Skip to content

Commit 33af1fa

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
authored
audit: classify 10 FFI/systems unsafe findings as legitimate (PA001/PA007) (#102)
## Summary `panic-attack assail` reports **10** `UnsafeCode` (PA001) + `UnsafeFFI` (PA007) Critical/High findings under `czech-file-knife/cfk-providers/src/, czech-file-knife/cfk-ios/src/, ffi/, port-endoscope/src/, session-sentinel/src/interface/, nerdsafe-restart/src/ada/` in this repo. All sit at the C-ABI / syscall / kernel boundary and are required by the host language to call across. Rationale: Cross-subproject syscall + FFI cluster. cfk-providers calls libc::statvfs; cfk-ios is the iOS FFI bridge; ffi/{fuse,systemd} are kernel/init FFI shims (Zig + Rust); port-endoscope uses libc::sysconf for clock ticks; session-sentinel/interface/ffi is the DBus Zig binding; nerdsafe-restart's Ada TUI uses Unchecked_Conversion against ncurses. ## What changes - `audits/assail-classifications.a2ml` — 10 entries, `classification=legitimate-ffi`. - `audits/audit-ffi-2026-05-26.md` — auditor record + anti-gameability note. ## Scope Classification is **scoped to the listed roots** (czech-file-knife/cfk-providers/src/, czech-file-knife/cfk-ios/src/, ffi/, port-endoscope/src/, session-sentinel/src/interface/, nerdsafe-restart/src/ada/). Any unsafe block outside those roots remains visible. ## Anti-gameability Same pattern as `hyperpolymath/svalinn`, `hyperpolymath/proven`, `hyperpolymath/gossamer`, `hyperpolymath/docudactyl`, `hyperpolymath/proven-servers`, `hyperpolymath/aerie`, and `hyperpolymath/boj-server` — registry is a separate file from any source under scan; new unsafe in a classified root requires a companion classification edit + audit-doc update, both visible. ## Verification Locally: `panic-attack assail . --headless` reports the 10 findings as `suppressed: true` on this branch. Refs hyperpolymath/panic-attack#32. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent 02eb686 commit 33af1fa

