feat(panicbot): PA024 InputBoundary + PA025 MutationGap mappings

Add category mappings for the two remaining v2.5.0 categories:
- PA024 InputBoundary: static-analysis/input-boundary, 0.72 conf,
  Control tier, Partial fixability
- PA025 MutationGap: static-analysis/mutation-gap, 0.80 conf,
  Substitute tier, Partial fixability

Update test_all_categories_have_unique_rule_ids to 25 categories.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

bots/panicbot/src/translator.rs

@@ -4,7 +4,7 @@
 //! Core responsibility: map each `WeakPoint` from the scanner output into a
 //! `Finding` struct with appropriate:
 //! - Fleet category (e.g., "static-analysis/unsafe-code")
-//! - Rule ID (canonical PA001–PA023 pattern for dedup with Hypatia findings)
+//! - Rule ID (canonical PA001–PA025 pattern for dedup with Hypatia findings)
 //! - Triangle tier (Eliminate / Substitute / Control)
 //! - Confidence score (honest assessment of detection accuracy)
 //! - Fixability (whether automated remediation is possible)
@@ -261,6 +261,30 @@ pub fn category_mapping(category: &str) -> Option<CategoryMapping> {
             default_confidence: 0.85,
             fixability: Fixability::Yes,
         }),
+        // PA024 — input boundary: unchecked deserialization of CBOR/MessagePack (serde_cbor,
+        // ciborium, rmp_serde in Rust), JSON.parse without try-catch (JavaScript), JSON3.read
+        // without error handling (Julia). Confidence 0.72 — per-file heuristics have false
+        // positives when error handling is in the call site rather than the same file.
+        "InputBoundary" => Some(CategoryMapping {
+            fleet_category: "static-analysis/input-boundary",
+            rule_id: "PA024",
+            rule_name: "Unguarded input boundary",
+            triangle_tier: TriangleTier::Control,
+            default_confidence: 0.72,
+            fixability: Fixability::Partial,
+        }),
+        // PA025 — mutation gap: test suites with no mutation-test tooling or no assertion
+        // diversity. Rust projects without cargo-mutants config, Elixir without StreamData/
+        // ExUnitProperties, Julia @testset with only type-check assertions. Confidence 0.80 —
+        // absent tooling is factual; assertion diversity heuristic has modest FP rate.
+        "MutationGap" => Some(CategoryMapping {
+            fleet_category: "static-analysis/mutation-gap",
+            rule_id: "PA025",
+            rule_name: "Mutation coverage gap",
+            triangle_tier: TriangleTier::Substitute,
+            default_confidence: 0.80,
+            fixability: Fixability::Partial,
+        }),
         _ => None,
     }
 }
@@ -604,6 +628,7 @@ mod tests {
             "UnsafeTypeCoercion", "UncheckedAllocation", "UnboundedLoop", "BlockingIO",
             "DeadlockPotential", "DynamicCodeExecution", "InsecureProtocol",
             "InfiniteRecursion", "ProofDrift", "CryptoMisuse", "SupplyChain",
+            "InputBoundary", "MutationGap",
         ];
 
         let mut rule_ids = std::collections::HashSet::new();
@@ -616,6 +641,6 @@ mod tests {
                 cat
             );
         }
-        assert_eq!(rule_ids.len(), 23);
+        assert_eq!(rule_ids.len(), 25);
     }
 }

bots/panicbot/tests/translator_test.rs

@@ -69,6 +69,8 @@ fn test_all_23_categories_have_mappings() {
         "ProofDrift",
         "CryptoMisuse",
         "SupplyChain",
+        "InputBoundary",
+        "MutationGap",
     ];
 
     for cat in &categories {
@@ -387,6 +389,7 @@ fn test_all_confidence_values_in_valid_range() {
         "UnsafeTypeCoercion", "UncheckedAllocation", "UnboundedLoop", "BlockingIO",
         "DeadlockPotential", "DynamicCodeExecution", "InsecureProtocol",
         "InfiniteRecursion", "ProofDrift", "CryptoMisuse", "SupplyChain",
+        "InputBoundary", "MutationGap",
     ];
 
     for cat in &categories {