chore(security): delete frozen _attic archive; document rsr_check false-positive

Triage of the Hypatia scan on #33: all findings pre-existing/informational (--exit-zero, gate passed), none from the merged PR.

- Delete playground/experiments/_attic (17 retired demo files incl. stray npm package.json + a Julia demo). Clears both placeholder-secret 'criticals' + several highs at the source.
- Clean all dangling _attic refs: deno.json excludes, bot_directives/hypatia.a2ml, .hypatia-ignore, playground README + Justfile (also drops a banned python3 call in a dead recipe).
- Document rsr_check.rs unsafe_block as a verified false-positive (Hypatia matched the RSR checker's own 'unsafe {' detection string) in .hypatia-ignore + hypatia.a2ml.
- STATE.a2ml: record this clean; correct prior 'deleted 2 stale branches' wording (git push --delete returned 403; they remain flagged for UI deletion).

Deferred to a deliberate governance-hardening pass: secret-scanner.yml, scorecard job-perms, curl|sh install hardening.

https://claude.ai/code/session_01BJmfoz1ZS1Pejy9LLMY742

Author: claude

.hypatia-ignore

@@ -12,9 +12,7 @@ web/Main.res:cicd_rules/banned_language_file
 web/MainTest.res:cicd_rules/banned_language_file
 web/Server.res:cicd_rules/banned_language_file
 
-# Frozen archive (playground/experiments/_attic/, see its FROZEN.md): retired
-# demo experiments kept for design lineage, not shipped code. The ArangoDB demo
-# uses a placeholder DB password ("rootpassword"), not a real credential — this
-# is a false-positive that re-fires on every scan. (Disposition keep-frozen vs
-# delete is a checkpoint decision; until then, exempt the false-positive.)
-playground/experiments/_attic/database-demos/arangodb-demo/queries.js:code_safety/js_hardcoded_secret
+# False-positive: rsr_check.rs IS the RSR compliance checker — its "unsafe"
+# matches are string literals in its own detector (it scans other files for the
+# literal `unsafe {`), not real unsafe blocks. No unsafe code exists here.
+crates/jtv-cli/src/rsr_check.rs:code_safety/unsafe_block

.machine_readable/6a2/STATE.a2ml

@@ -7,7 +7,7 @@ project = "julia-the-viper"
 version = "0.0.1"
 last-updated = "2026-06-15"
 status = "active"
-session = "2026-06-15 — bookkeeping/tidying consolidation: lake build green (8 libs, 0 sorry/admit/axiom, 0 vacuity, 0 lint warnings); 4 stray branches resolved (2 stale-merged deleted + codeql weekly->monthly cron folded + estate-standardization salvaged: CODEOWNERS + 17 wiki SPDX headers); ADR-0007 gains the graded-comonad/tropical-grade characterization note; PMPL-1.0 vs MPL-2.0 header discrepancy flagged for governance decision (gap-006); number-system-semantics + v2 (c) bridge remain queued"
+session = "2026-06-15 — bookkeeping/tidying consolidation: lake build green (8 libs, 0 sorry/admit/axiom, 0 vacuity, 0 lint warnings); 4 stray branches resolved (2 stale-merged flagged for UI deletion — git push --delete returned 403 — + codeql weekly->monthly cron folded + estate-standardization salvaged: CODEOWNERS + 17 wiki SPDX headers); ADR-0007 gains the graded-comonad/tropical-grade characterization note; PMPL-1.0 vs MPL-2.0 header discrepancy flagged for governance decision (gap-006); number-system-semantics + v2 (c) bridge remain queued"
 
 [project-context]
 name = "Julia The Viper"
@@ -82,7 +82,8 @@ sessions = [
   { date = "2026-06-13", subject = "PR #26 merged: Lean suite repaired (JtvEcho.neg_injective; orphan JtvExtended wired in → 8 libs); Echo a structural type-system gate over BOTH reverse{} and reversible{}->tok (checked first, before type inference); fixed pre-existing failing reverse-block echo test; root-cause Rust-CI revival (rust-ci/coverage hashFiles-in-job-if startup failure since ~05-27); clippy lint cleared; workflow pins+timeouts; *.jtv/*.pata eol=lf" },
   { date = "2026-06-13", subject = "PR #27 merged: de-vacuated 8 True-typed believeme theorems (string_not_executable, confluence, no_vulnerable_constructs, no_reverse_joinpoints, dataExpr_no_control, data_evaluation_secure, control_data_noninterference, rev_composition) into real compiled statements; NO-VACUITY + Int-only-scope recorded in capability matrix" },
   { date = "2026-06-13", subject = "ADR-0007: addition-only mandate (absolute; ×/÷ generated, not primitive); subtraction = reverse addition (not 2s-complement/not primitive); Harvard-in-von-Neumann AOLD insertability; shortest-path-to-equality + Echo lineage + cross-system routing; additive-algebra → reversibility-tier (group→Safe / cancellative→Neutral / idempotent→Breaking; Echo's own join is idempotent)" },
-  { date = "2026-06-15", subject = "Bookkeeping/tidying consolidation: confirmed lake build green (8 libs); cleared all Lean unused-variable lint warnings (_-prefix); resolved 4 stray remote branches (deleted 2 stale-merged changelog/tech-debt whose content is already on main; folded codeql weekly->monthly cron; salvaged CODEOWNERS + 17 wiki SPDX headers from estate-standardization-20260607, dropped its superseded pre-repair Lean drafts + old contractiles); ADR-0007 graded-comonad/tropical-grade characterization note; flagged PMPL-1.0 vs MPL-2.0 discrepancy (gap-006)" }
+  { date = "2026-06-15", subject = "Bookkeeping/tidying consolidation: confirmed lake build green (8 libs); cleared all Lean unused-variable lint warnings (_-prefix); resolved 4 stray remote branches (flagged 2 stale-merged changelog/tech-debt for UI deletion — content already on main, git 403 blocked programmatic delete; folded codeql weekly->monthly cron; salvaged CODEOWNERS + 17 wiki SPDX headers from estate-standardization-20260607, dropped its superseded pre-repair Lean drafts + old contractiles); ADR-0007 graded-comonad/tropical-grade characterization note; flagged PMPL-1.0 vs MPL-2.0 discrepancy (gap-006)" },
+  { date = "2026-06-15", subject = "Security-hygiene clean (post-#33): triaged the Hypatia 67-finding report — informational (--exit-zero, gate passed), none originating from #33. Added CodeQL actions language; DELETED the frozen playground/experiments/_attic archive (17 files incl. stray npm package.json + a Julia demo), clearing both criticals + several highs at the source, with all dangling refs cleaned (deno.json excludes, bot_directives/hypatia.a2ml, .hypatia-ignore, playground README/Justfile); documented rsr_check.rs unsafe_block as a verified false-positive (Hypatia matched the RSR checker's own detection string). Deferred to a deliberate governance-hardening pass: secret-scanner.yml creation, scorecard job-perms, curl|sh install hardening." }
 ]
 
