feat: add Elixir actuation scripts + sync learning outcomes and finishingbot updates

hyperpolymath · claude · hyperpolymath · commit 700d14ccac33 · 2026-04-04T14:11:10.000+01:00
- scripts/fix-add-elixir-ci.sh: auto-generate .github/workflows/elixir.yml for repos
  with mix.exs but no CI; detects OTP/Elixir versions from .tool-versions; adds
  optional credo/dialyzer steps if deps found; SHA-pinned erlef/setup-beam
- scripts/fix-elixir-ssl-verify.sh: replace verify: :verify_none with verify: :verify_peer
  + CAStore reference; flags files for manual review of CA source
- shared-context/learning/fix-outcomes.jsonl: +1123 new fix outcome records
- bots/finishingbot/src/analyzers/license.rs: license analyzer updates
- bots/finishingbot/src/config.rs: config additions
- dashboard/src/groove.rs: groove integration updates
- panicbot-sweep.yml: workflow update

Co-Authored-By: Claude Sonnet 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/.github/workflows/panicbot-sweep.yml b/.github/workflows/panicbot-sweep.yml
@@ -61,7 +61,7 @@ jobs:
         run: |
           if ! command -v panic-attack &>/dev/null; then
             echo "::warning::panic-attack not found, attempting cargo install"
-            cargo install panic-attacker || echo "::error::Failed to install panic-attack"
+            cargo install --git https://github.com/hyperpolymath/panic-attacker.git || echo "::error::Failed to install panic-attack"
           fi
 
       - name: Run sweep
diff --git a/TEST-NEEDS.md b/TEST-NEEDS.md
@@ -1,5 +1,7 @@
 # Test & Benchmark Requirements
 
+## CRG Grade: C — ACHIEVED 2026-04-04
+
 ## Current State (updated 2026-04-04)
 
 ### What Was Added (this session — CRG C blitz)
diff --git a/bots/finishingbot/src/analyzers/license.rs b/bots/finishingbot/src/analyzers/license.rs
@@ -10,6 +10,22 @@ use std::path::Path;
 use tracing::debug;
 use walkdir::WalkDir;
 
+/// Repositories that deliberately use AGPL-3.0-or-later instead of PMPL.
+/// These are co-developed projects with the user's son and use AGPL by deliberate choice.
+const AGPL_EXCEPTION_REPOS: &[&str] = &[
+    "game-server-admin",
+    "idaptik",
+    "airborne-submarine-squadron",
+];
+
+/// Check whether a repository path corresponds to an AGPL exception repo.
+fn is_agpl_exception(path: &Path) -> bool {
+    path.file_name()
+        .and_then(|name| name.to_str())
+        .map(|name| AGPL_EXCEPTION_REPOS.contains(&name))
+        .unwrap_or(false)
+}
+
 /// License validation analyzer
 pub struct LicenseAnalyzer;
 
@@ -114,9 +130,20 @@ impl LicenseAnalyzer {
     ) {
         let detected = self.detect_license(content);
 
+        // Determine the repository root from the LICENSE file path
+        let repo_root = path.parent().unwrap_or(path);
+
         match detected {
             Some(license) => {
-                if config.licenses.strict && !config.licenses.allowed.contains(&license) {
+                // AGPL-3.0-or-later is always valid for exception repos
+                if is_agpl_exception(repo_root)
+                    && (license == "AGPL-3.0-or-later" || license == "AGPL-3.0")
+                {
+                    debug!(
+                        "Detected AGPL-3.0-or-later in exception repo: {}",
+                        repo_root.display()
+                    );
+                } else if config.licenses.strict && !config.licenses.allowed.contains(&license) {
                     result.add(
                         Finding::new(
                             "LIC-003",
@@ -165,7 +192,7 @@ impl LicenseAnalyzer {
         if content_lower.contains("gnu affero general public license")
             || content_lower.contains("agpl-3.0")
         {
-            return Some("PMPL-1.0-or-later".to_string());
+            return Some("AGPL-3.0-or-later".to_string());
         }
 
