feat(rules): extend 5 existing rules to auto-classify recurring estate failure modes (#414)

Extends — not adds — 5 rules to cover failure patterns surfaced in the
2026-06-02 inbox audit. Each commit is a single rule extension.

## Commits

1. `feat(cicd_rules): extend license carve-outs for paint-type (PMPL)
and echidna docs (MPL)` — adds `@pmpl_exception_repos`,
`@license_exception_paths`, and a 3-arity `validate_license/3` with a
minimal glob matcher.
2. `chore(sha-pins): bump a2ml-validate-action to 6bff6ec` — full
40-char SHA `6bff6ec134fc977e86d25166a5c522ddea5c1e78` (s-expression
form support, panic-attack#94).
3. `feat(workflow_audit): Chapel >=2.8.0 ABI / runs-on detector (WF024)`
— flags `CHAPEL_DEB_URL` / `chapel-*.deb` workflows whose `runs-on:` is
`ubuntu-latest` / `ubuntu-24.04` (libclang-cpp.so.14 vs .so.18).
Sources: proven#141, panic-attack#99.
4. `feat(proof_obligation): add baseline-delta admit-count regression
detector` — exposes `count_admit_markers/1` and
`check_admit_regression/2`. Not wired into a top-level entry yet (per
ticket).
5. `feat(scorecard): extend check_fuzzing to classify PR (address)
sanitizer-job failures` — 3-arity input shape `%{files: [...],
workflows: %{name => log}}` classifies sibling-crate-missing /
toolchain-skew (rustc-1.91) / build-script-panic.

## Sanity

- `mix compile --warnings-as-errors` — blocked by unrelated Elixir 1.14
vs Phoenix 1.15 env mismatch in local sandbox; CI will run the canonical
check.
- All 5 edited files parse-check clean via `Code.string_to_quoted!/2`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: hyperpolymath

lib/rules/cicd_rules.ex

@@ -1331,12 +1331,46 @@ defmodule Hypatia.Rules.CicdRules do
   # Repos that legitimately use AGPL-3.0-or-later (co-developed with family, etc.)
   @agpl_exception_repos ["game-server-admin", "idaptik", "airborne-submarine-squadron"]
 
+  # Repos that legitimately use PMPL-1.0-or-later (Palimpsest MPL).
+  # paint-type (JoshuaJewell/son's repo) uses PMPL-1.0-or-later for source/doc
+  # SPDX headers with MPL-2.0 only as the LICENSE-file fallback (explicit dual
+  # pattern, paint-type#4 owner carve-out 2026-06-01). Estate-licence-debt
+  # audits flagging this as a mismatch are FALSE POSITIVES.
+  @pmpl_exception_repos ["paint-type"]
+
+  # Per-repo path globs to skip strict SPDX-vs-LICENSE checking on.
+  # echidna intentionally keeps doc files at MPL-2.0 even though the LICENSE
+  # file is AGPL (owner reverted PR #149 docs reconciliation 2026-05-30 —
+  # this is owner-managed and must NOT be auto-reconciled by sweep rules).
+  @license_exception_paths %{
+    "echidna" => [
+      "docs/**",
+      "EXPLAINME.adoc",
+      "CLAUDE.md",
+      "CONTRIBUTING.adoc",
+      "FAQ.md"
+    ]
+  }
+
   def required_spdx, do: @required_spdx
   def agpl_exception_repos, do: @agpl_exception_repos
+  def pmpl_exception_repos, do: @pmpl_exception_repos
+  def license_exception_paths, do: @license_exception_paths
+
+  @doc """
+  Return the list of path globs that are exempt from strict SPDX-vs-LICENSE
+  checking for the given repo. Returns `[]` if the repo has no carve-out.
+  """
+  def license_exception_paths_for(repo_name) when is_binary(repo_name) do
+    Map.get(@license_exception_paths, repo_name, [])
+  end
+
+  def license_exception_paths_for(_), do: []
 
   @doc """
   Validate a license SPDX identifier, optionally scoped to a repo name.
   AGPL-3.0-or-later is permitted for repos in @agpl_exception_repos.
+  PMPL-1.0 / PMPL-1.0-or-later is permitted for repos in @pmpl_exception_repos.
   """
   def validate_license(spdx_id, repo_name \\ nil)
 
