,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_automatic_custom_tracking_domain() reads 'model' but @api.depends does not declare it -- the stored value goes stale when 'model' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "server-tools/tracking_manager/models/ir_model_fields.py",
+   "line": 30,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_custom_tracking() reads 'model_id' but @api.depends does not declare it -- the stored value goes stale when 'model_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "server-tools/tracking_manager/models/ir_model_fields.py",
+   "line": 30,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_custom_tracking() reads 'model_id.automatic_custom_tracking' but @api.depends does not declare it -- the stored value goes stale when 'model_id.automatic_custom_tracking' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "server-tools/tracking_manager/models/ir_model_fields.py",
+   "line": 31,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_custom_tracking() reads 'model_id.automatic_custom_tracking_domain' but @api.depends does not declare it -- the stored value goes stale when 'model_id.automatic_custom_tracking_domain' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "server-tools/tracking_manager/models/ir_model_fields.py",
+   "line": 52,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_trackable() reads 'name' but @api.depends does not declare it -- the stored value goes stale when 'name' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_force_account/models/account_asset.py",
+   "line": 60,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_account_asset_id() reads 'state' but @api.depends does not declare it -- the stored value goes stale when 'state' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_force_account/models/account_asset.py",
+   "line": 64,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_account_asset_id() reads 'account_move_line_ids.account_id' but @api.depends does not declare it -- the stored value goes stale when 'account_move_line_ids.account_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_force_account/models/account_asset.py",
+   "line": 72,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_account_asset_id() reads 'profile_id.account_asset_id' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.account_asset_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_management/models/account_asset.py",
+   "line": 311,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_group_ids() reads 'profile_id.group_ids' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.group_ids' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_management/models/account_asset.py",
+   "line": 316,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_method() reads 'profile_id.method' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.method' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_management/models/account_asset.py",
+   "line": 324,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_method_number() reads 'profile_id.method_number' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.method_number' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_management/models/account_asset.py",
+   "line": 329,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_method_period() reads 'profile_id.method_period' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.method_period' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_management/models/account_asset.py",
+   "line": 340,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_method_progress_factor() reads 'profile_id.method_progress_factor' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.method_progress_factor' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_management/models/account_asset.py",
+   "line": 345,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_method_time() reads 'profile_id.method_time' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.method_time' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_management/models/account_asset.py",
+   "line": 350,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_days_calc() reads 'profile_id.days_calc' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.days_calc' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_management/models/account_asset.py",
+   "line": 355,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_use_leap_years() reads 'profile_id.use_leap_years' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.use_leap_years' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_management/models/account_asset.py",
+   "line": 363,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_prorrata() reads 'profile_id.prorata' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.prorata' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_management/models/account_asset.py",
+   "line": 368,
+   "verdict": "undecidable",
+   "class": "storedness-unknown",
+   "why": "the compute's field is declared in another module, so storedness cannot be read here",
+   "evidence": "_compute_account_analytic_id() reads 'profile_id.account_analytic_id' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.account_analytic_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_management/models/account_asset.py",
+   "line": 373,
+   "verdict": "undecidable",
+   "class": "storedness-unknown",
+   "why": "the compute's field is declared in another module, so storedness cannot be read here",
+   "evidence": "_compute_analytic_distribution() reads 'profile_id.analytic_distribution' but @api.depends does not declare it -- the stored value goes stale when 'profile_id.analytic_distribution' changes"
+  },
+  {
+   "rule": "odoo.constrains-must-list-every-field-read",
+   "path": "account-financial-tools/account_asset_management/models/account_asset.py",
+   "line": 398,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_check_profile_change() reads 'depreciation_line_ids' but @api.constrains declares only profile_id -- writing 'depreciation_line_ids' alone skips the check entirely"
+  },
+  {
+   "rule": "odoo.recursion-check-on-hierarchy",
+   "path": "account-financial-tools/account_asset_management/models/account_asset_group.py",
+   "line": 27,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "parent_id = fields.Many2one("
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "account-financial-tools/account_asset_management/models/account_move.py",
+   "line": 174,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "asset_profile_id declares no ondelete, so the ORM defaults it to 'set null' -- and asset_profile_id.account_asset_id on line 200 reads through it, which yields False rather than raising once the parent is deleted, and this tree does delete account.asset.profile"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_management/models/account_move.py",
+   "line": 192,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_asset_profile() reads 'account_id.asset_profile_id' but @api.depends does not declare it -- the stored value goes stale when 'account_id.asset_profile_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_asset_management/models/account_move.py",
+   "line": 195,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_asset_profile() reads 'asset_id.profile_id' but @api.depends does not declare it -- the stored value goes stale when 'asset_id.profile_id' changes"
+  },
+  {
+   "rule": "odoo.constrains-iterate-recordset",
+   "path": "account-financial-tools/account_asset_management/wizard/account_asset_remove.py",
+   "line": 80,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "@api.constrains(\"sale_value\", \"company_id\")"
+  },
+  {
+   "rule": "odoo.constrains-must-list-every-field-read",
+   "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py",
+   "line": 130,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_check_deposit() reads 'company_id' but @api.constrains declares only cash_journal_id, currency_id -- writing 'company_id' alone skips the check entirely"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py",
+   "line": 203,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_is_reconcile() reads 'cash_journal_id' but @api.depends does not declare it -- the stored value goes stale when 'cash_journal_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py",
+   "line": 203,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_is_reconcile() reads 'cash_journal_id.default_account_id' but @api.depends does not declare it -- the stored value goes stale when 'cash_journal_id.default_account_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py",
+   "line": 203,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_is_reconcile() reads 'move_id.line_ids.account_id' but @api.depends does not declare it -- the stored value goes stale when 'move_id.line_ids.account_id' changes"
+  },
+  {
+   "rule": "odoo.float-comparison-needs-float-utils",
+   "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py",
+   "line": 271,
+   "verdict": "false",
+   "class": "wrong-construct",
+   "why": "parent_id pointing at another model / == on an Integer / a commit on a separate cursor",
+   "evidence": "self.line_ids.filtered(lambda x: x.qty == 0).unlink()"
+  },
+  {
+   "rule": "odoo.recursion-check-on-hierarchy",
+   "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py",
+   "line": 381,
+   "verdict": "false",
+   "class": "wrong-construct",
+   "why": "parent_id pointing at another model / == on an Integer / a commit on a separate cursor",
+   "evidence": "parent_id = fields.Many2one(\"account.cash.deposit\", ondelete=\"cascade\")"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_cash_deposit/models/account_cash_deposit.py",
+   "line": 420,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_subtotal() reads 'cash_unit_id.total_value' but @api.depends does not declare it -- the stored value goes stale when 'cash_unit_id.total_value' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_cash_deposit/models/cash_unit.py",
+   "line": 114,
+   "verdict": "undecidable",
+   "class": "storedness-unknown",
+   "why": "the compute's field is declared in another module, so storedness cannot be read here",
+   "evidence": "_compute_display_name() reads 'total_value' but @api.depends does not declare it -- the stored value goes stale when 'total_value' changes"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "account-financial-tools/account_check_deposit/models/account_check_deposit.py",
+   "line": 41,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_check_deposit/models/account_check_deposit.py",
+   "line": 132,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_check_deposit() reads 'company_id.currency_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id.currency_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_check_deposit/models/account_check_deposit.py",
+   "line": 145,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_currency_id() reads 'company_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_check_deposit/models/account_check_deposit.py",
+   "line": 146,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_currency_id() reads 'journal_id.currency_id' but @api.depends does not declare it -- the stored value goes stale when 'journal_id.currency_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_check_deposit/models/account_check_deposit.py",
+   "line": 151,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_in_hand_check_account_id() reads 'journal_id.inbound_payment_method_line_ids' but @api.depends does not declare it -- the stored value goes stale when 'journal_id.inbound_payment_method_line_ids' changes"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "account-financial-tools/account_dashboard_banner_mis_builder/models/account_dashboard_banner_cell.py",
+   "line": 17,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "mis_report_instance_id declares no ondelete, so the ORM defaults it to 'set null' -- and mis_report_instance_id.currency_id on line 105 reads through it, which yields False rather than raising once the parent is deleted"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "account-financial-tools/account_dashboard_banner_mis_builder/models/account_dashboard_banner_cell.py",
+   "line": 35,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "mis_report_instance_period_id declares no ondelete, so the ORM defaults it to 'set null' -- and mis_report_instance_period_id.date_from on line 103 reads through it, which yields False rather than raising once the parent is deleted"
+  },
+  {
+   "rule": "odoo.constrains-must-list-every-field-read",
+   "path": "account-financial-tools/account_dashboard_banner_mis_builder/models/account_dashboard_banner_cell.py",
+   "line": 47,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_check_mis_builder() reads 'cell_type' but @api.constrains declares only mis_report_instance_id, mis_report_kpi_id -- writing 'cell_type' alone skips the check entirely"
+  },
+  {
+   "rule": "odoo.constrains-must-list-every-field-read",
+   "path": "account-financial-tools/account_dashboard_banner_mis_builder/models/account_dashboard_banner_cell.py",
+   "line": 74,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_check_mis_builder() reads 'mis_report_instance_period_id' but @api.constrains declares only mis_report_instance_id, mis_report_kpi_id -- writing 'mis_report_instance_period_id' alone skips the check entirely"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_journal_general_sequence/models/account_journal.py",
+   "line": 42,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_entry_number_sequence() reads 'company_id.name' but @api.depends does not declare it -- the stored value goes stale when 'company_id.name' changes"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "account-financial-tools/account_loan/models/account_loan.py",
+   "line": 144,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "relation to account.journal with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.journal, and this codebase runs multi-company"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "account-financial-tools/account_loan/models/account_loan.py",
+   "line": 149,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "account-financial-tools/account_loan/models/account_loan.py",
