fix(loop): post-fix estate-rescan trigger + audited FP classifications

dispatch-runner.sh now collects every repo that received a successful
fix and fires one estate-rescan repository_dispatch to hypatia at the
end of the run (best-effort, token-guarded). This closes the loop
stage that kept the numbers frozen: fixes landed but verisimdb-data
scans were never refreshed, so hypatia kept dispatching against
already-fixed findings.

audits/assail-classifications.a2ml records the audited-FP residuals
from a fresh panic-attack 2.5.5 scan: remediation scripts
(scripts/fix-*.sh) that necessarily contain the patterns they fix,
and cipherbot detector unit-test fixtures. With the registry in
place, gitbot-fleet's unsuppressed non-heuristic Critical/High count
is 0 (the stale store showed 6 Critical / 2 High, all phantom or FP).

Author: claude

audits/assail-classifications.a2ml

@@ -0,0 +1,69 @@
+;; SPDX-License-Identifier: MPL-2.0
+;; assail-classifications.a2ml — audited panic-attack findings for gitbot-fleet.
+;;
+;; Read by panic-attack >= 2.5.5 (load_user_classifications): findings
+;; matching (file, category) flip to suppressed = true after the kanren
+;; structural pass. Entries are AUDITED-SOUND residuals with rationale;
+;; the registry lives apart from the source so a code edit cannot
+;; self-suppress (panic-attack CLAUDE.md, User-Classification Registry).
+;;
+;; Audit trail: 2026-06-11 estate-loop session — fresh panic-attack
+;; 2.5.5 scan; every entry inspected at source. Two FP classes:
+;;
+;;   1. Remediation scripts (scripts/fix-*.sh) necessarily CONTAIN the
+;;      patterns they search for and replace — the same reason these
+;;      scripts carry `hypatia: allow` pragmas for hypatia's scanner.
+;;   2. Detector unit tests (cipherbot analyzers) assert detection by
+;;      feeding secret-shaped fixture literals to the analyzer inside
+;;      `#[cfg(test)] mod tests`.
+
+(assail-classifications
+  ;; ── Remediation scripts: pattern strings, not vulnerabilities ────
+  (classification
+    (file "scripts/fix-dynamic-code-exec.sh")
+    (category "CommandInjection")
+    (audit "remediation tool for PA011 — greps for and rewrites eval/exec patterns")
+    (rationale "contains eval as a SEARCH pattern; does not evaluate untrusted input"))
+  (classification
+    (file "scripts/fix-eval-to-safe.sh")
+    (category "CommandInjection")
+    (audit "remediation tool — replaces eval usage with safe alternatives")
+    (rationale "contains eval as a SEARCH/REPLACE pattern; does not evaluate untrusted input"))
+  (classification
+    (file "scripts/fix-heredoc-install.sh")
+    (category "CommandInjection")
+    (audit "remediation tool for PA009-shell-heredoc-eval; carries hypatia allow pragma at line 3")
+    (rationale "contains curl|bash / eval $() as SEARCH patterns; does not itself download-then-run"))
+  (classification
+    (file "scripts/fix-command-injection.sh")
+    (category "CommandInjection")
+    (audit "remediation tool for PA009 — quotes unquoted expansions")
+    (rationale "contains injection-shaped strings as SEARCH patterns only"))
+  (classification
+    (file "scripts/fix-secret-to-env.sh")
+    (category "HardcodedSecret")
+    (audit "remediation tool for PA017 — moves literals into env vars")
+    (rationale "contains secret-shaped strings as SEARCH patterns only"))
+  (classification
+    (file "scripts/fix-hardcoded-secrets.sh")
+    (category "HardcodedSecret")
+    (audit "remediation tool for PA017")
+    (rationale "contains secret-shaped strings as SEARCH patterns only"))
+  (classification
+    (file "scripts/fix-deno-permissions.sh")
+    (category "ExcessivePermissions")
+    (audit "remediation tool — replaces `deno -A` with scoped permission flags")
+    (rationale "contains -A as the SEARCH pattern it removes from other repos"))
+
+  ;; ── Detector tests: fixtures asserting detection works ───────────
+  (classification
+    (file "bots/cipherbot/src/analyzers/config.rs")
+    (category "HardcodedSecret")
+    (audit "config.rs:145+ `mod tests` — test_detect_hardcoded_secret feeds sk-1234… fixture to the analyzer")
+    (rationale "test fixture proving the secret detector detects; not a credential"))
+  (classification
+    (file "bots/cipherbot/src/analyzers/infra.rs")
+    (category "HardcodedSecret")
+    (audit "infra.rs:174+ `mod tests` — fixture password literal fed to the analyzer")
+    (rationale "test fixture proving the secret detector detects; not a credential"))
+)