@@ -1354,6 +1388,9 @@ defmodule Hypatia.Rules.CicdRules do
       spdx_id in ["AGPL-3.0", "AGPL-3.0-or-later"] and repo_name in @agpl_exception_repos ->
         :ok_agpl_exception
 
+      spdx_id in ["PMPL-1.0", "PMPL-1.0-or-later"] and repo_name in @pmpl_exception_repos ->
+        :ok_pmpl_exception
+
       spdx_id in @wrong_licenses ->
         {:error, :wrong_license, spdx_id}
 
@@ -1362,6 +1399,35 @@ defmodule Hypatia.Rules.CicdRules do
     end
   end
 
+  @doc """
+  Validate a license SPDX identifier for a specific file path within a repo.
+  If the file path matches a glob in @license_exception_paths for the repo,
+  returns `:ok_path_exception` regardless of the SPDX identifier — used by
+  doc-vs-source carve-outs (e.g. echidna's MPL-2.0 docs under AGPL LICENSE).
+  """
+  def validate_license(spdx_id, repo_name, file_path)
+      when is_binary(repo_name) and is_binary(file_path) do
+    globs = license_exception_paths_for(repo_name)
+
+    if Enum.any?(globs, &path_matches_glob?(file_path, &1)) do
+      :ok_path_exception
+    else
+      validate_license(spdx_id, repo_name)
+    end
+  end
+
+  # Minimal glob match: `**` (any depth), `*` (no slash), literal otherwise.
+  defp path_matches_glob?(path, glob) do
+    regex_src =
+      glob
+      |> String.replace(".", "\\.")
+      |> String.replace("**", "::DOUBLESTAR::")
+      |> String.replace("*", "[^/]*")
+      |> String.replace("::DOUBLESTAR::", ".*")
+
+    Regex.match?(~r/\A#{regex_src}\z/, path)
+  end
+
   # Detect SPDX identifiers with a duplicated `-or-later` (or `+`) suffix —
   # the rhodibot regex-regression class observed 2026-05-27 in
   # the-nash-equilibrium#41. The deployed bot's auto-fix applies

lib/rules/proof_obligation.ex

@@ -323,4 +323,83 @@ defmodule Hypatia.Rules.ProofObligation do
 
   # Best tactic hint for the eliminate tier (generic auto-tactic).
   defp best_tactic_hint, do: "simp; omega; decide"
+
+  # ─── Baseline-delta admit-count regression detector ──────────────────────
+  #
+  # Counts the literal proof-debt markers in a source blob, with light
+  # comment-guarding so a phrase like `(* sorry: TODO *)` doesn't inflate
+  # the count. Used by `check_admit_regression/2` to flag PRs whose head
+  # tree carries more admits than the base — a cheap soundness signal that
+  # complements per-module `Print Assumptions` whitelists.
+  #
+  # Markers counted (literal, case-sensitive where it matters):
+  #   Coq        → `Admitted.`  `Axiom `   (followed by an identifier)
+  #   Agda/Idris → `postulate`
+  #   Lean / Coq → `sorry`
+  #   Idris2     → `believe_me`
+  #
+  # Comment guard: strip Coq `(* … *)`, Lean/Rust `--`/`//` line comments,
+  # and Agda `--` line comments before counting. Block comments inside
+  # block comments are left alone (single-level strip is sufficient for
+  # the false-positive cases observed in practice).
+
+  @admit_markers [
+    {~r/\bAdmitted\.\B|\bAdmitted\./, :admitted},
+    {~r/\bAxiom\s+[A-Za-z_]/, :axiom},
+    {~r/\bsorry\b/, :sorry},
+    {~r/\bbelieve_me\b/, :believe_me},
+    {~r/\bpostulate\b/, :postulate}
+  ]
+
+  @doc """
+  Count literal proof-debt markers (`Admitted.`, `Axiom`, `sorry`,
+  `believe_me`, `postulate`) in a source blob. Single-level comment guard
+  strips `(* … *)`, `// …`, and `-- …` before counting so quoted markers
+  inside comments don't inflate the count.
+  """
+  @spec count_admit_markers(String.t()) :: non_neg_integer()
+  def count_admit_markers(text) when is_binary(text) do
+    stripped =
+      text
+      |> String.replace(~r/\(\*.*?\*\)/s, " ")
+      |> String.replace(~r/(?m)\/\/[^\n]*$/, "")
+      |> String.replace(~r/(?m)--[^\n]*$/, "")
+
+    Enum.reduce(@admit_markers, 0, fn {re, _kind}, acc ->
+      acc + length(Regex.scan(re, stripped))
+    end)
+  end
+
+  def count_admit_markers(_), do: 0
+
+  @doc """
+  Compare admit-marker counts between a base tree and a head tree.
+
+  Both arguments are maps of `%{filename => content}`. Returns:
+    * `:ok`                          — head_count ≤ base_count
+    * `{:warn, {base, head}}`        — head_count > base_count (regression)
+
+  Intended for use as a soft gate on proof-bearing PRs: combined with a
+  per-module `Print Assumptions` whitelist this catches the "snuck-in
+  extra Admitted" failure mode the whitelist alone cannot.
+  """
+  @spec check_admit_regression(map(), map()) ::
+          :ok | {:warn, {non_neg_integer(), non_neg_integer()}}
+  def check_admit_regression(base_files, head_files)
+      when is_map(base_files) and is_map(head_files) do
+    base_count = sum_admit_markers(base_files)
+    head_count = sum_admit_markers(head_files)
+
+    if head_count > base_count do
+      {:warn, {base_count, head_count}}
+    else
+      :ok
+    end
+  end
+
+  defp sum_admit_markers(files) do
+    Enum.reduce(files, 0, fn {_name, content}, acc ->
+      acc + count_admit_markers(content)
+    end)
+  end
 end

