From 48af63c7eb75a481ad61146d9587f7fec4ad74b4 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:36:34 +0000 Subject: [PATCH 1/2] chore(json): canonicalise .hypatia-baseline.json (I-JSON + JCS) The owner ruled that .hypatia-baseline.json must be J-1 canonical, as JSON-POLICY requires. The file was rewritten with ijson-jcs fix, built from the commit CI pins (0fdeea71). It is now one sorted line ending in LF, down from 516 indented lines. The parsed value is unchanged: jq reads both versions as equal. No tool rewrites the file here. It is edited by hand or with jq in PRs, and every reader parses it with jq, so the single-line layout breaks nothing: - apply-baseline.sh - filter-sarif-by-baseline.sh - check-exemption-ratchet.sh - the banned-language lookup in governance-reusable.yml - tests/test_secret_scanner_no_inherit.sh Docs: JSON-POLICY section 6 records the ruling. HYPATIA-BASELINE-FORMAT tells editors to run ijson-jcs fix after an edit. Checks: - apply-baseline.sh gives byte-identical output on the old and new files, in advisory and blocking mode. - exemption ratchet against origin/main: OK, .hypatia-baseline.json unchanged at 62. - Tests pass: exemption-ratchet, apply-baseline, hypatia-blocking-gate, check-ijson-jcs, secret-scanner-no-inherit. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_014h2gFLLQibfB5N5hFz9ZCD --- .hypatia-baseline.json | 517 +----------------------------- 3-practice/JSON-POLICY.adoc | 6 +- docs/HYPATIA-BASELINE-FORMAT.adoc | 6 + 3 files changed, 12 insertions(+), 517 deletions(-) diff --git a/.hypatia-baseline.json b/.hypatia-baseline.json index 06aa24e75..08e86d8cc 100644 --- a/.hypatia-baseline.json +++ b/.hypatia-baseline.json @@ -1,516 +1 @@ -[ - { - "severity": "high", - "rule_module": "code_safety", - "type": "js_exec_sync", - "file": "1-formats/k9/tools/conformance-report.mjs", - "note": "FALSE POSITIVE (CI triage 2026-10-18): Hypatia 51ab6496 matches the node:child_process import itself. The reporter uses spawnSync(command, args) with separate argument arrays and shell disabled by default; no command string is evaluated by a shell. Keep argv-only execution when extending this reporter." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "js_exec_sync", - "file": "1-formats/k9/tools/conformance-report.test.mjs", - "note": "FALSE POSITIVE (CI triage 2026-10-18): Hypatia 51ab6496 matches the node:child_process import itself. These tests use spawnSync with separate argument arrays and shell disabled by default to run git and Bash fixture scripts; no shell command interpolation occurs. The subprocesses verify that failed or missing validator evidence cannot pass." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "unwrap_without_check", - "file": "9-archive/rhodium-standard-repositories/examples/enterprise-service/benches/api_benchmarks.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Benchmark harness setup; panic on runtime-creation failure is the intended and only sensible failure mode. Not a DoS surface. Rule should exclude benches/ directories." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": ".github/workflows/changelog-reusable.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; write perms are job-scoped and required to open the changelog PR. Baseline permanently." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": ".github/workflows/hypatia-scan-reusable.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; security-events:write is the minimum for SARIF upload, not excess privilege. Baseline permanently." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": ".github/workflows/hypatia-scan.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; the permissions block is deliberate and documented in-file. Baseline permanently." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": ".github/workflows/scorecard.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Stale 46-day-old mirror (standards#378) against a file since renamed to scorecard-enforcer.yml/scorecard-reusable.yml; the missing_requirement alert has no current target." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "1-formats/k9/register.ncl", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Doubly false: CSA mirror double-report (#378) AND underlying ncl_http_url matched XML namespace identifiers which are opaque strings, never dereferenced. 1-formats/k9/** carved out to #491." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "2-protocols/overlay/ffi/zig/src/main.zig", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own SARIF alert (standards#378). Underlying @ptrCast is already emitted by the primary code_safety rule; the CSA copy is a duplicate." - }, - { - "severity": "medium", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "9-archive/rhodium-standard-repositories/templates/setup.sh.template", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of the Scorecard alert; file also lives under the #493 eviction carve-out. Baseline permanently as a mirror." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "9-archive/rhodium-standard-repositories/templates/setup.sh.template", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Mirror double-report per standards#378 of a Scorecard alert; file lives in rhodium-standard-repositories, carve-out #493 (template awaiting eviction). Re-acked 2026-10-14 (P1.1): CSA findings echo live Scorecard alert state and cannot be re-verified from the tree; the pinned scanner emitted no CSA finding on main (dead PAT), so this ack is kept as the tripwire #957 describes until that issue is ruled. Tracker #378 was closed.