From a5e5ea54247ed6a052d95f3485d435fd6cf053a6 Mon Sep 17 00:00:00 2001 From: hyperpolymath Date: Tue, 22 Sep 2026 09:55:01 +0000 Subject: [PATCH 1/3] fix(main-red): code repairs for the post-#899 red main - actions.lock: drop two orphan entries (denoland/setup-deno, left by the Deno retirement; asana/push-signed-commits, left by the migration to the local signed-push action). The deno entry failed gh verification (stale); the asana entry failed Hypatia (transitive_dependencies_missing). - governance-reusable: restore the actions-lock-verify job (2026-09-02 regularisation spec 2a) by transplanting #899's lock gate + ledger out of workflow-lint; fix two hardcoded runs-on. Shape suite 14/14. - timeouts: add timeout-minutes: 10 to 5 jobs missing it. - perms: narrow workflow-level grants to job level (5 workflows); drop provably-dead grants (canon actions:read, monitor checks/PRs/actions:read, pr-target security-events:read, propagate PRs:write/actions:read). - hypatia-scan-reusable: drop the incidental 'length > 0' (#771 broke the empty-scan control; #741/#742 treat empty as valid). - debtfile: align test + spec glossary to the 4-field taxonomy encoding (#783's template, MUST section and validator agree; the 3-field form was the odd one out) + add the stable-id grammar check the spec requires. - wave4 + 3 scorecard checks + wave3 test: repair stale post-reorg paths (conformance runner, agentic-a2ml cd, session-mgmt exclusion, gatekeeper M1 manifest count, dashboard path). - .gitleaksignore: restore exact historical paths (reorg rewrote them). - signed-push-smoke: repair committed '$/' verifier-mutation corruption. - SECURITY.md: add (scorecard SecurityPolicy + missing_requirement). - SonarCloud: collapse identical if/else (S3923), curl --proto (S6506), NOSONAR+justification on operator-owned CLI paths (S8707 x5) and the base-checkout fork gate (S7631). --- .github/workflows/actions.lock | 18 +- .github/workflows/canon-spine-lockstep.yml | 3 +- .github/workflows/check-suite-monitor.yml | 8 +- .github/workflows/ci-pipeline.yml | 1 + .github/workflows/deed-conformance.yml | 1 + .../github-backup-mirror-reusable.yml | 2 +- .github/workflows/governance-reusable.yml | 192 ++++++++++-------- .github/workflows/hypatia-scan-reusable.yml | 7 +- .github/workflows/pages-archive.yml | 12 +- .github/workflows/propagate-hooks.yml | 12 +- .github/workflows/security-gate-pr-target.yml | 16 +- .github/workflows/signed-push-smoke.yml | 2 +- .github/workflows/tag-ruleset-canon.yml | 1 + .../workflows/tailscale-connect-reusable.yml | 1 + .gitleaksignore | 6 +- .../hypatia-baseline.schema.json | 2 +- .../0-ai-gatekeeper-protocol.scorecard.a2ml | 4 +- .../scorecards/agentic-a2ml.scorecard.a2ml | 2 +- ...ession-management-standards.scorecard.a2ml | 2 +- 1-formats/deed/tools/a2ml_to_deed.py | 17 +- 1-formats/deed/tools/deed_lint.py | 8 +- SECURITY.md | 31 +++ docs/DEBTFILE-SPEC.adoc | 10 +- docs/HYPATIA-BASELINE-FORMAT.adoc | 4 +- scripts/apply-baseline.sh | 6 +- scripts/check-debtfile-structure.sh | 11 + scripts/check-required-contexts.sh | 2 +- scripts/tests/debtfile-structure-test.sh | 19 +- scripts/tests/run-debtfile-test.sh | 5 +- scripts/tests/wave3-scorecards-test.sh | 6 +- scripts/tests/wave4-dyadt-test.sh | 2 +- 31 files changed, 258 insertions(+), 155 deletions(-) create mode 100644 SECURITY.md diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 189a2f36f..83a8fd4cb 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -61,7 +61,6 @@ workflows: '.github/workflows/governance-reusable.yml': - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393' - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' '.github/workflows/governance.yml': [] @@ -140,15 +139,14 @@ workflows: '.github/workflows/signed-push-smoke.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1' - - 'asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897' '.github/workflows/spark-theatre-gate.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - '.github/workflows/tailscale-connect-reusable.yml': - - 'tailscale/github-action@780049a30b6ff5c378a9e7b389d15ece7a204888' '.github/workflows/tag-ruleset-canon.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1' - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + '.github/workflows/tailscale-connect-reusable.yml': + - 'tailscale/github-action@780049a30b6ff5c378a9e7b389d15ece7a204888' dependencies: 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9': ref: '55cc8345863c7cc4c66a329aec7e433d2d1c52a9' @@ -202,18 +200,6 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' - 'asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897': - ref: 'v1.3' - commit: 'sha1-d615ca88d8e1a946734c24970d1e7a6c56f34897' - owner_id: 1472111 - repo_id: 772313726 - uses: - - 'actions/setup-python@v2' - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed': - ref: '22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' - commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' - owner_id: 42048915 - repo_id: 356423100 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de': ref: '02cb101ec7c40f2c49e1d9714d64511d8e1b74de' commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de' diff --git a/.github/workflows/canon-spine-lockstep.yml b/.github/workflows/canon-spine-lockstep.yml index 352dd01c3..0dc702a06 100644 --- a/.github/workflows/canon-spine-lockstep.yml +++ b/.github/workflows/canon-spine-lockstep.yml @@ -57,8 +57,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +# Least privilege: all three jobs only check out and run local scripts β€” +# `actions: read` was dead (nothing calls the Actions API). permissions: - actions: read contents: read jobs: diff --git a/.github/workflows/check-suite-monitor.yml b/.github/workflows/check-suite-monitor.yml index 2b6e108c9..6d14f927e 100644 --- a/.github/workflows/check-suite-monitor.yml +++ b/.github/workflows/check-suite-monitor.yml @@ -14,11 +14,12 @@ on: workflows: ["πŸ”΄ GATE: *", "🟑 CHECK: *"] types: [completed] +# Least privilege: both monitor jobs only read the event payload and log it +# (the github-script step makes no API calls β€” see its "would create an +# issue" comment). Event payloads need no grants; `checks/pull-requests/ +# actions: read` were dead. permissions: contents: read - checks: read - pull-requests: read - actions: read jobs: monitor-check-suite: @@ -224,6 +225,7 @@ jobs: summary: name: Check Suite Monitor Summary runs-on: ubuntu-latest + timeout-minutes: 10 needs: [monitor-check-suite, workflow-run-monitor] if: always() diff --git a/.github/workflows/ci-pipeline.yml b/.github/workflows/ci-pipeline.yml index d831065c7..1753044d7 100644 --- a/.github/workflows/ci-pipeline.yml +++ b/.github/workflows/ci-pipeline.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # # CI Pipeline (reusable) β€” secrets, SAST, per-ecosystem lint/format, coverage. diff --git a/.github/workflows/deed-conformance.yml b/.github/workflows/deed-conformance.yml index a3d6f7ae1..54b3db873 100644 --- a/.github/workflows/deed-conformance.yml +++ b/.github/workflows/deed-conformance.yml @@ -22,6 +22,7 @@ permissions: {} jobs: lint: runs-on: ubuntu-latest + timeout-minutes: 10 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/github-backup-mirror-reusable.yml b/.github/workflows/github-backup-mirror-reusable.yml index 2ada4e256..1885423f2 100644 --- a/.github/workflows/github-backup-mirror-reusable.yml +++ b/.github/workflows/github-backup-mirror-reusable.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # github-backup-mirror-reusable.yml β€” Reusable GitHubβ†’GitHub backup mirror. # # `mirror-reusable.yml` covers seven NON-GitHub forges (GitLab, Bitbucket, diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml index ed8b71ca6..3c8c48aaa 100644 --- a/.github/workflows/governance-reusable.yml +++ b/.github/workflows/governance-reusable.yml @@ -24,7 +24,7 @@ permissions: jobs: workflow-staleness: name: Check Workflow Staleness - runs-on: ubuntu-latest + runs-on: ${{ inputs.runs-on }} timeout-minutes: 10 outputs: has_baseline: ${{ steps.check.outputs.has_baseline }} @@ -180,7 +180,7 @@ jobs: # repo without a baseline blocked forever, by construction. The job now # always runs; the EXPENSIVE steps are guarded individually, so it still # costs nothing when there is no baseline to validate. - runs-on: ubuntu-latest + runs-on: ${{ inputs.runs-on }} timeout-minutes: 15 steps: - name: Checkout caller repository @@ -1082,9 +1082,6 @@ jobs: path: .standards-dupkey sparse-checkout: | scripts/check-workflow-duplicate-keys.sh - scripts/update-actions-lock.sh - scripts/check-actions-lock-gate.sh - .machine_readable/lock-allow.txt sparse-checkout-cone-mode: false # ⚠ Not fatal if a file is absent, and the next step names precisely # which one was missing. Formerly this followed `main`, so a rename of @@ -1121,46 +1118,9 @@ jobs: exit 1 fi cp "$SCRIPT" "$RUNNER_TEMP/dupkeys.sh" - # The lockfile gate below runs in a consumer checkout, where the - # standards helper is not present. Preserve the canonical helper - # before removing this sparse standards checkout. - LOCK_SCRIPT=".standards-dupkey/scripts/update-actions-lock.sh" - if [ ! -f "$LOCK_SCRIPT" ] && [ -f scripts/update-actions-lock.sh ]; then - LOCK_SCRIPT="scripts/update-actions-lock.sh" - echo "Using this repository's own actions-lock verifier (standards self-lint)." - fi - if [ ! -f "$LOCK_SCRIPT" ]; then - echo "::error::actions-lock verifier not found β€” neither fetched from" \ - "standards@main nor present locally." - exit 1 - fi - cp "$LOCK_SCRIPT" "$RUNNER_TEMP/update-actions-lock.sh" - # The actions-lock GATE and its exemption ledger, same idiom: preserve - # them before this sparse standards checkout leaves the workspace. - GATE_SCRIPT=".standards-dupkey/scripts/check-actions-lock-gate.sh" - if [ ! -f "$GATE_SCRIPT" ] && [ -f scripts/check-actions-lock-gate.sh ]; then - GATE_SCRIPT="scripts/check-actions-lock-gate.sh" - echo "Using this repository's own actions-lock gate (standards self-lint)." - fi - if [ ! -f "$GATE_SCRIPT" ]; then - echo "::error::actions-lock gate not found β€” neither fetched from the" \ - "pinned standards helpers nor present locally." - exit 1 - fi - cp "$GATE_SCRIPT" "$RUNNER_TEMP/check-actions-lock-gate.sh" - LEDGER=".standards-dupkey/.machine_readable/lock-allow.txt" - if [ ! -f "$LEDGER" ] && [ -f .machine_readable/lock-allow.txt ]; then - LEDGER=".machine_readable/lock-allow.txt" - fi - # A MISSING ledger must not silently exempt everyone, nor silently - # exempt no one. Stage an empty file and let the gate step print the - # denominator it actually read β€” a skip is not a pass. - if [ -f "$LEDGER" ]; then - cp "$LEDGER" "$RUNNER_TEMP/lock-allow.txt" - else - echo "::warning::actions-lock exemption ledger not found; treating it as EMPTY (no repo is exempt)." - : > "$RUNNER_TEMP/lock-allow.txt" - fi + # NOTE: the actions-lock gate used to be staged here too. It is its + # own job now (`actions-lock-verify`, its own required context per + # the 2026-09-02 regularisation spec Β§6.2) β€” see that job below. rm -rf .standards-dupkey bash "$RUNNER_TEMP/dupkeys.sh" .github/workflows @@ -1192,17 +1152,114 @@ jobs: done [ $failed -eq 1 ] && { echo "Add SPDX header + permissions:"; exit 1; } echo "All workflows have SPDX headers + permissions" + # The actions-lock-verify job proves a pin has the right SHAPE. It cannot + # prove the SHA EXISTS β€” a fabricated 40-hex string passes it. + # Measured 2026-07-28: + # 112 of 613 unique estate pins (18%) do not resolve, in 876 committed + # files. An unresolvable `uses:` yields NO check run, so those repos look + # green while the job never ran. This step closes that gap. + - name: Checkout standards for the pin-existence gate + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: hyperpolymath/standards + # Immutable pin, for the same reason as the policy-helper checkout + # above: following `main` lets one standards push change the + # behaviour of every already-pinned caller with no review. + ref: 317101e03b8fe642589498f4bdb84541ab466062 + path: .standards-checkout + persist-credentials: false + sparse-checkout: | + scripts + sparse-checkout-cone-mode: false + - name: Check action pins resolve upstream + env: + GH_TOKEN: ${{ github.token }} + run: | + # Copy out and delete the checkout before scanning, so the standards + # tree is never part of the caller's workspace (same idiom as the + # allowlist preflight above). + cp .standards-checkout/scripts/check-action-pins-resolve.sh "$RUNNER_TEMP/" + rm -rf .standards-checkout + bash "$RUNNER_TEMP/check-action-pins-resolve.sh" . + - name: Check for duplicate workflows + run: | + if [ -f .github/workflows/codeql.yml ] && [ -f .github/workflows/codeql-analysis.yml ]; then + echo "ERROR: Duplicate CodeQL workflows found"; exit 1 + fi + echo "No critical duplicates found" + + actions-lock-verify: + name: Actions lockfile verify + runs-on: ${{ inputs.runs-on }} + timeout-minutes: 10 + permissions: + contents: read + steps: + - name: Checkout caller repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: ${{ github.repository }} + ref: ${{ github.sha }} + - name: Checkout standards for the lock gate + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: hyperpolymath/standards + # ⚠ BUMP THIS whenever scripts/check-actions-lock-gate.sh, + # scripts/update-actions-lock.sh or .machine_readable/lock-allow.txt + # changes, or callers are judged against a stale gate. Pinned to an + # immutable commit for the same reason as the dupkey helpers in + # workflow-lint: following `main` would let an edit in standards + # change the verdict of every already-pinned caller with no review + # in their repositories. + ref: 4f7f02ca528212c578fd56379a202d219d01abe0 + path: .standards-lock + persist-credentials: false + sparse-checkout: | + scripts/check-actions-lock-gate.sh + scripts/update-actions-lock.sh + .machine_readable/lock-allow.txt + sparse-checkout-cone-mode: false - name: Check locked or SHA-pinned actions env: GH_TOKEN: ${{ github.token }} run: | set -uo pipefail + # Stage the gate, the verifier and the exemption ledger. When THIS + # repository is standards, its own working tree already holds all + # three (self-lint); every other caller uses the pinned checkout. + if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then + SRC=scripts + LEDGERSRC=.machine_readable + echo "Using this repository's own gate + verifier + ledger (standards self-lint)." + else + SRC=.standards-lock/scripts + LEDGERSRC=.standards-lock/.machine_readable + fi + for f in check-actions-lock-gate.sh update-actions-lock.sh; do + if [ ! -f "$SRC/$f" ]; then + echo "::error::actions-lock gate: $f not found in $SRC (pinned standards checkout failed?)" + exit 1 + fi + cp "$SRC/$f" "$RUNNER_TEMP/$f" + done + # A MISSING ledger must not silently exempt everyone, nor silently + # exempt no one. Stage an empty file and let the gate below print + # the denominator it actually read β€” a skip is not a pass. + if [ -f "$LEDGERSRC/lock-allow.txt" ]; then + cp "$LEDGERSRC/lock-allow.txt" "$RUNNER_TEMP/lock-allow.txt" + else + echo "::warning::actions-lock exemption ledger not found; treating it as EMPTY (no repo is exempt)." + : > "$RUNNER_TEMP/lock-allow.txt" + fi + rm -rf .standards-lock + # ONE implementation of the lock/pin predicate, not two. # - # This step used to carry its own inline copy of the logic. That copy - # matched `^[[:space:]]+uses:` β€” with no `-?` β€” so it never saw - # `- uses: foo@v1`, the commonest step form, and its green was - # therefore partly vacuous. scripts/check-actions-lock-gate.sh uses + # The gate used to live inside workflow-lint with its own inline copy + # of the logic. That copy matched `^[[:space:]]+uses:` β€” with no + # `-?` β€” so it never saw `- uses: foo@v1`, the commonest step form, + # and its green was therefore partly vacuous. + # scripts/check-actions-lock-gate.sh uses # `^[[:space:]]+-?[[:space:]]*uses:` and is the tested implementation # (scripts/tests/check-actions-lock-gate-test.sh, 11/11). # @@ -1219,8 +1276,7 @@ jobs: fi # The gate delegates lockfile verification to the authoritative - # verifier. Both were staged into RUNNER_TEMP by the duplicate-key - # step, before its sparse standards checkout left the workspace. + # verifier, staged into RUNNER_TEMP above. export ACTIONS_LOCK_VERIFIER="$RUNNER_TEMP/update-actions-lock.sh" bash "$RUNNER_TEMP/check-actions-lock-gate.sh" rc=$? @@ -1256,40 +1312,6 @@ jobs: # Never a silent pass: state the denominator even when clean. echo "lock debt: $total ledgered repositories; $GITHUB_REPOSITORY is NOT among them." exit "$rc" - # The step above proves a pin has the right SHAPE. It cannot prove the - # SHA EXISTS β€” a fabricated 40-hex string passes it. Measured 2026-07-28: - # 112 of 613 unique estate pins (18%) do not resolve, in 876 committed - # files. An unresolvable `uses:` yields NO check run, so those repos look - # green while the job never ran. This step closes that gap. - - name: Checkout standards for the pin-existence gate - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - repository: hyperpolymath/standards - # Immutable pin, for the same reason as the policy-helper checkout - # above: following `main` lets one standards push change the - # behaviour of every already-pinned caller with no review. - ref: 317101e03b8fe642589498f4bdb84541ab466062 - path: .standards-checkout - persist-credentials: false - sparse-checkout: | - scripts - sparse-checkout-cone-mode: false - - name: Check action pins resolve upstream - env: - GH_TOKEN: ${{ github.token }} - run: | - # Copy out and delete the checkout before scanning, so the standards - # tree is never part of the caller's workspace (same idiom as the - # allowlist preflight above). - cp .standards-checkout/scripts/check-action-pins-resolve.sh "$RUNNER_TEMP/" - rm -rf .standards-checkout - bash "$RUNNER_TEMP/check-action-pins-resolve.sh" . - - name: Check for duplicate workflows - run: | - if [ -f .github/workflows/codeql.yml ] && [ -f .github/workflows/codeql-analysis.yml ]; then - echo "ERROR: Duplicate CodeQL workflows found"; exit 1 - fi - echo "No critical duplicates found" trusted-base: name: Trusted-base reduction policy diff --git a/.github/workflows/hypatia-scan-reusable.yml b/.github/workflows/hypatia-scan-reusable.yml index 83dd71eb7..33befadd0 100644 --- a/.github/workflows/hypatia-scan-reusable.yml +++ b/.github/workflows/hypatia-scan-reusable.yml @@ -126,9 +126,12 @@ jobs: run: | set -euo pipefail # Exactly one JSON array of findings, each with a recognised severity. - # Missing/truncated output is a scanner error, never an empty clean scan. + # Missing/truncated output is a scanner error; an empty array is a + # clean scan (the `length > 0` the #771 rewrite added broke the + # `empty findings are valid` control β€” #741/#742 always treated an + # empty scan as valid). if [ ! -s hypatia-findings.json ] || ! jq -e ' - type == "array" and length > 0 and all(.