audits: add assail-classifications.a2ml — Track-C suppressions for echo-types#113

First population of the canonical estate panic-attack suppression file
for echo-types, mirroring the convention used in boj-server / standards /
linguist / hypatia. Two real-path findings classified; ten path-duplicate
findings on .claude/worktrees/<id>/* paths from the 2026-05-26 sweep are
documented as scan artefacts in the file's metadata and not enumerated
(those paths are gitignored and absent from the committed tree).

Findings dismissed:

1. flake.nix SupplyChain (high) — "inputs without narHash, rev pinning,
   or sibling flake.lock". Stale at current main:
   * flake.lock exists adjacent to flake.nix
   * nixpkgs locked in flake.lock with rev + narHash
   * agda-stdlib input declares flake = false with tag pin
     github:agda/agda-stdlib/v2.3
   * absolute-zero input declares flake = false with explicit commit
     SHA pin 3ff5cee7f3fd002378089cd02f0c90a3747b45f0
   * .github/workflows/agda.yml re-pins absolute-zero by SHA with an
     explicit ABSZ_REF check at runtime; CI would fail on drift
   The 2026-05-26 scan was correct at the time if flake.lock had fewer
   locked nodes; current main satisfies the supply-chain pinning
   requirement.

2. arghda-core/src/lint/orphan_module.rs UnboundedAllocation (critical)
   — "Potential unbounded allocation pattern detected". Verdict: false
   positive in arghda-core's deployment model:
   * arghda-core is a developer-tooling crate; no untrusted-input surface
   * orphan_module's transitive-import worklist is bounded by HashSet
     dedup at L88/L101 — the worklist's total push count cannot exceed
     the number of distinct module names reachable from the entry
   * fs::read_to_string(file) at L114 reads developer-owned source one
     file at a time; multi-GB .agda files would OOM but have no
     realistic developer source surface
   No remediation needed; entry can be removed if scanner heuristic
   tightens to recognise the HashSet-dedup pattern.

Stale-path note: the .claude/worktrees/<id>/{flake.nix,arghda-core/...}
findings (10 of 12 reported) reference paths under .claude/ which is in
.gitignore and absent from origin/main. Those findings are scan-artefact
noise from the developer's local worktree state being read alongside the
committed tree; future scans against the committed tree should not raise
them. If panic-attack's scanner does re-raise them, the carve-out
belongs upstream in panic-attack rather than in this file.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

audits/assail-classifications.a2ml

@@ -0,0 +1,34 @@
+;; SPDX-License-Identifier: MPL-2.0
+;; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+;;
+;; Assail Classifications — echo-types
+;; See panic-attack/.claude/CLAUDE.md § "User-Classification Registry".
+;;
+;; First populated 2026-05-30 in response to the Track-C panic-attack
+;; sweep tracked at echo-types#113. Two real-path findings classified;
+;; ten path-duplicates flagged at `.claude/worktrees/*` paths are
+;; scan-artefact noise (those paths are gitignored and not present in
+;; the committed tree) and are not enumerated below.
+
+(assail-classifications
+  (metadata
+    (version "1.0.0")
+    (project "echo-types")
+    (last-updated "2026-05-30")
+    (entries 2)
+    (status "active")
+    (notes "Ten additional findings on .claude/worktrees/<id>/{flake.nix,arghda-core/src/lint/orphan_module.rs} from the 2026-05-26 sweep are excluded as scan artefacts: .claude/ is gitignored, those subtrees are not in the committed repo, the scanner picked up the developer's local worktree state. Future scans against the committed tree should not re-raise them; if they do, the panic-attack scanner is reading workspace state outside the repo and the carve-out belongs upstream in panic-attack."))
+
+  (classification
+    (file "flake.nix")
+    (category "SupplyChain")
+    (classification "flake-lock-present-tag-and-sha-pins")
+    (audit "echo-types#113 triage 2026-05-30")
+    (rationale "Scanner flagged 'inputs without narHash, rev pinning, or sibling flake.lock'. As of main HEAD: (a) flake.lock exists adjacent to flake.nix; (b) nixpkgs is locked in flake.lock with rev + narHash; (c) agda-stdlib input declares flake = false with tag pin github:agda/agda-stdlib/v2.3; (d) absolute-zero input declares flake = false with explicit commit SHA pin 3ff5cee7f3fd002378089cd02f0c90a3747b45f0. The CI workflow .github/workflows/agda.yml additionally re-pins absolute-zero by SHA at runtime with an explicit ABSZ_REF check, which would fail on any drift. The finding was correct on the 2026-05-26 scan date if flake.lock was absent or had fewer locked nodes at that time; it is stale at current main."))
+
+  (classification
+    (file "arghda-core/src/lint/orphan_module.rs")
+    (category "UnboundedAllocation")
+    (classification "dev-tooling-bounded-by-hashset-dedup")
+    (audit "echo-types#113 triage 2026-05-30")
+    (rationale "arghda-core is a developer-tooling crate (proof-ladder workspace manager for Agda). The orphan_module lint runs a transitive-import worklist over a developer's own Agda source tree. The HashSet at L79-80 + L88/L101 acts as an explicit dedup gate, so the worklist's total push count is bounded by the number of distinct module names reachable from the entry module — i.e. the developer's repo file count, typically <2000 .agda files for echo-types-scale workspaces. The single uncapped fs::read_to_string(file) at L114 reads one developer-owned source file at a time and would only OOM on a multi-GB .agda file, which has no realistic developer source surface. There is no untrusted-input pathway: arghda is invoked by the developer on their own workspace, not as a server. No remediation needed. If the scanner heuristic is later tuned to recognise the HashSet-dedup pattern, this entry can be removed.")))