ci(governance): refresh standards pins to d72fe5a + add Hypatia baseline (#42)

* ci(governance): refresh standards pins to d72fe5a + add Hypatia baseline

Two follow-ups after #41.

1. Pin refresh. The standards estate advanced 5a93d9d5 -> d72fe5a, so the
   governance + scorecard reusable pins went stale again (the "Check
   Workflow Staleness" gate compares pins against standards HEAD; this is
   why it went red on #41, independent of that PR's content). Bump both to
   d72fe5a. Verified against check-workflow-staleness.sh@d72fe5a: the only
   rules that match this repo are the two pin-freshness checks. The
   no_scorecard_sarif_code_scanning rule does not fire (no single workflow
   uses ossf/scorecard-action@ together with upload-sarif@) and
   no_stale_hypatia_reusable_pin does not apply (no hypatia-scan-reusable
   reference). scorecard-reusable.yml@d72fe5a needs exactly contents:read +
   security-events:write + id-token:write, which the job already grants.

2. .hypatia-baseline.json. Acknowledge the reviewed false positives so the
   governance baseline gate runs clean and the advisory scan stops raising
   them (including the two "critical" secret detections). Covers the
   file-based code_safety/security_errors findings -- the only ones the
   tokenless validate-hypatia-baseline scan sees: the two test-fixture
   "secrets" (a fuzzer seed and a commented-out placeholder), the three
   escaped-markup innerHTML sinks, the loopback HTTP URL, and the syscall
   @bitcast. Each entry carries a rationale note and validates against
   standards' hypatia-baseline.schema.json. The API-dependent meta findings
   (git_state, code_scanning_alerts, scorecard SAST) use uppercase types the
   schema forbids and are absent from the tokenless gate scan, so they are
   intentionally not baselined.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LvsZgNxFbeqfRmrVFNhJ8G

* fix(ci): keep reusable pin token out of scorecard.yml comment

The estate staleness check greps every workflow line for
"scorecard-reusable.yml@" and extracts the SHA after it. The #42 comment
("... declared by scorecard-reusable.yml@d72fe5a.") added a SECOND match,
so the extracted PINNED_SHA became two lines and never equalled the
expected single SHA — a false "stale Scorecard reusable" failure even
though the actual `uses:` pin is correct. Reword the comment to drop the
token, with a NOTE to prevent regression. Verified locally:
check-workflow-staleness.sh@d72fe5a now exits 0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LvsZgNxFbeqfRmrVFNhJ8G

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance.yml

@@ -31,4 +31,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d72fe5a14e841ac6d78514b53624b6173038ee20

.github/workflows/scorecard.yml

@@ -14,12 +14,15 @@ jobs:
   analysis:
     # Explicit least-privilege permissions for the reusable Scorecard call:
     # contents:read to check out, security-events:write to upload the SARIF,
-    # id-token:write to publish results to the OpenSSF API. Matches the scopes
-    # declared by scorecard-reusable.yml@5a93d9d5.
+    # id-token:write to publish results to the OpenSSF API — exactly the
+    # scopes the pinned reusable Scorecard workflow declares.
     # (Hypatia workflow_audit: scorecard_wrapper_missing_job_permissions)
+    # NOTE: do not write the reusable's "<name>.yml@<sha>" string in a comment
+    # here — the estate staleness check greps every line for that token and a
+    # second match would break its single-pin SHA comparison.
     permissions:
       contents: read
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d72fe5a14e841ac6d78514b53624b6173038ee20
     secrets: inherit

.hypatia-baseline.json

@@ -0,0 +1,51 @@
+[
+  {
+    "severity": "critical",
+    "rule_module": "security_errors",
+    "type": "secret_detected",
+    "file": "src/interface/ffi/src/fuzz_config.zig",
+    "note": "False positive: fuzzer seed in env_seeds[] (\"PASSWORD='quoted'\\nAPI_KEY=\\\"double_quoted\\\"\") — literal test input exercising the ENV config parser, not a credential. Corroborated: gitleaks, trufflehog, rust-secrets and shell-secrets all pass clean."
+  },
+  {
+    "severity": "critical",
+    "rule_module": "security_errors",
+    "type": "secret_detected",
+    "file": ".envrc",
+    "note": "False positive: commented-out placeholder (# export API_KEY=\"...\"). Real secrets live in the gitignored .env loaded via dotenv_if_exists; .envrc carries no credential."
+  },
+  {
+    "severity": "high",
+    "rule_module": "code_safety",
+    "type": "js_innerhtml",
+    "file": "src/gui/fli/fli-tooltip.js",
+    "note": "Reviewed: attribute-sourced text is escaped via escapeHtml before assignment; innerHTML renders the resulting markup, which textContent cannot express."
+  },
+  {
+    "severity": "high",
+    "rule_module": "code_safety",
+    "type": "js_innerhtml",
+    "file": "src/gui/fli/fli-terminal.js",
+    "note": "Reviewed: all text passes through escapeTermHtml before being wrapped in ANSI-styled <span> markup; innerHTML is required to render the styled spans."
+  },
+  {
+    "severity": "high",
+    "rule_module": "code_safety",
+    "type": "js_innerhtml",
+    "file": "src/gui/fli/fli-gauge.js",
+    "note": "Reviewed: dynamic labels are escaped via escapeXml; the assigned value is generated SVG markup, which textContent cannot express."
+  },
+  {
+    "severity": "high",
+    "rule_module": "code_safety",
+    "type": "ncl_http_url",
+    "file": ".machine_readable/svc/k9/template-hunt.k9.ncl",
+    "note": "Reviewed: IPv6 loopback (http://[::1]:8090) to a local VeriSimDB that serves plain HTTP; https would break the health check. CWE-319 concerns cleartext over a network — loopback is not network transit."
+  },
+  {
+    "severity": "medium",
+    "rule_module": "code_safety",
+    "type": "zig_bit_cast",
+    "file": "src/interface/ffi/src/probe.zig",
+    "note": "Reviewed: @bitCast flips O_NONBLOCK on the std.posix.O packed struct for the fcntl syscall (Zig 0.15). Behaviour-preserving and required; rewriting would break non-blocking connect."
+  }
+]