Activity

1. hyperpolymath commented on May 26, 2026

   

   hyperpolymath

   on May 26, 2026

   OwnerAuthor

   More actions

   panic-attack estate sweep — 2026-05-26 (status update)

   Owner: @hyperpolymath
   Scan tool: panic-attack v2.5.0 built 2026-05-26
   Driver: per-repo panic-attack assail --headless --output <repo>.json with 90s timeout

   Scan results

   Metric	Value
   Repos scanned	349 (368 walked, 19 no-source content-only repos skipped)
   Total Critical/High candidates	6,069
   Already-suppressed (existing audits/assail-classifications.a2ml)	961
   Worktree-path artefacts (skipped)	40
   Out-of-scope (Low/Medium severity)	2,591
   Actionable (this campaign)	2,477 (457 autofix + 1,777 issue + 243 proof-draft)

   PRs filed (this session)

   #	Repo	PR	Category	Findings	Pattern
   1	svalinn	#11	PA022 (CryptoMisuse)	4	test-context-fixture (decodeJwt in bench/tests)
   2	proven	#67	PA001+PA007	129	legitimate-ffi (bindings//src/ + ffi//src/)
   3	gossamer	#54	PA001+PA007	24	legitimate-ffi (src/interface/ffi/src/)
   4	docudactyl	#20	PA001+PA007	15	legitimate-ffi (ffi/zig/src/)
   5	proven-servers	#11	PA001+PA007	10	legitimate-ffi (bindings/rust/src/)
   6	aerie	#35	PA001+PA007	10	legitimate-ffi (src/api/zig/)
   7	boj-server	#153	PA001	2	legitimate-ffi (ffi/zig/src/) — cartridges/* deferred

   Total this session: 7 PRs, 194 findings classified.

   Remaining work — next-session queue

   Track A — legitimate-FFI classifications (high-confidence, batch-able)

   Repo	Active PA001/PA007 Critical/High	Notes
   boj-server cartridges/*	~113 across ~110 cartridge subdirs	One PR per cartridge OR one bundled cartridge PR
   linguist	16 (PA001 + 4× PA022 in samples/C++)	samples/ is reference code; classification
   stapeln	10	inspect FFI prefix
   ambientops	9 across 8 groups	spread out — file-by-file
   valence-shell	8 across 4 groups	impl/rust-cli/src/
   polystack	7 across 6 groups	inspect
   panll	6 across 5 groups	inspect
   HOL	5	proof toolchain — likely proof-draft, not autofix

   Track B — real bug fixes (need code edits, not classification)

   The triage bucketed 457 "autofix" candidates but most are actually legitimate-FFI. After Track A's classifications land, the true real-defect remainder is likely <50 findings. These are:

   • PA022 CryptoMisuse outside test/bench context — JWT decode-without-verify on production paths.
   • PA009 HardcodedSecret outside test/CI fixtures — actual leaked tokens.
   • PA003 CommandInjection in shipped scripts.
   • PA008 PathTraversal in real handlers.

   Triage script bucket distribution needs re-run after Track A to see what's left.

   Track C — issue-only findings (1,777)

   Will be filed as GitHub issues, not PRs (need human judgement):

   • PA023 SupplyChain (version pinning)
   • PA024 InputBoundary (schema design)
   • PA025 MutationGap (test-infra changes)
   • PA021 ProofDrift outside parked-debt list (proof refactor)

   Track D — proof-aware PRs (243)

   DRAFT PRs with local proof-rebuild verification, 13 proof repos:

   • echidna (largest: Lean 6, Agda 14, Coq 8, Idris2 12, F* 5, Isabelle 4)
   • proven (203 .ipkg)
   • agda-stdlib (125 Agda)
   • echo-types (64 Agda)
   • tropical-resource-typing (1 Lean, 9 Isabelle)
   • ephapax (3 Coq + 1 Idris2 — but parked-debt at Semantics.v:3327, do NOT refile)
   • kategoria (13 Idris2)
   • frayed-knot-toolkit (6 Agda)
   • boj-server (1 Idris2)
   • standards (2 Idris2 — verification targets)
   • zerostep (1 Isabelle)
   • burble (2 Idris2)
   • ochrance (9 Idris2)

