From 347623cc4233bcba3ae93ba55807d30c6b920797 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 1 Jul 2026 22:19:27 +0100 Subject: [PATCH] docs(reports): deposit 2026-06-06 hypatia alert-classification report Counts are as-of 2026-06-06; recorded for audit trail. Co-Authored-By: Claude Fable 5 --- ...2026-06-06-hypatia-alert-classification.md | 146 ++++++++++++++++++ 1 file changed, 146 insertions(+) create mode 100644 docs/reports/2026-06-06-hypatia-alert-classification.md diff --git a/docs/reports/2026-06-06-hypatia-alert-classification.md b/docs/reports/2026-06-06-hypatia-alert-classification.md new file mode 100644 index 00000000..5cc2a3ef --- /dev/null +++ b/docs/reports/2026-06-06-hypatia-alert-classification.md @@ -0,0 +1,146 @@ + + + + +# Hypatia Alert Classification Report + +Repository: `hyperpolymath/echidna` + +Date: 2026-06-06 + +This deposited report classifies the non-Dependabot code-scanning state seen in +`echidna`. It separates scanner/reporting debris from real repository work, and +it records which work should be handled by existing systems, extended systems, +or human/specialist review. + +## Open Alert Count + +GitHub code scanning showed 249 open alerts. + +| Bucket | Count | Classification | Route | +| --- | ---: | --- | --- | +| Hypatia `code_scanning_alerts/CSA001` self-echo | 27 | Reporting debris | Standards/Hypatia SARIF fix, then clear stale alerts | +| Structural stale refs: `SD022`, `SD007` | 28 | Lifecycle hygiene | PR-only documentation/state cleanup | +| Workflow and Scorecard control-plane hygiene | 51 | CI/security control | Existing PR machinery, conservative batching | +| ReScript migration findings | 73 | Language migration | Batch by subsystem, PR-only | +| Runtime crash/availability code safety | 45 | Source risk | Context-aware PRs, no blind rewrites | +| FFI/proof/memory-safety findings | 22 | High-risk source/proof boundary | Specialist review, proof route, report-only by default | +| Environment/report-only findings | 3 | Control-plane topology | Observe, model, and route manually | + +## Findings Expected To Dissolve + +The 27 `code_scanning_alerts/CSA001` alerts are not source work in `echidna`. +They should dissolve after: + +1. the standards reusable SARIF converter stops uploading `code_scanning_alerts` + meta-findings; +2. the next authoritative Hypatia run uploads an empty or reduced Hypatia SARIF + result set for that rule family; +3. stale GitHub code-scanning alerts clear or are dismissed with rationale. + +Related issue: + +## Real Work Buckets + +### Workflow and Scorecard Hygiene + +These are mostly easy or existing-system work. They include missing +`timeout-minutes`, Scorecard token-permission issues, and specific workflow +audit findings such as CodeQL language coverage and secret-action gates. + +Recommended handling: + +- set proportional timeouts, not a universal 10-minute value; +- let Scorecard/CodeQL work already in flight finish before duplicating work; +- use PR-only mode; +- verify workflows with focused CI. + +Related issue: + +### ReScript Migration + +The 73 migration findings should be treated as one language-migration campaign, +not 73 isolated defects. + +Recommended handling: + +- group by API and subtree; +- preserve deliberate externals and FFI bindings with local rationale; +- batch migration work by subsystem; +- avoid whole-tree automatic rewrites without build verification. + +Related issue: + +### Structural Drift + +The 28 structural findings are stale references in docs and machine-readable +state. They are low-risk when the canonical replacement path is known. + +Recommended handling: + +- map each old path to a current path or tombstone; +- keep machine-readable state parseable; +- update references in PR-only mode. + +Related issue: + +### Runtime Code Safety + +The unwrap, expect, panic, and lock-unwrap findings are plausible source-risk +signals. Some may be test-only or invariant-protected; others need proper error +propagation. + +Recommended handling: + +- separate tests and fixtures from production paths; +- replace production panics with typed errors only where behavior is preserved; +- avoid replacing `unwrap()` with default values that could corrupt prover + state. + +Related issue: + +### FFI, Memory, And Proof Boundary + +The unsafe block, raw pointer, `mem_forget`, Zig pointer cast, and Agda +postulate findings are high-risk. They should not be auto-fixed from pattern +matching alone. + +Recommended handling: + +- route to echidnabot or proof review; +- require focused tests or proof obligations; +- use report-only unless a proven recipe exists. + +Related issue: + +## Summary By Action Class + +| Action class | Count | Notes | +| --- | ---: | --- | +| Dissolve as stale/reporting debris | 27 | Self-echo SARIF artifacts | +| Trivial/easy existing-system PR work | 79 | Workflow/Scorecard plus structural docs/state | +| Readily accommodated by extended system | 118 | ReScript migration plus runtime code-safety with context | +| High risk, specialist review only | 22 | FFI/proof/memory boundary | +| Report-only environment topology | 3 | Needs environment self-modeling | + +## Ordering + +The safe order is: + +1. Fix the self-echo reporting path and clear stale alert debris. +2. Let relevant in-flight GitHub Actions, CodeQL, Scorecard, and Dependabot + work finish when it covers the same class. +3. Apply workflow and structural hygiene PRs. +4. Run the ReScript migration campaign by subsystem. +5. Triage runtime code-safety paths. +6. Hold FFI/proof/memory-safety items for specialist review. + +Doing this out of order can create more work than it removes. For example, +rewriting source before clearing stale SARIF debris makes alert counts look +worse, and blind workflow timeout edits can break formal or live-prover jobs. + +## Portfolio Note + +For `Git in the Time of NeSy Agency`, this report is an example of repository +portfolio triage: the useful unit is not a raw alert, but a classified work +order with route, cost, risk, and expected class-collapse.