feat(panicbot): teach translator about panic-attack v2.5.5 test_context

panic-attack v2.5.5 (#102 + #110, merged 2026-06-02) added a
test_context field to AssailReport.weak_points. Possible values:
"production" / "test_only" / "doc" / null (pre-v2.5.5 reports).

This PR wires panicbot to consume the field:

  scanner.rs:
    - WeakPoint gains `test_context: Option<String>` with
      `#[serde(default)]`. JSON without the field deserialises with
      None — fully backward compatible with pre-v2.5.5 panic-attack.

  translator.rs translate_all:
    - After the existing suppressed-drop, also drop findings whose
      test_context is "test_only" or "doc". This is DEFENSIVE:
      panic-attack's apply_v255_context_suppression typically sets
      suppressed=true for these already, but a future scanner version
      that preserves suppressed=false while classifying TestOnly should
      still not have those findings reach the fleet. Test code is not
      fleet-actionable.
    - Production / None pass through normally.

  5 new translator unit tests:
    * test_only drops even when suppressed=false
    * doc drops even when suppressed=false
    * production keeps
    * None (pre-v2.5.5) keeps (treated as production)
    * suppressed=true drops regardless of test_context

  All 11 existing WeakPoint construction sites in panicbot updated
  with `test_context: None` defaults for the new field.

Backward compat: panic-attack reports lacking test_context (older
panic-attack versions) deserialise cleanly via #[serde(default)] and
route through the production path.

Forward compat: when panic-attack adds the other v2.5.5 sidecars
(ffi_kind / jit_context) to AssailReport JSON, follow the same
pattern — Option<String> field with serde(default), then translator
decisions keyed on the value.

42 lib tests pass (37 baseline + 5 new test_context tests).

Author: hyperpolymath

bots/panicbot/src/scanner.rs

@@ -71,6 +71,17 @@ pub struct WeakPoint {
     /// Suppressed items are excluded from fleet counts and CI gates.
     #[serde(default)]
     pub suppressed: bool,
+    /// Test-vs-production classification of the finding's location
+    /// (panic-attack v2.5.5+). `None` means the scanner predates the
+    /// classification field; treat as "Production" for downstream
+    /// routing decisions. `"test_only"` and `"doc"` indicate the
+    /// finding is in test or documentation code respectively — usually
+    /// the panic-attack engine has ALREADY set `suppressed: true` for
+    /// these, but the metadata is preserved so the translator can emit
+    /// audit-trail context (e.g. "PanicPath in tests/foo.rs — accepted
+    /// by test_context rule").
+    #[serde(default)]
+    pub test_context: Option<String>,
 }
 
 /// Report from `panic-attack adjudicate` — cross-report verdict.

bots/panicbot/src/translator.rs

@@ -400,9 +400,25 @@ pub fn translate_all(
             // Skip weak points suppressed by panic-attack's context-aware FP engine.
             // Suppressed = the logic engine found a defensive pattern (e.g. mutex guard,
             // RAII, schema validation) that makes this finding likely a false positive.
+            //
+            // v2.5.5+ classifications (test_context field):
+            //   * `"test_only"` / `"doc"` → typically also `suppressed: true`
+            //     (set by `apply_v255_context_suppression` in panic-attack
+            //     after the kanren rule pass). Defensive: even if a future
+            //     scanner version preserves `suppressed: false` while
+            //     classifying as TestOnly, drop the finding here so test code
+            //     never reaches the fleet.
+            //   * `"production"` → forwarded normally.
+            //   * `None` → predates v2.5.5; treat as production.
             if wp.suppressed {
                 return None;
             }
+            if matches!(
+                wp.test_context.as_deref(),
+                Some("test_only") | Some("doc")
+            ) {
+                return None;
+            }
 