+   "line": 156,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "account-financial-tools/account_loan/models/account_loan.py",
+   "line": 162,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "account-financial-tools/account_loan/models/account_loan.py",
+   "line": 170,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
+  },
+  {
+   "rule": "odoo.depends-must-not-name-unread-fields",
+   "path": "account-financial-tools/account_loan/models/account_loan.py",
+   "line": 246,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_total_amounts() declares 'currency_id' in @api.depends and never reads it -- the value recomputes on writes that cannot change it, and the decorator stops describing the method"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_loan/models/account_loan_line.py",
+   "line": 132,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_rate() reads 'pending_principal_amount' but @api.depends does not declare it -- the stored value goes stale when 'pending_principal_amount' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_loan/models/account_loan_line.py",
+   "line": 139,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_interests_amount() reads 'pending_principal_amount' but @api.depends does not declare it -- the stored value goes stale when 'pending_principal_amount' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_loan/models/account_loan_line.py",
+   "line": 174,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_principal_amount() reads 'interests_amount' but @api.depends does not declare it -- the stored value goes stale when 'interests_amount' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_loan/models/account_loan_line.py",
+   "line": 174,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_principal_amount() reads 'payment_amount' but @api.depends does not declare it -- the stored value goes stale when 'payment_amount' changes"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "account-financial-tools/account_move_line_purchase_info/models/account_move.py",
+   "line": 59,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "oca_purchase_line_id declares no ondelete, so the ORM defaults it to 'set null' -- and oca_purchase_line_id.order_id on line 84 reads through it, which yields False rather than raising once the parent is deleted"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_move_line_purchase_info/models/account_move.py",
+   "line": 84,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_purchase_id() reads 'oca_purchase_line_id.order_id' but @api.depends does not declare it -- the stored value goes stale when 'oca_purchase_line_id.order_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_move_line_purchase_info/models/account_move.py",
+   "line": 84,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_purchase_id() reads 'purchase_line_id.order_id' but @api.depends does not declare it -- the stored value goes stale when 'purchase_line_id.order_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_move_line_sale_info/models/sale_order_line.py",
+   "line": 17,
+   "verdict": "undecidable",
+   "class": "storedness-unknown",
+   "why": "the compute's field is declared in another module, so storedness cannot be read here",
+   "evidence": "_compute_display_name() reads 'order_id' but @api.depends does not declare it -- the stored value goes stale when 'order_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_move_line_sale_info/models/sale_order_line.py",
+   "line": 17,
+   "verdict": "undecidable",
+   "class": "storedness-unknown",
+   "why": "the compute's field is declared in another module, so storedness cannot be read here",
+   "evidence": "_compute_display_name() reads 'order_id.name' but @api.depends does not declare it -- the stored value goes stale when 'order_id.name' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_move_line_sale_info/models/sale_order_line.py",
+   "line": 17,
+   "verdict": "undecidable",
+   "class": "storedness-unknown",
+   "why": "the compute's field is declared in another module, so storedness cannot be read here",
+   "evidence": "_compute_display_name() reads 'product_id' but @api.depends does not declare it -- the stored value goes stale when 'product_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_move_line_sale_info/models/sale_order_line.py",
+   "line": 17,
+   "verdict": "undecidable",
+   "class": "storedness-unknown",
+   "why": "the compute's field is declared in another module, so storedness cannot be read here",
+   "evidence": "_compute_display_name() reads 'product_id.name' but @api.depends does not declare it -- the stored value goes stale when 'product_id.name' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_move_line_sale_info/models/sale_order_line.py",
+   "line": 18,
+   "verdict": "undecidable",
+   "class": "storedness-unknown",
+   "why": "the compute's field is declared in another module, so storedness cannot be read here",
+   "evidence": "_compute_display_name() reads 'order_id.state' but @api.depends does not declare it -- the stored value goes stale when 'order_id.state' changes"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "account-financial-tools/account_move_line_tax_editable/models/account_move_line.py",
+   "line": 14,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "tax_line_id declares no ondelete, so the ORM defaults it to 'set null' -- and tax_line_id.refund_repartition_line_ids on line 27 reads through it, which yields False rather than raising once the parent is deleted"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "account-financial-tools/account_move_template/models/account_move_template.py",
+   "line": 132,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "partner_id declares no ondelete, so the ORM defaults it to 'set null' -- and partner_id.category_id on line 206 reads through it, which yields False rather than raising once the parent is deleted"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_move_template/models/account_move_template.py",
+   "line": 206,
+   "verdict": "undecidable",
+   "class": "storedness-unknown",
+   "why": "the compute's field is declared in another module, so storedness cannot be read here",
+   "evidence": "_compute_analytic_distribution() reads 'partner_id.category_id' but @api.depends does not declare it -- the stored value goes stale when 'partner_id.category_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_move_template/models/account_move_template.py",
+   "line": 209,
+   "verdict": "undecidable",
+   "class": "storedness-unknown",
+   "why": "the compute's field is declared in another module, so storedness cannot be read here",
+   "evidence": "_compute_analytic_distribution() reads 'account_id.code' but @api.depends does not declare it -- the stored value goes stale when 'account_id.code' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_move_template/models/account_move_template.py",
+   "line": 210,
+   "verdict": "undecidable",
+   "class": "storedness-unknown",
+   "why": "the compute's field is declared in another module, so storedness cannot be read here",
+   "evidence": "_compute_analytic_distribution() reads 'template_id' but @api.depends does not declare it -- the stored value goes stale when 'template_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_move_template/models/account_move_template.py",
+   "line": 210,
+   "verdict": "undecidable",
+   "class": "storedness-unknown",
+   "why": "the compute's field is declared in another module, so storedness cannot be read here",
+   "evidence": "_compute_analytic_distribution() reads 'template_id.company_id' but @api.depends does not declare it -- the stored value goes stale when 'template_id.company_id' changes"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "account-financial-tools/account_payroll_sheet_import/models/payroll_import_mapping.py",
+   "line": 12,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "relation to account.journal with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.journal, and this codebase runs multi-company"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "account-financial-tools/account_payroll_sheet_import/models/payroll_import_mapping.py",
+   "line": 36,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_sequence_option/models/account_move.py",
+   "line": 53,
+   "verdict": "undecidable",
+   "class": "storedness-unknown",
+   "why": "the compute's field is declared in another module, so storedness cannot be read here",
+   "evidence": "_compute_name() reads 'create_date' but @api.depends does not declare it -- the stored value goes stale when 'create_date' changes"
+  },
+  {
+   "rule": "odoo.constrains-must-list-every-field-read",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_move_line.py",
+   "line": 71,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_check_spread_account_balance_sheet() reads 'move_id' but @api.constrains declares only account_id, spread_id -- writing 'move_id' alone skips the check entirely"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
+   "line": 22,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "template_id declares no ondelete, so the ORM defaults it to 'set null' -- and template_id.spread_type on line 310 reads through it, which yields False rather than raising once the parent is deleted, and this tree does delete account.spread.template"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
+   "line": 55,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
+   "line": 62,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
+   "line": 113,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "invoice_line_id declares no ondelete, so the ORM defaults it to 'set null' -- and invoice_line_id.name on line 537 reads through it, which yields False rather than raising once the parent is deleted"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
+   "line": 218,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_all_posted() reads 'currency_id' but @api.depends does not declare it -- the stored value goes stale when 'currency_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
+   "line": 218,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_all_posted() reads 'currency_id.rounding' but @api.depends does not declare it -- the stored value goes stale when 'currency_id.rounding' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
+   "line": 268,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_journal_id() reads 'company_id.default_spread_expense_journal_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id.default_spread_expense_journal_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
+   "line": 270,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_journal_id() reads 'company_id.default_spread_revenue_journal_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id.default_spread_revenue_journal_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
+   "line": 280,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_debit_account_id() reads 'company_id.default_spread_revenue_account_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id.default_spread_revenue_account_id' changes"
+  },
+  {
+   "rule": "odoo.stored-compute-needs-complete-depends",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread.py",
+   "line": 288,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "_compute_credit_account_id() reads 'company_id.default_spread_expense_account_id' but @api.depends does not declare it -- the stored value goes stale when 'company_id.default_spread_expense_account_id' changes"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread_template.py",
+   "line": 20,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "relation to account.journal with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.journal, and this codebase runs multi-company"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread_template.py",
+   "line": 33,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread_template.py",
+   "line": 41,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "account-financial-tools/account_spread_cost_revenue/models/account_spread_template.py",
+   "line": 176,
+   "verdict": "true",
+   "class": null,
+   "why": null,
+   "evidence": "relation to account.account with no check_company, on a model that has its own company_id -- a record in one company can reference another company's account.account, and this codebase runs multi-company"
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "account-financial-tools/purchase_unreconciled/wizards/purchase_unreconciled_exceeded.py",
+   "line": 14,
+   "verdict": "false",
+   "class": "registry-model",
+   "why": "sudo() on ir.model, which has no company_id and so no tenant boundary",
+   "evidence": "(m.model, m.name) for m in self.env[\"ir.model\"].sudo().search([])"
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "server-tools/base_sequence_option/models/ir_sequence_option.py",
+   "line": 95,
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "ir.sequence.option is a configuration model with no tenant boundary; the call is self.sudo() so the checker cannot name the model and keeps the finding",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "account-financial-tools/account_asset_management/models/account_asset.py",
+   "line": 1190,
+   "verdict": "false",
+   "class": "scoped-by-hand",
+   "why": "reads every company's recompute triggers and then checks asset.company_id against them by hand, which is what the rule's own correct sample does",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "account-financial-tools/account_lock_date_update/wizards/account_update_lock_date.py",
+   "line": 60,
+   "verdict": "false",
+   "class": "registry-model",
+   "why": "search_read on ir.model.fields, which has no company_id and so no tenant boundary",
+   "evidence": null
+  }
+ ],
+ "note": "Re-measured after sudo-bypasses-record-rules became an AST pass and suppression learned to read a marker across the statement it sits in. Three findings are new: the AST pass also sees .sudo().search_count( and .sudo().search_read(, which the regex could not, and all three are false. One false positive left -- a sql-needs-query-parameters in base_multi_image/hooks.py that carries a marker on the line above it. All 79 true positives survived both changes."
