Context

After #26 bumped the standards reusables to d72fe5a, the Hypatia scanner upgraded (915139d → current) and now reports 11 advisory findings. Investigation (running the real scanner against this repo) found ~4 genuine + ~7 false-positives. This PR fixes the genuine, in-repo subset. It is the cleanup approved after "investigate upstream first."

This PR does not turn the hypatia check green on its own. The red check is an upstream regression: standards/.github/workflows/hypatia-scan-reusable.yml dropped --exit-zero + || true from the scan step, so the advisory scanner ("warn but don't fail — fix forward") now hard-fails on any ≥medium finding. Restoring that guard (owner-only, one line) is what greens the check; this PR just removes the genuine findings underneath.

Changes

Docs — structural_drift/SD022 ×6 (stale path after #20 removed the FFI stubs)

src/abi/ doesn't exist; the real RSR slot is src/interface/abi/. Corrected the path in:

• docs/practice/AI-CONVENTIONS.adoc, docs/RSR_OUTLINE.adoc, QUICKSTART-DEV.adoc, docs/governance/MAINTENANCE-CHECKLIST.adoc, .machine_readable/INTENT.contractile
• docs/developer/ABI-FFI-README.adoc was an unfilled template (still had a {{project}} placeholder + a {{~ delete this line ~}} instruction) describing a non-existent Idris2/Zig FFI surface → replaced with a short, honest "no FFI surface" stub pointing at the real src/interface/{abi,ffi,generated}/ placeholders and PROOF-NEEDS.md. (This is the one larger edit — easy to revert if you'd rather keep/rewrite the original.)

setup.sh — code_safety/shell_download_then_run (CWE-494)

• Replaced curl … just.systems/install.sh | bash (2 sites) with an install_just_upstream() helper that downloads then runs (no pipe-to-shell), with opt-in JUST_VERSION pinning and JUST_INSTALL_SHA256 verification. Native package managers (incl. nix/guix) are still tried first; the upstream installer is only the last-resort fallback.
• Updated the header usage example to the download-then-run form.

.envrc — secret_detected "Generic API key" (the 1 "critical")

• False-positive (a commented placeholder; the scanner doesn't skip comments), but removed the residual # export DATABASE_URL="..." / # export API_KEY="..." lines. This re-lands the fix intended in ci(governance): harden workflows — timeouts, perms, secret gate, codeql actions, drop privileged workflow_run (Part B) #25 that never actually reached main.

Not fixed here (scanner false-positives — belong upstream in hyperpolymath/hypatia)

• WF017 on instant-sync.yml — repo already uses the correct two-step secret-presence gate (if: steps.gate.outputs.has_token); the rule only recognizes same-step gating.
• SC-014 StaticAnalysis — check_sast matches governance.yml's docstring substring "codeql" instead of the real codeql.yml (which does declare language: actions).
• SC-013 DependencyPinning — triggered by commented-out @v4 examples in release.yml; it doesn't strip YAML comments. All live actions are SHA-pinned.

Verification

• ✅ No src/abi/ references remain (grep), all corrected paths resolve to real dirs.
• ✅ .envrc has no commented export API_KEY/DATABASE_URL lines.
• ✅ setup.sh has no curl … | sh/bash pipes and passes sh -n.
• ✅ Stub references (src/interface/*, PROOF-NEEDS.md) all exist.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

Generated by Claude Code