[]; + type == "array" and all(.[]; type == "object" and (.severity as $s | ["critical", "high", "medium", "warn", "low", "info", "informational"] | index($s) != null)) ' hypatia-findings.json >/dev/null; then diff --git a/.github/workflows/pages-archive.yml b/.github/workflows/pages-archive.yml index 4c5503499..e3166801d 100644 --- a/.github/workflows/pages-archive.yml +++ b/.github/workflows/pages-archive.yml @@ -8,11 +8,10 @@ on: branches: [main] workflow_dispatch: +# Least privilege: build reads, deploy publishes. Job-level permissions +# REPLACE (not union) the top level, so each job block below is self-sufficient. permissions: - actions: read contents: read - pages: write - id-token: write concurrency: group: "pages" @@ -22,6 +21,10 @@ jobs: build: timeout-minutes: 20 runs-on: ubuntu-latest + permissions: + # Job level replaces the top level β€” restate the checkout read grant. + contents: read + actions: read steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -97,6 +100,9 @@ jobs: url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest needs: build + permissions: + pages: write + id-token: write steps: - name: Deploy to GitHub Pages id: deployment diff --git a/.github/workflows/propagate-hooks.yml b/.github/workflows/propagate-hooks.yml index 8fbba2d51..24bfa73c4 100644 --- a/.github/workflows/propagate-hooks.yml +++ b/.github/workflows/propagate-hooks.yml @@ -29,10 +29,11 @@ on: repository_dispatch: types: [refresh-githooks] +# Least privilege (WH002/S8233): only the `propagate` job pushes, so only it +# carries `contents: write` (job level). `pull-requests: write` and +# `actions: read` were dead β€” no step opens a PR or calls the Actions API. permissions: - contents: write # Required to push hook updates to target repos - pull-requests: write - actions: read + contents: read # Only run one instance at a time concurrency: @@ -165,6 +166,10 @@ jobs: runs-on: ubuntu-latest needs: identify-repos timeout-minutes: 60 + permissions: + # Required to push hook updates to target repos. Job level replaces + # the top level; `contents: write` implies read, so this is sufficient. + contents: write strategy: matrix: repo: ${{ fromJson(needs.identify-repos.outputs.repos) }} @@ -312,6 +317,7 @@ jobs: summary: name: Propagation Summary runs-on: ubuntu-latest + timeout-minutes: 10 needs: [identify-repos, propagate] if: always() diff --git a/.github/workflows/security-gate-pr-target.yml b/.github/workflows/security-gate-pr-target.yml index 1f123595c..57b30ea1e 100644 --- a/.github/workflows/security-gate-pr-target.yml +++ b/.github/workflows/security-gate-pr-target.yml @@ -9,10 +9,11 @@ on: branches: [main, master] types: [opened, synchronize, reopened, ready_for_review] +# Least privilege: only the fork-PR job comments, so only it carries +# `pull-requests: write` (job level). `security-events: read` was dead β€” +# no step reads code-scanning alerts. permissions: contents: read - pull-requests: write - security-events: read # Critical: This runs in the BASE repository context, not the PR fork # This allows safe scanning of untrusted code from forks @@ -21,10 +22,18 @@ jobs: name: Security Checks for Fork PRs runs-on: ubuntu-latest timeout-minutes: 15 + permissions: + # Job level replaces the top level β€” restate the checkout read grant + # alongside the PR-comment grant this job's github-script step needs. + contents: read + pull-requests: write steps: - name: Checkout base repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + # NOSONAR githubactions:S7631 β€” this IS the remediated shape: the + # workflow checks out the BASE branch (never the fork's code) and + # only statically scans the PR diff; nothing from the fork executes. + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 NOSONAR with: # Explicitly checkout the base branch, not the PR branch ref: ${{ github.base_ref }} @@ -214,6 +223,7 @@ jobs: final-summary: name: Security Gate Summary runs-on: ubuntu-latest + timeout-minutes: 10 needs: [security-check-fork-pr, security-check-regular-pr] if: always() diff --git a/.github/workflows/signed-push-smoke.yml b/.github/workflows/signed-push-smoke.yml index 00782a22f..a016b5c56 100644 --- a/.github/workflows/signed-push-smoke.yml +++ b/.github/workflows/signed-push-smoke.yml @@ -53,7 +53,7 @@ jobs: git commit -m "test(signed-push): verified-commit smoke [run ${GITHUB_RUN_ID}]" - name: Push the local commit as Verified (via the App) - uses: $/.github/actions/signed-push + uses: ./.github/actions/signed-push with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} diff --git a/.github/workflows/tag-ruleset-canon.yml b/.github/workflows/tag-ruleset-canon.yml index 756dae883..08ce32fb8 100644 --- a/.github/workflows/tag-ruleset-canon.yml +++ b/.github/workflows/tag-ruleset-canon.yml @@ -41,6 +41,7 @@ permissions: jobs: converge: runs-on: ubuntu-latest + timeout-minutes: 10 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/tailscale-connect-reusable.yml b/.github/workflows/tailscale-connect-reusable.yml index 6587353e7..b87f2ee65 100644 --- a/.github/workflows/tailscale-connect-reusable.yml +++ b/.github/workflows/tailscale-connect-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # diff --git a/.gitleaksignore b/.gitleaksignore index 81a8afcc3..a680ac8a9 100644 --- a/.gitleaksignore +++ b/.gitleaksignore @@ -4,6 +4,6 @@ # from the current tree, and the exposed Cloudflare token was removed by # 080c3941f091bdc1b94fa32cf11362a77f8fe01a. Keep that token revoked: these # entries do not suppress the same rules in any new commit or location. -55ad53331e530d44b2ada3fb2ca80a024625dbac:2-protocols/avow/avow-lib/examples/python/stamp_example.py:generic-api-key:237 -55ad53331e530d44b2ada3fb2ca80a024625dbac:2-protocols/avow/avow-lib/examples/python/stamp_example.py:generic-api-key:251 -55ad53331e530d44b2ada3fb2ca80a024625dbac:2-protocols/avow/deploy-repos.sh:cloudflare-api-key:5 +55ad53331e530d44b2ada3fb2ca80a024625dbac:avow-protocol/avow-lib/examples/python/stamp_example.py:generic-api-key:237 +55ad53331e530d44b2ada3fb2ca80a024625dbac:avow-protocol/avow-lib/examples/python/stamp_example.py:generic-api-key:251 +55ad53331e530d44b2ada3fb2ca80a024625dbac:avow-protocol/deploy-repos.sh:cloudflare-api-key:5 diff --git a/.machine_readable/hypatia-baseline.schema.json b/.machine_readable/hypatia-baseline.schema.json index 67d04625b..8e4f0156c 100644 --- a/.machine_readable/hypatia-baseline.schema.json +++ b/.machine_readable/hypatia-baseline.schema.json @@ -20,7 +20,7 @@ "severity": { "description": "Severity of the finding as reported by Hypatia. Must match the finding's severity exactly for the entry to apply.", "type": "string", - "enum": ["critical", "high", "medium", "low", "info"] + "enum": ["critical", "high", "medium", "warn", "low", "info", "informational"] }, "rule_module": { "description": "Hypatia rule module that emitted the finding (e.g. `cicd_rules`, `code_safety`, `migration_rules`).", diff --git a/.machine_readable/scorecards/0-ai-gatekeeper-protocol.scorecard.a2ml b/.machine_readable/scorecards/0-ai-gatekeeper-protocol.scorecard.a2ml index 3155c58d0..a73b19d1b 100644 --- a/.machine_readable/scorecards/0-ai-gatekeeper-protocol.scorecard.a2ml +++ b/.machine_readable/scorecards/0-ai-gatekeeper-protocol.scorecard.a2ml @@ -14,8 +14,8 @@ id = "M1" text = "The repository MUST contain exactly one AI manifest file, named 0-AI-MANIFEST.a2ml (or a permitted alias), located in the repository root, per docs/AI-MANIFEST-SPEC.adoc Β§File Naming." system = "none (no automated validator script checks this in CI; verified manually via directory listing)" status = "pass" -evidence = "find confirms exactly one manifest at /home/user/standards/0-ai-gatekeeper-protocol/0-AI-MANIFEST.a2ml; no AI.a2ml, !AI.a2ml, or duplicate found at root." -check = "test -f 2-protocols/0-ai-gatekeeper/0-AI-MANIFEST.a2ml && [ $(find 0-ai-gatekeeper-protocol -maxdepth 1 \\( -iname \"0-AI-MANIFEST.a2ml\" -o -iname \"AI.a2ml\" -o -iname \"!AI.a2ml\" \\) | wc -l) -eq 1 ]" +evidence = "find confirms exactly one manifest at ./0-AI-MANIFEST.a2ml (repo root); no AI.a2ml, !AI.a2ml, or duplicate at root. (2-protocols/0-ai-gatekeeper/0-AI-MANIFEST.a2ml is protocol guidance sharing the filename, not a repo manifest.)" +check = "[ $(find . -maxdepth 1 \\( -iname \"0-AI-MANIFEST.a2ml\" -o -iname \"AI.a2ml\" -o -iname \"!AI.a2ml\" \\) | wc -l) -eq 1 ]" effects = "If violated, downstream MCP/FUSE parsers (mcp-repo-guardian, repo-guardian-fs) that assume a single canonical manifest path would pick an arbitrary or wrong file, breaking attestation for every consuming repo/agent." [[must]] diff --git a/.machine_readable/scorecards/agentic-a2ml.scorecard.a2ml b/.machine_readable/scorecards/agentic-a2ml.scorecard.a2ml index c86902feb..ca7e1dd64 100644 --- a/.machine_readable/scorecards/agentic-a2ml.scorecard.a2ml +++ b/.machine_readable/scorecards/agentic-a2ml.scorecard.a2ml @@ -15,7 +15,7 @@ text = "The repository MUST provide a normative specification document defining system = "spec/AGENTIC-FORMAT-SPEC.adoc (383 lines, present and referenced from README.adoc)" status = "pass" evidence = "/home/user/standards/agentic-a2ml/spec/AGENTIC-FORMAT-SPEC.adoc exists (383 lines) and is linked as 'the complete normative specification' from README.adoc." -check = "cd agentic-a2ml && test -f spec/AGENTIC-FORMAT-SPEC.adoc && [ \"$(wc -l < spec/AGENTIC-FORMAT-SPEC.adoc)\" -ge 383 ] && grep -q \"AGENTIC-FORMAT-SPEC.adoc\\[spec/AGENTIC-FORMAT-SPEC.adoc\\]\" README.adoc" +check = "cd 1-formats/a2ml/agentic && test -f spec/AGENTIC-FORMAT-SPEC.adoc && [ \"$(wc -l < spec/AGENTIC-FORMAT-SPEC.adoc)\" -ge 383 ] && grep -q \"AGENTIC-FORMAT-SPEC.adoc\\[spec/AGENTIC-FORMAT-SPEC.adoc\\]\" README.adoc" effects = "Consumers (playbook-a2ml, meta-a2ml, downstream agent tooling) rely on this document as the authoritative contract for gating-policy fields; without it, dependent repos cannot implement conformant readers." [[must]] diff --git a/.machine_readable/scorecards/session-management-standards.scorecard.a2ml b/.machine_readable/scorecards/session-management-standards.scorecard.a2ml index 4eb136f8e..812e2e395 100644 --- a/.machine_readable/scorecards/session-management-standards.scorecard.a2ml +++ b/.machine_readable/scorecards/session-management-standards.scorecard.a2ml @@ -59,7 +59,7 @@ text = "Retired protocol names (maintenance-check, planned-termination, handover system = "none" status = "pass" evidence = "grep across the monorepo (*.adoc, *.md) for 'maintenance-check', 'planned-termination', 'handover-preparation' returns no hits outside this directory's own README retirement notice." -check = "! grep -rn \"maintenance-check\\|planned-termination\\|handover-preparation\" --include=\"*.adoc\" --include=\"*.md\" . | grep -v \"^./session-management-standards/README.adoc\" | grep -q ." +check = "! grep -rn \"maintenance-check\\|planned-termination\\|handover-preparation\" --include=\"*.adoc\" --include=\"*.md\" . | grep -v \"^./3-practice/session-management-standards/README.adoc\" | grep -q ." effects = "n/a β€” no stale cross-references found, so no downstream confusion currently." [[should]] diff --git a/1-formats/deed/tools/a2ml_to_deed.py b/1-formats/deed/tools/a2ml_to_deed.py index b12cea1f4..3fdb19ea6 100644 --- a/1-formats/deed/tools/a2ml_to_deed.py +++ b/1-formats/deed/tools/a2ml_to_deed.py @@ -83,7 +83,10 @@ def val(v, what="value", closed=None): def spdx_of(path, profile=None): headers = [] - with open(path, encoding="utf-8") as fh: + # NOSONAR pythonsecurity:S8707 β€” local CLI converter: `path` is an + # operator-supplied filepath, not a trust boundary (CI passes only + # hardcoded repo paths; see deed-conformance.yml). + with open(path, encoding="utf-8") as fh: # NOSONAR for line in fh: m = re.match(r"^;;?\s*(SPDX-\S.*)$", line.rstrip("\n")) or re.match( r"^#\s*(SPDX-\S.*)$", line.rstrip("\n") @@ -98,7 +101,8 @@ def spdx_of(path, profile=None): def parse_a2ml(path): - src = open(path, encoding="utf-8").read() + # NOSONAR pythonsecurity:S8707 β€” see spdx_of above: operator-owned CLI path. + src = open(path, encoding="utf-8").read() # NOSONAR prof = re.findall(r"^\s*@profile\(\s*id\s*=\s*([^\s)]+)\s*\)", src, flags=re.M) body = re.sub(r"^\s*@profile\([^\n]*\)\s*\n", "", src, flags=re.M) try: @@ -307,10 +311,7 @@ def emit_ecosystem_clause(data, canonical_name): if unknown: raise TranslateError(f"ecosystem: related-projects entry untabled key(s) {sorted(unknown)}") L.append(f" (related :name {esc(r['name'])} :relationship {sym(r['relationship'], 'relationship', RELATIONSHIPS)} :notes {esc(r['notes'])})") - if rp["projects"]: - L[-1] = L[-1] + ")" - else: - L[-1] = L[-1] + ")" + L[-1] = L[-1] + ")" return "\n".join(L) @@ -540,7 +541,9 @@ def main(argv): cname = a.canonical_name text, fname = compose_deed(headers, a.canonical_name, a.beholding_chora, clauses, out_name=a.out) if a.out: - with open(a.out, "w", encoding="utf-8") as fh: + # NOSONAR pythonsecurity:S8707 β€” see spdx_of above: operator-owned + # CLI --out path; the tool writes where its operator tells it to. + with open(a.out, "w", encoding="utf-8") as fh: # NOSONAR fh.write(text) print(f"EMITTED {a.out} (validated by deed_lint, dispatch {fname})") else: diff --git a/1-formats/deed/tools/deed_lint.py b/1-formats/deed/tools/deed_lint.py index 2b045b804..af99a641d 100644 --- a/1-formats/deed/tools/deed_lint.py +++ b/1-formats/deed/tools/deed_lint.py @@ -395,7 +395,10 @@ def _fixtures(d): for sub, expect in (("valid", True), ("invalid", False)): for f in sorted(glob.glob(os.path.join(d, sub, "*.deed"))): try: - validate(open(f, encoding="utf-8").read(), filename=f) + # NOSONAR pythonsecurity:S8707 β€” local CLI linter: paths come + # from the operator's argv / a fixed fixtures dir, not a trust + # boundary (CI passes only hardcoded repo paths). + validate(open(f, encoding="utf-8").read(), filename=f) # NOSONAR got, err = True, "" except LintError as e: got, err = False, str(e) @@ -421,7 +424,8 @@ def main(argv): bad = 0 for f in files: try: - with open(f, encoding="utf-8") as fh: + # NOSONAR pythonsecurity:S8707 β€” see _fixtures above: operator argv. + with open(f, encoding="utf-8") as fh: # NOSONAR validate(fh.read(), filename=f) print(f"OK {f}") except LintError as e: diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..4e5974888 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,31 @@ +# Security Policy + +`hyperpolymath/standards` is the policy-and-tooling canon for the estate: it +ships specifications, CI workflows, and small local utilities β€” no networked +services and no production credentials. + +## Supported versions + +Only the tip of `main` is supported. The workflows and scripts in this +repository are consumed by pinned commit SHA across the estate; older commits +are superseded, not maintained. + +## Reporting a vulnerability + +**Do not open a public issue.