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#957" - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "setup.sh", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own alert (standards#378). Underlying curl|bash is real and covered by the primary code_safety finding; root scaffold is also #496 territory." - }, - { - "severity": "medium", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "setup.sh", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): Scorecard's Pinned-Dependencies alert already tracks this line; hypatia re-mirroring it adds nothing. Baseline permanently." - }, - { - "severity": "medium", - "rule_module": "code_scanning_alerts", - "type": "CSA002", - "file": "hyperpolymath/standards", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): aggregate counter of alerts hypatia already re-reports one-by-one; triple-counting by construction. Baseline permanently." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": ".github/workflows/changelog-reusable.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already follows the recommended pattern (read at top, write scoped per-job)." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": ".github/workflows/hypatia-scan-reusable.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378; security-events: write at top level is the documented requirement for SARIF upload from the reusable scan." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": ".github/workflows/hypatia-scan.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already declares least-privilege top-level perms with a documented, deliberate grant for SARIF upload." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": ".github/workflows/scorecard.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of hypatia's own missing_requirement alert; Scorecard coverage exists under scorecard-reusable.yml/scorecard-enforcer.yml, so the naming expectation is stale." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "1-formats/k9/register.ncl", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Double-false: mirror double-report per standards#378, AND the underlying ncl_http_url alert flags XML namespace/DTD identifiers, which are opaque IDs never fetched over HTTP. k9-svc carve-out #491." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "2-protocols/overlay/ffi/zig/src/main.zig", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): hypatia re-ingesting its own code_safety alert. Underlying shim debt is the estate-wide template-rot campaign (fix the boj-server template once)." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "setup.sh", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): third reporting channel (hypatia alert + Scorecard alert + this mirror) for the same two lines. Baseline permanently." - }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "1-formats/sub-specs/panll-panels/README.adoc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Explicitly a path in the external PanLL repo (future destination), not this tree. Intentional cross-repo reference." - }, - { - "severity": "critical", - "rule_module": "cicd_rules", - "type": "banned_language_file", - "file": "1-formats/deed/tools/a2ml_to_deed.py", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): DEED toolchain file in banned Python (port-or-exempt decision pending); SonarCloud issues in it fixed separately.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#944" - }, - { - "severity": "critical", - "rule_module": "cicd_rules", - "type": "banned_language_file", - "file": "1-formats/deed/tools/deed_lint.py", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): DEED toolchain file in banned Python (port-or-exempt decision pending); SonarCloud issues in it fixed separately.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#944" - }, - { - "severity": "warn", - "rule_module": "research_extensions", - "type": "RE001", - "file": ".github/workflows/mirror-reusable.yml", - "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#941" - }, - { - "severity": "warn", - "rule_module": "research_extensions", - "type": "RE001", - "file": ".github/workflows/boj-build.yml", - "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#941" - }, - { - "severity": "warn", - "rule_module": "research_extensions", - "type": "RE001", - "file": ".github/workflows/label-triage.yml", - "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#941" - }, - { - "severity": "warn", - "rule_module": "research_extensions", - "type": "RE001", - "file": ".github/workflows/github-backup-mirror-reusable.yml", - "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#941" - }, - { - "severity": "warn", - "rule_module": "research_extensions", - "type": "RE001", - "file": ".github/workflows/labels.yml", - "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#941" - }, - { - "severity": "warn", - "rule_module": "research_extensions", - "type": "RE001", - "file": ".github/workflows/hypatia-scan-reusable.yml", - "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#941" - }, - { - "severity": "warn", - "rule_module": "research_extensions", - "type": "RE001", - "file": ".github/workflows/instant-sync.yml", - "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#941" - }, - { - "severity": "warn", - "rule_module": "research_extensions", - "type": "RE001", - "file": ".github/workflows/tailscale-connect-reusable.yml", - "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#941" - }, - { - "severity": "warn", - "rule_module": "research_extensions", - "type": "RE001", - "file": ".github/workflows/governance-reusable.yml", - "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#941" - }, - { - "severity": "warn", - "rule_module": "research_extensions", - "type": "RE001", - "file": ".github/workflows/allowlist-preflight-reusable.yml", - "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#941" - }, - { - "severity": "high", - "rule_module": "workflow_hardening", - "type": "WH013", - "file": ".github/workflows/github-backup-mirror-reusable.yml", - "note": "FALSE POSITIVE (hypatia triage 2026-09-22): pushes target FOREIGN repos via PAT, not GITHUB_TOKEN contents; `contents: read` is correct least privilege.