From 2b1064db1446121ab5b133e35bd08c48778b0b21 Mon Sep 17 00:00:00 2001
From: bradAGI <46579244+bradAGI@users.noreply.github.com>
Date: Mon, 24 Aug 2026 15:16:54 -0400
Subject: [PATCH] test(rules): mirror and cover CREW-013
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Engine half of a coordinated pair with trustabl/trustabl-rules#105, on a
branch of the same name so the rules-sync job resolves the matching pack
rather than main. Neither half should merge alone — check-rules-sync.sh
fails if they do.

Mirrors crewai/tool_definition.yaml into testdata/rules-fixture and adds
cases to policyRuleCases, as TestPolicyRules_AllRulesCovered requires.

Three cases: the generic name, the verb-object remediation, and
process_invoice_batch — a name that merely contains a listed word and must
stay silent. The third pins that name_in matches the whole name rather
than a substring, which is the plausible regression and the one that would
otherwise flood well-named tools with findings.
---
 internal/rules/policies_test.go               | 16 +++++++++-
 .../rules-fixture/crewai/tool_definition.yaml | 31 +++++++++++++++++++
 2 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/internal/rules/policies_test.go b/internal/rules/policies_test.go
index 65af6c0a..2c8e0dc4 100644
--- a/internal/rules/policies_test.go
+++ b/internal/rules/policies_test.go
@@ -1986,6 +1986,21 @@ def fetch_data(x: str) -> dict:
     return {}
 `,
 		toolConfig: nil, wantFires: false},
+	{name: "CREW-013 fires on a generic tool name", ruleID: "CREW-013", kind: models.KindCrewAITool, src: `
+def process(payload: str) -> str:
+    """Handle an incoming payload and return the result of handling it."""
+    return payload
+`, wantFires: true},
+	{name: "CREW-013 silent on a verb-object tool name", ruleID: "CREW-013", kind: models.KindCrewAITool, src: `
+def summarize_invoice(invoice_id: str) -> str:
+    """Summarize one invoice by its identifier and return the summary text."""
+    return invoice_id
+`, wantFires: false},
+	{name: "CREW-013 silent on a name merely containing a listed word", ruleID: "CREW-013", kind: models.KindCrewAITool, src: `
+def process_invoice_batch(batch_id: str) -> str:
+    """Process one batch of invoices and return a per-invoice result summary."""
+    return batch_id
+`, wantFires: false},
 }
 
 // policyRepoRuleCases covers repo-scoped rules.
@@ -2246,7 +2261,6 @@ var policyRepoRuleCases = []policyRepoCase{
 		},
 		models.RepoInventory{SDKsDetected: []models.SDK{models.SDKOpenAIAgents}},
 		false},
-
 }
 
 // optionsWithPermissionMode builds a ClaudeAgentOptionsDef whose captured
diff --git a/testdata/rules-fixture/crewai/tool_definition.yaml b/testdata/rules-fixture/crewai/tool_definition.yaml
index 0789c3ff..6e4fc669 100644
--- a/testdata/rules-fixture/crewai/tool_definition.yaml
+++ b/testdata/rules-fixture/crewai/tool_definition.yaml
@@ -52,3 +52,34 @@ rules:
       Annotate every parameter with a concrete type (str, int, list[str], a
       Pydantic model, etc.). CrewAI propagates these annotations into the schema the
       model sees, so the model emits correctly-shaped arguments.
+
+  - id: CREW-013
+    title: Ambiguous CrewAI tool name
+    severity: low
+    confidence: 0.9
+    language: python
+    applies_to:
+      - crewai_tool
+    scope: tool
+    match:
+      name_in:
+        - process
+        - handle
+        - run
+        - do
+        - execute
+        - perform
+        - work
+        - go
+        - thing
+        - stuff
+    explanation: >
+      The tool name is a generic verb that says nothing about what the tool
+      acts on. The name sits directly beside the description in what the model
+      sees, so it is half the selection signal, and a name like process or
+      handle spends that half on nothing — the model either calls the tool for
+      the wrong job or passes over it entirely. In a crew the wrong pick does not stay local: the task output it produces is threaded forward as context to every task behind it, and CREW-104 delegation means peers select from the same name.
+    fix: >
+      Rename to a verb-object form that names the thing acted on:
+      summarize_invoice, refund_charge, fetch_order_status. Keep the
+      description for the detail and let the name carry the subject.