   Track E — assault (dynamic) + specialised modes

   Not run this session. Per plan:

   • Best-effort assault per repo with binary-build attempt (cargo/go/idris2/agda/coq/lean/dune)
   • bridge triage --offline for repos with Cargo.lock
   • signatures for C/C++/Rust/unsafe-heavy repos
   • temporal where prior VeriSimDB snapshots exist

   Skipped repos (19, no further action)

   • 14 from top-level pass: achievements-lab, cafescripto, claude-memory, dotfiles, ephapax-wiki, humor-ecosystem, info, jaffascript, lucidscript, pseudoscript, repos-monorepo, technical-notes, tentacles-agentic-syllabus, vext
   • 5 from nested pass: 4× awesome-projects/awesome-{lua,pandoc,selfhosted,zig}, idaptik-ums

   Most are content-only repos (lists, archives, docs). repos-monorepo did time out (likely proof-heavy or huge); revisit with longer timeout.

   Guardrails honoured this session

   • ✅ All commits GPG-signed (G status)
   • ✅ Base = main for every PR
   • ✅ No auto-merge enabled
   • ✅ No --no-verify / --no-gpg-sign
   • ✅ features/panic-attacker/ stub dirs untouched (canonical-tool references)
   • ✅ vcl-ut, hypatia agent worktrees, ephapax proof-debt worktrees — all untouched
   • ✅ ephapax preservation, betlang substTop, boj-server class-J — not refiled
   • ✅ Stray local commit on gossamer/main (workflow hardening, unpushed) preserved by branching from origin/main

   Campaign workspace

   • Plan + driver scripts: /tmp/panic-attack-campaign-2026-05-26/
   • Per-repo scan outputs: /tmp/panic-attack-campaign-2026-05-26/per-repo/*.json
   • Triage plan: /tmp/panic-attack-campaign-2026-05-26/02-plan.json
   • Tracker issue: panic-attack estate sweep — 2026-05-26 #32
   • Design follow-up: Complete VeriSimDB hexad persistence (S1–S3) — campaign-driven #33 (VeriSimDB hexad persistence — would make next campaign cheaper)
2. hyperpolymath

   added 2 commits that reference this issue on May 26, 2026

   audit: extend cartridge bundle to subsume backend FFI (#153)

   ...

   90af892

   audit: extend bindings classification to PA009 + PA003 false positive…

   ...

   0044629
3. hyperpolymath commented on May 26, 2026

   

   hyperpolymath

   on May 26, 2026

   OwnerAuthor

   More actions

   panic-attack estate sweep — 2026-05-26 (session 2 update)

   Owner: @hyperpolymath
   Scope this session: Tracks A, B, and C from the next-session queue.

   Session 2 output summary

   Type	Count	Coverage
   Track A classification PRs filed/extended	8	stapeln, ambientops, valence-shell, panll, boj-server, linguist, idaptik, proven (extended)
   Track A PRs from session 1	6	svalinn, proven, gossamer, docudactyl, proven-servers, aerie
   Track B real-bug issues	1	svalinn#12 (Jwt.verifyJwt skips signature verification — critical)
   Track C tracking issues filed	35+	per-repo human-triage backlogs
   Track D tracking issues filed	3	echidna, tropical-resource-typing, standards
   Total session 2 actions	~47

   Track A (FFI / systems unsafe classifications)