 }

classification-openspp-rest-2026-09.json

@@ -0,0 +1,1640 @@
+{
+ "generated_utc": "2026-09-16T06:57:44+00:00",
+ "stack": "odoo",
+ "roots": [
+  "D:/OpenSPP2-19.0"
+ ],
+ "checkouts": {
+  "OpenSPP2-19.0": "cfa0dc8ee3432ab2dd095a4882a861cc9dfba039"
+ },
+ "scope": "every remaining live finding on OpenSPP after the two depends/constrains rules were classified separately: the other 163, read by hand against the file. Measured against fieldtest-openspp-2026-09.json, i.e. the corpus AS IT WAS when these were read -- sudo-bypasses-record-rules was still a regex for `.sudo().search(` at that point. This file is the evidence that changed it, so it is deliberately not re-run against the narrowed rule; the line numbers are the regex's, and the AST pass that replaced it anchors a chained call one line earlier.",
+ "files": 1351,
+ "lines": 226937,
+ "totals": {
+  "true": 51,
+  "false": 109,
+  "undecidable": 3
+ },
+ "by_rule": {
+  "odoo.sudo-bypasses-record-rules": {
+   "false": 97,
+   "undecidable": 3,
+   "true": 6
+  },
+  "odoo.ondelete-is-a-decision": {
+   "true": 14
+  },
+  "odoo.depends-must-not-name-unread-fields": {
+   "true": 10,
+   "false": 1
+  },
+  "odoo.check-company-on-relations": {
+   "true": 8,
+   "false": 1
+  },
+  "odoo.onchange-is-not-validation": {
+   "false": 3,
+   "true": 4
+  },
+  "odoo.float-comparison-needs-float-utils": {
+   "true": 2,
+   "false": 5
+  },
+  "odoo.recursion-check-on-hierarchy": {
+   "true": 6
+  },
+  "odoo.sql-needs-query-parameters": {
+   "false": 2
+  },
+  "odoo.commit-inside-a-loop-splits-the-transaction": {
+   "true": 1
+  }
+ },
+ "false_classes": {
+  "no-record-rule-on-this-model": 73,
+  "scoped-by-hand": 14,
+  "rule-is-unconditional": 10,
+  "integer-not-float": 5,
+  "onchange-does-not-validate": 3,
+  "identifier-not-value": 2,
+  "sql-view-model": 1,
+  "deliberate-recompute-trigger": 1
+ },
+ "hits": [
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "fastapi/models/fastapi_endpoint.py",
+   "line": 40,
+   "evidence": "user_id declares no ondelete, so the ORM defaults it to 'set null' -- and user_id.company_id on line 106 reads through it, which yields False rather t",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "spp_alerts/models/alert_rule.py",
+   "line": 116,
+   "evidence": "monitored_field_id declares no ondelete, so the ORM defaults it to 'set null' -- and monitored_field_id.name on line 327 reads through it, which yield",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "spp_alerts/models/alert_rule.py",
+   "line": 123,
+   "evidence": "date_field_id declares no ondelete, so the ORM defaults it to 'set null' -- and date_field_id.name on line 360 reads through it, which yields False ra",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "spp_approval/models/approval_definition.py",
+   "line": 58,
+   "evidence": "approval_group_id declares no ondelete, so the ORM defaults it to 'set null' -- and approval_group_id.user_ids on line 158 reads through it, which yie",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.recursion-check-on-hierarchy",
+   "path": "spp_area/models/area_core.py",
+   "line": 26,
+   "evidence": "parent_id = fields.Many2one(_name, \"Parent\")",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.recursion-check-on-hierarchy",
+   "path": "spp_area/models/area_core.py",
+   "line": 230,
+   "evidence": "parent_id = fields.Many2one(_type_model, \"Parent\")",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.recursion-check-on-hierarchy",
+   "path": "spp_audit/models/spp_audit_rule.py",
+   "line": 142,
+   "evidence": "parent_id = fields.Many2one(",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.depends-must-not-name-unread-fields",
+   "path": "spp_base_common/models/phone_number.py",
+   "line": 84,
+   "evidence": "_compute_phone_sanitized() declares 'country_id' in @api.depends and never reads it -- the value recomputes on writes that cannot change it, and the d",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.depends-must-not-name-unread-fields",
+   "path": "spp_change_request_v2/wizards/conflict_wizard.py",
+   "line": 77,
+   "evidence": "_compute_can_override() declares 'change_request_id' in @api.depends and never reads it -- the value recomputes on writes that cannot change it, and t",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.depends-must-not-name-unread-fields",
+   "path": "spp_change_request_v2/wizards/document_upload_wizard.py",
+   "line": 172,
+   "evidence": "_compute_category_domain() declares 'change_request_id', 'change_request_id.request_type_id', 'change_request_id.request_type_id.required_document_typ",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.onchange-is-not-validation",
+   "path": "spp_claim_169/wizards/verify_qr_wizard.py",
+   "line": 66,
+   "evidence": "@api.onchange(\"auto_detect_key\")",
+   "verdict": "false",
+   "class": "onchange-does-not-validate",
+   "why": "the onchange clears a field; it enforces nothing"
+  },
+  {
+   "rule": "odoo.commit-inside-a-loop-splits-the-transaction",
+   "path": "spp_consent/models/consent.py",
+   "line": 926,
+   "evidence": "cr.commit() inside a loop -- an exception on a later iteration leaves the earlier ones written, and the caller cannot roll the batch back",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.recursion-check-on-hierarchy",
+   "path": "spp_consent/models/consent_purpose.py",
+   "line": 43,
+   "evidence": "parent_id = fields.Many2one(",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "spp_disability_registry/models/assessment.py",
+   "line": 406,
+   "evidence": "severity_level_id declares no ondelete, so the ORM defaults it to 'set null' -- and severity_level_id.display on line 431 reads through it, which yiel",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.recursion-check-on-hierarchy",
+   "path": "spp_dms/models/dms_directory.py",
+   "line": 20,
+   "evidence": "parent_id = fields.Many2one(",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "spp_drims/models/donation.py",
+   "line": 72,
+   "evidence": "donor_id declares no ondelete, so the ORM defaults it to 'set null' -- and donor_id.name on line 279 reads through it, which yields False rather than ",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "spp_drims/models/donation.py",
+   "line": 96,
+   "evidence": "relation to stock.warehouse with no check_company, on a model that has its own company_id -- a record in one company can reference another company's s",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "spp_drims/models/donation_line.py",
+   "line": 72,
+   "evidence": "disposition_id declares no ondelete, so the ORM defaults it to 'set null' -- and disposition_id.code on line 109 reads through it, which yields False ",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.depends-must-not-name-unread-fields",
+   "path": "spp_drims/models/personnel.py",
+   "line": 137,
+   "evidence": "_compute_days_deployed() declares 'status' in @api.depends and never reads it -- the value recomputes on writes that cannot change it, and the decorat",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "spp_drims/models/request.py",
+   "line": 155,
+   "evidence": "relation to stock.warehouse with no check_company, on a model that has its own company_id -- a record in one company can reference another company's s",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "spp_drims/models/returns.py",
+   "line": 48,
+   "evidence": "relation to stock.warehouse with no check_company, on a model that has its own company_id -- a record in one company can reference another company's s",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.onchange-is-not-validation",
+   "path": "spp_drims/wizard/create_return_wizard.py",
+   "line": 189,
+   "evidence": "@api.onchange(\"quantity_to_return\")",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.depends-must-not-name-unread-fields",
+   "path": "spp_drims/wizard/report_4w_wizard.py",
+   "line": 65,
+   "evidence": "_compute_cluster_ids_domain() declares 'incident_id' in @api.depends and never reads it -- the value recomputes on writes that cannot change it, and t",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.depends-must-not-name-unread-fields",
+   "path": "spp_gis_report/models/gis_report.py",
+   "line": 416,
+   "evidence": "_compute_next_refresh() declares 'refresh_interval' in @api.depends and never reads it -- the value recomputes on writes that cannot change it, and th",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.depends-must-not-name-unread-fields",
+   "path": "spp_grm/models/grm_ticket.py",
+   "line": 419,
+   "evidence": "_compute_user_id() declares 'category_id' in @api.depends and never reads it -- the value recomputes on writes that cannot change it, and the decorato",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.depends-must-not-name-unread-fields",
+   "path": "spp_grm/models/grm_ticket.py",
+   "line": 463,
+   "evidence": "_compute_sla_deadline() declares 'severity' in @api.depends and never reads it -- the value recomputes on writes that cannot change it, and the decora",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "spp_grm/models/grm_ticket_category.py",
+   "line": 29,
+   "evidence": "company_id declares no ondelete, so the ORM defaults it to 'set null' -- and company_id.name on line 118 reads through it, which yields False rather t",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.onchange-is-not-validation",
+   "path": "spp_grm_case_link/wizard/escalate_to_case_wizard.py",
+   "line": 104,
+   "evidence": "@api.onchange(\"team_id\")",
+   "verdict": "false",
+   "class": "onchange-does-not-validate",
+   "why": "the onchange sets a supervisor from the team; it enforces nothing"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "spp_grm_cel/models/grm_escalation_rule.py",
+   "line": 111,
+   "evidence": "notification_template_id declares no ondelete, so the ORM defaults it to 'set null' -- and notification_template_id.send_mail on line 508 reads throug",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.recursion-check-on-hierarchy",
+   "path": "spp_hazard/models/hazard_category.py",
+   "line": 28,
+   "evidence": "parent_id = fields.Many2one(",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "spp_key_management/models/asymmetric_key_support.py",
+   "line": 78,
+   "evidence": "provider_registry_id declares no ondelete, so the ORM defaults it to 'set null' -- and provider_registry_id.get_provider on line 392 reads through it,",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.float-comparison-needs-float-utils",
+   "path": "spp_metric_service/models/distribution_service.py",
+   "line": 144,
+   "evidence": "if total == 0:",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.float-comparison-needs-float-utils",
+   "path": "spp_metric_service/models/distribution_service.py",
+   "line": 161,
+   "evidence": "if not sorted_amounts or total == 0:",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.float-comparison-needs-float-utils",
+   "path": "spp_metric_service/models/fairness_service.py",
+   "line": 52,
+   "evidence": "if total_population == 0:",
+   "verdict": "false",
+   "class": "integer-not-float",
+   "why": "search_count returns an int, so == 0 is an exact comparison"
+  },
+  {
+   "rule": "odoo.float-comparison-needs-float-utils",
+   "path": "spp_metric_service/models/fairness_service.py",
+   "line": 240,
+   "evidence": "if group_total == 0:",
+   "verdict": "false",
+   "class": "integer-not-float",
+   "why": "a read_group _count is an int, so == 0 is an exact comparison"
+  },
+  {
+   "rule": "odoo.float-comparison-needs-float-utils",
+   "path": "spp_metric_service/models/fairness_service.py",
+   "line": 316,
+   "evidence": "if group_total == 0:",
+   "verdict": "false",
+   "class": "integer-not-float",
+   "why": "a read_group _count is an int, so == 0 is an exact comparison"
+  },
+  {
+   "rule": "odoo.float-comparison-needs-float-utils",
+   "path": "spp_metric_service/models/fairness_service.py",
+   "line": 381,
+   "evidence": "if group_total == 0:",
+   "verdict": "false",
+   "class": "integer-not-float",
+   "why": "a read_group _count is an int, so == 0 is an exact comparison"
+  },
+  {
+   "rule": "odoo.onchange-is-not-validation",
+   "path": "spp_programs/models/duplicate.py",
+   "line": 17,
+   "evidence": "@api.onchange(\"beneficiary_ids\")",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "spp_programs/models/entitlement.py",
+   "line": 92,
+   "evidence": "relation to account.journal with no check_company, on a model that has its own company_id -- a record in one company can reference another company's a",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "spp_programs/models/entitlement.py",
+   "line": 754,
+   "evidence": "product_id declares no ondelete, so the ORM defaults it to 'set null' -- and product_id.name on line 839 reads through it, which yields False rather t",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "spp_programs/models/entitlement.py",
+   "line": 761,