lib/rules/scorecard_compliance.ex

@@ -85,20 +85,156 @@ defmodule Hypatia.Rules.ScorecardCompliance do
 
   @doc """
   Check for Fuzzing integration.
+
+  Three input shapes accepted:
+
+    * `[file_path, ...]`               — legacy: file-presence check only
+    * `%{files: [...], workflows: %{}}` — enriched: also classify failing
+      sanitizer jobs (`PR (address)` / `PR (undefined)` / `PR (memory)`)
+      by their three most common failure modes:
+        1. sibling-crate missing in Docker fuzz context
+        2. toolchain skew — rustc-1.91-not-supported
+        3. build-script panic
+
+  Returns the legacy list of findings, optionally enriched with one
+  finding per classified sanitizer failure.
   """
-  def check_fuzzing(file_list) do
-    has_fuzzing = Enum.any?(file_list, fn f -> 
-      String.contains?(f, "fuzz") or String.contains?(f, "clusterfuzz")
-    end)
+  def check_fuzzing(input)
+
+  def check_fuzzing(file_list) when is_list(file_list) do
+    has_fuzzing =
+      Enum.any?(file_list, fn f ->
+        String.contains?(f, "fuzz") or String.contains?(f, "clusterfuzz")
+      end)
 
     if has_fuzzing do
       []
     else
-      [%{type: :scorecard_violation, metric: :fuzzing, file: "tests/fuzz/",
-         severity: :medium, detail: "No fuzz testing detected. Consider adding ClusterFuzzLite or similar."}]
+      [
+        %{
+          type: :scorecard_violation,
+          metric: :fuzzing,
+          file: "tests/fuzz/",
+          severity: :medium,
+          detail: "No fuzz testing detected. Consider adding ClusterFuzzLite or similar."
+        }
+      ]
+    end
+  end
+
+  def check_fuzzing(%{files: file_list} = input) when is_list(file_list) do
+    base = check_fuzzing(file_list)
+    workflows = Map.get(input, :workflows, %{})
+    base ++ classify_sanitizer_failures(workflows)
+  end
+
+  def check_fuzzing(_), do: []
+
+  # Pattern set for "PR (address|undefined|memory)" job names emitted by
+  # ClusterFuzzLite's PR-time sanitizer workflows. Each is a Regex that
+  # matches a job name string.
+  @sanitizer_job_patterns [
+    {~r/^PR\s*\(\s*address\s*\)/i, :asan},
+    {~r/^PR\s*\(\s*undefined\s*\)/i, :ubsan},
+    {~r/^PR\s*\(\s*memory\s*\)/i, :msan}
+  ]
+
+  # Failure-mode classifiers ordered most-specific → most-generic.
+  # `log_text` is the captured failure log (job step output) — any string;
+  # we pattern-match for the three known recurring failure modes.
+  defp classify_failure_mode(log_text) when is_binary(log_text) do
+    cond do
+      Regex.match?(
+        ~r/(no matching package|could not find .*Cargo\.toml|sibling crate|workspace member.+not found)/i,
+        log_text
+      ) ->
+        {:sibling_crate_missing,
+         "Sibling crate referenced from fuzz/ is absent from the Docker " <>
+           "build context. Add the missing crate to the fuzz Dockerfile " <>
+           "COPY/workspace or vendor it before invoking cargo fuzz."}
+
+      Regex.match?(
+        ~r/(rustc 1\.9[1-9]|requires rustc.+1\.9[1-9]|not supported.+1\.9[1-9]|toolchain.+1\.9[1-9].+not (?:installed|supported))/i,
+        log_text
+      ) ->
+        {:toolchain_skew_rustc_191,
+         "Toolchain skew: a dependency declares rustc-1.91+, but the fuzz " <>
+           "Docker image ships an older toolchain. Bump the rust-toolchain " <>
+           "file or pin the dependency to a 1.90-compatible version."}
+
+      Regex.match?(~r/(error: failed to run custom build command|build script .+ panicked|panicked at .*build\.rs)/i, log_text) ->
+        {:build_script_panic,
+         "Build-script panic: a transitive crate's `build.rs` crashed " <>
+           "before any fuzz target could be linked. Inspect the panic " <>
+           "message and pin the offending crate."}
+
+      true ->
+        :unknown
     end
   end
 
