From 7cf1117ebfafbe9561e840ac704ba3c2489ecac6 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 6 Aug 2026 13:50:51 +0100 Subject: [PATCH] chore(hypatia): acknowledge 2 findings in the baseline MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `Validate Hypatia Baseline` gate fails on any finding not acknowledged in .hypatia-baseline.json, at threshold `info` — so every existing finding blocks every pull request, including ones that touch none of it. Ruling: acknowledge the current findings and KEEP the threshold at `info`, so only NEW findings block from here. That preserves the gate's strictness rather than lowering the bar estate-wide, and records the debt explicitly instead of hiding it. Entries were taken from the gate's own job output — the findings it actually produced, tagged `baseline_status: "new"` — rather than from a local scanner that might be a different version. Only those entries are added; findings already matched by the existing baseline are left alone so their severity_override values are not lost. Types covered: banned_language_file. Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .hypatia-baseline.json | 48 ++++++++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 18 deletions(-) diff --git a/.hypatia-baseline.json b/.hypatia-baseline.json index 2311737c..e4e57022 100644 --- a/.hypatia-baseline.json +++ b/.hypatia-baseline.json @@ -61,7 +61,7 @@ "rule_module": "code_safety", "type": "js_innerhtml", "file": "axel-protocol/src/Tea.res.js", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real XSS surface: any view interpolating user data reaches innerHTML unescaped. File is bsc compiled output of Tea.res — fix belongs in the .res source. Product evicting under #492.", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real XSS surface: any view interpolating user data reaches innerHTML unescaped. File is bsc compiled output of Tea.res \u2014 fix belongs in the .res source. Product evicting under #492.", "expires_at": "2026-10-21", "tracking_issue": "hyperpolymath/standards#492" }, @@ -86,7 +86,7 @@ "rule_module": "code_safety", "type": "ncl_http_url", "file": "k9-svc/register.ncl", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): The http:// strings are an XML namespace URI and a DTD public identifier — opaque identifiers mandated by the freedesktop/Apple specs, never fetched. Changing them to https would break MIME registrati" + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): The http:// strings are an XML namespace URI and a DTD public identifier \u2014 opaque identifiers mandated by the freedesktop/Apple specs, never fetched. Changing them to https would break MIME registrati" }, { "severity": "high", @@ -127,14 +127,14 @@ "rule_module": "code_safety", "type": "shell_download_then_run", "file": "k9-svc/k9-sign/install.sh", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): The curl|sh is never executed — it is a printed installation hint. Rule should ignore pattern inside echo/string literals." + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): The curl|sh is never executed \u2014 it is a printed installation hint. Rule should ignore pattern inside echo/string literals." }, { "severity": "high", "rule_module": "code_safety", "type": "shell_download_then_run", "file": "neurosym-a2ml/scripts/bootstrap.sh", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real download-and-execute. Template-shared bootstrap (identical in agentic-a2ml and rsr-deployer) — fix the template once: download to file, verify sha256, then run.", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real download-and-execute. Template-shared bootstrap (identical in agentic-a2ml and rsr-deployer) \u2014 fix the template once: download to file, verify sha256, then run.", "expires_at": "2026-10-21", "tracking_issue": "hyperpolymath/standards#399" }, @@ -143,7 +143,7 @@ "rule_module": "code_safety", "type": "shell_download_then_run", "file": "rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/install.sh", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Pipe-to-shell appears only as printed install advice, never executed. Also a vendored satellite under #493 — never edit regardless. Rule should ignore echo/string contexts." + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Pipe-to-shell appears only as printed install advice, never executed. Also a vendored satellite under #493 \u2014 never edit regardless. Rule should ignore echo/string contexts." }, { "severity": "high", @@ -177,7 +177,7 @@ "rule_module": "code_safety", "type": "unwrap_without_check", "file": "0-ai-gatekeeper-protocol/repo-guardian-fs/src/session_manager.rs", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Same 5 lines as finding 26 (rwlock_unwrap) — generic rule double-counts the RwLock rule. Underlying issue is real: poison cascades panics in the production session manager. Evicting under #492.", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Same 5 lines as finding 26 (rwlock_unwrap) \u2014 generic rule double-counts the RwLock rule. Underlying issue is real: poison cascades panics in the production session manager. Evicting under #492.", "expires_at": "2026-10-21", "tracking_issue": "hyperpolymath/standards#492" }, @@ -207,14 +207,14 @@ "rule_module": "code_safety", "type": "unwrap_without_check", "file": "a2ml/lsp/src/completions.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): All 6 unwraps are const-pattern regex compiles or guaranteed capture groups — infallible. Same rule misfire class as ids 35/36." + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): All 6 unwraps are const-pattern regex compiles or guaranteed capture groups \u2014 infallible. Same rule misfire class as ids 35/36." }, { "severity": "high", "rule_module": "code_safety", "type": "unwrap_without_check", "file": "a2ml/lsp/src/diagnostics.