docs: document external ALCops configuration

[someC0d3r]

Summary

Documents Extends.Source for shared ALCops configuration and aligns the configuration guide and CM0001 page with ALCops/Analyzers#500.

• Explains anonymous HTTP(S) and absolute file sources, local precedence, nested-object merging, array replacement, and the single-level inheritance restriction.
• Documents complete fallback to built-in defaults when declared inheritance fails, including discarding local overrides and reporting CM0001.
• Specifies the 1 MiB (1,048,576-byte) HTTP response limit, including chunked/no-length responses, and the five-second timeout.
• Explains rejection of embedded URL credentials before network access and their omission from diagnostic output.
• Distinguishes non-fatal unknown setting names from invalid setting values, and explains source trust, retries after HTTP request failures and restart requirements for deterministic configuration errors.
• Explains the 30-second workspace cooldown after failed HTTP requests, shared retries after expiry, stable compilation snapshots, cancellation without a new cooldown, empty local input and the remaining HTTP wait. Cache hits do not extend the cooldown. The configuration guide and CM0001 page are cross-linked.

Related proposal: ALCops/Analyzers#483.

Validation

• Installed the merged lockfile dependencies with npm ci.
• Hugo Extended 0.165.0 production build completed successfully: 167 pages, no build errors.
• Checked the generated configuration and CM0001 pages for the 30-second cooldown and their internal link; the existing fallback, cancellation, initial-wait and empty-input documentation remains aligned.
• Existing Hugo/Docsy deprecation warnings remain (languageCode, LanguageDirection, and Site.AllPages).
• The corresponding analyzer change passed all 159 Common tests on AL 18, AL 16, and AL 12, plus the complete cop suites and all supported framework builds.

Codex disclosure

The initial documentation was generated using Codex. Original author note: 5.6 Sol, Reasoning: Very High (4/5).

The follow-up review and documentation updates were performed using Codex with GPT-6 Astra, Reasoning: Very High.

---

Generated via Codex using GPT-6 Astra with Very High reasoning.

[someC0d3r]

Updated and pushed in 640ea15, following the fixes in ALCops/Analyzers#500.

The configuration guide and CM0001 page now describe the same behavior:

• Failed declared inheritance discards the base and local overrides, applies complete built-in defaults, and reports CM0001.
• HTTP response content is limited to 1 MiB (1,048,576 bytes), including chunked/no-length responses, with a five-second timeout.
• Embedded URL credentials are rejected before network access and omitted from diagnostic output.
• Unknown setting names remain non-fatal; invalid inherited values cannot be hidden by local overrides.
• The project must trust its referenced source, and cached failures require restarting the analyzer process after correction.

Merged current upstream documentation first so the CM0001 page introduced alongside the analyzer work could be updated directly. The PR description and cross-links are current.

Validation: npm ci succeeded; Hugo Extended 0.165.0 generated 167 pages with no errors. The generated pages contain the updated behavior and the CM0001 link. Existing Hugo/Docsy deprecation warnings remain for languageCode, LanguageDirection, and Site.AllPages.

---

Generated via Codex using GPT-6 Astra with Very High reasoning.

[someC0d3r]

Updated in 261c1a7 to match the follow-up to Arthurvdv's analyzer review.

The configuration guide and CM0001 page now explain:

• Failed HTTP requests retry on a later compilation without restarting the language server. The original compilation keeps a consistent snapshot; successful settings and deterministic configuration errors remain cached.
• Cancelling analysis cancels the pending request, without recording CM0001 or a failed cache entry.
• Empty, whitespace-only, comment-only and JSON-null local configuration uses defaults silently. An inherited source must still contain a JSON object.
• The first analysis using an uncached HTTP source can still wait for the response, up to the existing five-second timeout. There is no background refresh.

The complete-defaults fallback and 1 MiB response limit remain as agreed. The PR description has been updated too.

Validation: Hugo Extended 0.165.0 generated 167 pages with no errors. The generated pages and the CM0001 cross-link were checked. Existing Hugo/Docsy deprecation warnings remain for languageCode, LanguageDirection, and Site.AllPages. The analyzer change passed all 152 Common tests on AL 18, AL 16 and AL 12, plus the complete cop suites.

---

Development and validation were performed with Codex, GPT-6 Astra, reasoning 'Very High'.

[someC0d3r]

Updated in 0fb14bc to reflect the cooldown requested in Arthurvdv's analyzer review.

The configuration guide and CM0001 page now explain the 30-second cooldown per workspace after each failed HTTP request. Analyses inside the window reuse defaults and CM0001 without another fetch. Cache hits do not extend the window; a new compilation requesting settings after expiry makes one shared retry. Existing compilation snapshots remain stable, successful loads remain cached, and cancellation does not start a new cooldown.

The configuration guide also clarifies that the initial request and retries after the cooldown can still wait for the existing five-second timeout. The PR description is updated accordingly.

Validation: Hugo Extended 0.165.0 built 167 pages without errors. Both generated pages contain the cooldown information, and their configuration-to-CM0001 link was verified. Existing Hugo/Docsy deprecation warnings remain. The corresponding analyzer update passed all 159 Common tests on AL 18, AL 16 and AL 12, plus the complete cop suites and all supported framework builds.

---

Development and validation were performed with Codex, GPT-6 Astra, Reasoning: Very High.