scripts/dispatch-runner.sh

@@ -135,6 +135,13 @@ OUTCOME_FILE="${HYPATIA_DATA}/outcomes/$(date -u +%Y-%m).jsonl"
 OUTCOME_FILE_CENTRAL="${VERISIMDB_DATA}/outcomes/$(date -u +%Y-%m).jsonl"
 mkdir -p "$(dirname "$OUTCOME_FILE")"
 
+# Repos that received at least one successful fix this run. Appended by
+# record_outcome (file, not a variable: execute_entry may run in
+# background subshells under --parallel) and consumed by the post-run
+# estate-rescan trigger so verisimdb-data reflects the fixes without
+# waiting for the nightly sweep.
+RESCAN_REPOS_FILE="$(mktemp /tmp/dispatch-rescan-repos.XXXXXX)"
+
 # --- Hypatia closed-loop contract ---
 #
 # Per hypatia/docs/operations/dispatch-runner-contract.adoc, after each
@@ -255,6 +262,7 @@ record_outcome() {
     case "$outcome" in
         success)
             hypatia_outcome="success"
+            echo "$repo" >> "$RESCAN_REPOS_FILE"
             ;;
         failure)
             hypatia_outcome="failure"
@@ -585,6 +593,35 @@ if [[ "$DRY_RUN" == "true" ]]; then
     echo "(Dry run — no changes were made)"
 fi
 
+# --- Trigger targeted estate rescan for fixed repos ---
+# Fire a single repository_dispatch to hypatia's estate-rescan workflow
+# listing every repo that received a successful fix this run. This is
+# the loop-closure step: the rescan refreshes verisimdb-data/scans, the
+# next pattern sync marks the fixed patterns resolved, and the numbers
+# actually drop. Best-effort: a missing token or API failure must never
+# fail the dispatch run itself.
+RESCAN_TOKEN="${FLEET_DISPATCH_TOKEN:-${GITHUB_TOKEN:-}}"
+if [[ "$DRY_RUN" != "true" && -s "$RESCAN_REPOS_FILE" && -n "$RESCAN_TOKEN" ]]; then
+    RESCAN_REPOS=$(sort -u "$RESCAN_REPOS_FILE" | tr '\n' ' ' | sed 's/ $//')
+    RESCAN_PAYLOAD=$(jq -n --arg repos "$RESCAN_REPOS" \
+        '{event_type: "estate-rescan", client_payload: {repos: $repos}}')
+    if curl -sf -X POST \
+        -H "Authorization: Bearer ${RESCAN_TOKEN}" \
+        -H "Accept: application/vnd.github+json" \
+        "https://api.github.com/repos/hyperpolymath/hypatia/dispatches" \
+        -d "$RESCAN_PAYLOAD" >/dev/null; then
+        echo ""
+        echo "Estate rescan requested for: $RESCAN_REPOS"
+    else
+        echo ""
+        echo "WARN: estate-rescan dispatch failed (non-fatal); nightly sweep will catch up" >&2
+    fi
+elif [[ -s "$RESCAN_REPOS_FILE" && -z "$RESCAN_TOKEN" ]]; then
+    echo ""
+    echo "WARN: fixes landed but no FLEET_DISPATCH_TOKEN/GITHUB_TOKEN set — skipping targeted rescan (nightly sweep will catch up)" >&2
+fi
+rm -f "$RESCAN_REPOS_FILE" 2>/dev/null || true
+
 # --- Kin Protocol: write heartbeat ---
 KIN_DIR="${HOME}/.hypatia/kin"
 mkdir -p "$KIN_DIR"