** Use one of these private channels: + +1. [Private vulnerability reporting](https://github.com/hyperpolymath/standards/security/advisories/new) + on this repository (preferred β€” keeps the report linked to the fix), or +2. Email the maintainer: `j.d.a.jewell@open.ac.uk`. + +Include the affected file(s) and commit SHA, steps to reproduce, and the +impact you see. Reports are acknowledged within 7 days; fixes land as +ordinary pull requests and are credited in the release notes unless you ask +otherwise. + +## Scope notes + +- Findings from the estate's own scanners (Hypatia, CodeQL, secret scanning) + are already tracked: see `.hypatia-baseline.json` for acknowledged items. +- Supply-chain pins live in `.github/workflows/actions.lock`, verified in CI + on every change β€” a stale lock fails the build rather than shipping. diff --git a/docs/DEBTFILE-SPEC.adoc b/docs/DEBTFILE-SPEC.adoc index 56b12fb3d..d47ca9fe2 100644 --- a/docs/DEBTFILE-SPEC.adoc +++ b/docs/DEBTFILE-SPEC.adoc @@ -137,20 +137,22 @@ per the standing owner directive in `.claude/CLAUDE.md`: licence changes are manual, per-file and owner-only, and every prior bulk sweep scrambled identifiers or reverted owner decisions. -`taxonomy-default-arm`, `taxonomy-selected-arm`, `taxonomy-departure-reason`:: +`taxonomy-choice`, `taxonomy-default-arm`, `taxonomy-non-default-arm`, `taxonomy-departure-reason`:: The required, machine-checkable encoding for an entry that records a testing -taxonomy choice. The first two fields are stable identifiers matching +taxonomy choice (see <>). `taxonomy-choice` is the +literal `non-default`. The two arm fields are stable identifiers matching `[a-z0-9][a-z0-9._-]*`; they record the elegant long-term arm and the different arm actually selected. `taxonomy-departure-reason` records why the non-default -arm is accepted on this occasion. All three fields must appear together, the +arm is accepted on this occasion. All four fields must appear together, the two arm identifiers must differ, and the reason must be non-empty. Neither `description` nor `tracking` substitutes for any member of this group: those fields continue to describe the debt and point to its external work item. [source] ---- +- taxonomy-choice: non-default - taxonomy-default-arm: adapt-proven-idris2-test -- taxonomy-selected-arm: write-local-test +- taxonomy-non-default-arm: write-local-test - taxonomy-departure-reason: the proven suite cannot yet exercise this host API ---- diff --git a/docs/HYPATIA-BASELINE-FORMAT.adoc b/docs/HYPATIA-BASELINE-FORMAT.adoc index 5029f209f..83c284fa1 100644 --- a/docs/HYPATIA-BASELINE-FORMAT.adoc +++ b/docs/HYPATIA-BASELINE-FORMAT.adoc @@ -52,7 +52,9 @@ Hypatia finding, plus optional metadata. == Required fields -`severity`:: One of `critical`, `high`, `medium`, `low`, `info`. Must +`severity`:: One of `critical`, `high`, `medium`, `warn`, `low`, `info`, +`informational` β€” the scanner's full vocabulary (`warn` is what the research +rules emit; it ranks with `medium`). Must match the finding's reported severity exactly for the entry to apply. `rule_module`:: Hypatia rule module (e.g. `cicd_rules`, `code_safety`, diff --git a/scripts/apply-baseline.sh b/scripts/apply-baseline.sh index efda04ac2..58fc87056 100755 --- a/scripts/apply-baseline.sh +++ b/scripts/apply-baseline.sh @@ -82,7 +82,11 @@ echo "$BASELINE_JSON" | jq -e 'type == "array"' >/dev/null || { SCHEMA_ERRORS="$(jq -r ' def known: ["severity","rule_module","type","file","file_pattern", "severity_override","expires_at","note","tracking_issue"]; - def sevs: ["critical","high","medium","low","info"]; + # Scanner vocabulary, mirroring the hypatia-scan-reusable validator: the + # research rules emit `warn` (ranked with medium) and some rules emit + # `informational`. Without these, research findings can never be + # acknowledged and the baseline gate can never go green on them. + def sevs: ["critical","high","medium","warn","low","info","informational"]; [ to_entries[] | .key as $i | .value as $e | if ($e|type) != "object" then "entry[\($i)]: not an object" else ( diff --git a/scripts/check-debtfile-structure.sh b/scripts/check-debtfile-structure.sh index bbfac55df..9ded16fa2 100755 --- a/scripts/check-debtfile-structure.sh +++ b/scripts/check-debtfile-structure.sh @@ -104,6 +104,17 @@ validate() { if [ -n "$taxonomy_default" ] && [ "$taxonomy_default" = "$taxonomy_non_default" ]; then bad "'$name' taxonomy-default-arm and taxonomy-non-default-arm must name different arms" fi + # Stable-identifier grammar per DEBTFILE-SPEC Β§Fields: [a-z0-9][a-z0-9._-]*. + if [ -n "$taxonomy_default" ]; then + case "$taxonomy_default" in + *[!a-z0-9._-]*|[^a-z0-9]*) bad "'$name' taxonomy-default-arm '$taxonomy_default' is not a stable identifier ([a-z0-9][a-z0-9._-]*)" ;; + esac + fi + if [ -n "$taxonomy_non_default" ]; then + case "$taxonomy_non_default" in + *[!a-z0-9._-]*|[^a-z0-9]*) bad "'$name' taxonomy-non-default-arm '$taxonomy_non_default' is not a stable identifier ([a-z0-9][a-z0-9._-]*)" ;; + esac + fi fi if [ -n "$accepted" ]; then diff --git a/scripts/check-required-contexts.sh b/scripts/check-required-contexts.sh index 7110d6dad..ca678370f 100755 --- a/scripts/check-required-contexts.sh +++ b/scripts/check-required-contexts.sh @@ -130,7 +130,7 @@ fetch_reusable() { # owner/repo/workflow@ref -> path on stdout, or empty cache="$(mktemp)"; TMP_FILES="${TMP_FILES:-} $cache" fi [ "$OFFLINE" = 1 ] && return 1 - if curl -fsSL "$url" -o "$cache" 2>/dev/null; then + if curl -fsSL --proto '=https' "$url" -o "$cache" 2>/dev/null; then printf '%s\n' "$cache" else rm -f "$cache"; return 1 diff --git a/scripts/tests/debtfile-structure-test.sh b/scripts/tests/debtfile-structure-test.sh index d9e078759..ec79a6471 100755 --- a/scripts/tests/debtfile-structure-test.sh +++ b/scripts/tests/debtfile-structure-test.sh @@ -41,8 +41,9 @@ expect 0 "a complete taxonomy choice is valid" <<'EOF' - ceiling: 1 - severity: high - policy: remediable +- taxonomy-choice: non-default - taxonomy-default-arm: adapt-proven-idris2-test -- taxonomy-selected-arm: write-local-test +- taxonomy-non-default-arm: write-local-test - taxonomy-departure-reason: the host API is not supported by the proven suite - accepted-until: 2030-01-01 EOF @@ -55,8 +56,9 @@ expect 1 "a partial taxonomy choice is rejected" <<'EOF' - ceiling: 1 - severity: high - policy: remediable +- taxonomy-choice: non-default - taxonomy-default-arm: adapt-proven-idris2-test -- taxonomy-selected-arm: write-local-test +- taxonomy-non-default-arm: write-local-test - accepted-until: 2030-01-01 EOF @@ -68,8 +70,9 @@ expect 1 "an empty taxonomy-choice encoding is rejected" <<'EOF' - ceiling: 1 - severity: high - policy: remediable +- taxonomy-choice: non-default - taxonomy-default-arm: -- taxonomy-selected-arm: +- taxonomy-non-default-arm: - taxonomy-departure-reason: - accepted-until: 2030-01-01 EOF @@ -82,8 +85,9 @@ expect 1 "a taxonomy choice must select the non-default arm" <<'EOF' - ceiling: 1 - severity: high - policy: remediable +- taxonomy-choice: non-default - taxonomy-default-arm: adapt-proven-idris2-test -- taxonomy-selected-arm: adapt-proven-idris2-test +- taxonomy-non-default-arm: adapt-proven-idris2-test - taxonomy-departure-reason: no departure actually recorded - accepted-until: 2030-01-01 EOF @@ -96,8 +100,9 @@ expect 1 "taxonomy arm identifiers use the stable-id grammar" <<'EOF' - ceiling: 1 - severity: high - policy: remediable +- taxonomy-choice: non-default - taxonomy-default-arm: Adapt proven test -- taxonomy-selected-arm: write-local-test +- taxonomy-non-default-arm: write-local-test - taxonomy-departure-reason: the host API is not supported by the proven suite - accepted-until: 2030-01-01 EOF @@ -153,8 +158,8 @@ expect 0 "a complete testing-taxonomy departure records both arms and its reason - severity: high - policy: remediable - taxonomy-choice: non-default -- taxonomy-default-arm: adapt the proven Idris2 test -- taxonomy-non-default-arm: retain the temporary local test +- taxonomy-default-arm: adapt-proven-idris2-test +- taxonomy-non-default-arm: retain-temporary-local-test - taxonomy-departure-reason: upstream fixture is gated on the next release - accepted-until: 2030-01-01 EOF diff --git a/scripts/tests/run-debtfile-test.sh b/scripts/tests/run-debtfile-test.sh index e1887da32..600794865 100755 --- a/scripts/tests/run-debtfile-test.sh +++ b/scripts/tests/run-debtfile-test.sh @@ -34,8 +34,9 @@ entry() { # entry [accepted-until] - ceiling: $3 - severity: high - policy: remediable +- taxonomy-choice: non-default - taxonomy-default-arm: adapt-proven-idris2-test -- taxonomy-selected-arm: write-local-test +- taxonomy-non-default-arm: write-local-test - taxonomy-departure-reason: the host API is not supported by the proven suite - accepted-until: ${4:-2030-01-01} EOF @@ -80,7 +81,7 @@ bash "$SCRIPT" --write Debtfile.a2ml >/dev/null 2>&1 || true if grep -q '^- ceiling: 2$' Debtfile.a2ml && grep -q '^- count: 2$' Debtfile.a2ml && grep -q '^- taxonomy-default-arm: adapt-proven-idris2-test$' Debtfile.a2ml && - grep -q '^- taxonomy-selected-arm: write-local-test$' Debtfile.a2ml && + grep -q '^- taxonomy-non-default-arm: write-local-test$' Debtfile.a2ml && grep -q '^- taxonomy-departure-reason: the host API is not supported by the proven suite$' Debtfile.a2ml; then pass=$((pass+1)); echo " ok --write updates measurements and preserves taxonomy-choice fields" else diff --git a/scripts/tests/wave3-scorecards-test.sh b/scripts/tests/wave3-scorecards-test.sh index a5b4328db..eb1f965a9 100644 --- a/scripts/tests/wave3-scorecards-test.sh +++ b/scripts/tests/wave3-scorecards-test.sh @@ -59,14 +59,14 @@ rm -f "$SCDIR/zzz-orphan.scorecard.a2ml" echo "== determinism + drift ==" # regenerate twice -> identical bash "$GEN" >/dev/null 2>&1 -h1="$(sha256sum "$ROOT/COMPLIANCE-DASHBOARD.adoc" | cut -d' ' -f1)" +h1="$(sha256sum "$ROOT/0-canon/COMPLIANCE-DASHBOARD.adoc" | cut -d' ' -f1)" bash "$GEN" >/dev/null 2>&1 -h2="$(sha256sum "$ROOT/COMPLIANCE-DASHBOARD.adoc" | cut -d' ' -f1)" +h2="$(sha256sum "$ROOT/0-canon/COMPLIANCE-DASHBOARD.adoc" | cut -d' ' -f1)" [ "$h1" = "$h2" ] && ok "regeneration is deterministic" || bad "regeneration not deterministic" # --check green when in sync bash "$GEN" --check >/dev/null 2>&1 && ok "--check passes when in sync" || bad "--check failed when in sync" # --check red when dashboard mutated -printf '\n// drift\n' >> "$ROOT/COMPLIANCE-DASHBOARD.adoc" +printf '\n// drift\n' >> "$ROOT/0-canon/COMPLIANCE-DASHBOARD.adoc" if bash "$GEN" --check >/dev/null 2>&1; then bad "--check missed injected drift"; else ok "--check detects injected drift"; fi bash "$GEN" >/dev/null 2>&1 # restore diff --git a/scripts/tests/wave4-dyadt-test.sh b/scripts/tests/wave4-dyadt-test.sh index d07ed20f6..ec92b67f4 100755 --- a/scripts/tests/wave4-dyadt-test.sh +++ b/scripts/tests/wave4-dyadt-test.sh @@ -188,7 +188,7 @@ verifier = "command-transcript"' [[ "$(reason_of "$TMP/lic.a2ml" C1)" == unverifiable*manual-only ]] && ok "licence-in-statement -> manual-only" || bad "licence-in-statement auto-confirmed" echo "== conformance suite ==" -bash "$ROOT/did-you-actually-do-that/spec/conformance/run-conformance.sh" >/dev/null 2>&1 && ok "conformance vectors pass" || bad "conformance vectors failed" +bash "$ROOT/1-formats/sub-specs/did-you-actually-do-that/spec/conformance/run-conformance.sh" >/dev/null 2>&1 && ok "conformance vectors pass" || bad "conformance vectors failed" echo echo "Wave-4 DYADT regression: $pass passed, $fail failed" From b0f1e95b69877b449c8a735006c29bc2df64c9ef Mon Sep 17 00:00:00 2001 From: hyperpolymath Date: Tue, 22 Sep 2026 09:55:08 +0000 Subject: [PATCH 2/3] =?UTF-8?q?chore(hypatia):=20baseline=20triage=202026-?= =?UTF-8?q?09-22=20=E2=80=94=20acknowledge=20new=20scanner=20modules?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The floating Hypatia scanner grew two rule modules the 129-entry baseline predates (content_patterns x69, research_extensions x43); with BLOCKING_THRESHOLD=info every unacknowledged finding fails the gate, so the baseline job cannot go green without this. 81 file-level entries (129 -> 210), each with note + expires_at 2026-12-22 + tracking issue: - hardcoded_tmp x30 -> #936, http_in_docs x11 -> #937, npx x9 -> #938 - download_then_run + eval x13 -> #939, fake_action_sha x6 -> #940 - RE001 harden-runner x23 -> #941, RE005 masking x20 -> #942 - WH008/WH013/WH006 x7 -> #943, banned deed .py x2 -> #944 - scorecard pinning (preemptive) + SD022 k9 x2 -> #945 Verified: apply-baseline.sh blocking/threshold-info over the 133 observed findings keeps 0 (the 10 code-fixed findings need no entries). --- .hypatia-baseline.json | 2721 +++++++++++++++++++++++++--------------- 1 file changed, 1725 insertions(+), 996 deletions(-) diff --git a/.hypatia-baseline.json b/.hypatia-baseline.json index 83a5cc959..1d39cd7a9 100644 --- a/.hypatia-baseline.json +++ b/.hypatia-baseline.json @@ -1,998 +1,1727 @@ [ - { - "severity": "critical", - "rule_module": "cicd_rules", - "type": "banned_language_file", - "file": "scripts/check-ts-allowlist.ts", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Genuine TS-ban hit: portable Deno CLI script = the policy's 'convert-now bucket' for AffineScript. Non-trivial (needs compile-verified .affine wired in same PR, byte-identical behaviour). Baseline wit", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#254" - }, - { - "severity": "high", - "rule_module": "cicd_rules", - "type": "missing_requirement", - "file": ".github/workflows/scorecard.yml", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Scorecard requirement is functionally satisfied by scorecard-enforcer.yml (push+weekly cron+dispatch) and scorecard-reusable.yml; rule matches the literal filename scorecard.yml instead of scorecard-a", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#399" - }, - { - "severity": "critical", - "rule_module": "code_safety", - "type": "agda_postulate", - "file": "lol/proofs/theories/information_theory.agda", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Genuine postulates but documented justified axioms of Shannon/Gibbs/Lin theorems, unprovable over IEEE754 Float without an R formalisation. Proof debt tracked; lol/ awaits eviction (#494).", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#124" - }, - { - "severity": "medium", - "rule_module": "code_safety", - "type": "as_ptr", - "file": "2-protocols/avow/avow-lib/examples/rust/src/main.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): No dangling: every as_ptr comes from a named CString binding that outlives the synchronous FFI call. Idiomatic CString FFI; rule cannot see lifetimes." - }, - { - "severity": "medium", - "rule_module": "code_safety", - "type": "expect_in_hot_path", - "file": "a2ml/bindings/rust/benches/a2ml_bench.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Criterion bench harness, not a production hot path; expect on static fixtures is idiomatic and unreachable by user input. Rule should exclude benches/." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "js_innerhtml", - "file": "2-protocols/avow/public/demo.js", - "note": "TRACKED (trivial fix available, not applied in this CI-hygiene PR): Genuine DOM XSS: user input flows unescaped into innerHTML in the public demo page. Low blast radius (self-XSS on a demo) but a real fix (textContent/escaping) is needed. Product evicting under #492.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#492" - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "js_innerhtml", - "file": "2-protocols/axel/src/Tea.res.js", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real XSS surface: any view interpolating user data reaches innerHTML unescaped. File is bsc compiled output of Tea.res \u2014 fix belongs in the .res source. Product evicting under #492.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#492" - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "ncl_http_url", - "file": "1-formats/k9/register.ncl", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): The http:// strings are an XML namespace URI and a DTD public identifier \u2014 opaque identifiers mandated by the freedesktop/Apple specs, never fetched. Changing them to https would break MIME registrati" - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "rwlock_unwrap", - "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/src/session_manager.rs", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Genuine: a single panic while holding the lock poisons it and every subsequent session operation panics (DoS cascade). Needs poison handling or parking_lot. Product evicting under #492.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#492" - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "rwlock_unwrap", - "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/tests-offline/src/lib.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Test-only mock of the production SessionManager; never shipped. The production copy is already flagged (findings 25/26, REAL_DEBT #492). Double report against test scaffolding." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "rwlock_unwrap", - "file": "rhodium-standard-repositories/examples/enterprise-service/src/handlers.rs", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real: exemplar code in the estate standard demonstrates unhandled lock poisoning; copies propagate the antipattern. Estate-authored (examples/ dir, distinct from third-party satellites/). Tracked by R", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#493" - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "shell_download_then_run", - "file": "1-formats/a2ml/agentic/scripts/bootstrap.sh", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Same template-shared bootstrap as id 41 (byte-identical pattern). One template fix (download + sha256-verify + run) clears all instances.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#399" - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "shell_download_then_run", - "file": "1-formats/a2ml/neurosym/scripts/bootstrap.sh", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real download-and-execute. Template-shared bootstrap (identical in agentic-a2ml and rsr-deployer) \u2014 fix the template once: download to file, verify sha256, then run.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#399" - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "shell_download_then_run", - "file": "rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/install.sh", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Pipe-to-shell appears only as printed install advice, never executed. Also a vendored satellite under #493 \u2014 never edit regardless. Rule should ignore echo/string contexts." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "shell_download_then_run", - "file": "rhodium-standard-repositories/satellites/rsr-deployer/scripts/bootstrap.sh", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real download-and-execute, but inside a vendored satellite of rhodium-standard-repositories: flag-only, never propose in-place edits; real fix lands via the eviction campaign.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#493" - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "shell_download_then_run", - "file": "setup.sh", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real curl|bash of the just installer with no integrity check; root scaffold slated for cleanup under the scaffold-junk carve-out.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#496" - }, - { - "severity": "medium", - "rule_module": "code_safety", - "type": "unsafe_block", - "file": "2-protocols/avow/avow-lib/examples/rust/src/main.rs", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Genuine hygiene gap (missing SAFETY comments on FFI calls) in example code of a product awaiting eviction; baseline with expiry under the avow-protocol carve-out.