 [design-artefact-locations]

.machine_readable/bot_directives/hypatia.a2ml

@@ -4,7 +4,7 @@
 
 [metadata]
 repo = "julia-the-viper"
-last-updated = "2026-06-14"
+last-updated = "2026-06-15"
 owner = "hyperpolymath"
 
 [scanner]
@@ -16,13 +16,14 @@ workflow = ".github/workflows/hypatia-scan.yml"
 # ============================================================
 
 [[accepted-findings]]
-rule = "code_safety/js_hardcoded_secret"
-path = "playground/experiments/_attic/database-demos/arangodb-demo/queries.js"
+rule = "code_safety/unsafe_block"
+path = "crates/jtv-cli/src/rsr_check.rs"
 status = "verified-false-positive"
 reason = """
-Placeholder DB password ("rootpassword") in the FROZEN demo archive
-(playground/experiments/_attic/, see its FROZEN.md) — not a real
-credential and not shipped code. Exempted in .hypatia-ignore.
+rsr_check.rs IS the RSR compliance checker; its `unsafe` matches are string
+literals in its own detector (it scans other files for the literal `unsafe {`),
+not real unsafe blocks. No unsafe code exists in this file. Exempted in
+.hypatia-ignore.
 """
 
 [[accepted-findings]]

deno.json

@@ -1,17 +1,11 @@
 {
   "lint": {
-    "exclude": [
-      "playground/experiments/_attic/"
-    ]
+    "exclude": []
   },
   "fmt": {
-    "exclude": [
-      "playground/experiments/_attic/"
-    ]
+    "exclude": []
   },
   "test": {
-    "exclude": [
-      "playground/experiments/_attic/"
-    ]
+    "exclude": []
   }
 }

playground/Justfile

@@ -92,22 +92,6 @@ clean:
     @find . -type f -name "*.pyc" -delete 2>/dev/null || true
     @echo "Clean complete"
 
-# ==============================================================================
-# LEGACY (QUARANTINED - per ANCHOR scope policy)
-# ==============================================================================
-
-# Run legacy algorithm demos (frozen, no expansion)
-_legacy-algorithms:
-    @echo "WARNING: Legacy code (frozen per ANCHOR scope policy)"
-    @echo ""
-    @cd experiments/_attic/algorithms && python3 sorting.py 2>/dev/null || echo "(algorithms not available)"
-
-# List legacy experiments (frozen)
-_legacy-list:
-    @echo "Legacy Experiments (frozen in _attic/):"
-    @echo ""
-    @find experiments/_attic -maxdepth 2 -name "README.md" -exec dirname {} \; 2>/dev/null || echo "  (none)"
-
 # ==============================================================================
 # REPOSITORY MANAGEMENT
 # ==============================================================================
@@ -150,8 +134,8 @@ scope:
     @echo "  - Conformance tests and corpora"
     @echo ""
     @echo "LEGACY QUARANTINE:"
-    @echo "  - All non-JTV experiments in experiments/_attic/"
-    @echo "  - No expansion allowed"
+    @echo "  - Non-JTV experiments removed (formerly in experiments/_attic/)"
+    @echo "  - No new non-JTV experiments allowed"
     @echo ""
     @echo "FORBIDDEN:"
     @echo "  - General polyglot experiments"

playground/README.adoc

@@ -55,7 +55,6 @@ jtv-playground/
 │   ├── tests/corpus/       # Test corpus (valid/invalid)
 │   ├── repl/               # REPL prototype
 │   └── tools/              # Development tools
-├── experiments/_attic/     # Legacy experiments (frozen)
 ├── .machine_read/          # Control plane files
 ├── Justfile                # Command interface
 └── Mustfile                # Mandatory checks
@@ -75,8 +74,8 @@ Per `.machine_read/ANCHOR.scope-arrest.2026-01-01.scm`:
 
 === Legacy (Frozen)
 
-* All non-JTV experiments are in `experiments/_attic/`
-* No new features or expansion permitted
+* Non-JTV experiments have been removed (formerly quarantined in `experiments/_attic/`)
+* No new non-JTV experiments or expansion permitted
 
 === Forbidden