Problem
PR #586 makes bots/echidnabot/ a pinned sync of hyperpolymath/echidnabot (drift gate: vendored-bot-drift.yml). The fleet copy can no longer be edited locally, but Hypatia scans it and reports four code_safety findings in vendored upstream code:
| File (fleet path) |
Rule |
Assessment |
bots/echidnabot/fuzz/fuzz_targets/fuzz_hmac.rs:29 |
unwrap_without_check (high) |
Hmac::new_from_slice on a constant key in a fuzz target; HMAC accepts any key length, so it cannot fail |
bots/echidnabot/src/adapters/mod.rs:290 |
unwrap_without_check (high, 5x) |
test helper assert_child_reaped |
bots/echidnabot/src/api/rate_limit.rs:54 |
expect_in_hot_path (medium) |
mutex-poisoning expect |
bots/echidnabot/src/scheduler/job_queue.rs:216 |
expect_in_hot_path (medium) |
index from position() under the same lock |
#586 adds them to .hypatia-baseline.json with expires_at and this issue as tracking_issue, so governance / Validate Hypatia Baseline and the Hypatia code-scanning context stop failing on code that must be fixed upstream.
Acceptance criteria
Deferral issue under AGENTS.md §5c item 3, filed from #586.
Problem
PR #586 makes
bots/echidnabot/a pinned sync ofhyperpolymath/echidnabot(drift gate:vendored-bot-drift.yml). The fleet copy can no longer be edited locally, but Hypatia scans it and reports fourcode_safetyfindings in vendored upstream code:bots/echidnabot/fuzz/fuzz_targets/fuzz_hmac.rs:29unwrap_without_check(high)Hmac::new_from_sliceon a constant key in a fuzz target; HMAC accepts any key length, so it cannot failbots/echidnabot/src/adapters/mod.rs:290unwrap_without_check(high, 5x)assert_child_reapedbots/echidnabot/src/api/rate_limit.rs:54expect_in_hot_path(medium)expectbots/echidnabot/src/scheduler/job_queue.rs:216expect_in_hot_path(medium)position()under the same lock#586 adds them to
.hypatia-baseline.jsonwithexpires_atand this issue astracking_issue, sogovernance / Validate Hypatia Baselineand theHypatiacode-scanning context stop failing on code that must be fixed upstream.Acceptance criteria
hyperpolymath/echidnabot(the canonical source).bots/echidnabot/FLEET-SYNC.jsonis bumped to an upstream rev containing those fixes, viascripts/sync-vendored-bot.sh echidnabot --sync --rev <sha>..hypatia-baseline.json, andgovernance / Validate Hypatia Baselinestays green without them.Deferral issue under AGENTS.md §5c item 3, filed from #586.