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#492" - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "unwrap_without_check", - "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/src/session_manager.rs", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Same 5 lines as finding 26 (rwlock_unwrap) \u2014 generic rule double-counts the RwLock rule. Underlying issue is real: poison cascades panics in the production session manager. Evicting under #492.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#492" - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "unwrap_without_check", - "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/tests-offline/src/lib.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): tests-offline is a test/mock crate (offline mirror of session_manager for testing). Panic IS the test-failure mode; unwrap in test code is idiomatic. Rule should exclude test crates." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "unwrap_without_check", - "file": "a2ml/bindings/rust/benches/a2ml_bench.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): The sole unwrap match is text inside a benchmark fixture string, not code. Upstream rule should skip string-literal contents." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "unwrap_without_check", - "file": "a2ml/bindings/rust/src/parser.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): The single production unwrap is provably infallible (len>=3 guard guarantees a first char). Remaining unwraps are a doc-comment (L32) and #[test] code (L499+)." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "unwrap_without_check", - "file": "a2ml/lsp/src/completions.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): All 6 unwraps are const-pattern regex compiles or guaranteed capture groups \u2014 infallible. Same rule misfire class as ids 35/36." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "unwrap_without_check", - "file": "a2ml/lsp/src/diagnostics.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): All 15 unwraps are const-pattern Regex::new() or mandatory capture groups after a successful match \u2014 provably infallible, no user-input panic path. Upstream: whitelist const-regex unwrap." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "unwrap_without_check", - "file": "a2ml/lsp/src/hover.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same infallible const-regex/mandatory-capture pattern as diagnostics.rs; cannot panic at runtime. Baseline permanently." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "unwrap_without_check", - "file": "rhodium-standard-repositories/examples/enterprise-service/benches/api_benchmarks.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Benchmark harness setup; panic on runtime-creation failure is the intended and only sensible failure mode. Not a DoS surface. Rule should exclude benches/ directories." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "unwrap_without_check", - "file": "rhodium-standard-repositories/examples/enterprise-service/src/handlers.rs", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Same 4 production lines as finding 30 (rwlock rule double-count). Estate-authored RSR example (examples/, not satellites/) that teaches the poison-cascade antipattern. RSR evicting under #493.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#493" - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "zig_align_cast", - "file": "lol/ffi/zig/src/main.zig", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Same shim-template issue as id 47 (each @alignCast pairs with a flagged @ptrCast); one template fix with handle validation covers both rule hits.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#494" - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "zig_ptr_cast", - "file": "lol/api/zig-gateway/src/lol_ffi.zig", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Rule matched @ptrCast inside a // comment; no actual cast in the file. Upstream rule should strip comments before matching." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "zig_ptr_cast", - "file": "lol/ffi/zig/src/main.zig", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real unchecked handle recovery (garbage handle = UB); this is the estate-wide vendored FFI shim pattern (~230x) \u2014 fix the shim template (magic-number handle validation), tracked with lol eviction.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#494" - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "zig_ptr_cast", - "file": "2-protocols/overlay/ffi/zig/src/main.zig", - "note": "TRACKED (trivial fix available, not applied in this CI-hygiene PR): The cast is sound only if termination is guaranteed; it is not when the message exactly fills the 1024-byte buffer, giving the C caller an out-of-bounds read. One-character fix.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#399" - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": ".github/workflows/changelog-reusable.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; write perms are job-scoped and required to open the changelog PR. Baseline permanently." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": ".github/workflows/hypatia-scan-reusable.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; security-events:write is the minimum for SARIF upload, not excess privilege. Baseline permanently." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": ".github/workflows/hypatia-scan.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; the permissions block is deliberate and documented in-file. Baseline permanently." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": ".github/workflows/scorecard.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Stale 46-day-old mirror (standards#378) against a file since renamed to scorecard-enforcer.yml/scorecard-reusable.yml; the missing_requirement alert has no current target." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/src/session_manager.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); underlying rwlock unwrap already tracked by the primary rule. repo-guardian-fs/** carved out to #492." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/tests-offline/src/lib.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); also test code, where lock unwrap is idiomatic. repo-guardian-fs/** carved out to #492." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "a2ml/lsp/src/completions.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); underlying alert already exists as the primary code_safety finding. a2ml/** carved out to #490." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "a2ml/lsp/src/diagnostics.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own unwrap_without_check alert (standards#378). a2ml/** carved out to #490." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "a2ml/lsp/src/hover.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); underlying unwraps are compile-constant regexes plus a guarded caps.get(1). a2ml/** carved out to #490." - }, - { - "severity": "medium", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "2-protocols/avow/avow-lib/examples/rust/src/main.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); as_ptr into an FFI param struct is the intended example-code pattern. 2-protocols/avow/** carved out to #492." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "1-formats/k9/register.ncl", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Doubly false: CSA mirror double-report (#378) AND underlying ncl_http_url matched XML namespace identifiers which are opaque strings, never dereferenced. 1-formats/k9/** carved out to #491." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "lol/api/zig-gateway/src/lol_ffi.zig", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Doubly false: CSA mirror double-report (#378) AND the underlying alert matched a comment, not code. lol/** is also carved out to #494." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "2-protocols/overlay/ffi/zig/src/main.zig", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own SARIF alert (standards#378). Underlying @ptrCast is already emitted by the primary code_safety rule; the CSA copy is a duplicate." - }, - { - "severity": "medium", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "rhodium-standard-repositories/templates/setup.sh.template", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of the Scorecard alert; file also lives under the #493 eviction carve-out. Baseline permanently as a mirror." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "scorecard.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): hypatia re-ingesting its own workflow_audit alert. Underlying gap is tracked by the original alert; baseline permanently." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "scripts/check-ts-allowlist.ts", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); underlying banned_language_file is emitted by cicd_rules directly. The .ts is the allowlist checker, in the grandfathered TS\u2192AffineScript migration bucket (#252 t" - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "setup.sh", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own alert (standards#378). Underlying curl|bash is real and covered by the primary code_safety finding; root scaffold is also #496 territory." - }, - { - "severity": "medium", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "setup.sh", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): Scorecard's Pinned-Dependencies alert already tracks this line; hypatia re-mirroring it adds nothing. Baseline permanently." - }, - { - "severity": "medium", - "rule_module": "code_scanning_alerts", - "type": "CSA002", - "file": "hyperpolymath/standards", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): aggregate counter of alerts hypatia already re-reports one-by-one; triple-counting by construction. Baseline permanently." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": ".github/workflows/changelog-reusable.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already follows the recommended pattern (read at top, write scoped per-job)." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": ".github/workflows/hypatia-scan-reusable.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378; security-events: write at top level is the documented requirement for SARIF upload from the reusable scan." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": ".github/workflows/hypatia-scan.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already declares least-privilege top-level perms with a documented, deliberate grant for SARIF upload." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": ".github/workflows/scorecard.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of hypatia's own missing_requirement alert; Scorecard coverage exists under scorecard-reusable.yml/scorecard-enforcer.yml, so the naming expectation is stale." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/src/session_manager.rs", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Mirror double-report per standards#378. Underlying rwlock-unwrap debt is real-but-tracked in the repo-guardian-fs eviction carve-out #492; the CSA003 staleness echo adds nothing.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#378" - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/tests-offline/src/lib.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378. Also test-only code (tests-offline), where unwrap is conventional; product tracked under #492." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "a2ml/lsp/src/completions.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of hypatia's own alert; underlying unwrap debt rides the a2ml eviction carve-out #490." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "a2ml/lsp/src/diagnostics.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of hypatia's own alert; a2ml/** tracked under eviction #490." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "a2ml/lsp/src/hover.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of hypatia's own unwrap_without_check alert; a2ml/** product debt tracked under eviction #490." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "2-protocols/avow/avow-lib/examples/rust/src/main.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378: hypatia re-ingests its own code-scanning alert. Underlying file is avow-protocol product awaiting eviction (#492); as_ptr in an FFI example is idiomatic." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "1-formats/k9/register.ncl", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Double-false: mirror double-report per standards#378, AND the underlying ncl_http_url alert flags XML namespace/DTD identifiers, which are opaque IDs never fetched over HTTP. k9-svc carve-out #491." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "lol/api/zig-gateway/src/lol_ffi.zig", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of hypatia's own alert; lol/** is carved out for eviction under #494 where the real work is tracked." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "2-protocols/overlay/ffi/zig/src/main.zig", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): hypatia re-ingesting its own code_safety alert. Underlying shim debt is the estate-wide template-rot campaign (fix the boj-server template once)." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "rhodium-standard-repositories/templates/setup.sh.template", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Mirror double-report per standards#378 of a Scorecard alert; file lives in rhodium-standard-repositories, carve-out #493 (template awaiting eviction).", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#378" - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "scorecard.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of hypatia workflow_audit/missing_workflow; the scorecard workflow exists under different filenames \u2014 rule expects a fixed name." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "scripts/check-ts-allowlist.ts", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Mirror double-report per standards#378. Underlying alert is also wrong at source: this is Deno-runtime tooling enforcing the TS allowlist itself; TS-tooling carve-outs exist in CLAUDE.md policy.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#378" - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "setup.sh", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): third reporting channel (hypatia alert + Scorecard alert + this mirror) for the same two lines. Baseline permanently." - }, - { - "severity": "critical", - "rule_module": "security_errors", - "type": "secret_detected", - "file": "a2ml/actions/validate/.envrc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder; commented out, value \"...\". No secret." - }, - { - "severity": "critical", - "rule_module": "security_errors", - "type": "secret_detected", - "file": "a2ml/bindings/deno/.envrc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Commented-out template placeholder (value is literally \"...\"); no credential present. Upstream rule should skip comment lines / \"...\" values. a2ml eviction tracked in #490." - }, - { - "severity": "critical", - "rule_module": "security_errors", - "type": "secret_detected", - "file": "a2ml/bindings/haskell/.envrc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder; commented out, value \"...\". No secret." - }, - { - "severity": "critical", - "rule_module": "security_errors", - "type": "secret_detected", - "file": "a2ml/bindings/rust/.envrc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder as id 96; commented out, value \"...\". No secret." - }, - { - "severity": "critical", - "rule_module": "security_errors", - "type": "secret_detected", - "file": "a2ml/editors/vscode/.envrc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder; commented out, value \"...\". No secret. Fix the upstream generic-API-key rule to ignore commented placeholders." - }, - { - "severity": "critical", - "rule_module": "security_errors", - "type": "secret_detected", - "file": "a2ml/pandoc/.envrc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder; commented out, value \"...\". No secret." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/TRUSTED-BASE-REDUCTION-POLICY.adoc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Path is inside the `proven` repo, cited in an estate-wide trusted-base table. SD022 wrongly resolves cross-repo paths against the standards tree. Rule needs cross-repo-doc awareness." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/archive/provenance/echidna/ECHIDNA-TODO.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Archived provenance doc describing the echidna repo's tree, not standards'. Also historical (docs/archive/). SD022 cross-repo resolution error." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/audits/dogfooding-matrix-2026-04-04.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Estate-wide dogfooding audit; `src/scan/` is in the iseriser repo. Dated snapshot audit (2026-04-04) referencing another repo. SD022 cross-repo resolution error." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/proofs/REQUIREMENTS-MASTER.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Doc is 'Proof Requirements Master \u2014 All 292 Repos'; `src/vql/` is verisimdb's tree. SD022 cross-repo resolution error." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/proofs/spec-templates/T1-critical/ProvenCrypto.jl.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template explicitly targets the ProvenCrypto.jl repo; paths are relative to that repo. SD022 cross-repo resolution error." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/proofs/spec-templates/T1-critical/echidna.