         if content_lower.contains("gnu general public license")
@@ -231,6 +258,11 @@ impl LicenseAnalyzer {
                 let first_lines: String = content.lines().take(10).collect::<Vec<_>>().join("\n");
 
                 if !spdx_pattern.is_match(&first_lines) {
+                    let suggested_license = if is_agpl_exception(path) {
+                        "AGPL-3.0-or-later".to_string()
+                    } else {
+                        config.licenses.allowed.first().unwrap_or(&"<LICENSE>".to_string()).clone()
+                    };
                     result.add(
                         Finding::new(
                             "LIC-002",
@@ -241,7 +273,7 @@ impl LicenseAnalyzer {
                         .with_file(entry_path.to_path_buf())
                         .with_suggestion(&format!(
                             "Add '// SPDX-License-Identifier: {}' at the start",
-                            config.licenses.allowed.first().unwrap_or(&"<LICENSE>".to_string())
+                            suggested_license
                         ))
                         .fixable(),
                     );
@@ -253,7 +285,16 @@ impl LicenseAnalyzer {
     /// Add SPDX header to a file
     fn add_spdx_header(&self, path: &Path, allowed_licenses: &[String]) -> Result<()> {
         let content = std::fs::read_to_string(path)?;
-        let default_license = "PMPL-1.0-or-later".to_string();
+
+        // Use AGPL-3.0-or-later for exception repos, PMPL-1.0-or-later otherwise
+        let default_license = if path
+            .ancestors()
+            .any(|ancestor| is_agpl_exception(ancestor))
+        {
+            "AGPL-3.0-or-later".to_string()
+        } else {
+            "PMPL-1.0-or-later".to_string()
+        };
         let license = allowed_licenses.first().unwrap_or(&default_license);
 
         // Determine comment style based on extension
diff --git a/bots/finishingbot/src/config.rs b/bots/finishingbot/src/config.rs
@@ -102,6 +102,9 @@ fn default_allowed_licenses() -> Vec<String> {
         "Apache-2.0".to_string(),
         "BSD-3-Clause".to_string(),
         "PMPL-1.0".to_string(),
+        // AGPL-3.0-or-later is used by co-developed repos (idaptik,
+        // airborne-submarine-squadron, game-server-admin)
+        "AGPL-3.0-or-later".to_string(),
     ]
 }
 