+   "evidence": "relation to stock.warehouse with no check_company, on a model that has its own company_id -- a record in one company can reference another company's s",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "spp_programs/models/entitlement.py",
+   "line": 771,
+   "evidence": "relation to account.journal with no check_company, on a model that has its own company_id -- a record in one company can reference another company's a",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "spp_programs/models/payment.py",
+   "line": 66,
+   "evidence": "relation to account.journal with no check_company, on a model that has its own company_id -- a record in one company can reference another company's a",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "spp_programs/models/programs.py",
+   "line": 52,
+   "evidence": "company_id declares no ondelete, so the ORM defaults it to 'set null' -- and company_id.currency_id on line 725 reads through it, which yields False r",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "spp_programs/models/programs.py",
+   "line": 134,
+   "evidence": "relation to account.journal with no check_company, on a model that has its own company_id -- a record in one company can reference another company's a",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.check-company-on-relations",
+   "path": "spp_programs/models/accounting/fund_report.py",
+   "line": 17,
+   "evidence": "relation to account.journal with no check_company, on a model that has its own company_id -- a record in one company can reference another company's a",
+   "verdict": "false",
+   "class": "sql-view-model",
+   "why": "a read-only SQL view model; check_company has nothing to enforce on it"
+  },
+  {
+   "rule": "odoo.sql-needs-query-parameters",
+   "path": "spp_programs/models/accounting/fund_report.py",
+   "line": 77,
+   "evidence": "the query handed to cr.execute() is built by an f-string -- pass the values as the second argument so the driver quotes them",
+   "verdict": "false",
+   "class": "identifier-not-value",
+   "why": "the f-string interpolates self._table, an identifier, and the values are bound"
+  },
+  {
+   "rule": "odoo.float-comparison-needs-float-utils",
+   "path": "spp_programs/models/managers/pagination_utils.py",
+   "line": 36,
+   "evidence": "if total == 0:",
+   "verdict": "false",
+   "class": "integer-not-float",
+   "why": "SELECT COUNT(*) returns an int, so == 0 is an exact comparison"
+  },
+  {
+   "rule": "odoo.sql-needs-query-parameters",
+   "path": "spp_programs/models/managers/pagination_utils.py",
+   "line": 51,
+   "evidence": "the query handed to cr.execute() is built by an f-string -- pass the values as the second argument so the driver quotes them",
+   "verdict": "false",
+   "class": "identifier-not-value",
+   "why": "the f-string interpolates a table name; the values go through params"
+  },
+  {
+   "rule": "odoo.onchange-is-not-validation",
+   "path": "spp_programs/models/managers/recurrence_mixin.py",
+   "line": 51,
+   "evidence": "@api.onchange(\"day\")",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "spp_programs/models/stock/stock.py",
+   "line": 9,
+   "evidence": "entitlement_id declares no ondelete, so the ORM defaults it to 'set null' -- and entitlement_id.cycle_id on line 19 reads through it, which yields Fal",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.onchange-is-not-validation",
+   "path": "spp_programs/wizard/create_program_wizard.py",
+   "line": 136,
+   "evidence": "@api.onchange(\"day\")",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.depends-must-not-name-unread-fields",
+   "path": "spp_registry/models/group.py",
+   "line": 34,
+   "evidence": "_compute_force_recompute_canary() declares 'group_membership_ids', 'group_membership_ids.individual' in @api.depends and never reads them -- the value",
+   "verdict": "false",
+   "class": "deliberate-recompute-trigger",
+   "why": "a canary field whose whole purpose is to declare fields it does not read"
+  },
+  {
+   "rule": "odoo.depends-must-not-name-unread-fields",
+   "path": "spp_service_points/models/registrant.py",
+   "line": 100,
+   "evidence": "_compute_phone_sanitized() declares 'country_id' in @api.depends and never reads it -- the value recomputes on writes that cannot change it, and the d",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.ondelete-is-a-decision",
+   "path": "spp_studio/models/studio_field.py",
+   "line": 113,
+   "evidence": "link_model_id declares no ondelete, so the ORM defaults it to 'set null' -- and link_model_id.model on line 368 reads through it, which yields False r",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.depends-must-not-name-unread-fields",
+   "path": "spp_studio/models/studio_field.py",
+   "line": 185,
+   "evidence": "_compute_target_model() declares 'target_type' in @api.depends and never reads it -- the value recomputes on writes that cannot change it, and the dec",
+   "verdict": "true",
+   "class": null,
+   "why": "the construct and the harm the rule names are both present"
+  },
+  {
+   "rule": "odoo.onchange-is-not-validation",
+   "path": "spp_studio/wizard/variable_remap_wizard.py",
+   "line": 110,
+   "evidence": "@api.onchange(\"variable_id\")",
+   "verdict": "false",
+   "class": "onchange-does-not-validate",
+   "why": "the onchange sets the target model; it enforces nothing"
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "fastapi/models/fastapi_endpoint_demo.py",
+   "line": 89,
+   "model": "res.users",
+   "verdict": "false",
+   "class": "scoped-by-hand",
+   "why": "a real rule exists, and the domain constrains the search to records the caller already identified",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_analytics/models/service_cache.py",
+   "line": 69,
+   "model": "spp.analytics.cache.entry",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_analytics/models/service_cache.py",
+   "line": 184,
+   "model": "spp.analytics.cache.entry",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_analytics/models/service_cache.py",
+   "line": 241,
+   "model": "spp.analytics.cache.entry",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_analytics/models/service_scope_resolver.py",
+   "line": 169,
+   "model": "res.partner",
+   "verdict": "false",
+   "class": "scoped-by-hand",
+   "why": "a real rule exists, and the domain constrains the search to records the caller already identified",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_analytics/models/service_scope_resolver.py",
+   "line": 312,
+   "model": "res.partner",
+   "verdict": "false",
+   "class": "scoped-by-hand",
+   "why": "a real rule exists, and the domain constrains the search to records the caller already identified",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/middleware/auth.py",
+   "line": 104,
+   "model": "spp.api.client",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/group_service.py",
+   "line": 40,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/group_service.py",
+   "line": 324,
+   "model": "spp.vocabulary.code",
+   "verdict": "false",
+   "class": "rule-is-unconditional",
+   "why": "the only ir.rule on this model is [(1,'=',1)], so sudo drops no filtering",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/group_service.py",
+   "line": 427,
+   "model": "spp.vocabulary.code",
+   "verdict": "false",
+   "class": "rule-is-unconditional",
+   "why": "the only ir.rule on this model is [(1,'=',1)], so sudo drops no filtering",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/group_service.py",
+   "line": 486,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/group_service.py",
+   "line": 500,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/group_service.py",
+   "line": 638,
+   "model": "spp.group.membership",
+   "verdict": "false",
+   "class": "scoped-by-hand",
+   "why": "a real rule exists, and the domain constrains the search to records the caller already identified",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/group_service.py",
+   "line": 686,
+   "model": "spp.vocabulary.code",
+   "verdict": "false",
+   "class": "rule-is-unconditional",
+   "why": "the only ir.rule on this model is [(1,'=',1)], so sudo drops no filtering",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/group_service.py",
+   "line": 807,
+   "model": "spp.vocabulary.code",
+   "verdict": "false",
+   "class": "rule-is-unconditional",
+   "why": "the only ir.rule on this model is [(1,'=',1)], so sudo drops no filtering",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/group_service.py",
+   "line": 912,
+   "model": "spp.vocabulary.code",
+   "verdict": "false",
+   "class": "rule-is-unconditional",
+   "why": "the only ir.rule on this model is [(1,'=',1)], so sudo drops no filtering",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/group_service.py",
+   "line": 1018,
+   "model": "spp.group.membership",
+   "verdict": "false",
+   "class": "scoped-by-hand",
+   "why": "a real rule exists, and the domain constrains the search to records the caller already identified",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/group_service.py",
+   "line": 1055,
+   "model": "spp.vocabulary.code",
+   "verdict": "false",
+   "class": "rule-is-unconditional",
+   "why": "the only ir.rule on this model is [(1,'=',1)], so sudo drops no filtering",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/group_service.py",
+   "line": 1199,
+   "model": "spp.group.membership",
+   "verdict": "false",
+   "class": "scoped-by-hand",
+   "why": "a real rule exists, and the domain constrains the search to records the caller already identified",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/individual_service.py",
+   "line": 42,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/individual_service.py",
+   "line": 85,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/individual_service.py",
+   "line": 357,
+   "model": "spp.vocabulary.code",
+   "verdict": "false",
+   "class": "rule-is-unconditional",
+   "why": "the only ir.rule on this model is [(1,'=',1)], so sudo drops no filtering",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/individual_service.py",
+   "line": 454,
+   "model": "spp.vocabulary.code",
+   "verdict": "false",
+   "class": "rule-is-unconditional",
+   "why": "the only ir.rule on this model is [(1,'=',1)], so sudo drops no filtering",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/individual_service.py",
+   "line": 745,
+   "model": "spp.group.membership",
+   "verdict": "false",
+   "class": "scoped-by-hand",
+   "why": "a real rule exists, and the domain constrains the search to records the caller already identified",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/search_service.py",
+   "line": 100,
+   "model": null,
+   "verdict": "undecidable",
+   "class": "model-not-resolvable",
+   "why": "the searched model is a variable, so the record-rule question cannot be answered from the call site",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/search_service.py",
+   "line": 139,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/search_service.py",
+   "line": 250,
+   "model": "spp.vocabulary.code",
+   "verdict": "false",
+   "class": "rule-is-unconditional",
+   "why": "the only ir.rule on this model is [(1,'=',1)], so sudo drops no filtering",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/search_service.py",
+   "line": 278,
+   "model": "spp.group.membership",
+   "verdict": "true",
+   "class": null,
+   "why": "an unscoped sweep of every membership on a model whose rules filter ended and disabled rows",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/search_service.py",
+   "line": 294,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2/services/search_service.py",
+   "line": 327,
+   "model": "spp.vocabulary.code",
+   "verdict": "false",
+   "class": "rule-is-unconditional",
+   "why": "the only ir.rule on this model is [(1,'=',1)], so sudo drops no filtering",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_cycles/services/cycle_service.py",
+   "line": 30,
+   "model": "spp.cycle",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_cycles/services/cycle_service.py",
+   "line": 98,
+   "model": "spp.cycle",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_entitlements/services/entitlement_service.py",
+   "line": 47,
+   "model": "spp.entitlement.inkind",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_entitlements/services/entitlement_service.py",
+   "line": 211,
+   "model": "spp.entitlement.inkind",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_entitlements/services/entitlement_service.py",
+   "line": 232,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_gis/routers/geofence.py",
+   "line": 75,
+   "model": "spp.hazard.incident",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_gis/routers/ogc_features.py",
+   "line": 339,
+   "model": "spp.gis.report",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_gis/services/export_service.py",
+   "line": 101,
+   "model": "spp.gis.report",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_gis/services/layers_service.py",