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template for the echidna repo; `src/rust/` is echidna's tree. SD022 cross-repo resolution error." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/proofs/spec-templates/T1-critical/ephapax.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template for the ephapax repo; `src/formal/` is ephapax's tree. SD022 cross-repo resolution error." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/proofs/spec-templates/T1-critical/januskey.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template for the januskey repo; path is in that repo. SD022 cross-repo resolution error." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/proofs/spec-templates/T1-critical/proven.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template explicitly targets the proven repo; `src/Proven/` is its Idris2 source tree. SD022 cross-repo resolution error." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/proofs/spec-templates/T1-critical/svalinn.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template targets the svalinn repo; path is in that repo. SD022 cross-repo resolution error." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/proofs/spec-templates/T1-critical/verisimdb.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template targets the verisimdb repo; `src/vcl/` is its tree. SD022 cross-repo resolution error." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/proofs/spec-templates/T2-high/conflow.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Proof-spec template for the external conflow repo; src/pipeline/ is conflow's tree, not standards'. Not drift \u2014 upstream rule should skip cross-repo spec templates." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/proofs/spec-templates/T2-high/panic-attacker.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Path belongs to the panic-attacker repo, not standards. Cross-repo spec template; baseline permanently." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/proofs/spec-templates/T2-high/panll.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Describes panll's tree, not standards'. Cross-repo spec template; baseline permanently." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/proofs/spec-templates/T2-high/reposystem.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): External-repo key-files list; not a local dangling reference." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/proofs/spec-templates/T2-high/statistease.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): statistease repo's Julia sources, not standards'. Cross-repo spec template; baseline permanently." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "2-protocols/k9-coordination/spec/COORDINATION-K9-SPEC.adoc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Illustrative YAML example in a protocol spec (sample invariants/protected config for a hypothetical project). Not a reference to this repo's tree." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "1-formats/a2ml/meta/spec/SCM-FORMAT-FAMILY.adoc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Sample SCM session data in a format spec \u2014 the path is example payload content, not a repo reference." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "1-formats/sub-specs/panll-panels/README.adoc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Explicitly a path in the external PanLL repo (future destination), not this tree. Intentional cross-repo reference." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "rhodium-standard-repositories/docs/haskell-registry-design.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Design doc laying out a proposed rsr-registry Haskell service; src/RSR/ is the design's target layout, not an existing dir. Also inside RSR carve-out #493." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "rhodium-standard-repositories/satellites/META.scm/spec/SCM-FORMAT-FAMILY.adoc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Vendored satellite copy of the SCM spec \u2014 same illustrative example payload as meta-a2ml. Satellite is third-party-treated: never edit; baseline permanently." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "rhodium-standard-repositories/satellites/palimpsest-license/PROJECT_MANAGEMENT/RECONCILIATION_AUDIT.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Historical audit record of a GitLab source repo path that was deliberately NOT imported \u2014 prose-history by design. Vendored satellite: never edit." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "3-practice/testing-and-benchmarking/TESTING-TAXONOMY.adoc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): All src/rust/ mentions are explicitly paths inside the external echidna repo (named on each line). Cross-repo reference, not local drift." - }, - { - "severity": "high", - "rule_module": "workflow_audit", - "type": "missing_workflow", - "file": "scorecard.yml", - "note": "TRACKED (trivial fix available, not applied in this CI-hygiene PR): Required caller workflow genuinely absent while the reusable already exists in-repo; a 15-line thin wrapper closes it.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#399" - }, - { - "severity": "high", - "rule_module": "workflow_audit", - "type": "scorecard_publish_with_run_step", - "file": "scorecard-enforcer.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): OSSF publish verification restricts publishing workflows; enforcement run-steps belong apart. scorecard-reusable.yml already publishes \u2014 enforcer should not double-publish." - }, - { - "severity": "high", - "rule_module": "workflow_audit", - "type": "secret_action_without_presence_gate", - "file": "instant-sync.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Presence gate exists via the env-mapped pattern (secrets context is illegal in step if:). Rule must learn to recognize job-level env secret mapping + env-based step if:. Baseline permanently." - }, - { - "severity": "high", - "rule_module": "workflow_audit", - "type": "secret_action_without_presence_gate", - "file": "mirror-reusable.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): mirror-gitlab ssh-agent step IS presence-gated via env mapping; comment L54-57 documents why secrets can't appear in if:. Same upstream rule gap as instant-sync. Baseline permanently." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "zig_ptr_cast", - "file_pattern": "**/ffi/zig/**", - "note": "FFI boundary. A Zig shim crossing into a foreign runtime must reinterpret opaque pointers; the cast is unavoidable in the host language and the guarantee holds on the core's side of the boundary. Architectural, not deferred \u2014 it does not shrink over time." - }, - { - "severity": "medium", - "rule_module": "code_safety", - "type": "zig_bit_cast", - "file_pattern": "**/ffi/zig/**", - "note": "FFI boundary. A Zig shim crossing into a foreign runtime must reinterpret opaque pointers; the cast is unavoidable in the host language and the guarantee holds on the core's side of the boundary. Architectural, not deferred \u2014 it does not shrink over time." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "zig_align_cast", - "file_pattern": "**/ffi/zig/**", - "note": "FFI boundary. A Zig shim crossing into a foreign runtime must reinterpret opaque pointers; the cast is unavoidable in the host language and the guarantee holds on the core's side of the boundary. Architectural, not deferred \u2014 it does not shrink over time." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "zig_ptr_cast", - "file_pattern": "**/zig-gateway/**", - "note": "FFI boundary. A Zig shim crossing into a foreign runtime must reinterpret opaque pointers; the cast is unavoidable in the host language and the guarantee holds on the core's side of the boundary. Architectural, not deferred \u2014 it does not shrink over time." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file_pattern": "docs/proofs/spec-templates/**/*.adoc", - "note": "FALSE POSITIVE CLASS (2026-08-24): these are cross-repository proof-spec templates. Their src/... examples describe the target repository named by each template, not directories asserted to exist inside standards. The Markdown-to-AsciiDoc migration made this established corpus newly visible to SD022.", - "tracking_issue": "hyperpolymath/standards#399" - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": ".machine_readable/scorecards/hypatia-rules.scorecard.a2ml", - "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify whether the src/A2ML path is target-relative example content or stale repository-local documentation.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": ".machine_readable/template-capability-gates.toml", - "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the template's target-relative src/interface path before changing either content or rule semantics.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "0-canon/TEMPLATE-APPLICABILITY-POLICY.adoc", - "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the policy's target-relative src/interface example before correction or rule refinement.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/audits/dogfooding-matrix-2026-04-04.adoc", - "note": "TEMPORARY REVIEW BASELINE (2026-08-29): historical audit path may be intentionally historical or stale; review without rewriting audit evidence.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "docs/proofs/REQUIREMENTS-MASTER.adoc", - "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the src/vql and src/registry references as target-relative requirements or local drift.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "2-protocols/groove/spec/GROOVE-RANKED-OWNERSHIP-CLEAVE-SPEC.adoc", - "note": "TEMPORARY REVIEW BASELINE (2026-08-29): the Groove spec references a consumer source layout; verify target context before altering the interface design.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "rhodium-standard-repositories/docs/haskell-registry-design.adoc", - "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the src/RSR reference against the documented target repository rather than assuming local drift.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "rhodium-standard-repositories/satellites/palimpsest-license/PROJECT_MANAGEMENT/RECONCILIATION_AUDIT.adoc", - "note": "TEMPORARY REVIEW BASELINE (2026-08-29): preserve the satellite audit while classifying its src/widget-ts and src/scripts references.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "0-canon/rsr/LANGUAGE-POLICY.adoc", - "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the src/api policy example as target-relative content or stale local documentation.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "2-protocols/axel/CNAME", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide extraction or an explicit co-location carve-out for AXEL deployment metadata.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "2-protocols/axel/Containerfile", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide extraction or an explicit co-location carve-out for the AXEL implementation.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "2-protocols/axel/ads.txt", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide extraction or an explicit co-location carve-out for AXEL deployment metadata.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "2-protocols/axel/docs/CNAME", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide extraction or an explicit co-location carve-out for AXEL documentation deployment metadata.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "2-protocols/axel/docs/ads.txt", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide extraction or an explicit co-location carve-out for AXEL documentation deployment metadata.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "2-protocols/axel/public/CNAME", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide extraction or an explicit co-location carve-out for AXEL public deployment metadata.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "2-protocols/axel/public/ads.txt", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide extraction or an explicit co-location carve-out for AXEL public deployment metadata.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "2-protocols/k9-coordination/tools/k9-init/Cargo.toml", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide whether k9-init belongs beside the protocol or must be extracted.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/package.json", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): classify nested satellite implementation ownership before extraction or carve-out.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "rhodium-standard-repositories/satellites/palimpsest-license/Containerfile", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): classify satellite implementation ownership before extraction or carve-out.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "rhodium-standard-repositories/satellites/rsr-certifier/Cargo.toml", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): review the RSR certifier workspace's placement under the canonical home.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "rhodium-standard-repositories/satellites/rsr-certifier/container/Containerfile", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): review the RSR certifier container's placement under the canonical home.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "rhodium-standard-repositories/satellites/rsr-certifier/engine/Cargo.toml", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): review the RSR certifier engine's placement under the canonical home.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "rhodium-standard-repositories/satellites/rsr-certifier/extensions/vscode/package.json", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): review the RSR certifier editor extension's placement under the canonical home.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "rhodium-standard-repositories/satellites/rsr-certifier/lsp/Cargo.toml", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): review the RSR certifier LSP's placement under the canonical home.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - }, - { - "severity": "medium", - "rule_module": "implementation_inside_canon", - "type": "HYP-S009", - "file": "rhodium-standard-repositories/satellites/state.scm/Containerfile", - "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): classify satellite implementation ownership before extraction or carve-out.", - "expires_at": "2026-11-29", - "tracking_issue": "hyperpolymath/standards#687" - } + { + "severity": "critical", + "rule_module": "cicd_rules", + "type": "banned_language_file", + "file": "scripts/check-ts-allowlist.ts", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Genuine TS-ban hit: portable Deno CLI script = the policy's 'convert-now bucket' for AffineScript. Non-trivial (needs compile-verified .affine wired in same PR, byte-identical behaviour). Baseline wit", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#254" + }, + { + "severity": "high", + "rule_module": "cicd_rules", + "type": "missing_requirement", + "file": ".github/workflows/scorecard.yml", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Scorecard requirement is functionally satisfied by scorecard-enforcer.yml (push+weekly cron+dispatch) and scorecard-reusable.yml; rule matches the literal filename scorecard.yml instead of scorecard-a", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#399" + }, + { + "severity": "critical", + "rule_module": "code_safety", + "type": "agda_postulate", + "file": "lol/proofs/theories/information_theory.agda", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Genuine postulates but documented justified axioms of Shannon/Gibbs/Lin theorems, unprovable over IEEE754 Float without an R formalisation. Proof debt tracked; lol/ awaits eviction (#494).", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#124" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "as_ptr", + "file": "2-protocols/avow/avow-lib/examples/rust/src/main.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): No dangling: every as_ptr comes from a named CString binding that outlives the synchronous FFI call. Idiomatic CString FFI; rule cannot see lifetimes." + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "a2ml/bindings/rust/benches/a2ml_bench.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Criterion bench harness, not a production hot path; expect on static fixtures is idiomatic and unreachable by user input. Rule should exclude benches/." + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "js_innerhtml", + "file": "2-protocols/avow/public/demo.js", + "note": "TRACKED (trivial fix available, not applied in this CI-hygiene PR): Genuine DOM XSS: user input flows unescaped into innerHTML in the public demo page. Low blast radius (self-XSS on a demo) but a real fix (textContent/escaping) is needed. Product evicting under #492.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#492" + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "js_innerhtml", + "file": "2-protocols/axel/src/Tea.res.js", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real XSS surface: any view interpolating user data reaches innerHTML unescaped. File is bsc compiled output of Tea.res \u2014 fix belongs in the .res source. Product evicting under #492.