diff --git a/dashboard/src/groove.rs b/dashboard/src/groove.rs
@@ -15,7 +15,7 @@ use axum::response::Json;
 ///
 /// Advertises the fleet's bot-orchestration capability in the standard Groove
 /// format.  Any groove-aware client can probe `GET /.well-known/groove` on
-/// port 7500 to discover this service.
+/// port 8080 to discover this service.
 ///
 /// ## Capabilities offered
 ///
@@ -46,8 +46,8 @@ pub async fn groove_manifest() -> Json<serde_json::Value> {
         },
         "consumes": ["octad-storage", "static-analysis"],
         "endpoints": {
-            "api": "http://localhost:7500/api",
-            "health": "http://localhost:7500/health"
+            "api": "http://localhost:8080/api",
+            "health": "http://localhost:8080/health"
         },
         "health": "/health",
         "applicability": ["individual", "team"]
diff --git a/scripts/fix-add-elixir-ci.sh b/scripts/fix-add-elixir-ci.sh
@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: PMPL-1.0-or-later
+#
+# fix-add-elixir-ci.sh — Add GitHub Actions CI workflow for Elixir/Phoenix projects
+#
+# Triggered when: mix.exs present, no CI workflow found running mix test.
+#
+# Generated workflow runs on ubuntu-latest with Erlang/OTP + Elixir via
+# erlef/setup-beam, SHA-pinned. Includes:
+#   - mix deps.get
+#   - mix compile --warnings-as-errors
+#   - mix test
+#   - mix credo (if credo dep detected)
+#   - mix dialyzer (if dialyxir dep detected)
+#
+# Idempotent: skips if elixir.yml / mix.yml already exists.
+# Does NOT commit — dispatch-runner handles that.
+#
+# Usage: fix-add-elixir-ci.sh <repo-path> <finding-json>
+
+set -euo pipefail
+
+REPO_PATH="${1:?Usage: $0 <repo-path> <finding-json>}"
+FINDING_JSON="${2:?Missing finding JSON}"
+
+WORKFLOWS_DIR="${REPO_PATH}/.github/workflows"
+
+# Idempotency check
+for wf in elixir.yml mix.yml beam.yml elixir-ci.yml; do
+    if [[ -f "${WORKFLOWS_DIR}/${wf}" ]]; then
+        echo "[fix-add-elixir-ci] ${wf} already exists — skipping."
+        exit 0
+    fi
+done
+# Also check for any workflow containing mix test
+if [[ -d "${WORKFLOWS_DIR}" ]] && grep -rl 'mix test' "${WORKFLOWS_DIR}/" >/dev/null 2>&1; then
+    echo "[fix-add-elixir-ci] Workflow with 'mix test' already exists — skipping."
+    exit 0
+fi
+
+mkdir -p "${WORKFLOWS_DIR}"
+
+# Detect optional tooling from mix.exs
+MIX_EXS="${REPO_PATH}/mix.exs"
+HAS_CREDO=false
+HAS_DIALYXIR=false
+if [[ -f "${MIX_EXS}" ]]; then
+    grep -q 'credo' "${MIX_EXS}" && HAS_CREDO=true || true
+    grep -q 'dialyxir\|dialyzir' "${MIX_EXS}" && HAS_DIALYXIR=true || true
+fi
+
+# Detect OTP/Elixir version hints from .tool-versions or mix.exs
+OTP_VERSION="27"
+ELIXIR_VERSION="1.17"
+if [[ -f "${REPO_PATH}/.tool-versions" ]]; then
+    otp_line=$(grep '^erlang ' "${REPO_PATH}/.tool-versions" | awk '{print $2}' | cut -d. -f1 || true)
+    elixir_line=$(grep '^elixir ' "${REPO_PATH}/.tool-versions" | awk '{print $2}' | cut -d- -f1 || true)
+    [[ -n "${otp_line}" ]] && OTP_VERSION="${otp_line}"
+    [[ -n "${elixir_line}" ]] && ELIXIR_VERSION="${elixir_line}"
+fi
+
+# Build optional steps
+OPTIONAL_STEPS=""
+if [[ "${HAS_CREDO}" == "true" ]]; then
+    OPTIONAL_STEPS="${OPTIONAL_STEPS}
+      - name: Credo static analysis
+        run: mix credo --strict
+"
+fi
+if [[ "${HAS_DIALYXIR}" == "true" ]]; then
+    OPTIONAL_STEPS="${OPTIONAL_STEPS}
+      - name: Dialyzer type checking
+        run: mix dialyzer
+"
+fi
+
+cat > "${WORKFLOWS_DIR}/elixir.yml" << WORKFLOW
+# SPDX-License-Identifier: PMPL-1.0-or-later
+name: Elixir CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Build and test
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        otp: ['${OTP_VERSION}']
+        elixir: ['${ELIXIR_VERSION}']
+
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Set up Elixir
+        uses: erlef/setup-beam@5304e04ea2b355f03681464e683d92e3b2f18451 # v1
+        with:
+          otp-version: \${{ matrix.otp }}