+  defp classify_failure_mode(_), do: :unknown
+
+  defp classify_sanitizer_failures(workflows) when is_map(workflows) do
+    workflows
+    |> Enum.flat_map(fn {job_name, payload} ->
+      case classify_one_job(job_name, payload) do
+        nil -> []
+        finding -> [finding]
+      end
+    end)
+  end
+
+  defp classify_sanitizer_failures(_), do: []
+
+  defp classify_one_job(job_name, payload) when is_binary(job_name) do
+    matched =
+      Enum.find_value(@sanitizer_job_patterns, nil, fn {re, kind} ->
+        if Regex.match?(re, job_name), do: kind, else: nil
+      end)
+
+    log_text =
+      cond do
+        is_binary(payload) -> payload
+        is_map(payload) -> Map.get(payload, :log, "") |> to_string()
+        true -> ""
+      end
+
+    cond do
+      is_nil(matched) ->
+        nil
+
+      true ->
+        case classify_failure_mode(log_text) do
+          :unknown ->
+            %{
+              type: :scorecard_violation,
+              metric: :fuzzing,
+              sanitizer: matched,
+              job: job_name,
+              severity: :low,
+              classification: :unknown,
+              detail:
+                "Sanitizer job `#{job_name}` failed; failure mode did not " <>
+                  "match any known recurring pattern."
+            }
+
+          {mode, advice} ->
+            %{
+              type: :scorecard_violation,
+              metric: :fuzzing,
+              sanitizer: matched,
+              job: job_name,
+              severity: :medium,
+              classification: mode,
+              detail: advice
+            }
+        end
+    end
+  end
+
+  defp classify_one_job(_, _), do: nil
+
   @doc """
   Check for CII Best Practices badge (or entry point for the badge).
   """

lib/rules/security_errors.ex

@@ -300,7 +300,8 @@ defmodule Hypatia.Rules.SecurityErrors do
     "actions/deploy-pages@v4" => "d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e",
     "ruby/setup-ruby@v1" => "09a7688d3b55cf0e976497ff046b70949eeaccfd",
     "editorconfig-checker/action-editorconfig-checker@main" => "4054fa83a075fdf090bd098bdb1c09aaf64a4169",
-    "hyperpolymath/a2ml-validate-action@main" => "cb3c1e298169dc5ac2b42e257068b0fb5920cd5e",
+    # Bumped 2026-06-01 → 6bff6ec (s-expression form support, panic-attack#94)
+    "hyperpolymath/a2ml-validate-action@main" => "6bff6ec134fc977e86d25166a5c522ddea5c1e78",
     "hyperpolymath/k9-validate-action@main" => "236f0035cc159051c8dd5dc7cd8af1e8cf961462",
     "hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@main" => "21fc3f00a088c954912936f4a68970621b82c2e6"
   }