   #	Repo	PR	Findings	Pattern
   8	stapeln	#62	10	vordr eBPF + Zig FFI + Ada↔liboqs bindings
   9	ambientops	#102	10	cross-subproject syscall + FFI cluster
   10	valence-shell	#32	8	POSIX shell job-control libc + Zig FFI
   11	panll	#47	6	Idris2 Zig FFI + src-gossamer (frozen) OS-FFI
   12	linguist	#3	13	sample-reference-fixture (PA001 + PA022) + vendored PCRE
   13	boj-server	#154	119	117 MCP cartridge_shim + 2 backend FFI (supersedes #153)
   14	idaptik	#98	12	in-game password fixtures (game-content)
   15	proven	#67 (extended)	+21	added PA009 + PA003 false-positive classifications (150 total)

   Track A skipped: polystack (repo archived, read-only).

   Track B (real-bug remainder)

   #	Repo	Issue	Severity	Finding
   1	svalinn	#12	Critical	Jwt.verifyJwt claims to verify but skips signature check; AuthMiddleware bypass on both OIDC and no-OIDC paths

   After Track A classifications drained ~497 UnsafeCode/UnsafeFFI findings as legitimate FFI/fixtures, and Track B classifications drained ~21 more on proven's PA009 + PA003 (false positives), and idaptik#98 covered 12 game fixtures, the genuine real-bug remainder shrunk much smaller than estimated. The remaining real bugs need human design judgement and are tracked via Track C tracking issues (per repo).

   Track C (per-repo human-triage tracking issues)

   35+ issues filed. Each lists Critical/High findings by category (excluding PA001/PA007 covered by Track A; excluding ProofDrift covered by Track D).

   Repo	Issue	Findings
   stapeln	#63	13
   ambientops	#103	34
   gitbot-fleet	#207	51
   standards	#178	39
   reposystem	#68	37
   panll	#48	44
   proven	#68	33
   boj-server	#155	n
   valence-shell	#33	n
   grim-repo	#22	29
   protocol-squisher	#64	23
   burble	#91	19
   svalinn	#13	n
   wordpress-tools	#25	18
   academic-workflow-suite	#201	15
   my-lang	#67	14
   januskey	#37	13
   idaptik	#99	23
   patallm-gallery	#55	15
   echo-types	#113	12
   verisimdb	#47	10
   eclexia	#20	10
   conflow	#17	10
   claude-integrations	#38	10
   bofig	#80	10
   ssg-collection	#13	9
   asdf-tool-plugins	#32	9
   affinescript	#378	9
   game-server-admin	#20	8
   ephapax	#138	8
   echidna	#104	8
   conative-gating	#53	8
   proven-servers	#12	7
   odds-and-sods-package-manager	#31	7
   absolute-zero	#43	7
   wokelang	#61	6
   proof-burrower	#14	6
   julia-ecosystem	#6	209
   developer-ecosystem	#83	166
   project-wharf	#34	6
   palimpsest-plasma	#19	6
   betlang	#31	6
   zotero-tools	#14	5
   vex-tools	#24	5
   vexometer	#20	5
   social-media-tools	#27	5
   maa-framework	#72	5
   fireflag	#29	5
   filesoup	#18	5
   file-soup	#41	5
   accessibility-everywhere	#41	5

   Track C skipped repos:

   • julia.jl sub-repos (Julia chapter closed per project memory — covered via julia-ecosystem container issue chore(deps): bump colored from 2.2.0 to 3.1.1 #6)
   • hypatia (active working tree with 280+ untracked files; would require careful out-of-tree handling)
   • polystack (archived on remote)
   • linguist, rescript, HOL (issues disabled on the GH repos — they're forks)
   • hyperpolymath-archive, standards-as-port (repo deleted on GH; local-only or worktree)

   Track D (proof-aware tracking issues)

   Filed lightweight tracking issues rather than DRAFT-fix PRs (the proof-rebuild-per-finding cost is too high for one session).

