feat(panicbot): PA021 ProofDrift mapping + suppressed field on WeakPoint

Add PA021 rule mapping for the new ProofDrift weak point category
(formal verification drift: sorry/Admitted/believe_me/oops/trustMe etc.).
Fleet category: static-analysis/proof-drift. Confidence 0.92, Control tier.

Add suppressed: bool field to WeakPoint (serde(default)) so panicbot can
parse reports from panic-attack v2.1.0+ without breaking on older JSON.
translate_all() filters suppressed=true findings — the logic engine marked
them as likely false positives from defensive patterns. Full audit trail
preserved in the raw report; only active findings reach fleet dispatch.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

bots/panicbot/src/translator.rs

@@ -4,7 +4,7 @@
 //! Core responsibility: map each `WeakPoint` from the scanner output into a
 //! `Finding` struct with appropriate:
 //! - Fleet category (e.g., "static-analysis/unsafe-code")
-//! - Rule ID (canonical PA001–PA020 pattern for dedup with Hypatia findings)
+//! - Rule ID (canonical PA001–PA021 pattern for dedup with Hypatia findings)
 //! - Triangle tier (Eliminate / Substitute / Control)
 //! - Confidence score (honest assessment of detection accuracy)
 //! - Fixability (whether automated remediation is possible)
@@ -223,6 +223,19 @@ pub fn category_mapping(category: &str) -> Option<CategoryMapping> {
             default_confidence: 0.65,
             fixability: Fixability::No,
         }),
+        // PA021 — formal verification drift: banned proof escape hatches (sorry, Admitted,
+        // believe_me, oops, trustMe, assert_total, %partial) or Julia mirror files that
+        // substitute `@test x isa Y` assertions for formally-proven theorems.
+        // Confidence is high because these keywords have essentially no false positives
+        // in proof assistant files — they exist only to bypass the checker.
+        "ProofDrift" => Some(CategoryMapping {
+            fleet_category: "static-analysis/proof-drift",
+            rule_id: "PA021",
+            rule_name: "Formal verification drift",
+            triangle_tier: TriangleTier::Control,
+            default_confidence: 0.92,
+            fixability: Fixability::No,
+        }),
         _ => None,
     }
 }
@@ -435,6 +448,7 @@ mod tests {
             severity: "Critical".to_string(),
             description: "AWS_SECRET_KEY found in source".to_string(),
             recommended_attack: vec![],
+            suppressed: false,
         };
         let config = PanicbotConfig::default();
         let finding = translate_weak_point(&wp, &config);
@@ -458,6 +472,7 @@ mod tests {
             severity: "Medium".to_string(),
             description: "Something new".to_string(),
             recommended_attack: vec![],
+            suppressed: false,
         };
         let config = PanicbotConfig::default();
         let finding = translate_weak_point(&wp, &config);
@@ -476,6 +491,7 @@ mod tests {
             severity: "High".to_string(),
             description: "unsafe block".to_string(),
             recommended_attack: vec![],
+            suppressed: false,
         };
         let config = PanicbotConfig {
             confidence_overrides: vec![crate::config::ConfidenceOverride {
@@ -497,13 +513,15 @@ mod tests {
                 severity: "Low".to_string(),
                 description: "low severity".to_string(),
                 recommended_attack: vec![],
+            suppressed: false,
             },
             WeakPoint {
                 category: "CommandInjection".to_string(),
                 location: None,
                 severity: "Critical".to_string(),
                 description: "critical severity".to_string(),
                 recommended_attack: vec![],
+            suppressed: false,
             },
         ];
         let config = PanicbotConfig {
@@ -528,6 +546,7 @@ mod tests {
                     severity: "High".to_string(),
                     description: "fixable".to_string(),
                     recommended_attack: vec![],
+            suppressed: false,
                 },
                 &config,
             ),
@@ -538,6 +557,7 @@ mod tests {
                     severity: "High".to_string(),
                     description: "not fixable".to_string(),
                     recommended_attack: vec![],
+            suppressed: false,
                 },
                 &config,
             ),

bots/panicbot/tests/integration_test.rs

@@ -28,34 +28,39 @@ fn mock_assail_report() -> AssailReport {
                 severity: "High".to_string(),
                 description: "3 unsafe blocks in FFI boundary".to_string(),
                 recommended_attack: vec!["Memory".to_string()],
+            suppressed: false,
             },
             WeakPoint {
                 category: "HardcodedSecret".to_string(),
                 location: Some("src/config.rs:15".to_string()),
                 severity: "Critical".to_string(),
                 description: "AWS_SECRET_ACCESS_KEY found in source code".to_string(),
                 recommended_attack: vec![],
+            suppressed: false,
             },
             WeakPoint {
                 category: "PanicPath".to_string(),
                 location: Some("src/handler.rs:87".to_string()),
                 severity: "Medium".to_string(),
                 description: "unwrap() on user-provided input".to_string(),
                 recommended_attack: vec!["CPU".to_string()],
+            suppressed: false,
             },
             WeakPoint {
                 category: "RaceCondition".to_string(),
                 location: Some("src/cache.rs:23".to_string()),
                 severity: "High".to_string(),
                 description: "Shared mutable state without synchronisation".to_string(),
                 recommended_attack: vec!["Concurrency".to_string()],
+            suppressed: false,
             },
             WeakPoint {
                 category: "UncheckedError".to_string(),
                 location: Some("src/db.rs:56".to_string()),
                 severity: "Medium".to_string(),
                 description: "Result ignored from database query".to_string(),
                 recommended_attack: vec![],
+            suppressed: false,
             },
         ],
         statistics: serde_json::json!({"total_lines": 5000}),

bots/panicbot/tests/translator_test.rs

@@ -25,6 +25,7 @@ fn weak_point(category: &str, severity: &str) -> WeakPoint {
         severity: severity.to_string(),
         description: format!("Test finding for {}", category),
         recommended_attack: vec![],
+    suppressed: false,
     }
 }
 
@@ -36,6 +37,7 @@ fn weak_point_at(category: &str, severity: &str, location: &str) -> WeakPoint {
         severity: severity.to_string(),
         description: format!("Test finding at {}", location),
         recommended_attack: vec![],
+    suppressed: false,
     }
 }
 
@@ -302,6 +304,7 @@ fn test_translate_metadata_includes_panic_attack_category() {
         severity: "Critical".to_string(),
         description: "os.system with user input".to_string(),
         recommended_attack: vec!["Memory".to_string(), "Concurrency".to_string()],
+    suppressed: false,
     };
     let finding = translator::translate_weak_point(&wp, &config);