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#943" - }, - { - "severity": "medium", - "rule_module": "scorecard", - "type": "DependencyPinning", - "file": ".", - "note": "PREEMPTIVE (hypatia triage 2026-09-22): observed once alongside the invalid lock; the lock repair should clear it \u2014 dormant if so.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#945" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "npx_in_workflow", - "file": ".github/copilot/coding-agent.yml", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#938" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "npx_in_workflow", - "file": "9-archive/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/.github/workflows/rescript-deno-ci.yml", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#938" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "npx_in_workflow", - "file": "9-archive/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/.gitlab-ci.yml", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#938" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "npx_in_workflow", - "file": "9-archive/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/Justfile", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#938" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "npx_in_workflow", - "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/rescript-deno-ci.yml", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#938" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "npx_in_workflow", - "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/post-sync.sh", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#938" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "known_fake_action_sha", - "file": "9-archive/rhodium-standard-repositories/examples/enterprise-service/.github/workflows/security.yml", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#940" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "known_fake_action_sha", - "file": "9-archive/rhodium-standard-repositories/satellites/cccp/satellites/php-aegis/.github/workflows/comprehensive-quality.yml", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#940" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "known_fake_action_sha", - "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/ci.yml", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#940" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "known_fake_action_sha", - "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/security.yml", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#940" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "eval_in_shell", - "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-dns-discovery.sh", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI. Re-acked 2026-10-14 (P1.1): still present (finding re-verified in the file and in the main@bf211558 CI scan); tracker #939 closed, moved to #493 (open; de-vendoring of the rhodium-standard-repositories satellites that carry this demo content).", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#493" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "eval_in_shell", - "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-http-headers.sh", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI. Re-acked 2026-10-14 (P1.1): still present (finding re-verified in the file and in the main@bf211558 CI scan); tracker #939 closed, moved to #493 (open; de-vendoring of the rhodium-standard-repositories satellites that carry this demo content).", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#493" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "download_then_run_shell", - "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/install.sh", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI. Re-acked 2026-10-14 (P1.1): still present (finding re-verified in the file and in the main@bf211558 CI scan); tracker #939 closed, moved to #493 (open; de-vendoring of the rhodium-standard-repositories satellites that carry this demo