[lestarch-autobot]

Related Issue(s)	Component Development Checklist v1.2.0 automation (companion: nasa/fprime-actions#55)
Has Unit Tests (y/n)	y
Documentation Included (y/n)	y
Generative AI was used in this contribution (y/n)	AI

---

Change Description

Eleven new F Prime CodeQL rules in .github/codeql/fprime-queries, each with a fprime-queries-tests unit test, covering the source-level items of the Component Development Checklist that had no rule yet:

Rule id (cpp/fprime/)	Checklist item
unthrottled-cyclic-event	3.4 events from sched/run/cycle handlers must be throttled or state-gated
global-mutable-variable	3.7 mutable namespace-scope / function-static variables
float-equality	3.9 ==/!= on floating operands (NaN self-compare exempt)
float-narrowing	3.10 implicit F64 -> F32
uninitialized-member	3.11 scalar/pointer/array members not set by every constructor
assert-on-untrusted-input	3.18 FW_ASSERT on data flowing from command args or paramGet_*
isr-complexity	3.20 loops or >20 statements in ISR-named functions
float-division-guard	3.27 floating divisor not checked before division
unchecked-array-index	3.28 variable index with no preceding condition/FW_ASSERT
signed-overflow	3.31 signed + - * that range analysis says may overflow, unguarded
define-constant	3.34 numeric #define outside config/

FprimeGuards.qll factors the "a condition or FW_ASSERT on this variable precedes the use" logic shared by the division/index/overflow rules. uninitialized-member is excluded from jpl-standard-pack-1 and run from jpl-standard-known-autocode-issues (autocoded component bases defer parameter members to loadParameters()).

Also adds the skill .github/skills/fprime-component-checklist-review that maps all 73 checklist items to their CodeQL rule / component-checks script / review rule (CL-1..CL-8 for the residual judgements: ISR state-before-enable, interrupt enables at init, units in names, implementation-vs-SDD, boundary tests, float precision, requirement and design-prose quality) / human (5.3 hardware run), and registers it in AGENTS.md.

Rationale

Lets the component checklist be filled from CI evidence instead of by hand; only the physical hardware run remains a human step.

Testing/Review Recommendations

• codeql test run fprime-queries-tests/Fprime{FloatEquality,...,SignedOverflow} --additional-packs=. : 11/11 pass.
• Run against a full devel database (CodeQL 2.26.1): array-index 45, uninitialized-member 31 (hence the autocode leg), mutable static 20, signed-overflow 19, define-constant 16, assert-on-input 6 (TlmPacketizer, Version), float-equality 4, float-division 1 (FpySequencerDirectives), unthrottled event 1 (TlmChan Run_handler). Review focus: whether signed-overflow and unchecked-array-index heuristics are too noisy for pack-1 (warning severity).

Future Work

Triage the devel findings above into fixes or per-rule refinements; companion scripts in nasa/fprime-actions#55.

Contributor Checklist

• I have the rights to contribute this change set under the Apache-2.0 license.
• I agree to be bound by the contributor guidelines.

AI Usage (see policy)

Queries, tests, skill and this description were written by an AI agent (Devin) at the request of @LeStarch, who reviewed the checklist split; the agent ran the CodeQL tests and the full-database analysis.

• This contribution follows the F´ AI development skills (entered through AGENTS.md).

IAMAI

[github-actions]

Coverage report — base devel

Overall (line): 85.94% → 85.92% (-0.02)
Regression threshold: 0.50% (line).

Regressions

(none over threshold)

Modules changed

Module	Line	Δ	Function	Δ	Branch	Δ
Os/Generic	90.08	-0.20	89.13	+0.00	74.90	-0.58
Fw/DataStructures	97.60	-0.09	96.95	-0.19	82.12	-0.18
Os/Posix	71.03	+0.39	87.50	+0.00	50.89	+0.22

New modules

Module	Line	Function	Branch
Fw/Prm	0.00	0.00	0.00

Modules without UTs

CFDP/Checksum/GTest, Drv/LinuxGpioDriver, Drv/LinuxI2cDriver, Drv/LinuxSpiDriver, Drv/Ports/DataTypes, Drv/PosixUartDriver, FppTestProject/FppTest/topology/async, FppTestProject/FppTest/topology/components/Comp, FppTestProject/FppTest/topology/components/Framework, FppTestProject/FppTest/topology/components/Receiver, FppTestProject/FppTest/topology/components/Sender, FppTestProject/FppTest/topology/guarded, FppTestProject/FppTest/topology/sync, FppTestProject/FppTest/topology/top_ports, FppTestProject/FppTest/topology/types, Fw/Com, Fw/Comp, Fw/FilePacket/GTest, Fw/Fpy, Fw/Obj, Fw/Port, Fw/Sm, Fw/Test, Fw/Types/GTest, Os/Models, Svc/Ccsds/Types, Svc/Ccsds/Utils, Svc/FatalHandler, Svc/Subtopologies/CdhCore, Svc/Subtopologies/ComCcsds, Svc/Subtopologies/ComCcsdsSdls, Svc/Subtopologies/ComFprime, Svc/Subtopologies/ComLoggerTee, Svc/Subtopologies/DataProducts, Svc/Subtopologies/DpCompression, Svc/Subtopologies/FileHandling, Svc/Subtopologies/FileHandlingCfdp, Svc/Subtopologies/FileHandlingCfdp/FileHandlingCfdpConfig, TestDeploymentsProject/Ref/DpDemo, TestDeploymentsProject/Ref/PingReceiver, TestDeploymentsProject/Ref/RecvBuffApp, TestDeploymentsProject/Ref/SendBuffApp, TestDeploymentsProject/Ref/Top, TestDeploymentsProject/Ref/TypeDemo, cmake/test/data/TestConfigDeployment, cmake/test/data/TestDeployment/TestBuildAutocoder, cmake/test/data/TestDeployment/TestDuplicateDirective, cmake/test/data/TestDeployment/TestHeaderAutocoder, cmake/test/data/TestDeployment/TestLinkDepends, cmake/test/data/TestDeployment/TestRelative, cmake/test/data/test-fprime-library/TestLibrary/TestComponent, cmake/test/data/test-fprime-library2/TestLibrary2/TestComponent