   Repo	Issue	ProofDrift findings
   echidna	#105	2
   tropical-resource-typing	#3	4
   standards	#181	2

   Track D not filed:

   • ephapax (parked debt: preservation Semantics.v:3327, per memory)
   • boj-server SafetyLemmas.idr 5 believe_me's (parked class-J primitive axioms)
   • agda-stdlib (upstream agda/agda-stdlib clone, no hyperpolymath/ fork)
   • proven (proof-file findings already classified via PR chore(ci): replace secret-scanner.yml with reusable wrapper #67)
   • echo-types, kategoria, frayed-knot-toolkit, zerostep, burble, ochrance (0 active ProofDrift)

   Track E (assault + specialised modes)

   Not started this session. Deferred to follow-up. Per the campaign plan, this involves:

   1. Best-effort assault per repo with binary-build attempt (cargo / go / idris2 / agda / coq / lean / dune)
   2. bridge triage --offline for repos with Cargo.lock
   3. signatures for C/C++/Rust/unsafe-heavy repos
   4. temporal diff where prior .verisimdb/ snapshots exist

   Expected output: another wave of dynamic/runtime findings layered on top of the static assail view.

   Guardrails honoured this session

   • ✅ All commits GPG-signed (G status verified per repo)
   • ✅ Base = main for every PR
   • ✅ No auto-merge enabled
   • ✅ No --no-verify / --no-gpg-sign
   • ✅ features/panic-attacker/ stub dirs untouched
   • ✅ vcl-ut _wt-vclut*, hypatia .claude/worktrees/agent-*, ephapax _wt-eph-* — all untouched
   • ✅ ephapax preservation (Semantics.v:3327), betlang substTop_preserves_typing, boj-server class-J — not refiled
   • ✅ Julia chapter closed — no per-.jl issues filed; container-only
   • ✅ valence-shell stray local main commit (workflow hardening) preserved by branching from origin/main

   Outstanding follow-ups

   1. Real-bug remainder fixes: each Track C issue needs human triage to separate real bugs from FPs. The svalinn#12 JWT bug is the only known critical real bug from this session.
   2. Track D actual DRAFT PRs: 8 findings across 3 repos still need DRAFT PR + local proof-rebuild before remediation.
   3. Track E: run dynamic/specialised modes (assault, bridge, signatures, temporal).
   4. hypatia: re-attempt classification once the active session's untracked files are committed elsewhere.
   5. polystack: unarchive on GH (owner action) before security work can land.

   Campaign workspace

   • Per-repo scan outputs: /tmp/panic-attack-campaign-2026-05-26/per-repo/*.json
   • Triage plan: /tmp/panic-attack-campaign-2026-05-26/02-plan.json
   • Driver scripts: 00-per-repo.sh, 00b-nested.sh, 01-triage.ts, file-ffi-pr-v2.sh
4. hyperpolymath commented on May 26, 2026

   

   hyperpolymath

   on May 26, 2026

   OwnerAuthor

   More actions

   panic-attack estate sweep — 2026-05-26 (session 2 — Track E update)

   Track E (assault + specialised modes) ran after Tracks A/B/C/D in this same session.

   Track E summary

   Sub-track	Status	Output
   bridge triage (CVE + reachability)	✅ done	24 CVE tracking issues filed across 29 of 58 Rust repos with non-zero advisories
   signatures (use-after-free / deadlock)	❌ N/A	Subcommand does not exist in panic-attack v2.5.0 — removed/never-shipped despite plan reference
   temporal diff	⚠️ blocked	The 4 .verisimdb/ directories in the estate contain verisimdb-service deployment configs, not temporal-snapshot data (verisimdb-data/temporal-index.json doesn't exist). Real temporal coverage depends on panic-attack#33 (VeriSimDB hexad persistence) landing.
   assault (dynamic)	⏸ deferred	Per-repo build attempts (cargo / go / idris2 / agda / coq / lean / dune) are high-failure-rate and lengthy; deferred to a dedicated assault session.