content).", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#493" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "hardcoded_tmp", - "file": "scripts/sweep-classifiers/classify-codeql.sh", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#1243" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "hardcoded_tmp", - "file": "scripts/sweep-classifiers/classify-hypatia-scan.sh", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#1243" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "hardcoded_tmp", - "file": "scripts/sweep-classifiers/classify-mirror.sh", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#1243" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "hardcoded_tmp", - "file": "scripts/sweep-classifiers/classify-secret-scanner.sh", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#1243" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "http_in_docs", - "file": "2-protocols/axel/CODE_OF_CONDUCT.adoc", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#937" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "http_in_docs", - "file": "2-protocols/axel/docs/cloudflare-dns-guide.adoc", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#937" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "http_in_docs", - "file": "2-protocols/axel/docs/github-pages-setup.adoc", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#937" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "http_in_docs", - "file": "LICENSES/MPL-2.0.txt", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#937" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "http_in_docs", - "file": "9-archive/rhodium-standard-repositories/examples/minimal-rust-project/README.adoc", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#937" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "http_in_docs", - "file": "9-archive/rhodium-standard-repositories/examples/standard-library/README.adoc", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#937" - }, - { - "severity": "medium", - "rule_module": "content_patterns", - "type": "http_in_docs", - "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/GUIDES_v0.4/professional-integration/MUSEUMS.adoc", - "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#937" - }, - { - "severity": "warn", - "rule_module": "research_extensions", - "type": "RE001", - "file": ".github/workflows/k9-contractile.yml", - "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today. Same decision as the other RE001 entries; this workflow's 'Publish the K9 verdict' job (GITHUB_TOKEN only) joined the set on 2026-10-06.", - "expires_at": "2026-12-22", - "tracking_issue": "hyperpolymath/standards#941" - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "ncl_k9_missing_pedigree", - "file": "1-formats/k9/tools/fixtures/invalid/L1-K9-S001-no-pedigree.k9.ncl", - "note": "FALSE POSITIVE BY DESIGN: this is the NEGATIVE CONTROL for K9-S001 (no pedigree). k9-validate.sh --fixtures requires it to be rejected at L1 for exactly this reason; adding a pedigree would destroy the control. Exact path, not a pattern, so a real component that loses its pedigree is still reported." - } -] +[{"file":"1-formats/k9/tools/conformance-report.mjs","note":"FALSE POSITIVE (CI triage 2026-10-18): Hypatia 51ab6496 matches the node:child_process import itself. The reporter uses spawnSync(command, args) with separate argument arrays and shell disabled by default; no command string is evaluated by a shell. Keep argv-only execution when extending this reporter.","rule_module":"code_safety","severity":"high","type":"js_exec_sync"},{"file":"1-formats/k9/tools/conformance-report.test.mjs","note":"FALSE POSITIVE (CI triage 2026-10-18): Hypatia 51ab6496 matches the node:child_process import itself. These tests use spawnSync with separate argument arrays and shell disabled by default to run git and Bash fixture scripts; no shell command interpolation occurs. The subprocesses verify that failed or missing validator evidence cannot pass.","rule_module":"code_safety","severity":"high","type":"js_exec_sync"},{"file":"9-archive/rhodium-standard-repositories/examples/enterprise-service/benches/api_benchmarks.rs","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Benchmark harness setup; panic on runtime-creation failure is the intended and only sensible failure mode. Not a DoS surface. Rule should exclude benches/ directories.","rule_module":"code_safety","severity":"high","type":"unwrap_without_check"},{"file":".github/workflows/changelog-reusable.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; write perms are job-scoped and required to open the changelog PR. Baseline permanently.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA001"},{"file":".github/workflows/hypatia-scan-reusable.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; security-events:write is the minimum for SARIF upload, not excess privilege. Baseline permanently.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA001"},{"file":".github/workflows/hypatia-scan.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; the permissions block is deliberate and documented in-file. Baseline permanently.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA001"},{"file":".github/workflows/scorecard.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Stale 46-day-old mirror (standards#378) against a file since renamed to scorecard-enforcer.yml/scorecard-reusable.yml; the missing_requirement alert has no current target.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA001"},{"file":"1-formats/k9/register.ncl","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Doubly false: CSA mirror double-report (#378) AND underlying ncl_http_url matched XML namespace identifiers which are opaque strings, never dereferenced. 1-formats/k9/** carved out to #491.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA001"},{"file":"2-protocols/overlay/ffi/zig/src/main.zig","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own SARIF alert (standards#378). Underlying @ptrCast is already emitted by the primary code_safety rule; the CSA copy is a duplicate.