bug: The assembly warning policy lint accepts the switches that disable it

[wallstop]

Problem

scripts/lint-assembly-warnings.ps1 enforces one strict-warning policy: exactly one -warn:5 in each csc.rsp, no analyzer arguments, and a WarningsAsErrors.ruleset with one IncludeAll Action="Error" and no weakening rules. Its response-file scan only recognizes the positive warning-level token, so the switches that undo the policy pass unnoticed.

Reproduction (repository at 9cd77e1, verified 2026-10-02)

mkdir -p /tmp/awfix/Editor
cp Editor/WallstopStudios.DataVisualizer.Editor.asmdef /tmp/awfix/Editor/
cp Editor/WarningsAsErrors.ruleset /tmp/awfix/Editor/
printf -- '-warn:5\n-nowarn:1701,CS0162\n' > /tmp/awfix/Editor/csc.rsp
pwsh -NoProfile -File scripts/lint-assembly-warnings.ps1 -Root /tmp/awfix

Actual: [assembly-warnings] OK: all 1 assembly definition(s) use maximum compiler warnings and warnings as errors without repository-local analyzer payloads, exit 0.

Expected: exit 1 naming the response file. The same fixture with -warnaserror- instead of -nowarn: also reports OK.

Evidence for the cause: the scan filters with ^(?:-|/)(?:warn|w)(?::|$) (scripts/lint-assembly-warnings.ps1:57). -nowarn:... starts with -n and -warnaserror- with -warnaserror, so neither token matches, the count of recognized arguments stays 1, and the disabling switch is never inspected.

Impact

• The guard that exists to keep warnings at maximum and as errors reports success on a response file that suppresses specific warnings or disables warnings-as-errors. That is the same silent-pass shape as the accepted -warn:5 drift in chore: The CSharpier gate cannot pass on a non-Windows checkout (CRLF vs LF) #129, so the policy it claims to enforce can be turned off without any signal.
• It also weakens the evidence base for Enforce SonarAnalyzer.CSharp via the pinned host-project installer #85 and Warnings/Errors #96: a passing lint no longer proves maximum warnings and errors.

Acceptance criteria

1. scripts/lint-assembly-warnings.ps1 fails, naming the response file, when a csc.rsp contains -nowarn: / -nowarn, /nowarn, or any -warnaserror / /warnaserror form that disables or weakens warnings-as-errors.
2. It fails when a suppression switch is hidden from the scan, for example behind an rsp comment or a differently spelled alias the scanner does not recognize, rather than relying on a prefix list.
3. Self-tests in scripts/tests/test-assembly-warnings.ps1 cover each rejecting case as a data-driven row, and the existing clean case still passes.
4. npm run lint:llm:full green on ubuntu and Windows; the four committed assemblies still pass.

Notes

Found while repairing the #131 review finding, which was the same class of defect in a different guard: a machine-readable config construct the reader does not understand is silently ignored, so the check passes while the real configuration disagrees. PR #131 fixes its own guard and refuses glob constructs it cannot match instead of guessing.

[wallstop]

Fixed on main by PR #133, merged 2026-10-02 as a3ccc08. Closed here so the backlog reflects what is actually delivered.

Verified on main before closing: a fixture csc.rsp holding -warn:5 and -nowarn:1701,CS0162 now reports

[assembly-warnings] ERROR: Editor/csc.rsp must contain exactly one argument, the maximum warning level (-warn:5); found: -warn:5 -nowarn:1701,CS0162
[assembly-warnings] FAILED: 1 assembly warning policy error(s)

with exit 1, naming the file and every argument it found. npm run lint:llm:full is green (19/19 self-test files) and llm-lint run #279 succeeded on ubuntu and windows.