   Bridge triage CVE issues (24)

   Repo	Issue	CVEs	Notes
   git-reticulator	#10	24	highest CVE count
   docmatrix	#21	22	mostly phantom-imports
   presswerk	#40	20
   formatrix-docs	#13	19
   intsoc-transactor	#16	16
   vcs-ircd	#36	5
   hesiod-dns-map	#47	4
   verisimdb	#48	4
   bunsenite	#48	3
   multiterm	#1	3
   007	#16	2
   eclexia	#21	2
   reposystem	#69	2
   zerostep	#39	2
   cloudguard-cli	#15	1
   cloudguard-server	#16	1
   conflow	#18	1
   echidna	#106	1
   echidnabot	#18	1
   ephapax	#139	1
   file-soup	#42	1
   heterogenous-mobile-computing	#33	1
   hypatia	#330	1
   januskey	#38	1
   panll	#49	1
   project-wharf	#35	1
   proof-of-work	#71	1
   rpa-elysium	#47	1
   veridical-simulation-core	#5	1

   (Some rows merged for brevity — full table is 29 entries.)

   Recommended follow-up actions

   Most bridge findings are phantom-imports (deps declared in Cargo.toml but never imported in any .rs file). The recommended action per finding is Remove unused dependency — a low-risk no-behaviour-change Cargo.toml edit. Highest-impact next step:

   1. For each phantom-classification CVE: open a small PR removing the unused dep from Cargo.toml. This is mechanical and could potentially be batched estate-wide.
   2. For reachable-classification CVEs (the actually-dangerous ones): bump the dep version in Cargo.toml and Cargo.lock to the fixed_versions[0].

   Campaign workspace addendum

   • Bridge reports: /tmp/panic-attack-campaign-2026-05-26/bridge/*.json
   • 58 Rust repos scanned; 29 with non-zero CVEs (50%); 24 GH issues filed (5 not-yet-filed for time reasons — they have 0 informational/0 mitigated triage and 1 CVE each, the same pattern as the ones filed).

   End-of-session summary (across all 5 tracks)

   Track	PRs / Issues	Coverage
   A (FFI classifications)	8 PRs (this session) + 6 (last session)	14 repos, ~500 findings classified as legitimate-FFI
   B (real-bug fix surface)	1 critical issue	svalinn#12 (JWT verify bypass)
   C (per-repo Track C tracking)	35+ issues	~1,300+ findings surfaced for human triage
   D (proof-aware tracking)	3 issues	echidna, tropical-resource-typing, standards — full DRAFT-PR remediation deferred
   E (bridge CVE triage)	24 issues	29 Rust repos with non-zero advisories surfaced
   Total session 2	~71 GH actions

   All five tracks substantially closed-out for this campaign. Carry-forward queue:

   • assault (Track E continued) — heavyweight, dedicated session
   • DRAFT-PR-with-rebuild remediation (Track D continued) — ~8 ProofDrift findings need actual fixes
   • Phantom-import auto-PRs (Track E follow-up) — could be batched cheaply estate-wide
   • svalinn#12 fix (Track B follow-up) — real Web Crypto wiring
5. hyperpolymath commented on May 26, 2026

   

   hyperpolymath

   on May 26, 2026

   OwnerAuthor

   More actions

   panic-attack estate sweep — 2026-05-26 (Phase 5 closure)

   Phase 5 / Track D conclusion

   All 7 ProofDrift findings across the 3 proof-aware repos triaged. Zero require actual proof discharge — each is either a legitimate axiom with inline justification or a panic-attack PA021 detector false positive.

   Repo	Findings	PR	Outcome
   echidna	2 (funext, Conflicts)	#107	Both legitimate axioms — funext = HoTT-standard function extensionality; Conflicts = intentional design parameter
   tropical-resource-typing	4 (Kleene, Ordinal, Matrices_Clean, CNO)	#4	All 4 are PA021 detector false positives — keywords matched inside Isabelle \<open>...\</close> and @{text ...} comment antiquotations
   standards	4 postulates in 1 file (entropy/kl/js)	#184	Justified postulates — textbook real-analysis theorems; Agda discharge requires a ℝ formalisation out of scope per the file's own line 112 comment

   Track D tracking issues closed: echidna#105, tropical-resource-typing#3, standards#181 — superseded by the classification PRs.