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA001"},{"file":"9-archive/rhodium-standard-repositories/templates/setup.sh.template","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of the Scorecard alert; file also lives under the #493 eviction carve-out. Baseline permanently as a mirror.","rule_module":"code_scanning_alerts","severity":"medium","type":"CSA001"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/templates/setup.sh.template","note":"TRACKED DEBT (hypatia triage 2026-07-21): Mirror double-report per standards#378 of a Scorecard alert; file lives in rhodium-standard-repositories, carve-out #493 (template awaiting eviction). Re-acked 2026-10-14 (P1.1): CSA findings echo live Scorecard alert state and cannot be re-verified from the tree; the pinned scanner emitted no CSA finding on main (dead PAT), so this ack is kept as the tripwire #957 describes until that issue is ruled. Tracker #378 was closed.","rule_module":"code_scanning_alerts","severity":"high","tracking_issue":"hyperpolymath/standards#957","type":"CSA003"},{"file":"setup.sh","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own alert (standards#378). Underlying curl|bash is real and covered by the primary code_safety finding; root scaffold is also #496 territory.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA001"},{"file":"setup.sh","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): Scorecard's Pinned-Dependencies alert already tracks this line; hypatia re-mirroring it adds nothing. Baseline permanently.","rule_module":"code_scanning_alerts","severity":"medium","type":"CSA001"},{"file":"hyperpolymath/standards","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): aggregate counter of alerts hypatia already re-reports one-by-one; triple-counting by construction. Baseline permanently.","rule_module":"code_scanning_alerts","severity":"medium","type":"CSA002"},{"file":".github/workflows/changelog-reusable.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already follows the recommended pattern (read at top, write scoped per-job).","rule_module":"code_scanning_alerts","severity":"high","type":"CSA003"},{"file":".github/workflows/hypatia-scan-reusable.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378; security-events: write at top level is the documented requirement for SARIF upload from the reusable scan.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA003"},{"file":".github/workflows/hypatia-scan.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already declares least-privilege top-level perms with a documented, deliberate grant for SARIF upload.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA003"},{"file":".github/workflows/scorecard.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of hypatia's own missing_requirement alert; Scorecard coverage exists under scorecard-reusable.yml/scorecard-enforcer.yml, so the naming expectation is stale.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA003"},{"file":"1-formats/k9/register.ncl","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Double-false: mirror double-report per standards#378, AND the underlying ncl_http_url alert flags XML namespace/DTD identifiers, which are opaque IDs never fetched over HTTP. k9-svc carve-out #491.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA003"},{"file":"2-protocols/overlay/ffi/zig/src/main.zig","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): hypatia re-ingesting its own code_safety alert. Underlying shim debt is the estate-wide template-rot campaign (fix the boj-server template once).","rule_module":"code_scanning_alerts","severity":"high","type":"CSA003"},{"file":"setup.sh","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): third reporting channel (hypatia alert + Scorecard alert + this mirror) for the same two lines. Baseline permanently.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA003"},{"file":"1-formats/sub-specs/panll-panels/README.adoc","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Explicitly a path in the external PanLL repo (future destination), not this tree. Intentional cross-repo reference.","rule_module":"structural_drift","severity":"medium","type":"SD022"},{"expires_at":"2026-12-22","file":"1-formats/deed/tools/a2ml_to_deed.py","note":"TRACKED DEBT (hypatia triage 2026-09-22): DEED toolchain file in banned Python (port-or-exempt decision pending); SonarCloud issues in it fixed separately.","rule_module":"cicd_rules","severity":"critical","tracking_issue":"hyperpolymath/standards#944","type":"banned_language_file"},{"expires_at":"2026-12-22","file":"1-formats/deed/tools/deed_lint.py","note":"TRACKED DEBT (hypatia triage 2026-09-22): DEED toolchain file in banned Python (port-or-exempt decision pending); SonarCloud issues in it fixed separately.","rule_module":"cicd_rules","severity":"critical","tracking_issue":"hyperpolymath/standards#944","type":"banned_language_file"},{"expires_at":"2026-12-22","file":".github/workflows/mirror-reusable.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/boj-build.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/label-triage.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/github-backup-mirror-reusable.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/labels.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/hypatia-scan-reusable.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/instant-sync.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/tailscale-connect-reusable.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/governance-reusable.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/allowlist-preflight-reusable.