+   "line": 217,
+   "model": "spp.area",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_gis/services/layers_service.py",
+   "line": 224,
+   "model": "spp.area",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_gis/services/layers_service.py",
+   "line": 417,
+   "model": "spp.gis.report",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_gis/services/layers_service.py",
+   "line": 485,
+   "model": "spp.gis.report",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_gis/services/layers_service.py",
+   "line": 492,
+   "model": "spp.gis.report.data",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_gis/services/layers_service.py",
+   "line": 708,
+   "model": "spp.area",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_gis/services/ogc_service.py",
+   "line": 513,
+   "model": "spp.gis.report",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_gis/services/qml_template_service.py",
+   "line": 169,
+   "model": "spp.gis.report.data",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_products/services/product_category_service.py",
+   "line": 31,
+   "model": "product.category",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_products/services/product_category_service.py",
+   "line": 62,
+   "model": "product.category",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_products/services/product_service.py",
+   "line": 31,
+   "model": "product.template",
+   "verdict": "true",
+   "class": null,
+   "why": "product.template carries Odoo's company rule and the lookup constrains no company",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_products/services/product_service.py",
+   "line": 43,
+   "model": "product.template",
+   "verdict": "true",
+   "class": null,
+   "why": "product.template carries Odoo's company rule and the lookup constrains no company",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_products/services/product_service.py",
+   "line": 97,
+   "model": "product.template",
+   "verdict": "true",
+   "class": null,
+   "why": "product.template carries Odoo's company rule and the listing constrains no company",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_products/services/uom_service.py",
+   "line": 30,
+   "model": "uom.uom",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_products/services/uom_service.py",
+   "line": 63,
+   "model": "uom.uom",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_programs/services/program_membership_service.py",
+   "line": 51,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_programs/services/program_membership_service.py",
+   "line": 119,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_programs/services/program_membership_service.py",
+   "line": 135,
+   "model": "spp.program.membership",
+   "verdict": "false",
+   "class": "scoped-by-hand",
+   "why": "a real rule exists, and the domain constrains the search to records the caller already identified",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_programs/services/program_membership_service.py",
+   "line": 158,
+   "model": "spp.program.membership",
+   "verdict": "false",
+   "class": "scoped-by-hand",
+   "why": "a real rule exists, and the domain constrains the search to records the caller already identified",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_programs/services/program_membership_service.py",
+   "line": 385,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_programs/services/program_service.py",
+   "line": 48,
+   "model": "spp.program.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_simulation/routers/scenario.py",
+   "line": 527,
+   "model": "res.currency",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_simulation/routers/scenario.py",
+   "line": 538,
+   "model": "spp.program",
+   "verdict": "true",
+   "class": null,
+   "why": "a duplicate-name check across every company on a company-ruled model",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_simulation/services/analytics_api_service.py",
+   "line": 93,
+   "model": "res.partner",
+   "verdict": "false",
+   "class": "scoped-by-hand",
+   "why": "a real rule exists, and the domain constrains the search to records the caller already identified",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_api_v2_simulation/services/simulation_api_service.py",
+   "line": 32,
+   "model": "spp.simulation.scenario.template",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_approval/models/approval_review.py",
+   "line": 205,
+   "model": "spp.approval.definition",
+   "verdict": "false",
+   "class": "scoped-by-hand",
+   "why": "a real rule exists, and the domain constrains the search to records the caller already identified",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_approval/models/approval_review.py",
+   "line": 217,
+   "model": "spp.approval.definition",
+   "verdict": "true",
+   "class": null,
+   "why": "every manager-type definition, unscoped, on a company-ruled model",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_attachment_av_scan/models/ir_attachment.py",
+   "line": 337,
+   "model": "spp.encryption.provider",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_attendance/controllers/controllers.py",
+   "line": 108,
+   "model": null,
+   "verdict": "undecidable",
+   "class": "model-not-resolvable",
+   "why": "the searched model is a variable, so the record-rule question cannot be answered from the call site",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_attendance/controllers/controllers.py",
+   "line": 111,
+   "model": null,
+   "verdict": "undecidable",
+   "class": "model-not-resolvable",
+   "why": "the searched model is a variable, so the record-rule question cannot be answered from the call site",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_attendance/controllers/controllers.py",
+   "line": 215,
+   "model": "spp.attendance.subscriber",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_attendance/controllers/controllers.py",
+   "line": 367,
+   "model": "spp.attendance.list",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_attendance/controllers/controllers.py",
+   "line": 411,
+   "model": "spp.attendance.list",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_attendance/controllers/controllers.py",
+   "line": 436,
+   "model": "spp.attendance.subscriber",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_attendance/controllers/controllers.py",
+   "line": 593,
+   "model": "spp.attendance.type",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_attendance/controllers/controllers.py",
+   "line": 625,
+   "model": "spp.attendance.location",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_attendance/controllers/controllers.py",
+   "line": 706,
+   "model": "spp.attendance.subscriber",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_attendance/models/attendance_subscriber.py",
+   "line": 134,
+   "model": "spp.attendance.list",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_branding_kit/__init__.py",
+   "line": 41,
+   "model": "ir.ui.menu",
+   "verdict": "false",
+   "class": "scoped-by-hand",
+   "why": "a real rule exists, and the domain constrains the search to records the caller already identified",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_client_crvs/middleware/signature.py",
+   "line": 70,
+   "model": "spp.dci.crvs.sender",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_client_dr/middleware/signature.py",
+   "line": 70,
+   "model": "spp.dci.dr.sender",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_client_dr/routers/callback.py",
+   "line": 199,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_client_dr/routers/callback.py",
+   "line": 216,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_client_ibr/middleware/signature.py",
+   "line": 70,
+   "model": "spp.dci.ibr.sender",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_client_ibr/routers/callback.py",
+   "line": 166,
+   "model": "spp.dci.duplication.check",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_client_sr/routers/callback.py",
+   "line": 262,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_client_sr/routers/callback.py",
+   "line": 279,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_server/middleware/rate_limit.py",
+   "line": 205,
+   "model": "spp.dci.sender.registry",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_server/middleware/signature.py",
+   "line": 278,
+   "model": "spp.api.client",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_server/models/transaction.py",
+   "line": 571,
+   "model": "spp.dci.subscription",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_server/models/transaction.py",
+   "line": 684,
+   "model": "spp.dci.transaction",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_server/routers/async_router.py",
+   "line": 262,
+   "model": "spp.dci.sender.registry",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_server/routers/async_router.py",
+   "line": 426,
+   "model": "spp.dci.sender.registry",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_server/routers/async_router.py",
+   "line": 438,
+   "model": "spp.dci.subscription",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_server/routers/async_router.py",
+   "line": 573,
+   "model": "spp.dci.transaction",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_server/routers/bulk_upload.py",
+   "line": 304,
+   "model": "spp.dci.sender.registry",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_server/routers/callbacks.py",
+   "line": 277,
+   "model": "spp.dci.sender.registry",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_dci_server/routers/receipt.py",
+   "line": 140,
+   "model": "spp.dci.subscription",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_gis/models/base.py",
+   "line": 73,
+   "model": "ir.ui.view",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_key_management/models/key_provider_database.py",
+   "line": 322,
+   "model": "spp.encryption.key",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_key_management/models/key_provider_database.py",
+   "line": 348,
+   "model": "spp.encryption.key",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_programs/models/managers/compliance_manager.py",
+   "line": 306,
+   "model": "res.partner",
+   "verdict": "false",
+   "class": "scoped-by-hand",
+   "why": "a real rule exists, and the domain constrains the search to records the caller already identified",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_programs/models/managers/entitlement_manager_default_compliance.py",
+   "line": 34,
+   "model": "res.partner",
+   "verdict": "false",
+   "class": "scoped-by-hand",
+   "why": "a real rule exists, and the domain constrains the search to records the caller already identified",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_programs/models/managers/payment_manager.py",
+   "line": 167,
+   "model": "spp.payment.batch.tag",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_registry/models/group_membership.py",
+   "line": 266,
+   "model": "ir.cron.trigger",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_studio_api_v2/routers/studio.py",
+   "line": 480,
+   "model": "spp.registry.id",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_studio_change_requests/models/studio_change_request_type.py",
+   "line": 312,
+   "model": "ir.model.fields",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  },
+  {
+   "rule": "odoo.sudo-bypasses-record-rules",
+   "path": "spp_studio_events/models/studio_event_type.py",
+   "line": 424,
+   "model": "ir.model.fields",
+   "verdict": "false",
+   "class": "no-record-rule-on-this-model",
+   "why": "no ir.rule is declared for this model anywhere in the tree, so sudo bypasses nothing",
+   "evidence": null
+  }
+ ],
+ "what_this_changed": "sudo-bypasses-record-rules went 6 true / 97 false / 3 undecidable, 5.8%. 73 of the 97 were on models the tree gives no ir.rule at all and 10 on a model whose only rule is [(1,'=',1)], so sudo dropped nothing at 83 of 106 sites. The rule is now an AST pass that asks the tree whether a filtering rule exists, and answers UNKNOWN -- keeping the finding -- for any model the walk did not see declared. The 14 remaining false positives constrain the search by hand to records the caller already named, in a spelling the rule does not recognise because it names only company_id. That is a worklist entry, not a narrowing: deciding a domain is already scoped means evaluating it.",
+ "worklist": "float-comparison-needs-float-utils is the next one down at 2 true / 5 false. All five compare an INTEGER to zero -- search_count, a read_group _count, SELECT COUNT(*) -- which the regex cannot see because it matches on the variable's name. Fixing it means tracing the assignment, so it is named here and not yet done. onchange-is-not-validation is 4 true / 3 false, and all three false ones are an onchange that sets a field rather than enforcing anything, which the rule's existing narrowing was supposed to exclude and does not catch when the write is to a Many2one."