   Side product: detector bug filed upstream

   panic-attack#43 — PA021 false-positive bug: the Isabelle detector counts sorry / oops inside \<open>...\</close> and @{text ...} markup. Fix sketch: skip those antiquotations and text \<open>...\</close> declarations. The same blind spot probably affects Agda/Coq/Idris docstring-mentions of the equivalent keywords and warrants a re-audit of the corresponding detector cases.

   Mid-session correction noted

   The first echidna PR commit accidentally overwrote 14 pre-existing FFI-boundary classification entries on audits/assail-classifications.a2ml. Fixed in a follow-up commit (fix: restore pre-existing FFI-boundary classifications); the PR now sits at 16 entries (14 original + 2 new PA021). Future per-repo classification PRs should git show origin/main:audits/assail-classifications.a2ml before truncating.

   Tracks status summary

   Track	Status
   A — FFI classifications	✅ done (14 PRs, 1 repo archived/skipped)
   B — real-bug remainder	✅ surveyed (1 critical bug filed: svalinn#12; rest in Track C)
   C — per-repo human-triage tracking	✅ done (35+ issues)
   D / Phase 5 — proof-aware	✅ done (3 classification PRs, 3 tracking issues closed, 0 findings needed actual proof discharge)
   E — bridge CVE triage	✅ done (24 CVE issues across 29 Rust repos)
   E — assault (dynamic)	⏸ deferred (separate session)
   E — signatures / temporal	❌ N/A (signatures subcommand absent; temporal needs verisimdb data)
6. hyperpolymath

   added 2 commits that reference this issue on May 26, 2026

   audit: classify 4 PA021 ProofDrift comment-text false positives (#4)

   ...

   ba2ee6d

   audit: classify 2 PA021 legitimate mathematical axioms (funext + Conf…

   ...

   2b59fb8
7. hyperpolymath commented on May 26, 2026

   

   hyperpolymath

   on May 26, 2026

   OwnerAuthor

   More actions

   panic-attack estate sweep — 2026-05-26 (Lanes 1–3 closure)

   After the Phase 5 closure I continued through the three lanes in the user's stated order: 2 → 1 → 3.

   Lane 2 — svalinn JWT verification fix (done)

   svalinn#14 — wires real crypto.subtle.verify against the kid-resolved JWK, builds the signing input via TextEncoder from the raw base64url segments, with an algorithm allow-list (RS{256,384,512} / PS{256,384,512} / ES{256,384,512} / EdDSA; rejects none and anything unrecognised).

   Test results: 29/29 auth tests pass (was 17/12 split on main).

   Surprise discovery during implementation: the original verifyJwt did not silently accept forged tokens — its compiled JS referenced undefined variables (decoded, header) because ReScript's %raw blocks are opaque to its optimiser. Every call threw ReferenceError. The middleware's catch-block turned that into authenticated: false, so JWT auth was fail-closed by accident, not by design. The same %raw-opaqueness pitfall was present in:

   • base64UrlDecode (bound _i, %raw referenced i)
   • OAuth2.generateState (array var elided)
   • OAuth2.URLSearchParams (module placeholder shadowed the global constructor in compiled JS)

   All four fixed in one PR. Posted reassessment comment on svalinn#12.

   Lane 1 — phantom-import deletion PRs (pivoted)

   Planned: open small no-behaviour-change PRs removing unused deps from Cargo.toml for the 157 phantom-classified bridge findings.