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#492" + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "ncl_http_url", + "file": "1-formats/k9/register.ncl", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): The http:// strings are an XML namespace URI and a DTD public identifier \u2014 opaque identifiers mandated by the freedesktop/Apple specs, never fetched. Changing them to https would break MIME registrati" + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "rwlock_unwrap", + "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/src/session_manager.rs", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Genuine: a single panic while holding the lock poisons it and every subsequent session operation panics (DoS cascade). Needs poison handling or parking_lot. Product evicting under #492.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#492" + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "rwlock_unwrap", + "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/tests-offline/src/lib.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Test-only mock of the production SessionManager; never shipped. The production copy is already flagged (findings 25/26, REAL_DEBT #492). Double report against test scaffolding." + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "rwlock_unwrap", + "file": "rhodium-standard-repositories/examples/enterprise-service/src/handlers.rs", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real: exemplar code in the estate standard demonstrates unhandled lock poisoning; copies propagate the antipattern. Estate-authored (examples/ dir, distinct from third-party satellites/). Tracked by R", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#493" + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "shell_download_then_run", + "file": "1-formats/a2ml/agentic/scripts/bootstrap.sh", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Same template-shared bootstrap as id 41 (byte-identical pattern). One template fix (download + sha256-verify + run) clears all instances.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#399" + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "shell_download_then_run", + "file": "1-formats/a2ml/neurosym/scripts/bootstrap.sh", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real download-and-execute. Template-shared bootstrap (identical in agentic-a2ml and rsr-deployer) \u2014 fix the template once: download to file, verify sha256, then run.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#399" + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "shell_download_then_run", + "file": "rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/install.sh", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Pipe-to-shell appears only as printed install advice, never executed. Also a vendored satellite under #493 \u2014 never edit regardless. Rule should ignore echo/string contexts." + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "shell_download_then_run", + "file": "rhodium-standard-repositories/satellites/rsr-deployer/scripts/bootstrap.sh", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real download-and-execute, but inside a vendored satellite of rhodium-standard-repositories: flag-only, never propose in-place edits; real fix lands via the eviction campaign.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#493" + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "shell_download_then_run", + "file": "setup.sh", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real curl|bash of the just installer with no integrity check; root scaffold slated for cleanup under the scaffold-junk carve-out.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#496" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "unsafe_block", + "file": "2-protocols/avow/avow-lib/examples/rust/src/main.rs", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Genuine hygiene gap (missing SAFETY comments on FFI calls) in example code of a product awaiting eviction; baseline with expiry under the avow-protocol carve-out.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#492" + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "unwrap_without_check", + "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/src/session_manager.rs", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Same 5 lines as finding 26 (rwlock_unwrap) \u2014 generic rule double-counts the RwLock rule. Underlying issue is real: poison cascades panics in the production session manager. Evicting under #492.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#492" + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "unwrap_without_check", + "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/tests-offline/src/lib.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): tests-offline is a test/mock crate (offline mirror of session_manager for testing). Panic IS the test-failure mode; unwrap in test code is idiomatic. Rule should exclude test crates." + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "unwrap_without_check", + "file": "a2ml/bindings/rust/benches/a2ml_bench.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): The sole unwrap match is text inside a benchmark fixture string, not code. Upstream rule should skip string-literal contents." + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "unwrap_without_check", + "file": "a2ml/bindings/rust/src/parser.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): The single production unwrap is provably infallible (len>=3 guard guarantees a first char). Remaining unwraps are a doc-comment (L32) and #[test] code (L499+)." + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "unwrap_without_check", + "file": "a2ml/lsp/src/completions.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): All 6 unwraps are const-pattern regex compiles or guaranteed capture groups \u2014 infallible. Same rule misfire class as ids 35/36." + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "unwrap_without_check", + "file": "a2ml/lsp/src/diagnostics.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): All 15 unwraps are const-pattern Regex::new() or mandatory capture groups after a successful match \u2014 provably infallible, no user-input panic path. Upstream: whitelist const-regex unwrap." + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "unwrap_without_check", + "file": "a2ml/lsp/src/hover.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same infallible const-regex/mandatory-capture pattern as diagnostics.rs; cannot panic at runtime. Baseline permanently." + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "unwrap_without_check", + "file": "rhodium-standard-repositories/examples/enterprise-service/benches/api_benchmarks.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Benchmark harness setup; panic on runtime-creation failure is the intended and only sensible failure mode. Not a DoS surface. Rule should exclude benches/ directories." + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "unwrap_without_check", + "file": "rhodium-standard-repositories/examples/enterprise-service/src/handlers.rs", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Same 4 production lines as finding 30 (rwlock rule double-count). Estate-authored RSR example (examples/, not satellites/) that teaches the poison-cascade antipattern. RSR evicting under #493.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#493" + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "zig_align_cast", + "file": "lol/ffi/zig/src/main.zig", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Same shim-template issue as id 47 (each @alignCast pairs with a flagged @ptrCast); one template fix with handle validation covers both rule hits.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#494" + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "zig_ptr_cast", + "file": "lol/api/zig-gateway/src/lol_ffi.zig", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Rule matched @ptrCast inside a // comment; no actual cast in the file. Upstream rule should strip comments before matching." + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "zig_ptr_cast", + "file": "lol/ffi/zig/src/main.zig", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real unchecked handle recovery (garbage handle = UB); this is the estate-wide vendored FFI shim pattern (~230x) \u2014 fix the shim template (magic-number handle validation), tracked with lol eviction.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#494" + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "zig_ptr_cast", + "file": "2-protocols/overlay/ffi/zig/src/main.zig", + "note": "TRACKED (trivial fix available, not applied in this CI-hygiene PR): The cast is sound only if termination is guaranteed; it is not when the message exactly fills the 1024-byte buffer, giving the C caller an out-of-bounds read. One-character fix.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#399" + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": ".github/workflows/changelog-reusable.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; write perms are job-scoped and required to open the changelog PR. Baseline permanently." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": ".github/workflows/hypatia-scan-reusable.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; security-events:write is the minimum for SARIF upload, not excess privilege. Baseline permanently." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": ".github/workflows/hypatia-scan.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; the permissions block is deliberate and documented in-file. Baseline permanently." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": ".github/workflows/scorecard.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Stale 46-day-old mirror (standards#378) against a file since renamed to scorecard-enforcer.yml/scorecard-reusable.yml; the missing_requirement alert has no current target." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/src/session_manager.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); underlying rwlock unwrap already tracked by the primary rule. repo-guardian-fs/** carved out to #492." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/tests-offline/src/lib.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); also test code, where lock unwrap is idiomatic. repo-guardian-fs/** carved out to #492." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": "a2ml/lsp/src/completions.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); underlying alert already exists as the primary code_safety finding. a2ml/** carved out to #490." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": "a2ml/lsp/src/diagnostics.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own unwrap_without_check alert (standards#378). a2ml/** carved out to #490." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": "a2ml/lsp/src/hover.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); underlying unwraps are compile-constant regexes plus a guarded caps.get(1). a2ml/** carved out to #490." + }, + { + "severity": "medium", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": "2-protocols/avow/avow-lib/examples/rust/src/main.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); as_ptr into an FFI param struct is the intended example-code pattern. 2-protocols/avow/** carved out to #492." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": "1-formats/k9/register.ncl", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Doubly false: CSA mirror double-report (#378) AND underlying ncl_http_url matched XML namespace identifiers which are opaque strings, never dereferenced. 1-formats/k9/** carved out to #491." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": "lol/api/zig-gateway/src/lol_ffi.zig", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Doubly false: CSA mirror double-report (#378) AND the underlying alert matched a comment, not code. lol/** is also carved out to #494." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": "2-protocols/overlay/ffi/zig/src/main.zig", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own SARIF alert (standards#378). Underlying @ptrCast is already emitted by the primary code_safety rule; the CSA copy is a duplicate." + }, + { + "severity": "medium", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": "rhodium-standard-repositories/templates/setup.sh.template", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of the Scorecard alert; file also lives under the #493 eviction carve-out. Baseline permanently as a mirror." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": "scorecard.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): hypatia re-ingesting its own workflow_audit alert. Underlying gap is tracked by the original alert; baseline permanently." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": "scripts/check-ts-allowlist.ts", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); underlying banned_language_file is emitted by cicd_rules directly. The .ts is the allowlist checker, in the grandfathered TS\u2192AffineScript migration bucket (#252 t" + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": "setup.sh", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own alert (standards#378). Underlying curl|bash is real and covered by the primary code_safety finding; root scaffold is also #496 territory." + }, + { + "severity": "medium", + "rule_module": "code_scanning_alerts", + "type": "CSA001", + "file": "setup.sh", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): Scorecard's Pinned-Dependencies alert already tracks this line; hypatia re-mirroring it adds nothing. Baseline permanently." + }, + { + "severity": "medium", + "rule_module": "code_scanning_alerts", + "type": "CSA002", + "file": "hyperpolymath/standards", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): aggregate counter of alerts hypatia already re-reports one-by-one; triple-counting by construction. Baseline permanently." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": ".github/workflows/changelog-reusable.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already follows the recommended pattern (read at top, write scoped per-job)." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": ".github/workflows/hypatia-scan-reusable.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378; security-events: write at top level is the documented requirement for SARIF upload from the reusable scan." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": ".github/workflows/hypatia-scan.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already declares least-privilege top-level perms with a documented, deliberate grant for SARIF upload." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": ".github/workflows/scorecard.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of hypatia's own missing_requirement alert; Scorecard coverage exists under scorecard-reusable.yml/scorecard-enforcer.yml, so the naming expectation is stale." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/src/session_manager.rs", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Mirror double-report per standards#378. Underlying rwlock-unwrap debt is real-but-tracked in the repo-guardian-fs eviction carve-out #492; the CSA003 staleness echo adds nothing.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#378" + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/tests-offline/src/lib.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378. Also test-only code (tests-offline), where unwrap is conventional; product tracked under #492." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": "a2ml/lsp/src/completions.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of hypatia's own alert; underlying unwrap debt rides the a2ml eviction carve-out #490." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": "a2ml/lsp/src/diagnostics.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of hypatia's own alert; a2ml/** tracked under eviction #490." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": "a2ml/lsp/src/hover.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of hypatia's own unwrap_without_check alert; a2ml/** product debt tracked under eviction #490." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": "2-protocols/avow/avow-lib/examples/rust/src/main.rs", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378: hypatia re-ingests its own code-scanning alert. Underlying file is avow-protocol product awaiting eviction (#492); as_ptr in an FFI example is idiomatic." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": "1-formats/k9/register.ncl", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Double-false: mirror double-report per standards#378, AND the underlying ncl_http_url alert flags XML namespace/DTD identifiers, which are opaque IDs never fetched over HTTP. k9-svc carve-out #491." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": "lol/api/zig-gateway/src/lol_ffi.zig", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of hypatia's own alert; lol/** is carved out for eviction under #494 where the real work is tracked." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": "2-protocols/overlay/ffi/zig/src/main.zig", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): hypatia re-ingesting its own code_safety alert. Underlying shim debt is the estate-wide template-rot campaign (fix the boj-server template once)." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": "rhodium-standard-repositories/templates/setup.sh.template", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Mirror double-report per standards#378 of a Scorecard alert; file lives in rhodium-standard-repositories, carve-out #493 (template awaiting eviction).", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#378" + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": "scorecard.