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/github-backup-mirror-reusable.yml","note":"FALSE POSITIVE (hypatia triage 2026-09-22): pushes target FOREIGN repos via PAT, not GITHUB_TOKEN contents; `contents: read` is correct least privilege.","rule_module":"workflow_hardening","severity":"high","tracking_issue":"hyperpolymath/standards#943","type":"WH013"},{"expires_at":"2026-12-22","file":".","note":"PREEMPTIVE (hypatia triage 2026-09-22): observed once alongside the invalid lock; the lock repair should clear it — dormant if so.","rule_module":"scorecard","severity":"medium","tracking_issue":"hyperpolymath/standards#945","type":"DependencyPinning"},{"expires_at":"2026-12-22","file":".github/copilot/coding-agent.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#938","type":"npx_in_workflow"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/.github/workflows/rescript-deno-ci.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#938","type":"npx_in_workflow"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/.gitlab-ci.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#938","type":"npx_in_workflow"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/Justfile","note":"TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#938","type":"npx_in_workflow"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/rescript-deno-ci.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#938","type":"npx_in_workflow"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/post-sync.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#938","type":"npx_in_workflow"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/examples/enterprise-service/.github/workflows/security.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#940","type":"known_fake_action_sha"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/cccp/satellites/php-aegis/.github/workflows/comprehensive-quality.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#940","type":"known_fake_action_sha"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/ci.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#940","type":"known_fake_action_sha"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/security.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#940","type":"known_fake_action_sha"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-dns-discovery.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI. Re-acked 2026-10-14 (P1.1): still present (finding re-verified in the file and in the main@bf211558 CI scan); tracker #939 closed, moved to #493 (open; de-vendoring of the rhodium-standard-repositories satellites that carry this demo content).","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#493","type":"eval_in_shell"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-http-headers.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI. Re-acked 2026-10-14 (P1.1): still present (finding re-verified in the file and in the main@bf211558 CI scan); tracker #939 closed, moved to #493 (open; de-vendoring of the rhodium-standard-repositories satellites that carry this demo content).","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#493","type":"eval_in_shell"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/install.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI. Re-acked 2026-10-14 (P1.1): still present (finding re-verified in the file and in the main@bf211558 CI scan); tracker #939 closed, moved to #493 (open; de-vendoring of the rhodium-standard-repositories satellites that carry this demo content).","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#493","type":"download_then_run_shell"},{"expires_at":"2026-12-22","file":"scripts/sweep-classifiers/classify-codeql.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#1243","type":"hardcoded_tmp"},{"expires_at":"2026-12-22","file":"scripts/sweep-classifiers/classify-hypatia-scan.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#1243","type":"hardcoded_tmp"},{"expires_at":"2026-12-22","file":"scripts/sweep-classifiers/classify-mirror.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#1243","type":"hardcoded_tmp"},{"expires_at":"2026-12-22","file":"scripts/sweep-classifiers/classify-secret-scanner.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#1243","type":"hardcoded_tmp"},{"expires_at":"2026-12-22","file":"2-protocols/axel/CODE_OF_CONDUCT.adoc","note":"TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#937","type":"http_in_docs"},{"expires_at":"2026-12-22","file":"2-protocols/axel/docs/cloudflare-dns-guide.adoc","note":"TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#937","type":"http_in_docs"},{"expires_at":"2026-12-22","file":"2-protocols/axel/docs/github-pages-setup.adoc","note":"TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#937","type":"http_in_docs"},{"expires_at":"2026-12-22","file":"LICENSES/MPL-2.0.txt","note":"TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#937","type":"http_in_docs"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/examples/minimal-rust-project/README.adoc","note":"TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#937","type":"http_in_docs"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/examples/standard-library/README.adoc","note":"TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#937","type":"http_in_docs"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/GUIDES_v0.4/professional-integration/MUSEUMS.adoc","note":"TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#937","type":"http_in_docs"},{"expires_at":"2026-12-22","file":".github/workflows/k9-contractile.