+}

corpus/build_corpus.py

@@ -989,8 +989,12 @@ ENRICH = {
         "source": ODOO_ORM,
     },
     "odoo.sudo-bypasses-record-rules": {
-        "violation_pattern": r"\.sudo\(\)\s*\.\s*search\(",
-        "satisfied_pattern": r"company_id",
+        # Was a regex for `.sudo().search(`, which asked only whether the
+        # construct was present. Measured on OpenSPP it made 106 findings and 6
+        # were the defect: the other 100 were on models the tree gives no
+        # filtering rule, where sudo drops nothing. The AST pass asks the tree
+        # the second half of the question.
+        "semantic_check": "sudo_search_drops_a_real_rule",
         # Record rules are a security concept, not an ORM one. The ORM reference
         # does not mention sudo at all.
         "source": ODOO_SECURITY,
@@ -1208,9 +1212,18 @@ ENRICH = {
 # the one-bit version of this axis and is now the gate that falls out of it.
 
 LIKELIHOOD = {
-    # 13 of 41 placements on a line somebody changed, the best-aimed rule in the
-    # corpus and the only one measured to be right about the bug more often than
-    # it is right about the file.
+    # 13 on-target of 44 placements, re-measured after this rule became an AST
+    # pass. Still the best-aimed rule in the corpus by a distance: the next one
+    # down lands on the line once. The total moved from 41 because the AST pass
+    # also sees .sudo().search_count( and .sudo().search_read(, which the regex
+    # it replaced could not.
+    #
+    # Like ondelete's, this grade is what the rule is worth WITHOUT its trigger.
+    # recall.py builds no tree_facts, so context.model_is_record_ruled reads
+    # UNKNOWN on every file it measures and the checker keeps every finding it
+    # can make. The trigger only ever suppresses, so the aimed subset is a
+    # subset of what was measured here -- the grade is a floor for the narrowed
+    # rule rather than a description of it.
     "odoo.sudo-bypasses-record-rules": "defect",
 
     # 1 of 42, and 7 in the right method describing something else. The trigger

corpus/corpus_meta.json

@@ -1,14 +1,14 @@
 {
-  "built_utc": "2026-09-16T00:03:33.130288+00:00",
+  "built_utc": "2026-09-16T07:06:37.091305+00:00",
   "rules": 43,
   "machine_checkable": 40,
-  "by_pattern": 31,
-  "by_semantic_check": 9,
+  "by_pattern": 30,
+  "by_semantic_check": 10,
   "checked_against": {
     "odoo": "18.0",
     "python": "3.12",
     "typescript": "5.x",
     "javascript": "ES2023"
   },
-  "corpus_sha256": "815ebc6467b1d939dcd18077685a6318fed2cd938d4a670628fd6950fdc1c6ff"
+  "corpus_sha256": "a7e3adddd78657b2c19cab0616f95a93de4784d5a422089c3eae4552b0750f35"
 }

corpus/rules/odoo.json

@@ -321,8 +321,7 @@
       "record-rules"
     ],
     "stack": "odoo",
-    "violation_pattern": "\\.sudo\\(\\)\\s*\\.\\s*search\\(",
-    "satisfied_pattern": "company_id",
+    "semantic_check": "sudo_search_drops_a_real_rule",
     "source": "https://www.odoo.com/documentation/18.0/developer/reference/backend/security.html",
     "likelihood": "defect",
     "advisory": false,

fieldtest-openspp-2026-09.json

@@ -15,6 +15,16 @@
     "multi_company": true
   },
   "hits": [
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "severity": "critical",
+      "line": 65,
+      "evidence": "sudo().search_count() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": false,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "endpoint_route_handler/models/endpoint_route_handler.py"
+    },
     {
       "rule": "odoo.ondelete-is-a-decision",
       "severity": "high",
@@ -39,7 +49,7 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 89,
-      "evidence": "partner = env[\"res.users\"].sudo().search([(\"login\", \"=\", api_key)], limit=1).partner_id",
+      "evidence": "sudo().search() on res.users runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": false,
       "advisory": false,
       "likelihood": "defect",
@@ -85,21 +95,11 @@
       "likelihood": "preference",
       "path": "spp_analytics/models/analytics_access.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 300,
-      "evidence": "child_areas = self.env[\"spp.area\"].sudo().search(domain)  # nosemgrep: odoo-sudo-without-context",
-      "suppressed": true,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_analytics/models/analytics_access.py"
-    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 88,
-      "evidence": "for stat in stat_model.sudo().search([(\"active\", \"=\", True)]):  # nosemgrep: odoo-sudo-without-conte",
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
@@ -109,7 +109,7 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 99,
-      "evidence": "for var in var_model.sudo().search(domain):  # nosemgrep: odoo-sudo-without-context",
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
@@ -119,7 +119,7 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 157,
-      "evidence": "stat = stat_model.sudo().search([(\"name\", \"=\", stat_name)], limit=1)  # nosemgrep: odoo-sudo-without",
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
@@ -129,7 +129,7 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 173,
-      "evidence": "variable = var_model.sudo().search([(\"name\", \"=\", stat_name)], limit=1)  # nosemgrep: odoo-sudo-with",
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
@@ -139,7 +139,7 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 245,
-      "evidence": "statistic_records = statistic_model.sudo().search(  # nosemgrep: odoo-sudo-without-context",
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
@@ -148,48 +148,8 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 69,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_analytics/models/service_cache.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 184,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_analytics/models/service_cache.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 210,
-      "evidence": "entries = self.env[\"spp.analytics.cache.entry\"].sudo().search([])  # nosemgrep: odoo-sudo-without-co",
-      "suppressed": true,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_analytics/models/service_cache.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 241,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_analytics/models/service_cache.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 158,
-      "evidence": "child_areas = self.env[\"spp.area\"].sudo().search(domain)  # nosemgrep: odoo-sudo-without-context",
+      "line": 168,
+      "evidence": "sudo().search() on res.partner runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
@@ -198,43 +158,13 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 169,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_analytics/models/service_scope_resolver.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 215,
-      "evidence": "areas = self.env[\"spp.area\"].sudo().search([(\"tag_ids\", \"in\", tag_ids)])  # nosemgrep: odoo-sudo-wit",
+      "line": 311,
+      "evidence": "sudo().search() on res.partner runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_analytics/models/service_scope_resolver.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 312,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_analytics/models/service_scope_resolver.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 104,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2/middleware/auth.py"
-    },
     {
       "rule": "odoo.prefer-sql-constraint",
       "severity": "high",
@@ -259,7 +189,7 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 88,
-      "evidence": "return self.sudo().search(  # nosemgrep: odoo-sudo-without-context",
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
@@ -298,18 +228,8 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 40,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2/services/group_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 85,
-      "evidence": "reg_ids = self.env[\"spp.registry.id\"].sudo().search(domain)  # nosemgrep: odoo-sudo-without-context",
+      "line": 637,
+      "evidence": "sudo().search() on spp.group.membership runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
@@ -318,59 +238,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 324,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2/services/group_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 427,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2/services/group_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 486,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2/services/group_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 500,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2/services/group_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 638,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2/services/group_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 686,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 1017,
+      "evidence": "sudo().search() on spp.group.membership runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2/services/group_service.py"
@@ -378,9 +248,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 807,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 1157,
+      "evidence": "sudo().search_count() on spp.group.membership runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2/services/group_service.py"
@@ -388,9 +258,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 912,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 1165,
+      "evidence": "sudo().search_count() on spp.group.membership runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2/services/group_service.py"
@@ -398,9 +268,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 1018,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 1169,
+      "evidence": "sudo().search_count() on spp.group.membership runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2/services/group_service.py"
@@ -408,9 +278,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 1055,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 1174,
+      "evidence": "sudo().search_count() on spp.group.membership runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2/services/group_service.py"
@@ -419,58 +289,18 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 1199,
-      "evidence": "memberships = self.env[\"spp.group.membership\"].sudo().search(domain, order=\"create_date desc\")",
-      "suppressed": false,
+      "evidence": "sudo().search() on spp.group.membership runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2/services/group_service.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 42,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2/services/individual_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 85,
-      "evidence": "reg_ids = self.env[\"spp.registry.id\"].sudo().search(domain)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2/services/individual_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 357,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2/services/individual_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 454,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2/services/individual_service.py"
-    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 745,
-      "evidence": "memberships = self.env[\"spp.group.membership\"].sudo().search(domain, limit=limit, order=\"start_date ",
-      "suppressed": false,
+      "evidence": "sudo().search() on spp.group.membership runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2/services/individual_service.py"
@@ -478,9 +308,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 100,
-      "evidence": "records = Partner.sudo().search(domain, limit=limit, offset=offset, order=order)",
-      "suppressed": false,
+      "line": 79,
+      "evidence": "sudo().search_count() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2/services/search_service.py"
@@ -488,9 +318,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 139,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 100,
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2/services/search_service.py"
@@ -498,8 +328,8 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 176,
-      "evidence": "records = Partner.sudo().search(domain, limit=limit, order=order)  # nosemgrep: odoo-sudo-without-co",
+      "line": 160,
+      "evidence": "sudo().search_count() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
@@ -508,9 +338,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 250,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 176,
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2/services/search_service.py"
@@ -519,28 +349,8 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 278,
-      "evidence": "active_memberships = self.env[\"spp.group.membership\"].sudo().search([(\"is_ended\", \"=\", False)])",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2/services/search_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 294,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2/services/search_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 327,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "evidence": "sudo().search() on spp.group.membership runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2/services/search_service.py"
@@ -549,198 +359,28 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 30,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_cycles/services/cycle_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 98,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_cycles/services/cycle_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 33,
