feat(panicbot): teach translator about panic-attack v2.5.5 test_context (#252)

## Summary

panic-attack v2.5.5 (#102 + #110, merged earlier 2026-06-02) added a
`test_context` field to `AssailReport.weak_points`. This PR wires
panicbot's translator to consume it.

## Behaviour

| `suppressed` | `test_context` | Outcome |
|---|---|---|
| `true` | (any) | Drop (existing behaviour) |
| `false` | `"test_only"` | **Drop** (new — defensive) |
| `false` | `"doc"` | **Drop** (new — defensive) |
| `false` | `"production"` | Route to fleet (existing) |
| `false` | `null` (pre-v2.5.5 report) | Route to fleet (backward
compat) |

## Why defensive

panic-attack's `apply_v255_context_suppression` already sets
`suppressed: true` for TestOnly/Doc findings. The defensive double-check
ensures that:
1. If a future panic-attack release decides to preserve `suppressed:
false` while still classifying as TestOnly (e.g. to surface them in
audit-trail mode), the fleet doesn't inadvertently start chasing
test-code findings.
2. If a TestOnly finding slips through some other code path, this is the
safety net.

## Backward compatibility

`#[serde(default)]` on the new field — old panic-attack reports without
the field deserialise cleanly to `None` and route as production. **No
fleet ops disruption when scanning against older panic-attack
installs.**

## Verification

- `cargo build --release`: clean
- `cargo test --release --lib`: **42 pass / 0 fail** (37 baseline + 5
new tests covering all combinations)

## Forward compat

When panic-attack surfaces `ffi_kind` / `jit_context` in JSON (currently
only `test_context` is on `WeakPoint` itself; the other two are
classifier-only), follow the same pattern:
- Add `Option<String>` field on scanner's `WeakPoint`
- Add `#[serde(default)]`
- Translator decisions keyed on the value

## Refs

- panic-attack#102 (test_context foundation)
- panic-attack#110 (analyzer wire-up — sets the field)
- panic-attack#112 (docs closeout — documents the cross-repo wiring
need)

Author: hyperpolymath

bots/panicbot/src/scanner.rs

@@ -71,6 +71,17 @@ pub struct WeakPoint {
     /// Suppressed items are excluded from fleet counts and CI gates.
     #[serde(default)]
     pub suppressed: bool,
+    /// Test-vs-production classification of the finding's location
+    /// (panic-attack v2.5.5+). `None` means the scanner predates the
+    /// classification field; treat as "Production" for downstream
+    /// routing decisions. `"test_only"` and `"doc"` indicate the
+    /// finding is in test or documentation code respectively — usually
+    /// the panic-attack engine has ALREADY set `suppressed: true` for
+    /// these, but the metadata is preserved so the translator can emit
+    /// audit-trail context (e.g. "PanicPath in tests/foo.rs — accepted
+    /// by test_context rule").
+    #[serde(default)]
+    pub test_context: Option<String>,
 }
 
 /// Report from `panic-attack adjudicate` — cross-report verdict.

bots/panicbot/src/translator.rs

@@ -400,9 +400,25 @@ pub fn translate_all(
             // Skip weak points suppressed by panic-attack's context-aware FP engine.
             // Suppressed = the logic engine found a defensive pattern (e.g. mutex guard,
             // RAII, schema validation) that makes this finding likely a false positive.
+            //
+            // v2.5.5+ classifications (test_context field):
+            //   * `"test_only"` / `"doc"` → typically also `suppressed: true`
+            //     (set by `apply_v255_context_suppression` in panic-attack
+            //     after the kanren rule pass). Defensive: even if a future
+            //     scanner version preserves `suppressed: false` while
+            //     classifying as TestOnly, drop the finding here so test code
+            //     never reaches the fleet.
+            //   * `"production"` → forwarded normally.
+            //   * `None` → predates v2.5.5; treat as production.
             if wp.suppressed {
                 return None;
             }
+            if matches!(
+                wp.test_context.as_deref(),
+                Some("test_only") | Some("doc")
+            ) {
+                return None;
+            }
 