2 files changed

Lines changed: 103 additions & 0 deletions

File tree

‎audits/assail-classifications.a2ml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
;; SPDX-License-Identifier: MPL-2.0
2+
;; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
3+
;;
4+
;; Assail Classifications — ambientops
5+
;; See panic-attack/.claude/CLAUDE.md § "User-Classification Registry".
6+
7+
(assail-classifications
8+
(metadata
9+
(version "1.0.0")
10+
(project "ambientops")
11+
(last-updated "2026-05-26")
12+
(entries 10)
13+
(status "active"))
14+
15+
(classification
16+
(file "czech-file-knife/cfk-providers/src/local.rs")
17+
(category "UnsafeCode")
18+
(classification "legitimate-ffi")
19+
(audit "audits/audit-ffi-2026-05-26.md")
20+
(rationale "Cross-subproject syscall + FFI cluster. cfk-providers calls libc::statvfs; cfk-ios is the iOS FFI bridge; ffi/{fuse,systemd} are kernel/init FFI shims (Zig + Rust); port-endoscope uses libc::sysconf for clock ticks; session-sentinel/interface/ffi is the DBus Zig binding; nerdsafe-restart's Ada TUI uses Unchecked_Conversion against ncurses."))
21+
(classification
22+
(file "czech-file-knife/cfk-providers/src/nfs.rs")
23+
(category "UnsafeCode")
24+
(classification "legitimate-ffi")
25+
(audit "audits/audit-ffi-2026-05-26.md")
26+
(rationale "Cross-subproject syscall + FFI cluster. cfk-providers calls libc::statvfs; cfk-ios is the iOS FFI bridge; ffi/{fuse,systemd} are kernel/init FFI shims (Zig + Rust); port-endoscope uses libc::sysconf for clock ticks; session-sentinel/interface/ffi is the DBus Zig binding; nerdsafe-restart's Ada TUI uses Unchecked_Conversion against ncurses."))
27+
(classification
28+
(file "czech-file-knife/cfk-ios/src/ffi.rs")
29+
(category "UnsafeCode")
30+
(classification "legitimate-ffi")
31+
(audit "audits/audit-ffi-2026-05-26.md")
32+
(rationale "Cross-subproject syscall + FFI cluster. cfk-providers calls libc::statvfs; cfk-ios is the iOS FFI bridge; ffi/{fuse,systemd} are kernel/init FFI shims (Zig + Rust); port-endoscope uses libc::sysconf for clock ticks; session-sentinel/interface/ffi is the DBus Zig binding; nerdsafe-restart's Ada TUI uses Unchecked_Conversion against ncurses."))
33+
(classification
34+
(file "ffi/systemd/src/main.zig")
35+
(category "UnsafeCode")
36+
(classification "legitimate-ffi")
37+
(audit "audits/audit-ffi-2026-05-26.md")
38+
(rationale "Cross-subproject syscall + FFI cluster. cfk-providers calls libc::statvfs; cfk-ios is the iOS FFI bridge; ffi/{fuse,systemd} are kernel/init FFI shims (Zig + Rust); port-endoscope uses libc::sysconf for clock ticks; session-sentinel/interface/ffi is the DBus Zig binding; nerdsafe-restart's Ada TUI uses Unchecked_Conversion against ncurses."))
39+
(classification
40+
(file "ffi/systemd/shim/src/lib.rs")
41+
(category "UnsafeCode")
42+
(classification "legitimate-ffi")
43+
(audit "audits/audit-ffi-2026-05-26.md")
44+
(rationale "Cross-subproject syscall + FFI cluster. cfk-providers calls libc::statvfs; cfk-ios is the iOS FFI bridge; ffi/{fuse,systemd} are kernel/init FFI shims (Zig + Rust); port-endoscope uses libc::sysconf for clock ticks; session-sentinel/interface/ffi is the DBus Zig binding; nerdsafe-restart's Ada TUI uses Unchecked_Conversion against ncurses."))
45+
(classification
46+
(file "ffi/fuse/src/c.zig")
47+
(category "UnsafeFFI")
48+
(classification "legitimate-ffi")
49+
(audit "audits/audit-ffi-2026-05-26.md")
50+
(rationale "Cross-subproject syscall + FFI cluster. cfk-providers calls libc::statvfs; cfk-ios is the iOS FFI bridge; ffi/{fuse,systemd} are kernel/init FFI shims (Zig + Rust); port-endoscope uses libc::sysconf for clock ticks; session-sentinel/interface/ffi is the DBus Zig binding; nerdsafe-restart's Ada TUI uses Unchecked_Conversion against ncurses."))
51+
(classification
52+
(file "ffi/fuse/src/cloud/cloud_fs.zig")
53+
(category "UnsafeCode")
54+
(classification "legitimate-ffi")
55+
(audit "audits/audit-ffi-2026-05-26.md")
56+
(rationale "Cross-subproject syscall + FFI cluster. cfk-providers calls libc::statvfs; cfk-ios is the iOS FFI bridge; ffi/{fuse,systemd} are kernel/init FFI shims (Zig + Rust); port-endoscope uses libc::sysconf for clock ticks; session-sentinel/interface/ffi is the DBus Zig binding; nerdsafe-restart's Ada TUI uses Unchecked_Conversion against ncurses."))
57+
(classification
58+
(file "port-endoscope/src/process.rs")
59+
(category "UnsafeCode")
60+
(classification "legitimate-ffi")
61+
(audit "audits/audit-ffi-2026-05-26.md")
62+
(rationale "Cross-subproject syscall + FFI cluster. cfk-providers calls libc::statvfs; cfk-ios is the iOS FFI bridge; ffi/{fuse,systemd} are kernel/init FFI shims (Zig + Rust); port-endoscope uses libc::sysconf for clock ticks; session-sentinel/interface/ffi is the DBus Zig binding; nerdsafe-restart's Ada TUI uses Unchecked_Conversion against ncurses."))
63+
(classification
64+
(file "session-sentinel/src/interface/ffi/src/dbus.zig")
65+
(category "UnsafeCode")
66+
(classification "legitimate-ffi")
67+
(audit "audits/audit-ffi-2026-05-26.md")
68+
(rationale "Cross-subproject syscall + FFI cluster. cfk-providers calls libc::statvfs; cfk-ios is the iOS FFI bridge; ffi/{fuse,systemd} are kernel/init FFI shims (Zig + Rust); port-endoscope uses libc::sysconf for clock ticks; session-sentinel/interface/ffi is the DBus Zig binding; nerdsafe-restart's Ada TUI uses Unchecked_Conversion against ncurses."))
69+
(classification
70+
(file "nerdsafe-restart/src/ada/nerdsafe_tui.adb")
71+
(category "UnsafeCode")
72+
(classification "legitimate-ffi")
73+
(audit "audits/audit-ffi-2026-05-26.md")
74+
(rationale "Cross-subproject syscall + FFI cluster. cfk-providers calls libc::statvfs; cfk-ios is the iOS FFI bridge; ffi/{fuse,systemd} are kernel/init FFI shims (Zig + Rust); port-endoscope uses libc::sysconf for clock ticks; session-sentinel/interface/ffi is the DBus Zig binding; nerdsafe-restart's Ada TUI uses Unchecked_Conversion against ncurses."))
75+
)

‎audits/audit-ffi-2026-05-26.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<!--
2+
SPDX-License-Identifier: MPL-2.0
3+
Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
4+
-->
5+
6+
# Audit: FFI / systems `unsafe` blocks (ambientops)
7+
8+
**Auditor**: Jonathan D.A. Jewell
9+
**Date**: 2026-05-26
10+
**Scope**: panic-attack assail Critical/High `UnsafeCode` (PA001) and `UnsafeFFI` (PA007) findings located under: `czech-file-knife/cfk-providers/src/, czech-file-knife/cfk-ios/src/, ffi/, port-endoscope/src/, session-sentinel/src/interface/, nerdsafe-restart/src/ada/`.
11+
**Cross-reference**: campaign tracker [hyperpolymath/panic-attack#32](https://github.com/hyperpolymath/picpath/issues/32).
12+
**Registry**: `audits/assail-classifications.a2ml`.
13+
14+
## Rationale
15+
16+
Cross-subproject syscall + FFI cluster. cfk-providers calls libc::statvfs; cfk-ios is the iOS FFI bridge; ffi/{fuse,systemd} are kernel/init FFI shims (Zig + Rust); port-endoscope uses libc::sysconf for clock ticks; session-sentinel/interface/ffi is the DBus Zig binding; nerdsafe-restart's Ada TUI uses Unchecked_Conversion against ncurses.
17+
18+
The classification is scoped to the listed root(s). Any `unsafe` block outside those roots remains visible to assail.
19+
20+
## Anti-gameability
21+
22+
The registry is a separate file from any source under scan; adding a new `unsafe` block inside a classified root requires a companion classification edit and an update to this audit doc, both of which are visible in the diff.
23+
24+
## Verification
25+
26+
Locally on this branch: `panic-attack assail . --headless` reports the listed PA001/PA007 findings as `suppressed: true`. Any new `unsafe` outside the listed roots remains unsuppressed.
27+
28+
Refs hyperpolymath/panic-attack#32.

0 commit comments

Comments
 (0)