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of hypatia workflow_audit/missing_workflow; the scorecard workflow exists under different filenames \u2014 rule expects a fixed name." + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": "scripts/check-ts-allowlist.ts", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Mirror double-report per standards#378. Underlying alert is also wrong at source: this is Deno-runtime tooling enforcing the TS allowlist itself; TS-tooling carve-outs exist in CLAUDE.md policy.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#378" + }, + { + "severity": "high", + "rule_module": "code_scanning_alerts", + "type": "CSA003", + "file": "setup.sh", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): third reporting channel (hypatia alert + Scorecard alert + this mirror) for the same two lines. Baseline permanently." + }, + { + "severity": "critical", + "rule_module": "security_errors", + "type": "secret_detected", + "file": "a2ml/actions/validate/.envrc", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder; commented out, value \"...\". No secret." + }, + { + "severity": "critical", + "rule_module": "security_errors", + "type": "secret_detected", + "file": "a2ml/bindings/deno/.envrc", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Commented-out template placeholder (value is literally \"...\"); no credential present. Upstream rule should skip comment lines / \"...\" values. a2ml eviction tracked in #490." + }, + { + "severity": "critical", + "rule_module": "security_errors", + "type": "secret_detected", + "file": "a2ml/bindings/haskell/.envrc", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder; commented out, value \"...\". No secret." + }, + { + "severity": "critical", + "rule_module": "security_errors", + "type": "secret_detected", + "file": "a2ml/bindings/rust/.envrc", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder as id 96; commented out, value \"...\". No secret." + }, + { + "severity": "critical", + "rule_module": "security_errors", + "type": "secret_detected", + "file": "a2ml/editors/vscode/.envrc", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder; commented out, value \"...\". No secret. Fix the upstream generic-API-key rule to ignore commented placeholders." + }, + { + "severity": "critical", + "rule_module": "security_errors", + "type": "secret_detected", + "file": "a2ml/pandoc/.envrc", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder; commented out, value \"...\". No secret." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/TRUSTED-BASE-REDUCTION-POLICY.adoc", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Path is inside the `proven` repo, cited in an estate-wide trusted-base table. SD022 wrongly resolves cross-repo paths against the standards tree. Rule needs cross-repo-doc awareness." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/archive/provenance/echidna/ECHIDNA-TODO.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Archived provenance doc describing the echidna repo's tree, not standards'. Also historical (docs/archive/). SD022 cross-repo resolution error." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/audits/dogfooding-matrix-2026-04-04.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Estate-wide dogfooding audit; `src/scan/` is in the iseriser repo. Dated snapshot audit (2026-04-04) referencing another repo. SD022 cross-repo resolution error." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/proofs/REQUIREMENTS-MASTER.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Doc is 'Proof Requirements Master \u2014 All 292 Repos'; `src/vql/` is verisimdb's tree. SD022 cross-repo resolution error." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/proofs/spec-templates/T1-critical/ProvenCrypto.jl.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template explicitly targets the ProvenCrypto.jl repo; paths are relative to that repo. SD022 cross-repo resolution error." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/proofs/spec-templates/T1-critical/echidna.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template for the echidna repo; `src/rust/` is echidna's tree. SD022 cross-repo resolution error." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/proofs/spec-templates/T1-critical/ephapax.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template for the ephapax repo; `src/formal/` is ephapax's tree. SD022 cross-repo resolution error." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/proofs/spec-templates/T1-critical/januskey.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template for the januskey repo; path is in that repo. SD022 cross-repo resolution error." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/proofs/spec-templates/T1-critical/proven.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template explicitly targets the proven repo; `src/Proven/` is its Idris2 source tree. SD022 cross-repo resolution error." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/proofs/spec-templates/T1-critical/svalinn.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template targets the svalinn repo; path is in that repo. SD022 cross-repo resolution error." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/proofs/spec-templates/T1-critical/verisimdb.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template targets the verisimdb repo; `src/vcl/` is its tree. SD022 cross-repo resolution error." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/proofs/spec-templates/T2-high/conflow.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Proof-spec template for the external conflow repo; src/pipeline/ is conflow's tree, not standards'. Not drift \u2014 upstream rule should skip cross-repo spec templates." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/proofs/spec-templates/T2-high/panic-attacker.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Path belongs to the panic-attacker repo, not standards. Cross-repo spec template; baseline permanently." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/proofs/spec-templates/T2-high/panll.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Describes panll's tree, not standards'. Cross-repo spec template; baseline permanently." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/proofs/spec-templates/T2-high/reposystem.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): External-repo key-files list; not a local dangling reference." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/proofs/spec-templates/T2-high/statistease.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): statistease repo's Julia sources, not standards'. Cross-repo spec template; baseline permanently." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "2-protocols/k9-coordination/spec/COORDINATION-K9-SPEC.adoc", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Illustrative YAML example in a protocol spec (sample invariants/protected config for a hypothetical project). Not a reference to this repo's tree." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "1-formats/a2ml/meta/spec/SCM-FORMAT-FAMILY.adoc", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Sample SCM session data in a format spec \u2014 the path is example payload content, not a repo reference." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "1-formats/sub-specs/panll-panels/README.adoc", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Explicitly a path in the external PanLL repo (future destination), not this tree. Intentional cross-repo reference." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "rhodium-standard-repositories/docs/haskell-registry-design.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Design doc laying out a proposed rsr-registry Haskell service; src/RSR/ is the design's target layout, not an existing dir. Also inside RSR carve-out #493." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "rhodium-standard-repositories/satellites/META.scm/spec/SCM-FORMAT-FAMILY.adoc", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Vendored satellite copy of the SCM spec \u2014 same illustrative example payload as meta-a2ml. Satellite is third-party-treated: never edit; baseline permanently." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "rhodium-standard-repositories/satellites/palimpsest-license/PROJECT_MANAGEMENT/RECONCILIATION_AUDIT.md", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Historical audit record of a GitLab source repo path that was deliberately NOT imported \u2014 prose-history by design. Vendored satellite: never edit." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "3-practice/testing-and-benchmarking/TESTING-TAXONOMY.adoc", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): All src/rust/ mentions are explicitly paths inside the external echidna repo (named on each line). Cross-repo reference, not local drift." + }, + { + "severity": "high", + "rule_module": "workflow_audit", + "type": "missing_workflow", + "file": "scorecard.yml", + "note": "TRACKED (trivial fix available, not applied in this CI-hygiene PR): Required caller workflow genuinely absent while the reusable already exists in-repo; a 15-line thin wrapper closes it.", + "expires_at": "2026-10-21", + "tracking_issue": "hyperpolymath/standards#399" + }, + { + "severity": "high", + "rule_module": "workflow_audit", + "type": "scorecard_publish_with_run_step", + "file": "scorecard-enforcer.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): OSSF publish verification restricts publishing workflows; enforcement run-steps belong apart. scorecard-reusable.yml already publishes \u2014 enforcer should not double-publish." + }, + { + "severity": "high", + "rule_module": "workflow_audit", + "type": "secret_action_without_presence_gate", + "file": "instant-sync.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Presence gate exists via the env-mapped pattern (secrets context is illegal in step if:). Rule must learn to recognize job-level env secret mapping + env-based step if:. Baseline permanently." + }, + { + "severity": "high", + "rule_module": "workflow_audit", + "type": "secret_action_without_presence_gate", + "file": "mirror-reusable.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): mirror-gitlab ssh-agent step IS presence-gated via env mapping; comment L54-57 documents why secrets can't appear in if:. Same upstream rule gap as instant-sync. Baseline permanently." + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "zig_ptr_cast", + "file_pattern": "**/ffi/zig/**", + "note": "FFI boundary. A Zig shim crossing into a foreign runtime must reinterpret opaque pointers; the cast is unavoidable in the host language and the guarantee holds on the core's side of the boundary. Architectural, not deferred \u2014 it does not shrink over time." + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "zig_bit_cast", + "file_pattern": "**/ffi/zig/**", + "note": "FFI boundary. A Zig shim crossing into a foreign runtime must reinterpret opaque pointers; the cast is unavoidable in the host language and the guarantee holds on the core's side of the boundary. Architectural, not deferred \u2014 it does not shrink over time." + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "zig_align_cast", + "file_pattern": "**/ffi/zig/**", + "note": "FFI boundary. A Zig shim crossing into a foreign runtime must reinterpret opaque pointers; the cast is unavoidable in the host language and the guarantee holds on the core's side of the boundary. Architectural, not deferred \u2014 it does not shrink over time." + }, + { + "severity": "high", + "rule_module": "code_safety", + "type": "zig_ptr_cast", + "file_pattern": "**/zig-gateway/**", + "note": "FFI boundary. A Zig shim crossing into a foreign runtime must reinterpret opaque pointers; the cast is unavoidable in the host language and the guarantee holds on the core's side of the boundary. Architectural, not deferred \u2014 it does not shrink over time." + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file_pattern": "docs/proofs/spec-templates/**/*.adoc", + "note": "FALSE POSITIVE CLASS (2026-08-24): these are cross-repository proof-spec templates. Their src/... examples describe the target repository named by each template, not directories asserted to exist inside standards. The Markdown-to-AsciiDoc migration made this established corpus newly visible to SD022.", + "tracking_issue": "hyperpolymath/standards#399" + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": ".machine_readable/scorecards/hypatia-rules.scorecard.a2ml", + "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify whether the src/A2ML path is target-relative example content or stale repository-local documentation.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": ".machine_readable/template-capability-gates.toml", + "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the template's target-relative src/interface path before changing either content or rule semantics.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "0-canon/TEMPLATE-APPLICABILITY-POLICY.adoc", + "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the policy's target-relative src/interface example before correction or rule refinement.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/audits/dogfooding-matrix-2026-04-04.adoc", + "note": "TEMPORARY REVIEW BASELINE (2026-08-29): historical audit path may be intentionally historical or stale; review without rewriting audit evidence.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "docs/proofs/REQUIREMENTS-MASTER.adoc", + "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the src/vql and src/registry references as target-relative requirements or local drift.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "2-protocols/groove/spec/GROOVE-RANKED-OWNERSHIP-CLEAVE-SPEC.adoc", + "note": "TEMPORARY REVIEW BASELINE (2026-08-29): the Groove spec references a consumer source layout; verify target context before altering the interface design.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "rhodium-standard-repositories/docs/haskell-registry-design.adoc", + "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the src/RSR reference against the documented target repository rather than assuming local drift.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "rhodium-standard-repositories/satellites/palimpsest-license/PROJECT_MANAGEMENT/RECONCILIATION_AUDIT.adoc", + "note": "TEMPORARY REVIEW BASELINE (2026-08-29): preserve the satellite audit while classifying its src/widget-ts and src/scripts references.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "0-canon/rsr/LANGUAGE-POLICY.adoc", + "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the src/api policy example as target-relative content or stale local documentation.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "2-protocols/axel/CNAME", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide extraction or an explicit co-location carve-out for AXEL deployment metadata.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "2-protocols/axel/Containerfile", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide extraction or an explicit co-location carve-out for the AXEL implementation.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "2-protocols/axel/ads.txt", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide extraction or an explicit co-location carve-out for AXEL deployment metadata.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "2-protocols/axel/docs/CNAME", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide extraction or an explicit co-location carve-out for AXEL documentation deployment metadata.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "2-protocols/axel/docs/ads.txt", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide extraction or an explicit co-location carve-out for AXEL documentation deployment metadata.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "2-protocols/axel/public/CNAME", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide extraction or an explicit co-location carve-out for AXEL public deployment metadata.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "2-protocols/axel/public/ads.txt", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide extraction or an explicit co-location carve-out for AXEL public deployment metadata.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "2-protocols/k9-coordination/tools/k9-init/Cargo.toml", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): decide whether k9-init belongs beside the protocol or must be extracted.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/package.json", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): classify nested satellite implementation ownership before extraction or carve-out.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "rhodium-standard-repositories/satellites/palimpsest-license/Containerfile", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): classify satellite implementation ownership before extraction or carve-out.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "rhodium-standard-repositories/satellites/rsr-certifier/Cargo.toml", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): review the RSR certifier workspace's placement under the canonical home.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "rhodium-standard-repositories/satellites/rsr-certifier/container/Containerfile", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): review the RSR certifier container's placement under the canonical home.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "rhodium-standard-repositories/satellites/rsr-certifier/engine/Cargo.toml", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): review the RSR certifier engine's placement under the canonical home.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "rhodium-standard-repositories/satellites/rsr-certifier/extensions/vscode/package.json", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): review the RSR certifier editor extension's placement under the canonical home.