   What happened: all 28 phantoms in a 6-repo sample turned out to be transitive deps (pulled in by upstream crates, never declared in any local Cargo.toml). bridge triage's "Remove unused dependency from Cargo.toml" action assumes direct dependency and is wrong for transitive cases. cargo update doesn't help — the bad versions are at the latest crates.io constraint upstream allows.

   Filed panic-attack#47 documenting the misclassification with a fix sketch (detect direct vs transitive via Cargo.toml-key check; emit a different action for transitives).

   Net: the underlying classification (informational + phantom = code unreachable) is correct; the recommended action is just misleading. No PR work to do; findings are already documented as informational in the Track E tracking issues.

   Lane 3 — assault + specialised modes (mostly N/A)

   Sub-track	Status
   bridge triage	✅ done (24 CVE tracking issues filed; panic-attack#47 to upstream the misclassification)
   signatures	❌ subcommand doesn't exist in v2.5.0
   temporal	⚠️ blocked — no verisimdb-data/temporal-index.json exists anywhere in the estate (the 4 .verisimdb/ dirs found are verisimdb-service deployment configs, not snapshot data)
   assault	⏸ deferred — needs per-target long-running build + manually-chosen stdin/args; CLIs that exit on --help return 100% robustness because attacks never land. Not estate-wide automatable; each target is its own session. Tried panic-attack self-assault as a smoke test (light intensity, 5s/axis, cpu+memory): 0 crashes, 0 signatures, 100% robustness — as expected for a fast-exit CLI.

   Bugs filed upstream this session

   • panic-attack#43 — PA021 ProofDrift false positives on Isabelle comment-text
   • panic-attack#47 — bridge triage's "Remove from Cargo.toml" action wrong for transitive deps

   All tasks status

   Track	Status
   A — FFI classifications	✅ done (14 PRs)
   B — real-bug remainder	✅ svalinn JWT fix landed (#14)
   C — per-repo tracking issues	✅ 35+ issues filed
   D / Phase 5 — proof-aware	✅ 3 classification PRs (zero needed real proof discharge)
   E — bridge CVE triage	✅ 24 issues filed
   E — assault / signatures / temporal	⏸ deferred / N/A (see Lane 3 above)

   The campaign is now bounded by owner-side throughput (review/merge the 18 open classification + fix PRs, triage the 60+ tracking issues, decide on the open panic-attack design and bug issues).
8. hyperpolymath

   added 2 commits that reference this issue on May 26, 2026

   docs(campaigns): add 2026-05-26 estate sweep report (human + machine)

   ...

   85c99d4

   docs(campaigns): add 2026-05-26 driver scripts + README

   ...

   ce54b21
9. hyperpolymath commented on May 26, 2026

   

   hyperpolymath

   on May 26, 2026

   OwnerAuthor

   More actions

   Estate sweep campaign — close-out

   The 2026-05-26 estate sweep is now documented, committed, and pushed end-to-end.

   Documentation

   • docs/campaigns/2026-05-26.md — human-readable summary (178 lines)
   • docs/campaigns/2026-05-26.a2ml — machine-readable A2ML (379 lines, campaign-report v1.0.0 schema)
   • docs/campaigns/2026-05-26/ — driver scripts (00-per-repo.sh, 00b-nested.sh, 01-triage.ts, file-ffi-pr-v2.sh) + README explaining gotchas and re-run procedure
   • Filed in PR #48.

   Final tally across both sessions

   Track	Output
   A — FFI / fixture classifications	13 PRs (12 open, 1 merged via #154 supersedes #153 thread)
   B — real-bug fix	1 PR (svalinn#14 — JWT signature verification + 3 adjacent %raw-opacity bugs; 29/29 auth tests pass)
   C — per-repo tracking issues	35+ issues across the estate
   D / Phase 5 — proof-aware	3 PRs (2 merged: echidna#107, tropical-resource-typing#4)
   E — bridge CVE triage	24 tracking issues
   Total actions	~71 GH actions

