Exempt pass,nolog control rules from detection-rule metadata

.coderabbit.yaml

@@ -1,4 +1,4 @@
 # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
 #
 # CodeRabbit organization config for the `coreruleset` GitHub org.
 #
@@ -29,7 +29,7 @@
 # Tone guidance appended to every review prompt. Max 250 chars (silently
 # truncated beyond that).
 tone_instructions: >-
   Be direct, with respect. Be concise. Assume positive intent. Flag bugs, security issues, false-positive risk and regressions, with a fix. Cite rule IDs, paranoia levels and affected variables. Skip style nits. No praise.
 
 # Opt in to early-access / beta features org-wide.
 early_access: true
@@ -299,18 +299,24 @@
         would. Flag ⚠️ WARNING: <description> — <fix> on the affected line for:
 
         Rule ID range — the ID must fall in the family's range and be unused:
-        900000-900999 initialization, 901000-901999 IP reputation,
+        900000-900999 crs-setup.conf, 901000-901999 initialization,
         905000-905999 common exceptions, 910000-919999 protocol enforcement,
         920000-929999 protocol attacks, 930000-939999 LFI/RFI/RCE/PHP,
         941000-941999 XSS, 942000-942999 SQLi, 943000-943999 session fixation,
         944000-944999 Java. A new rule should take the next unused multiple of
         10 in its family. Plugin rules must use the plugin's own reserved
         range, never a core range.
 
-        Missing or wrong metadata — every rule needs `id`, `phase`, `msg`,
+        Missing or wrong metadata — every detection rule (one that scores
+        anomaly points, in 911-944 or 950-956) needs `id`, `phase`, `msg`,
         `logdata`, `tag:'OWASP_CRS'`, a `paranoia-level/N` tag, the relevant
         attack-type and `capec/NNN` tags, `ver:'OWASP_CRS/4.x.x'` matching the
-        current version, and a `severity`. A `tag:` value that is not in
+        current version, and a `severity`. Control rules are exempt: the
+        `pass,nolog` rules in 901 (initialization), 905, 949, 959, 980 and 999,
+        and the `TX:DETECTION_PARANOIA_LEVEL "@lt N"` skipAfter guards at the
+        top of each detection file, carry only `id`, `phase`, `pass,nolog`,
+        `tag:'OWASP_CRS'` and `ver`. Do not ask for msg, logdata, severity,
+        paranoia-level, attack-type or capec metadata on them. A `tag:` value that is not in
         `util/APPROVED_TAGS` fails the crs-linter CI job — say so explicitly
         and tell the author to add it there in sorted position first.
 
@@ -367,7 +373,7 @@
         `crs-toolchain regex update <id>`.
 
     - path: "plugins/*.conf"
       # CRS plugins: coreruleset/plugins/ and the *-rule-exclusions-plugin repos.
       instructions: |
         This is a CRS plugin's seclang. Every invariant that applies to core
         rules applies here too: metadata completeness, approved tags, a
@@ -418,9 +424,9 @@
         Changed default without justification — anomaly score thresholds
         (`tx.inbound_anomaly_score_threshold`,
         `tx.outbound_anomaly_score_threshold`), `tx.blocking_paranoia_level`,
         `tx.detection_paranoia_level`, `tx.critical/error/warning/notice_anomaly_score`,
         sampling percentage, `tx.enforce_bodyproc_urlencoded`, allowed methods,
         allowed content types, request body limits, or `tx.crs_validate_utf8_encoding`.
         Each of these is a behaviour change for every default deployment and
         needs the reasoning in the PR description.
 
@@ -865,8 +871,12 @@
           `lts/v*` branch, where it must carry the LTS version rather than
           main's.
 
-          Missing paranoia-level tag, or a tag inconsistent with the
-          `TX:DETECTION_PARANOIA_LEVEL` guard and the file section around it.
+          Missing paranoia-level tag on a detection rule, or a tag
+          inconsistent with the `TX:DETECTION_PARANOIA_LEVEL` guard and the
+          file section around it. `pass,nolog` control rules (901
+          initialization, 905, 949, 959, 980, 999, and the PL skipAfter
+          guards) carry no paranoia-level, severity, logdata or capec
+          metadata by design — never flag them for it.
 
           Missing `capec/` tag on a new detection rule, missing `logdata`, a
           `msg` that does not name the attack class, or a `severity` that does
@@ -972,14 +982,14 @@
       - name: "OWASP Security (Web, API & LLM)"
         mode: warning
         instructions: |
           Flag ⚠️ WARNING: <description> — <fix> on any affected line or block for:
 
           ## Web (OWASP Top 10)
 
           Broken Access Control — missing authorization checks, insecure direct object references,
           CORS misconfiguration, privilege escalation paths, forced browsing to authenticated resources.
 
           Cryptographic Failures — hardcoded secrets or API keys, weak algorithms (MD5, SHA1, DES),
           unencrypted sensitive data in transit or at rest, weak or expired TLS configuration,
           secrets committed to version control.