             // Apply severity filter
             let severity_value = match wp.severity.to_lowercase().as_str() {
@@ -498,6 +514,7 @@ mod tests {
             description: "AWS_SECRET_KEY found in source".to_string(),
             recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
         };
         let config = PanicbotConfig::default();
         let finding = translate_weak_point(&wp, &config);
@@ -522,6 +539,7 @@ mod tests {
             description: "Something new".to_string(),
             recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
         };
         let config = PanicbotConfig::default();
         let finding = translate_weak_point(&wp, &config);
@@ -541,6 +559,7 @@ mod tests {
             description: "unsafe block".to_string(),
             recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
         };
         let config = PanicbotConfig {
             confidence_overrides: vec![crate::config::ConfidenceOverride {
@@ -563,6 +582,7 @@ mod tests {
                 description: "low severity".to_string(),
                 recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
             },
             WeakPoint {
                 category: "CommandInjection".to_string(),
@@ -571,6 +591,7 @@ mod tests {
                 description: "critical severity".to_string(),
                 recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
             },
         ];
         let config = PanicbotConfig {
@@ -596,6 +617,7 @@ mod tests {
                     description: "fixable".to_string(),
                     recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
                 },
                 &config,
             ),
@@ -607,6 +629,7 @@ mod tests {
                     description: "not fixable".to_string(),
                     recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
                 },
                 &config,
             ),
@@ -643,4 +666,75 @@ mod tests {
         }
         assert_eq!(rule_ids.len(), 25);
     }
+
+    // ─────────────────────────────────────────────────────────────────────
+    // v2.5.5 test_context tests
+    // ─────────────────────────────────────────────────────────────────────
+
+    fn make_wp(category: &str, test_context: Option<&str>, suppressed: bool) -> WeakPoint {
+        WeakPoint {
+            category: category.to_string(),
+            location: Some("src/foo.rs:1".to_string()),
+            severity: "Critical".to_string(),
+            description: "test".to_string(),
+            recommended_attack: vec![],
+            suppressed,
+            test_context: test_context.map(String::from),
+        }
+    }
+
+    #[test]
+    fn translate_all_drops_test_only_findings_even_if_not_suppressed() {
+        // Defensive: even when `suppressed: false`, a `test_context: test_only`
+        // finding should not reach the fleet.
+        let wps = vec![
+            make_wp("UnsafeCode", Some("test_only"), false),
+            make_wp("UnsafeCode", Some("production"), false),
+        ];
+        let config = PanicbotConfig::default();
+        let findings = translate_all(&wps, &config);
+        assert_eq!(
+            findings.len(),
+            1,
+            "test_only finding must be dropped regardless of suppressed flag"
+        );
+    }
+
+    #[test]
+    fn translate_all_drops_doc_findings_even_if_not_suppressed() {
+        let wps = vec![
+            make_wp("PanicPath", Some("doc"), false),
+            make_wp("PanicPath", Some("production"), false),
+        ];
+        let config = PanicbotConfig::default();
+        let findings = translate_all(&wps, &config);
+        assert_eq!(findings.len(), 1, "doc finding must be dropped");
+    }
+
+    #[test]
+    fn translate_all_keeps_production_test_context() {
+        let wps = vec![make_wp("UnsafeCode", Some("production"), false)];
+        let config = PanicbotConfig::default();
+        let findings = translate_all(&wps, &config);
+        assert_eq!(findings.len(), 1);
+    }
+
+    #[test]
+    fn translate_all_treats_none_test_context_as_production() {
+        // Pre-v2.5.5 panic-attack reports don't have the field; they should
+        // still be routed.
+        let wps = vec![make_wp("UnsafeCode", None, false)];
+        let config = PanicbotConfig::default();
+        let findings = translate_all(&wps, &config);
+        assert_eq!(findings.len(), 1);
+    }
+
+    #[test]
+    fn translate_all_respects_suppressed_independently() {
+        // `suppressed: true` should drop regardless of test_context.
+        let wps = vec![make_wp("UnsafeCode", Some("production"), true)];
+        let config = PanicbotConfig::default();
+        let findings = translate_all(&wps, &config);
+        assert_eq!(findings.len(), 0);
+    }
 }

bots/panicbot/tests/integration_test.rs

@@ -29,6 +29,7 @@ fn mock_assail_report() -> AssailReport {
                 description: "3 unsafe blocks in FFI boundary".to_string(),
                 recommended_attack: vec!["Memory".to_string()],
             suppressed: false,
+            test_context: None,
             },
             WeakPoint {
                 category: "HardcodedSecret".to_string(),
@@ -37,6 +38,7 @@ fn mock_assail_report() -> AssailReport {
                 description: "AWS_SECRET_ACCESS_KEY found in source code".to_string(),
                 recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
             },
             WeakPoint {
                 category: "PanicPath".to_string(),
@@ -45,6 +47,7 @@ fn mock_assail_report() -> AssailReport {
                 description: "unwrap() on user-provided input".to_string(),
                 recommended_attack: vec!["CPU".to_string()],
             suppressed: false,
+            test_context: None,
             },
             WeakPoint {
                 category: "RaceCondition".to_string(),
@@ -53,6 +56,7 @@ fn mock_assail_report() -> AssailReport {
                 description: "Shared mutable state without synchronisation".to_string(),
                 recommended_attack: vec!["Concurrency".to_string()],
             suppressed: false,
+            test_context: None,
             },
             WeakPoint {
                 category: "UncheckedError".to_string(),
@@ -61,6 +65,7 @@ fn mock_assail_report() -> AssailReport {
                 description: "Result ignored from database query".to_string(),
                 recommended_attack: vec![],
             suppressed: false,
+            test_context: None,
             },
         ],
         statistics: serde_json::json!({"total_lines": 5000}),

bots/panicbot/tests/translator_test.rs

@@ -26,6 +26,7 @@ fn weak_point(category: &str, severity: &str) -> WeakPoint {
         description: format!("Test finding for {}", category),
         recommended_attack: vec![],
     suppressed: false,
+            test_context: None,
     }
 }
 
@@ -38,6 +39,7 @@ fn weak_point_at(category: &str, severity: &str, location: &str) -> WeakPoint {
         description: format!("Test finding at {}", location),
         recommended_attack: vec![],
     suppressed: false,
+            test_context: None,
     }
 }
 
@@ -310,6 +312,7 @@ fn test_translate_metadata_includes_panic_attack_category() {
         description: "os.system with user input".to_string(),
         recommended_attack: vec!["Memory".to_string(), "Concurrency".to_string()],
     suppressed: false,
+            test_context: None,
     };
     let finding = translator::translate_weak_point(&wp, &config);