   Upstream bugs filed against panic-attack

   • #33 — design: complete VeriSimDB hexad persistence
   • #43 — bug: PA021 ProofDrift detector matches sorry / oops inside Isabelle docstring antiquotations
   • #47 — bug: bridge triage "Remove unused dependency" action wrong for transitive deps

   Local state

   • All 17 PRs pushed, all visible on GitHub.
   • /tmp scratch cleaned (18MB removed; scripts now in docs/campaigns/2026-05-26/).
   • Parallel-session work on fix/idris-lang-chapel-not-c (PA021 Isabelle detector fix in progress) preserved in a labelled stash on that branch.
   • Active session worktrees (hypatia, vcl-ut, ephapax) untouched throughout.

   What remains (owner-side)

   1. Review/merge the 15 open PRs.
   2. Triage Track C tracking issues (~1,300 findings).
   3. Decide on the 3 upstream panic-attack bugs above (most actionable: PA021 ProofDrift: detector matches sorry/oops in Isabelle comment text (false positives) #43 — partial fix appears already in flight on fix/idris-lang-chapel-not-c).

   Issue #32 is safe to close once this campaign-report PR (#48) lands — no further agent-side work is queued against it.
10. hyperpolymath

    added 3 commits that reference this issue on May 26, 2026

    audit: classify 6 FFI/systems unsafe findings as legitimate (PA001/PA…

    ...

    a858e78

    audit: classify 8 FFI/systems unsafe findings as legitimate (PA001/PA…

    ...

    e4cae83

    audit: classify FFI binding unsafe blocks as legitimate (PA001/PA007,…

    ...

    35948ac
11. 9 remaining items

    Load more
12. hyperpolymath

    added a commit that references this issue on May 27, 2026

    audit: classify 10 FFI/systems unsafe findings as legitimate (PA001/P…

    ...

    33af1fa
13. hyperpolymath

    closed this as completedin #76on May 27, 2026
14. hyperpolymath

    added 6 commits that reference this issue on May 27, 2026

    feat(bridge): split phantom into phantom-declared vs phantom-transiti…

    ...

    This issue will close once commit 03fdd9f is merged into the 'main' branch.

    03fdd9f

    audit: classify Track C panic-attack findings (#155) (#175)

    ...

    This issue will close once commit c2c107d is merged into the 'main' branch.

    c2c107d

    audit: classify Track C panic-attack findings (#138) (#271)

    ...

    This issue will close once commit 27f7b1f is merged into the 'main' branch.

    27f7b1f

    audit: classify Track C residuals + pin flake (closes #33) (#52)

    ...

    This issue will close once commit 9c81564 is merged into the 'main' branch.

    9c81564

    docs(audits): FFI boundary §§9-11 (FLINT + Zig bridges + Zig overlay) —

    ...

    This issue will close once commit e045c20 is merged into the 'main' branch.

    e045c20

    chore(security): classify panic-attack assail dogfood fixtures + test…

    ...

    This issue will close once commit 6c2e00c is merged into the 'main' branch.

    6c2e00c
15. hyperpolymath

    added 6 commits that reference this issue on Jun 22, 2026

    security: triage Track C panic-attack findings (#68) — fix stubs.c, c…

    ...

    9a5a016

    fix(panicbot): pass --headless and strip banner so panic-attack >= 2.…

    ...

    404471f

    audit: record verified panic-attack 2.5.5 scan results (follow-up to #…

    ...

    48d40d7

    fix(panicbot): pass --headless and strip banner so panic-attack ≥ 2.5…

    ...

    77b07d0

    fix(assail): null-check-aware UncheckedAllocation + precise eval dete…

    ...

    60d9219

    docs: record assail precision fixes in CHANGELOG + STATE.a2ml (#149)

    ...

    f9062d6
16. hyperpolymath

    added a commit that references this issue on Jul 26, 2026

    audit: classify 24 FFI unsafe findings as legitimate (PA001/PA007) (#127

    ...

    f14c998