Repository navigation
Consume panic-attack patch-bridge registry as a fact source #358
Description
Current state
Hypatia reads CVE alerts from GitHub APIs:
- DA001-DA004 — Dependabot alerts
- CSA001-CSA004 — CodeQL security alerts
It does not read panic-attack's local .machine_readable/patch-bridge/registry.json.
Gap
panic-attack establishes a per-CVE reach classification from local code analysis:
phantom-declared— listed inCargo.tomlbut nousesitephantom-transitive— not declared, pulled transitivelyreachable— declared and usedunreachable— declared, used, but not reachable from any entry point
Hypatia is currently blind to this richer classification and cannot reason over reach when scoring findings.
Proposed
Add a new fact source / rule module that reads .machine_readable/patch-bridge/registry.json from the repo under analysis.
- Schema home:
panic-attack/src/bridge/mod.rs(BridgeReportstruct) - In-flight schema change: panic-attack#16 splits prior
phantomintophantom-declaredvsphantom-transitive. Consumer should target the post-chore(deps): bump trufflesecurity/trufflehog from 3.92.4 to 3.92.5 #16 schema (checkschema_version).
Track E findings (motivation)
Today's Track E security sweep across 29 repos revealed that 26/29 repos contained transitive-dep misclassifications that Dependabot alone could not have surfaced. panic-attack catches these locally; hypatia is the natural aggregator.
Acceptance criteria
- Locate registry file at
<repo>/.machine_readable/patch-bridge/registry.json - Deserialize
BridgeReportmatching panic-attack'sschema_version(post-chore(deps): bump trufflesecurity/trufflehog from 3.92.4 to 3.92.5 #16) - Emit findings as hypatia facts (one per CVE entry; carry
reach+ classification + severity) - Smoke test against panic-attack's own registry
- Document the rule family identifier (suggest
PA001-PA004to mirror DA/CSA)
References
- panic-attack#16 — in-flight PR introducing split
reachvalues - Track E sweep summary (in-session, 26/29 repos affected)
Activity
hyperpolymath commentedon May 27, 2026
Downstream tracker: #359 enumerates higher-order composition rules that become possible once this issue lands the registry as a fact source.
hyperpolymath commentedon May 30, 2026
Scoped status (2026-05-30 — cicd label triage)
Quick read of the current state vs the acceptance criteria:
gh api repos/hyperpolymath/panic-attack/contents/.machine_readable/patch-bridge/registry.jsonreturns 404 today. No registry produced yet on the producer side.So two upstream gaps, both producer-side, before hypatia can consume:
registry.json(file does not exist).schema_versioncarried.Recommended plan (when upstream is ready)
crates/hypatia-rules/src/pa_reach/with PA001-PA004 mirroring DA/CSA shape.<repo>/.machine_readable/patch-bridge/registry.jsonas a fact source (deserializeBridgeReport; gate onschema_version).Action
Leaving open, blocked on panic-attack registry emission.
cicdlabel retained as the rule-family belongs to the CI/CD fact-source landscape.hyperpolymath commentedon Sep 30, 2026
Consolidated into the roadmap tracker #886 during the 2026-09-30 issue sweep. The idea is kept there as a checklist item; reopen this issue when work starts.