-      "evidence": ".sudo()  # nosemgrep: odoo-sudo-on-sensitive-models",
+      "evidence": "sudo().search() on product.category runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
-      "path": "spp_api_v2_entitlements/services/entitlement_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 47,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_entitlements/services/entitlement_service.py"
+      "path": "spp_api_v2_products/services/product_category_service.py"
     },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 141,
-      "evidence": ".sudo()  # nosemgrep: odoo-sudo-on-sensitive-models",
+      "line": 54,
+      "evidence": "sudo().search_count() on product.category runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
-      "path": "spp_api_v2_entitlements/services/entitlement_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 211,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_entitlements/services/entitlement_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 232,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_entitlements/services/entitlement_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 75,
-      "evidence": "incident = env[\"spp.hazard.incident\"].sudo().search([(\"code\", \"=\", request.incident_code)], limit=1)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_gis/routers/geofence.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 339,
-      "evidence": "report = env[\"spp.gis.report\"].sudo().search([(\"code\", \"=\", report_code)], limit=1)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_gis/routers/ogc_features.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 101,
-      "evidence": "reports = self.env[\"spp.gis.report\"].sudo().search([(\"active\", \"=\", True)])",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_gis/services/export_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 217,
-      "evidence": "parent_area = self.env[\"spp.area\"].sudo().search([(\"code\", \"=\", parent_area_code)], limit=1)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_gis/services/layers_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 224,
-      "evidence": "matching_areas = self.env[\"spp.area\"].sudo().search([(\"geo_polygon\", \"gis_intersects\", bbox_geojson)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_gis/services/layers_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 417,
-      "evidence": "report = self.env[\"spp.gis.report\"].sudo().search([(\"code\", \"=\", layer_id)], limit=1)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_gis/services/layers_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 485,
-      "evidence": "report = self.env[\"spp.gis.report\"].sudo().search([(\"code\", \"=\", report_code)], limit=1)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_gis/services/layers_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 492,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_gis/services/layers_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 708,
-      "evidence": "areas = self.env[\"spp.area\"].sudo().search([(\"code\", \"in\", area_codes)])",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_gis/services/layers_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 513,
-      "evidence": "report = self.env[\"spp.gis.report\"].sudo().search([(\"code\", \"=\", report_code)], limit=1)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_gis/services/ogc_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 169,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_gis/services/qml_template_service.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 31,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
       "path": "spp_api_v2_products/services/product_category_service.py"
     },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 62,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 61,
+      "evidence": "sudo().search() on product.category runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2_products/services/product_category_service.py"
@@ -748,9 +388,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 31,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 30,
+      "evidence": "sudo().search() on product.template runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2_products/services/product_service.py"
@@ -758,9 +398,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 43,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 42,
+      "evidence": "sudo().search() on product.template runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2_products/services/product_service.py"
@@ -768,9 +408,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 97,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 89,
+      "evidence": "sudo().search_count() on product.template runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2_products/services/product_service.py"
@@ -778,19 +418,19 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 30,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 96,
+      "evidence": "sudo().search() on product.template runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
-      "path": "spp_api_v2_products/services/uom_service.py"
+      "path": "spp_api_v2_products/services/product_service.py"
     },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 63,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 29,
+      "evidence": "sudo().search() on uom.uom runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2_products/services/uom_service.py"
@@ -798,29 +438,29 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 51,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 56,
+      "evidence": "sudo().search_count() on uom.uom runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
-      "path": "spp_api_v2_programs/services/program_membership_service.py"
+      "path": "spp_api_v2_products/services/uom_service.py"
     },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 94,
-      "evidence": "records = Membership.sudo().search(  # nosemgrep: odoo-sudo-without-context",
+      "line": 62,
+      "evidence": "sudo().search() on uom.uom runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
-      "path": "spp_api_v2_programs/services/program_membership_service.py"
+      "path": "spp_api_v2_products/services/uom_service.py"
     },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 119,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 93,
+      "evidence": "sudo().search_count() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2_programs/services/program_membership_service.py"
@@ -828,9 +468,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 135,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 94,
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2_programs/services/program_membership_service.py"
@@ -838,9 +478,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 158,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 134,
+      "evidence": "sudo().search() on spp.program.membership runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2_programs/services/program_membership_service.py"
@@ -848,9 +488,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 385,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 157,
+      "evidence": "sudo().search() on spp.program.membership runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2_programs/services/program_membership_service.py"
@@ -858,9 +498,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 48,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 47,
+      "evidence": "sudo().search() on spp.program.id runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2_programs/services/program_service.py"
@@ -868,8 +508,8 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 66,
-      "evidence": ".sudo()  # nosemgrep: odoo-sudo-on-sensitive-models",
+      "line": 65,
+      "evidence": "sudo().search() on spp.program runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
@@ -879,8 +519,8 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 527,
-      "evidence": "currency = env[\"res.currency\"].sudo().search([(\"name\", \"=\", request.currency_code)], limit=1)",
-      "suppressed": false,
+      "evidence": "sudo().search() on res.currency runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2_simulation/routers/scenario.py"
@@ -888,9 +528,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 538,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 537,
+      "evidence": "sudo().search() on spp.program runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2_simulation/routers/scenario.py"
@@ -899,22 +539,12 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 93,
-      "evidence": "partner_ids = self.env[\"res.partner\"].sudo().search(domain).ids",
-      "suppressed": false,
+      "evidence": "sudo().search() on res.partner runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_api_v2_simulation/services/analytics_api_service.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 32,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_api_v2_simulation/services/simulation_api_service.py"
-    },
     {
       "rule": "odoo.ondelete-is-a-decision",
       "severity": "high",
@@ -938,9 +568,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 205,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 204,
+      "evidence": "sudo().search() on spp.approval.definition runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_approval/models/approval_review.py"
@@ -949,8 +579,8 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 217,
-      "evidence": "manager_definitions = self.env[\"spp.approval.definition\"].sudo().search([(\"approval_type\", \"=\", \"man",
-      "suppressed": false,
+      "evidence": "sudo().search() on spp.approval.definition runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_approval/models/approval_review.py"
@@ -1075,22 +705,12 @@
       "likelihood": "unmeasured",
       "path": "spp_attachment_av_scan/models/av_scanner_backend.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 337,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_attachment_av_scan/models/ir_attachment.py"
-    },
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 108,
-      "evidence": "entity = request.env[model_name].sudo().search([(\"id\", \"=\", model_id)], limit=1)",
-      "suppressed": false,
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_attendance/controllers/controllers.py"
@@ -1099,92 +719,12 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 111,
-      "evidence": "model_ids = request.env[model_name].sudo().search([])",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_attendance/controllers/controllers.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 215,
-      "evidence": "req.env[\"spp.attendance.subscriber\"].sudo().search([(\"person_identifier\", \"=\", person_id)], limit=1)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_attendance/controllers/controllers.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 367,
-      "evidence": "attendance_list_id = req.env[\"spp.attendance.list\"].sudo().search([(\"id\", \"=\", attendance_id)], limi",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_attendance/controllers/controllers.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 411,
-      "evidence": "attendance_list_ids = req.env[\"spp.attendance.list\"].sudo().search([(\"id\", \"in\", ids)])",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_attendance/controllers/controllers.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 436,
-      "evidence": "req.env[\"spp.attendance.subscriber\"].sudo().search([(\"person_identifier\", \"=\", person_identifier)], ",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_attendance/controllers/controllers.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 593,
-      "evidence": "attendance_type_ids = req.env[\"spp.attendance.type\"].sudo().search([])",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_attendance/controllers/controllers.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 625,
-      "evidence": "attendance_location_ids = req.env[\"spp.attendance.location\"].sudo().search([])",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_attendance/controllers/controllers.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 706,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_attendance/controllers/controllers.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 134,
-      "evidence": "set(self.env[\"spp.attendance.list\"].sudo().search(present_domain).mapped(\"attendance_date\"))",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_attendance/models/attendance_subscriber.py"
-    },
     {
       "rule": "odoo.recursion-check-on-hierarchy",
       "severity": "high",
@@ -1195,16 +735,6 @@
       "likelihood": "unmeasured",
       "path": "spp_audit/models/spp_audit_rule.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 245,
-      "evidence": "return self.env[\"spp.audit.rule\"].sudo().search(domain)  # nosemgrep: odoo-sudo-without-context",
-      "suppressed": true,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_audit/models/spp_audit_rule.py"
-    },
     {
       "rule": "odoo.depends-must-not-name-unread-fields",
       "severity": "medium",
@@ -1219,8 +749,8 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 41,
-      "evidence": "theme_menu = env[\"ir.ui.menu\"].sudo().search([(\"name\", \"ilike\", \"Theme Store\")], limit=1)",
-      "suppressed": false,
