audits: assail-classifications.a2ml — Track-C suppressions (echo-types#113) (#158)

## Summary

First population of \`audits/assail-classifications.a2ml\` for
echo-types, mirroring the canonical estate convention (boj-server /
standards / linguist / hypatia). Resolves the in-repo half of
[#113](#113) by
classifying the two real-path panic-attack findings and documenting the
ten path-duplicate findings as scan artefacts.

## What the issue actually reports

The 2026-05-26 sweep reported 12 findings on echo-types. On inspection,
the breakdown is:

| Bucket | Count | Disposition |
|---|---|---|
| \`.claude/worktrees/<id>/flake.nix\` SupplyChain | 5 | Scan artefact —
paths are gitignored, absent from committed tree |
| \`.claude/worktrees/<id>/arghda-core/src/lint/orphan_module.rs\`
UnboundedAllocation | 5 | Scan artefact — same reason |
| \`flake.nix\` SupplyChain (real path) | 1 | **Stale** — \`flake.lock\`
now exists; agda-stdlib is tag-pinned, absolute-zero is SHA-pinned, CI
re-verifies |
| \`arghda-core/src/lint/orphan_module.rs\` UnboundedAllocation (real
path) | 1 | **False positive** — bounded by HashSet dedup at L88/L101;
dev-tooling, no untrusted-input surface |
| **Total** | **12** | All dismissible |

Detailed audit rationale in the file itself; brief reasoning in the
commit body.

## Seam observations (drive-by, surfaced for the owner)

While triaging, two adjacent things were noticed:

1. **\`arghda-core/\` has no CI workflow.** It's a Rust crate inside
echo-types with a proper \`Cargo.toml\` + tests directory, but no
\`.github/workflows/\` step runs \`cargo test\` / \`cargo clippy\`. This
is independent of #113; surfacing as a potential follow-up issue.
2. **\`flake.lock\` only locks \`nixpkgs\` in its \`.nodes\` map**
(verified via \`jq '.nodes | keys[]'\`). The other two inputs
(\`agda-stdlib\`, \`absolute-zero\`) are \`flake = false\` and have
concrete tag / SHA refs in \`flake.nix\` directly, so the security
posture isn't materially weaker, but a future \`nix flake update\` may
want to fully populate the lockfile for narHash provenance on those two
as well. Tangential to #113.

Neither is in-scope for this PR; flagging as observations.

## Test plan

- [x] Pure config / docs addition. Agda suite unaffected.
- [x] A2ML format matches the canonical schema used by boj-server /
standards / linguist / hypatia.
- [ ] Re-running \`panic-attack assail\` against the post-merge tip
should produce no findings (or report the two classified entries as
suppressed); the ten path-duplicates should not reappear since
\`.claude/\` is gitignored.

## Closes

Closes #113 — the in-repo Track-C work is complete; if the panic-attack
scanner re-raises any of these on a future sweep, that's a scanner-side
question (scan-artefact paths shouldn't be in the haystack) rather than
an echo-types content question.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

audits/assail-classifications.a2ml

@@ -0,0 +1,34 @@
+;; SPDX-License-Identifier: MPL-2.0
+;; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+;;
+;; Assail Classifications — echo-types
+;; See panic-attack/.claude/CLAUDE.md § "User-Classification Registry".
+;;
+;; First populated 2026-05-30 in response to the Track-C panic-attack
+;; sweep tracked at echo-types#113. Two real-path findings classified;
+;; ten path-duplicates flagged at `.claude/worktrees/*` paths are
+;; scan-artefact noise (those paths are gitignored and not present in
+;; the committed tree) and are not enumerated below.
+
+(assail-classifications
+  (metadata
+    (version "1.0.0")
+    (project "echo-types")
+    (last-updated "2026-05-30")
+    (entries 2)
+    (status "active")
+    (notes "Ten additional findings on .claude/worktrees/<id>/{flake.nix,arghda-core/src/lint/orphan_module.rs} from the 2026-05-26 sweep are excluded as scan artefacts: .claude/ is gitignored, those subtrees are not in the committed repo, the scanner picked up the developer's local worktree state. Future scans against the committed tree should not re-raise them; if they do, the panic-attack scanner is reading workspace state outside the repo and the carve-out belongs upstream in panic-attack."))
+
+  (classification
+    (file "flake.nix")
+    (category "SupplyChain")
+    (classification "flake-lock-present-tag-and-sha-pins")
+    (audit "echo-types#113 triage 2026-05-30")
+    (rationale "Scanner flagged 'inputs without narHash, rev pinning, or sibling flake.lock'. As of main HEAD: (a) flake.lock exists adjacent to flake.nix; (b) nixpkgs is locked in flake.lock with rev + narHash; (c) agda-stdlib input declares flake = false with tag pin github:agda/agda-stdlib/v2.3; (d) absolute-zero input declares flake = false with explicit commit SHA pin 3ff5cee7f3fd002378089cd02f0c90a3747b45f0. The CI workflow .github/workflows/agda.yml additionally re-pins absolute-zero by SHA at runtime with an explicit ABSZ_REF check, which would fail on any drift. The finding was correct on the 2026-05-26 scan date if flake.lock was absent or had fewer locked nodes at that time; it is stale at current main."))
+
+  (classification
+    (file "arghda-core/src/lint/orphan_module.rs")
+    (category "UnboundedAllocation")
+    (classification "dev-tooling-bounded-by-hashset-dedup")
+    (audit "echo-types#113 triage 2026-05-30")
+    (rationale "arghda-core is a developer-tooling crate (proof-ladder workspace manager for Agda). The orphan_module lint runs a transitive-import worklist over a developer's own Agda source tree. The HashSet at L79-80 + L88/L101 acts as an explicit dedup gate, so the worklist's total push count is bounded by the number of distinct module names reachable from the entry module — i.e. the developer's repo file count, typically <2000 .agda files for echo-types-scale workspaces. The single uncapped fs::read_to_string(file) at L114 reads one developer-owned source file at a time and would only OOM on a multi-GB .agda file, which has no realistic developer source surface. There is no untrusted-input pathway: arghda is invoked by the developer on their own workspace, not as a server. No remediation needed. If the scanner heuristic is later tuned to recognise the HashSet-dedup pattern, this entry can be removed.")))