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "rhodium-standard-repositories/satellites/rsr-certifier/lsp/Cargo.toml", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): review the RSR certifier LSP's placement under the canonical home.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "medium", + "rule_module": "implementation_inside_canon", + "type": "HYP-S009", + "file": "rhodium-standard-repositories/satellites/state.scm/Containerfile", + "note": "TEMPORARY ARCHITECTURE BASELINE (2026-08-29): classify satellite implementation ownership before extraction or carve-out.", + "expires_at": "2026-11-29", + "tracking_issue": "hyperpolymath/standards#687" + }, + { + "severity": "critical", + "rule_module": "cicd_rules", + "type": "banned_language_file", + "file": "1-formats/deed/tools/a2ml_to_deed.py", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): DEED toolchain file in banned Python (port-or-exempt decision pending); SonarCloud issues in it fixed separately.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#944" + }, + { + "severity": "critical", + "rule_module": "cicd_rules", + "type": "banned_language_file", + "file": "1-formats/deed/tools/deed_lint.py", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): DEED toolchain file in banned Python (port-or-exempt decision pending); SonarCloud issues in it fixed separately.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#944" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/signed-push-smoke.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/mirror-reusable.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/settings-drift-detect.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/boj-build.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/label-triage.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/github-backup-mirror-reusable.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/labels.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/hypatia-scan-reusable.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/instant-sync.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/apply-workflow-pins.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/propagate-hooks.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/tailscale-connect-reusable.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/tag-ruleset-canon.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/lockfile-drift-detect.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/governance-reusable.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE001", + "file": ".github/workflows/allowlist-preflight-reusable.yml", + "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#941" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE005", + "file": ".github/workflows/echidna-verify.yml", + "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#942" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE005", + "file": ".github/workflows/affinescript-verify.yml", + "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#942" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE005", + "file": ".github/workflows/readme-derive-reusable.yml", + "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#942" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE005", + "file": ".github/workflows/changelog-reusable.yml", + "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#942" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE005", + "file": ".github/workflows/hypatia-scan-reusable.yml", + "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#942" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE005", + "file": ".github/workflows/security-gate-pr-target.yml", + "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#942" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE005", + "file": ".github/workflows/scorecard-enforcer.yml", + "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#942" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE005", + "file": ".github/workflows/secret-scanner-reusable.yml", + "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#942" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE005", + "file": ".github/workflows/governance-reusable.yml", + "note": "VERIFIED FAIL-CLOSED (hypatia triage 2026-09-22): best-effort helper checkout whose next step names the missing piece and exits non-zero; masking is by design, not a bug.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#942" + }, + { + "severity": "warn", + "rule_module": "research_extensions", + "type": "RE005", + "file": ".github/workflows/ci-pipeline.yml", + "note": "VERIFIED FAIL-CLOSED (hypatia triage 2026-09-22): best-effort helper checkout whose next step names the missing piece and exits non-zero; masking is by design, not a bug.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#942" + }, + { + "severity": "warn", + "rule_module": "workflow_hardening", + "type": "WH006", + "file": ".github/workflows/codeql.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-09-22): a `uses:` caller job cannot carry timeout-minutes; the called reusable declares its own (20).", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#943" + }, + { + "severity": "warn", + "rule_module": "workflow_hardening", + "type": "WH008", + "file": ".github/workflows/mirror.yml", + "note": "ACCEPTED ESTATE CONVENTION (hypatia triage 2026-09-22): reusable-workflow callers use `secrets: inherit` by design.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#943" + }, + { + "severity": "warn", + "rule_module": "workflow_hardening", + "type": "WH008", + "file": ".github/workflows/hypatia-scan.yml", + "note": "ACCEPTED ESTATE CONVENTION (hypatia triage 2026-09-22): reusable-workflow callers use `secrets: inherit` by design.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#943" + }, + { + "severity": "warn", + "rule_module": "workflow_hardening", + "type": "WH008", + "file": ".github/workflows/governance.yml", + "note": "ACCEPTED ESTATE CONVENTION (hypatia triage 2026-09-22): reusable-workflow callers use `secrets: inherit` by design.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#943" + }, + { + "severity": "warn", + "rule_module": "workflow_hardening", + "type": "WH008", + "file": ".github/workflows/secret-scanner.yml", + "note": "ACCEPTED ESTATE CONVENTION (hypatia triage 2026-09-22): reusable-workflow callers use `secrets: inherit` by design.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#943" + }, + { + "severity": "high", + "rule_module": "workflow_hardening", + "type": "WH013", + "file": ".github/workflows/mirror-reusable.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-09-22): pushes target FOREIGN repos via PAT, not GITHUB_TOKEN contents; `contents: read` is correct least privilege.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#943" + }, + { + "severity": "high", + "rule_module": "workflow_hardening", + "type": "WH013", + "file": ".github/workflows/github-backup-mirror-reusable.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-09-22): pushes target FOREIGN repos via PAT, not GITHUB_TOKEN contents; `contents: read` is correct least privilege.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#943" + }, + { + "severity": "medium", + "rule_module": "scorecard", + "type": "DependencyPinning", + "file": ".", + "note": "PREEMPTIVE (hypatia triage 2026-09-22): observed once alongside the invalid lock; the lock repair should clear it \u2014 dormant if so.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#945" + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "2-protocols/k9-coordination/spec/COORDINATION-K9-SPEC_v1.adoc", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): illustrative spec content referencing another project's path; needs an owner eyes-check before editing.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#945" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "npx_in_workflow", + "file": ".github/copilot/coding-agent.yml", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#938" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "npx_in_workflow", + "file": "rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/.github/workflows/rescript-deno-ci.yml", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#938" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "npx_in_workflow", + "file": "rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/.gitlab-ci.yml", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#938" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "npx_in_workflow", + "file": "rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/Justfile", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#938" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "npx_in_workflow", + "file": "rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/rescript-deno-ci.yml", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#938" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "npx_in_workflow", + "file": "rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/post-sync.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#938" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "known_fake_action_sha", + "file": "rhodium-standard-repositories/examples/enterprise-service/.github/workflows/security.yml", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#940" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "known_fake_action_sha", + "file": "rhodium-standard-repositories/satellites/cccp/satellites/php-aegis/.github/workflows/comprehensive-quality.yml", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#940" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "known_fake_action_sha", + "file": "rhodium-standard-repositories/satellites/cccp/satellites/sanctify-php/.github/workflows/comprehensive-quality.yml", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#940" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "known_fake_action_sha", + "file": "rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/ci.yml", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#940" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "known_fake_action_sha", + "file": "rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/security.yml", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#940" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "eval_in_shell", + "file": "rhodium-standard-repositories/rsr-audit.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#939" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "eval_in_shell", + "file": "rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-dns-discovery.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#939" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "eval_in_shell", + "file": "rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-http-headers.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#939" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "eval_in_shell", + "file": "scripts/tests/fill-placeholders-test.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#939" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "eval_in_shell", + "file": "scripts/tests/propagate-workflow-pins-test.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#939" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "download_then_run_shell", + "file": ".github/workflows/security-gate-pr-target.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-09-22): rule matches the scanner's own detection patterns/comments in this file; no real download-then-run present (verified).", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#939" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "download_then_run_shell", + "file": ".github/workflows/tag-ruleset-canon.yml", + "note": "FALSE POSITIVE (hypatia triage 2026-09-22): rule matches the scanner's own detection patterns/comments in this file; no real download-then-run present (verified).", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#939" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "download_then_run_shell", + "file": "rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/install.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#939" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "download_then_run_shell", + "file": "setup.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#939" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "download_then_run_shell", + "file": "tests/test_tag_ruleset_canon.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#939" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "hardcoded_tmp", + "file": "1-formats/sub-specs/inline-annotations/extractor/batch-extract.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#936" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "hardcoded_tmp", + "file": "docs/UX-standards/comprehensive-launcher-template.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#936" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "hardcoded_tmp", + "file": "docs/UX-standards/dustfile-template.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#936" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "hardcoded_tmp", + "file": "docs/UX-standards/e-grade-launcher-template.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#936" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "hardcoded_tmp", + "file": "launcher/soft-attach.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#936" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "hardcoded_tmp", + "file": "rhodium-standard-repositories/ux-test-harness/run-ux-test.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#936" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "hardcoded_tmp", + "file": "rhodium-standard-repositories/ux-test-harness/test-repo.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#936" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "hardcoded_tmp", + "file": "scripts/check-lockfile-drift.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#936" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "hardcoded_tmp", + "file": "scripts/registry-readiness.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#936" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "hardcoded_tmp", + "file": "scripts/sweep-classifiers/classify-codeql.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#936" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "hardcoded_tmp", + "file": "scripts/sweep-classifiers/classify-hypatia-scan.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#936" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "hardcoded_tmp", + "file": "scripts/sweep-classifiers/classify-mirror.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#936" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "hardcoded_tmp", + "file": "scripts/sweep-classifiers/classify-secret-scanner.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#936" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "hardcoded_tmp", + "file": "scripts/sweep-classifiers/list-workflow-paths.sh", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#936" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "http_in_docs", + "file": "2-protocols/axel/CODE_OF_CONDUCT.adoc", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#937" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "http_in_docs", + "file": "2-protocols/axel/docs/cloudflare-dns-guide.adoc", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#937" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "http_in_docs", + "file": "2-protocols/axel/docs/github-pages-setup.adoc", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#937" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "http_in_docs", + "file": "3-practice/TRUST-DEFAULTS-POLICY.adoc", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#937" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "http_in_docs", + "file": "LICENSES/MPL-2.0.txt", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#937" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "http_in_docs", + "file": "rhodium-standard-repositories/examples/minimal-rust-project/README.adoc", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#937" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "http_in_docs", + "file": "rhodium-standard-repositories/examples/standard-library/README.adoc", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#937" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "http_in_docs", + "file": "rhodium-standard-repositories/satellites/palimpsest-license/GUIDES_v0.4/professional-integration/MUSEUMS.adoc", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#937" + }, + { + "severity": "medium", + "rule_module": "content_patterns", + "type": "http_in_docs", + "file": "toolchain-readiness-grades/testing/LANGUAGE-TESTING-STANDARDS.adoc", + "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#937" + } ] From c7cd8c9091e0574efb5ac8d7676688b00b551c87 Mon Sep 17 00:00:00 2001 From: hyperpolymath Date: Tue, 22 Sep 2026 09:55:08 +0000 Subject: [PATCH 3/3] chore(registry): regenerate after fix-forward repairs --- .machine_readable/REGISTRY.a2ml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.machine_readable/REGISTRY.a2ml b/.machine_readable/REGISTRY.a2ml index 167b2b0e2..92b9171bd 100644 --- a/.machine_readable/REGISTRY.a2ml +++ b/.machine_readable/REGISTRY.a2ml @@ -207,7 +207,7 @@ name = "RSR β€” Rhodium Standard Repositories" stream = "governance" home = "rhodium-standard-repositories/" canonical_doc = "rhodium-standard-repositories/README.adoc" -source_hash = "sha256:343ee9bb809ea0920cbe064ac26d6889c91d38e476813b41dd279504729d373a" +source_hash = "sha256:7e07d81d2373e8ce2820f1a3db13550626582ca9992854327a8b3b39e0d366c3" route = "the repository-compliance standard every repo is graded against" [[spec]]