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today. Same decision as the other RE001 entries; this workflow's 'Publish the K9 verdict' job (GITHUB_TOKEN only) joined the set on 2026-10-06.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"file":"1-formats/k9/tools/fixtures/invalid/L1-K9-S001-no-pedigree.k9.ncl","note":"FALSE POSITIVE BY DESIGN: this is the NEGATIVE CONTROL for K9-S001 (no pedigree). k9-validate.sh --fixtures requires it to be rejected at L1 for exactly this reason; adding a pedigree would destroy the control. Exact path, not a pattern, so a real component that loses its pedigree is still reported.","rule_module":"code_safety","severity":"high","type":"ncl_k9_missing_pedigree"}] diff --git a/3-practice/JSON-POLICY.adoc b/3-practice/JSON-POLICY.adoc index 79ecd8f01..764d802ca 100644 --- a/3-practice/JSON-POLICY.adoc +++ b/3-practice/JSON-POLICY.adoc @@ -116,7 +116,11 @@ would differ from another JCS implementation's. output. Converting those is undone on the next tool run. For `package.json` the answer is RULED in LANGUAGE-POLICY §1.4 (2026-10-14): `js-runtimes regen` (tools/js-runtimes) re-canonicalises it after the tool, and the governance - `js-runtimes` jobs fail a forgotten run. For the + `js-runtimes` jobs fail a forgotten run. For `.hypatia-baseline.json` the + answer is RULED (owner, 2026-10-19): it is J-1 canonical. No tool rewrites + it here; it is edited by hand or with `jq` in a PR. After an edit, run + `ijson-jcs fix .hypatia-baseline.json`. The `ijson-jcs.yml` job + `Converted JSON stays canonical` fails a forgotten run. For the rest, whether they are carved out or the tools are changed is open. * *Mass reformatting.* Convert a repository's JSON in a PR scoped to that repository, after checking each consumer reads it by parsing, not by line. diff --git a/docs/HYPATIA-BASELINE-FORMAT.adoc b/docs/HYPATIA-BASELINE-FORMAT.adoc index 895994d9e..1045a5ea9 100644 --- a/docs/HYPATIA-BASELINE-FORMAT.adoc +++ b/docs/HYPATIA-BASELINE-FORMAT.adoc @@ -35,6 +35,12 @@ ajv validate --spec=draft2020 -s /tmp/schema.json -d .hypatia-baseline.json A JSON array. Each element is a *baseline entry* — same shape as a Hypatia finding, plus optional metadata. +The committed file is I-JSON + JCS canonical (`3-practice/JSON-POLICY.adoc` +J-1): one line, members sorted. The example below is indented for reading +only. After any edit, by hand or with `jq`, run +`ijson-jcs fix .hypatia-baseline.json`. In `hyperpolymath/standards`, CI +fails a non-canonical baseline. + [source,json] ---- [ From 2b535120ca1385294883f404afbbf8cbf00ded58 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:37:31 +0000 Subject: [PATCH 2/2] ci(json): block drift on converted JSON (.hypatia-baseline.json) The ijson-jcs scan is report-only. On its own it would let the next jq edit put the baseline back into an indented layout without failing anything. The baseline is edited often (#1239 and #1244 last week). The package.json ruling (LANGUAGE-POLICY 1.4) pairs its conversion with a job that fails on a forgotten re-canonicalise. This does the same for the baseline. New job in ijson-jcs.yml, "Converted JSON stays canonical": runs check-ijson-jcs.sh --enforce on .hypatia-baseline.json only. The repo-wide scan stays report-only. The job's checkout and the ijson-jcs commit are pinned the same as the existing job. Verified: enforce exits 0 on this branch and 1 on origin/main's copy. actionlint 1.7.7 is clean. validate-sha-pins, validate-actions-lock, check-lock-sync, duplicate-keys, permissions and the actions-lock gate pass. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_014h2gFLLQibfB5N5hFz9ZCD --- .github/workflows/ijson-jcs.yml | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ijson-jcs.yml b/.github/workflows/ijson-jcs.yml index d3cbfe14e..813462f8d 100644 --- a/.github/workflows/ijson-jcs.yml +++ b/.github/workflows/ijson-jcs.yml @@ -1,8 +1,9 @@ # SPDX-License-Identifier: MPL-2.0 # Local dogfood gate for 3-practice/JSON-POLICY.adoc (owner ruling D306): # every .json / .jsonl is I-JSON (RFC 7493) + JCS (RFC 8785) canonical. -# REPORT-ONLY: the scan lists non-canonical files and exits 0. The test step -# is what can fail, and it proves the scan can tell the three verdicts apart. +# The repo-wide scan is REPORT-ONLY: it lists non-canonical files and exits 0. +# Its test step can fail, and proves the scan can tell the three verdicts apart. +# The converted-stay-canonical job BLOCKS, but only on files already converted. name: ijson-jcs conformance on: @@ -30,3 +31,19 @@ jobs: - run: cargo install --git https://github.com/hyperpolymath/ijson-jcs --rev 0fdeea716fd558e9807362acf6f8202d56d8d88f --locked ijson-jcs - run: bash scripts/tests/check-ijson-jcs-test.sh - run: scripts/check-ijson-jcs.sh . + + # BLOCKING, for converted files only (JSON-POLICY §6). A file listed here was + # canonicalised under an owner ruling and must not drift back to an indented + # layout on its next jq edit. The report-only scan above cannot catch that. + # Fix a failure with `ijson-jcs fix `. + converted-stay-canonical: + name: Converted JSON stays canonical + runs-on: ubuntu-latest + timeout-minutes: 15 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + # Pinned to a commit: ijson-jcs has no releases yet. + - run: cargo install --git https://github.com/hyperpolymath/ijson-jcs --rev 0fdeea716fd558e9807362acf6f8202d56d8d88f --locked ijson-jcs + - run: scripts/check-ijson-jcs.sh --enforce .hypatia-baseline.json