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): All 15 unwraps are const-pattern Regex::new() or mandatory capture groups after a successful match — provably infallible, no user-input panic path. Upstream: whitelist const-regex unwrap." + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): All 15 unwraps are const-pattern Regex::new() or mandatory capture groups after a successful match \u2014 provably infallible, no user-input panic path. Upstream: whitelist const-regex unwrap." }, { "severity": "high", @@ -274,7 +274,7 @@ "rule_module": "code_safety", "type": "zig_ptr_cast", "file": "lol/ffi/zig/src/main.zig", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real unchecked handle recovery (garbage handle = UB); this is the estate-wide vendored FFI shim pattern (~230x) — fix the shim template (magic-number handle validation), tracked with lol eviction.", + "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real unchecked handle recovery (garbage handle = UB); this is the estate-wide vendored FFI shim pattern (~230x) \u2014 fix the shim template (magic-number handle validation), tracked with lol eviction.", "expires_at": "2026-10-21", "tracking_issue": "hyperpolymath/standards#494" }, @@ -418,7 +418,7 @@ "rule_module": "code_scanning_alerts", "type": "CSA001", "file": "scripts/check-ts-allowlist.ts", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); underlying banned_language_file is emitted by cicd_rules directly. The .ts is the allowlist checker, in the grandfathered TS→AffineScript migration bucket (#252 t" + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); underlying banned_language_file is emitted by cicd_rules directly. The .ts is the allowlist checker, in the grandfathered TS\u2192AffineScript migration bucket (#252 t" }, { "severity": "high", @@ -569,7 +569,7 @@ "rule_module": "code_scanning_alerts", "type": "CSA003", "file": "scorecard.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of hypatia workflow_audit/missing_workflow; the scorecard workflow exists under different filenames — rule expects a fixed name." + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of hypatia workflow_audit/missing_workflow; the scorecard workflow exists under different filenames \u2014 rule expects a fixed name." }, { "severity": "high", @@ -697,7 +697,7 @@ "rule_module": "structural_drift", "type": "SD022", "file": "docs/proofs/REQUIREMENTS-MASTER.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Doc is 'Proof Requirements Master — All 292 Repos'; `src/vql/` is verisimdb's tree. SD022 cross-repo resolution error." + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Doc is 'Proof Requirements Master \u2014 All 292 Repos'; `src/vql/` is verisimdb's tree. SD022 cross-repo resolution error." }, { "severity": "medium", @@ -753,7 +753,7 @@ "rule_module": "structural_drift", "type": "SD022", "file": "docs/proofs/spec-templates/T2-high/conflow.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Proof-spec template for the external conflow repo; src/pipeline/ is conflow's tree, not standards'. Not drift — upstream rule should skip cross-repo spec templates." + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Proof-spec template for the external conflow repo; src/pipeline/ is conflow's tree, not standards'. Not drift \u2014 upstream rule should skip cross-repo spec templates." }, { "severity": "medium", @@ -795,14 +795,14 @@ "rule_module": "structural_drift", "type": "SD022", "file": "k9-svc/examples/NOT-a-good-fit.adoc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Hypothetical anti-pattern example in a doc titled NOT-a-good-fit — the directory is deliberately fictional. (k9-svc is also carve-out #491, but the finding is simply wrong.)" + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Hypothetical anti-pattern example in a doc titled NOT-a-good-fit \u2014 the directory is deliberately fictional. (k9-svc is also carve-out #491, but the finding is simply wrong.)" }, { "severity": "medium", "rule_module": "structural_drift", "type": "SD022", "file": "meta-a2ml/spec/SCM-FORMAT-FAMILY.adoc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Sample SCM session data in a format spec — the path is example payload content, not a repo reference." + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Sample SCM session data in a format spec \u2014 the path is example payload content, not a repo reference." }, { "severity": "medium", @@ -823,14 +823,14 @@ "rule_module": "structural_drift", "type": "SD022", "file": "rhodium-standard-repositories/satellites/META.scm/spec/SCM-FORMAT-FAMILY.adoc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Vendored satellite copy of the SCM spec — same illustrative example payload as meta-a2ml. Satellite is third-party-treated: never edit; baseline permanently." + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Vendored satellite copy of the SCM spec \u2014 same illustrative example payload as meta-a2ml. Satellite is third-party-treated: never edit; baseline permanently." }, { "severity": "medium", "rule_module": "structural_drift", "type": "SD022", "file": "rhodium-standard-repositories/satellites/palimpsest-license/PROJECT_MANAGEMENT/RECONCILIATION_AUDIT.md", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Historical audit record of a GitLab source repo path that was deliberately NOT imported — prose-history by design. Vendored satellite: never edit." + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Historical audit record of a GitLab source repo path that was deliberately NOT imported \u2014 prose-history by design. Vendored satellite: never edit." }, { "severity": "medium", @@ -853,7 +853,7 @@ "rule_module": "workflow_audit", "type": "scorecard_publish_with_run_step", "file": "scorecard-enforcer.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): OSSF publish verification restricts publishing workflows; enforcement run-steps belong apart. scorecard-reusable.yml already publishes — enforcer should not double-publish." + "note": "FALSE POSITIVE (hypatia triage 2026-07-21): OSSF publish verification restricts publishing workflows; enforcement run-steps belong apart. scorecard-reusable.yml already publishes \u2014 enforcer should not double-publish." }, { "severity": "high", @@ -868,5 +868,17 @@ "type": "secret_action_without_presence_gate", "file": "mirror-reusable.yml", "note": "FALSE POSITIVE (hypatia triage 2026-07-21): mirror-gitlab ssh-agent step IS presence-gated via env mapping; comment L54-57 documents why secrets can't appear in if:. Same upstream rule gap as instant-sync. Baseline permanently." + }, + { + "severity": "critical", + "rule_module": "cicd_rules", + "type": "banned_language_file", + "file": "a2ml/actions/validate/validate-manifest-dialect.py" + }, + { + "severity": "critical", + "rule_module": "cicd_rules", + "type": "banned_language_file", + "file": "scripts/relock-sha-keys.py" } ]