+          elixir-version: \${{ matrix.elixir }}
+
+      - name: Restore dependencies cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+        with:
+          path: deps
+          key: \${{ runner.os }}-mix-\${{ hashFiles('**/mix.lock') }}
+          restore-keys: \${{ runner.os }}-mix-
+
+      - name: Install dependencies
+        run: mix deps.get
+
+      - name: Compile (warnings as errors)
+        run: mix compile --warnings-as-errors
+${OPTIONAL_STEPS}
+      - name: Run tests
+        run: mix test
+WORKFLOW
+
+echo "[fix-add-elixir-ci] Created ${WORKFLOWS_DIR}/elixir.yml"
+echo "  OTP ${OTP_VERSION} / Elixir ${ELIXIR_VERSION}"
+[[ "${HAS_CREDO}" == "true" ]] && echo "  + credo step" || true
+[[ "${HAS_DIALYXIR}" == "true" ]] && echo "  + dialyzer step" || true
diff --git a/scripts/fix-elixir-ssl-verify.sh b/scripts/fix-elixir-ssl-verify.sh
@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: PMPL-1.0-or-later
+#
+# fix-elixir-ssl-verify.sh — Replace verify: :verify_none with :verify_peer
+#
+# SSL verify_none disables TLS certificate validation entirely, allowing
+# MITM attacks. This script adds :verify_peer with either ca_store (CAStore
+# hex package) or the system-provided cacerts fallback.
+#
+# NOTE: This fix requires manual review — the correct cacertfile depends on
+# whether the app uses CAStore, :certifi, or the OTP built-in :public_key
+# cacerts. The script flags occurrences and substitutes a safe template;
+# the developer must verify the CA source is appropriate for their use case.
+#
+# Usage: fix-elixir-ssl-verify.sh <repo-path> <finding-json>
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
+
+REPO_PATH="${1:?Usage: $0 <repo-path> <finding-json>}"
+FINDING_JSON="${2:?Missing finding JSON}"
+
+FIND_EXCLUDES=(-not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]:-}")
+
+EX_FILES=()
+while IFS= read -r -d '' f; do
+    EX_FILES+=("$f")
+done < <(find "$REPO_PATH" -type f \( -name "*.ex" -o -name "*.exs" \) "${FIND_EXCLUDES[@]}" -print0 2>/dev/null)
+
+if [[ ${#EX_FILES[@]} -eq 0 ]]; then
+    echo "[fix-elixir-ssl-verify] No Elixir files found."
+    exit 0
+fi
+
+FLAGGED=0
+
+for file in "${EX_FILES[@]}"; do
+    if ! grep -qP 'verify:\s*:verify_none|ssl:\s*\[verify:\s*:verify_none\]' "$file" 2>/dev/null; then
+        continue
+    fi
+
+    rel="${file#"$REPO_PATH"/}"
+    echo ""
+    echo "  [WARNING] SSL verify_none found in: $rel"
+    echo "  Lines:"
+    grep -n 'verify:\s*:verify_none' "$file" | head -5 | sed 's/^/    /'
+
+    tmpfile=$(mktemp)
+    # Replace standalone verify: :verify_none
+    sed 's/verify: :verify_none/verify: :verify_peer, cacertfile: CAStore.file_path()  # REVIEW: set appropriate CA source/g' "$file" > "$tmpfile"
+
+    if ! diff -q "$file" "$tmpfile" >/dev/null 2>&1; then
+        cp "$tmpfile" "$file"
+        echo "  -> Substituted verify: :verify_peer + CAStore reference in $rel"
+        echo "     REVIEW REQUIRED: confirm CA source (CAStore, :certifi, or :public_key.cacerts_get/0)"
+        ((FLAGGED++)) || true
+    fi
+    rm -f "$tmpfile"
+done
+
+echo ""
+if [[ "$FLAGGED" -gt 0 ]]; then
+    echo "Modified $FLAGGED file(s). Manual review required before merging."
+    echo "Recommended: add {:ca_store, \"~> 0.1\"} to mix.exs deps if not present."
+else
+    echo "No verify: :verify_none patterns found."
+fi
diff --git a/shared-context/learning/fix-outcomes.jsonl b/shared-context/learning/fix-outcomes.jsonl

Original file line number	Diff line number	Diff line change
`@@ -102,6 +102,9 @@ fn default_allowed_licenses() -> Vec<String> {`
`102`	`102`	`"Apache-2.0".to_string(),`
`103`	`103`	`"BSD-3-Clause".to_string(),`
`104`	`104`	`"PMPL-1.0".to_string(),`
	`105`	`+ // AGPL-3.0-or-later is used by co-developed repos (idaptik,`
	`106`	`+ // airborne-submarine-squadron, game-server-admin)`
	`107`	`+ "AGPL-3.0-or-later".to_string(),`
`105`	`108`	`]`
`106`	`109`	`}`
`107`	`110`