             // Apply severity filter
             let severity_value = match wp.severity.to_lowercase().as_str() {
@@ -498,6 +514,7 @@ mod tests {
             description: "AWS_SECRET_KEY found in source".to_string(),
             recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
         };
         let config = PanicbotConfig::default();
         let finding = translate_weak_point(&wp, &config);
@@ -522,6 +539,7 @@ mod tests {
             description: "Something new".to_string(),
             recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
         };
         let config = PanicbotConfig::default();
         let finding = translate_weak_point(&wp, &config);
@@ -541,6 +559,7 @@ mod tests {
             description: "unsafe block".to_string(),
             recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
         };
         let config = PanicbotConfig {
             confidence_overrides: vec![crate::config::ConfidenceOverride {
@@ -563,6 +582,7 @@ mod tests {
                 description: "low severity".to_string(),
                 recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
             },
             WeakPoint {
                 category: "CommandInjection".to_string(),
@@ -571,6 +591,7 @@ mod tests {
                 description: "critical severity".to_string(),
                 recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
             },
         ];
         let config = PanicbotConfig {
@@ -596,6 +617,7 @@ mod tests {
                     description: "fixable".to_string(),
                     recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
                 },
                 &config,
             ),
@@ -607,6 +629,7 @@ mod tests {
                     description: "not fixable".to_string(),
                     recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
                 },
                 &config,
             ),
@@ -643,4 +666,75 @@ mod tests {
         }
         assert_eq!(rule_ids.len(), 25);
     }
+
+    // ─────────────────────────────────────────────────────────────────────
+    // v2.5.5 test_context tests
+    // ─────────────────────────────────────────────────────────────────────
+
+    fn make_wp(category: &str, test_context: Option<&str>, suppressed: bool) -> WeakPoint {
+        WeakPoint {
+            category: category.to_string(),
+            location: Some("src/foo.rs:1".to_string()),
+            severity: "Critical".to_string(),
+            description: "test".to_string(),
+            recommended_attack: vec![],
+            suppressed,
+            test_context: test_context.map(String::from),
+        }
+    }
+
+    #[test]
+    fn translate_all_drops_test_only_findings_even_if_not_suppressed() {
+        // Defensive: even when `suppressed: false`, a `test_context: test_only`
+        // finding should not reach the fleet.
+        let wps = vec![
+            make_wp("UnsafeCode", Some("test_only"), false),
+            make_wp("UnsafeCode", Some("production"), false),
+        ];
+        let config = PanicbotConfig::default();
+        let findings = translate_all(&wps, &config);
+        assert_eq!(
+            findings.len(),
+            1,
+            "test_only finding must be dropped regardless of suppressed flag"
+        );
+    }
+
+    #[test]
+    fn translate_all_drops_doc_findings_even_if_not_suppressed() {
+        let wps = vec![
+            make_wp("PanicPath", Some("doc"), false),
+            make_wp("PanicPath", Some("production"), false),
+        ];
+        let config = PanicbotConfig::default();
+        let findings = translate_all(&wps, &config);
+        assert_eq!(findings.len(), 1, "doc finding must be dropped");
+    }
+
+    #[test]
+    fn translate_all_keeps_production_test_context() {
+        let wps = vec![make_wp("UnsafeCode", Some("production"), false)];
+        let config = PanicbotConfig::default();
+        let findings = translate_all(&wps, &config);
+        assert_eq!(findings.len(), 1);
+    }
+
+    #[test]
+    fn translate_all_treats_none_test_context_as_production() {
+        // Pre-v2.5.5 panic-attack reports don't have the field; they should
+        // still be routed.
+        let wps = vec![make_wp("UnsafeCode", None, false)];
+        let config = PanicbotConfig::default();
+        let findings = translate_all(&wps, &config);
+        assert_eq!(findings.len(), 1);
+    }
+
+    #[test]
+    fn translate_all_respects_suppressed_independently() {
+        // `suppressed: true` should drop regardless of test_context.
+        let wps = vec![make_wp("UnsafeCode", Some("production"), true)];
+        let config = PanicbotConfig::default();
+        let findings = translate_all(&wps, &config);
+        assert_eq!(findings.len(), 0);
+    }
 }

bots/panicbot/tests/integration_test.rs

@@ -29,6 +29,7 @@ fn mock_assail_report() -> AssailReport {
                 description: "3 unsafe blocks in FFI boundary".to_string(),
                 recommended_attack: vec!["Memory".to_string()],
             suppressed: false,
+            test_context: None,
             },
             WeakPoint {
                 category: "HardcodedSecret".to_string(),
@@ -37,6 +38,7 @@ fn mock_assail_report() -> AssailReport {
                 description: "AWS_SECRET_ACCESS_KEY found in source code".to_string(),
                 recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
             },
             WeakPoint {
                 category: "PanicPath".to_string(),
@@ -45,6 +47,7 @@ fn mock_assail_report() -> AssailReport {
                 description: "unwrap() on user-provided input".to_string(),
                 recommended_attack: vec!["CPU".to_string()],
             suppressed: false,
+            test_context: None,
             },
             WeakPoint {
                 category: "RaceCondition".to_string(),
@@ -53,6 +56,7 @@ fn mock_assail_report() -> AssailReport {
                 description: "Shared mutable state without synchronisation".to_string(),
                 recommended_attack: vec!["Concurrency".to_string()],
             suppressed: false,
+            test_context: None,
             },
             WeakPoint {
                 category: "UncheckedError".to_string(),
@@ -61,6 +65,7 @@ fn mock_assail_report() -> AssailReport {
                 description: "Result ignored from database query".to_string(),
                 recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
             },
         ],
         statistics: serde_json::json!({"total_lines": 5000}),

bots/panicbot/tests/translator_test.rs

@@ -26,6 +26,7 @@ fn weak_point(category: &str, severity: &str) -> WeakPoint {
         description: format!("Test finding for {}", category),
         recommended_attack: vec![],
     suppressed: false,
+            test_context: None,
     }
 }
 
@@ -38,6 +39,7 @@ fn weak_point_at(category: &str, severity: &str, location: &str) -> WeakPoint {
         description: format!("Test finding at {}", location),
         recommended_attack: vec![],
     suppressed: false,
+            test_context: None,
     }
 }
 
@@ -310,6 +312,7 @@ fn test_translate_metadata_includes_panic_attack_category() {
         description: "os.system with user input".to_string(),
         recommended_attack: vec!["Memory".to_string(), "Concurrency".to_string()],
     suppressed: false,
+            test_context: None,
     };
     let finding = translator::translate_weak_point(&wp, &config);