+      "evidence": "sudo().search() on ir.ui.menu runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_branding_kit/__init__.py"
@@ -1655,16 +1185,6 @@
       "likelihood": "preference",
       "path": "spp_dci_client/models/data_source.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 70,
-      "evidence": "crvs_sender = env[\"spp.dci.crvs.sender\"].sudo().search([(\"sender_id\", \"=\", sender_id)], limit=1)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_client_crvs/middleware/signature.py"
-    },
     {
       "rule": "odoo.prefer-sql-constraint",
       "severity": "high",
@@ -1685,16 +1205,6 @@
       "likelihood": "preference",
       "path": "spp_dci_client_crvs/models/crvs_sender.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 70,
-      "evidence": "dr_sender = env[\"spp.dci.dr.sender\"].sudo().search([(\"sender_id\", \"=\", sender_id)], limit=1)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_client_dr/middleware/signature.py"
-    },
     {
       "rule": "odoo.constrains-must-list-every-field-read",
       "severity": "critical",
@@ -1725,36 +1235,6 @@
       "likelihood": "preference",
       "path": "spp_dci_client_dr/models/dr_sender.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 199,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_client_dr/routers/callback.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 216,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_client_dr/routers/callback.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 70,
-      "evidence": "ibr_sender = env[\"spp.dci.ibr.sender\"].sudo().search([(\"sender_id\", \"=\", sender_id)], limit=1)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_client_ibr/middleware/signature.py"
-    },
     {
       "rule": "odoo.prefer-sql-constraint",
       "severity": "high",
@@ -1765,16 +1245,6 @@
       "likelihood": "preference",
       "path": "spp_dci_client_ibr/models/ibr_sender.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 166,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_client_ibr/routers/callback.py"
-    },
     {
       "rule": "odoo.stored-compute-needs-complete-depends",
       "severity": "critical",
@@ -1785,46 +1255,6 @@
       "likelihood": "construct",
       "path": "spp_dci_client_sr/models/sr_record.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 262,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_client_sr/routers/callback.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 279,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_client_sr/routers/callback.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 205,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_server/middleware/rate_limit.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 278,
-      "evidence": "client = env[\"spp.api.client\"].sudo().search([(\"client_id\", \"=\", client_id), (\"active\", \"=\", True)],",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_server/middleware/signature.py"
-    },
     {
       "rule": "odoo.prefer-sql-constraint",
       "severity": "high",
@@ -1855,96 +1285,6 @@
       "likelihood": "construct",
       "path": "spp_dci_server/models/subscription.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 571,
-      "evidence": "self.env[\"spp.dci.subscription\"].sudo().search([(\"original_transaction_id\", \"=\", transaction_id)])",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_server/models/transaction.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 684,
-      "evidence": "referenced_txn = self.env[\"spp.dci.transaction\"].sudo().search(domain, limit=1)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_server/models/transaction.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 262,
-      "evidence": "sender = env[\"spp.dci.sender.registry\"].sudo().search([(\"sender_id\", \"=\", verified_sender_id)], limi",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_server/routers/async_router.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 426,
-      "evidence": "sender = env[\"spp.dci.sender.registry\"].sudo().search([(\"sender_id\", \"=\", verified_sender_id)], limi",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_server/routers/async_router.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 438,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_server/routers/async_router.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 573,
-      "evidence": "transactions = env[\"spp.dci.transaction\"].sudo().search(domain, limit=1)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_server/routers/async_router.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 304,
-      "evidence": "sender = env[\"spp.dci.sender.registry\"].sudo().search([(\"sender_id\", \"=\", sender_id)], limit=1)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_server/routers/bulk_upload.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 277,
-      "evidence": "sender = env[\"spp.dci.sender.registry\"].sudo().search([(\"sender_id\", \"=\", sender_id_str)], limit=1)",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_server/routers/callbacks.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 140,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_dci_server/routers/receipt.py"
-    },
     {
       "rule": "odoo.ondelete-is-a-decision",
       "severity": "high",
@@ -2365,16 +1705,6 @@
       "likelihood": "unmeasured",
       "path": "spp_farmer_registry_cr/details/cr_land_parcel.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 659,
-      "evidence": "records = self.env[\"spp.service.point\"].sudo().search([(\"name\", \"in\", names)])  # nosemgrep",
-      "suppressed": true,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_farmer_registry_demo/models/farmer_demo_generator.py"
-    },
     {
       "rule": "odoo.sql-needs-query-parameters",
       "severity": "critical",
@@ -2388,21 +1718,11 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 856,
-      "evidence": "sp_records = self.env[\"spp.service.point\"].sudo().search([])  # nosemgrep",
+      "line": 72,
+      "evidence": "sudo().search() on ir.ui.view runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
-      "path": "spp_farmer_registry_demo/models/seeded_farm_generator.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 73,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
       "path": "spp_gis/models/base.py"
     },
     {
@@ -2635,6 +1955,26 @@
       "likelihood": "preference",
       "path": "spp_grm_cel/models/grm_escalation_rule.py"
     },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "severity": "critical",
+      "line": 687,
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "spp_grm_cel/models/grm_escalation_rule.py"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "severity": "critical",
+      "line": 238,
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "spp_grm_cel/models/grm_routing_rule.py"
+    },
     {
       "rule": "odoo.constrains-must-list-every-field-read",
       "severity": "critical",
@@ -2745,26 +2085,6 @@
       "likelihood": "preference",
       "path": "spp_key_management/models/encryption_key.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 322,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_key_management/models/key_provider_database.py"
-    },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 348,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_key_management/models/key_provider_database.py"
-    },
     {
       "rule": "odoo.float-comparison-needs-float-utils",
       "severity": "high",
@@ -2895,6 +2215,16 @@
       "likelihood": "preference",
       "path": "spp_programs/models/cycle.py"
     },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "severity": "critical",
+      "line": 1266,
+      "evidence": "sudo().search() on res.partner runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "spp_programs/models/cycle.py"
+    },
     {
       "rule": "odoo.prefer-sql-constraint",
       "severity": "high",
@@ -2995,6 +2325,16 @@
       "likelihood": "preference",
       "path": "spp_programs/models/programs.py"
     },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "severity": "critical",
+      "line": 308,
+      "evidence": "sudo().search_count() on ir.mail_server runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "spp_programs/models/programs.py"
+    },
     {
       "rule": "odoo.check-company-on-relations",
       "severity": "critical",
@@ -3010,7 +2350,7 @@
       "severity": "critical",
       "line": 77,
       "evidence": "the query handed to cr.execute() is built by an f-string -- pass the values as the second argument so the driver quotes them",
-      "suppressed": false,
+      "suppressed": true,
       "advisory": false,
       "likelihood": "unmeasured",
       "path": "spp_programs/models/accounting/fund_report.py"
@@ -3018,8 +2358,8 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 257,
-      "evidence": ".sudo()  # nosemgrep: odoo-sudo-on-sensitive-models",
+      "line": 256,
+      "evidence": "sudo().search() on res.partner runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
@@ -3029,8 +2369,8 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 306,
-      "evidence": "compliant_partners = self.env[\"res.partner\"].sudo().search(domain)",
-      "suppressed": false,
+      "evidence": "sudo().search() on res.partner runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_programs/models/managers/compliance_manager.py"
@@ -3038,8 +2378,8 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 38,
-      "evidence": ".sudo()  # nosemgrep: odoo-sudo-on-sensitive-models",
+      "line": 37,
+      "evidence": "sudo().search() on res.partner runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
@@ -3048,9 +2388,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 34,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 33,
+      "evidence": "sudo().search() on res.partner runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_programs/models/managers/entitlement_manager_default_compliance.py"
@@ -3110,21 +2450,11 @@
       "severity": "critical",
       "line": 51,
       "evidence": "the query handed to cr.execute() is built by an f-string -- pass the values as the second argument so the driver quotes them",
-      "suppressed": false,
+      "suppressed": true,
       "advisory": false,
       "likelihood": "unmeasured",
       "path": "spp_programs/models/managers/pagination_utils.py"
     },
-    {
-      "rule": "odoo.sudo-bypasses-record-rules",
-      "severity": "critical",
-      "line": 167,
-      "evidence": ".sudo()",
-      "suppressed": false,
-      "advisory": false,
-      "likelihood": "defect",
-      "path": "spp_programs/models/managers/payment_manager.py"
-    },
     {
       "rule": "odoo.constrains-must-list-every-field-read",
       "severity": "critical",
@@ -3188,9 +2518,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 266,
-      "evidence": ".sudo()  # system table ordinary users cannot read; _trigger creates as sudo anyway",
-      "suppressed": false,
+      "line": 265,
+      "evidence": "sudo().search() on ir.cron.trigger runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_registry/models/group_membership.py"
@@ -3209,7 +2539,7 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 127,
-      "evidence": "clash = self.sudo().search(domain, limit=1)  # nosemgrep: odoo-sudo-without-context",
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
       "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
@@ -3548,12 +2878,42 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 480,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 107,
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "spp_studio_api_v2/services/variable_value_service.py"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "severity": "critical",
+      "line": 174,
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "spp_studio_api_v2/services/variable_value_service.py"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "severity": "critical",
+      "line": 225,
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
+      "advisory": false,
+      "likelihood": "defect",
+      "path": "spp_studio_api_v2/services/variable_value_service.py"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "severity": "critical",
+      "line": 276,
+      "evidence": "sudo().search() runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
-      "path": "spp_studio_api_v2/routers/studio.py"
+      "path": "spp_studio_api_v2/services/variable_value_service.py"
     },
     {
       "rule": "odoo.constrains-must-list-every-field-read",
@@ -3568,9 +2928,9 @@
     {
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
-      "line": 312,
-      "evidence": ".sudo()",
-      "suppressed": false,
+      "line": 311,
+      "evidence": "sudo().search() on ir.model.fields runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_studio_change_requests/models/studio_change_request_type.py"
@@ -3609,8 +2969,8 @@
       "rule": "odoo.sudo-bypasses-record-rules",
       "severity": "critical",
       "line": 424,
-      "evidence": "wizard_model = self.env[\"ir.model\"].sudo().search([(\"model\", \"=\", \"spp.event.data.entry.wizard\")], l",
-      "suppressed": false,
+      "evidence": "sudo().search() on ir.model runs with record rules off -- ir.rule filtering, including multi-company isolation, does not apply and the result looks correct in single-company testing",
+      "suppressed": true,
       "advisory": false,
       "likelihood": "defect",
       "path": "spp_studio_events/models/studio_event_type.py"