security(assail): classify the 4 audited false-positive panic-attack residuals (#166)

## Summary

Makes `panic-attack assail` **provably clean** for neurophone (answers
"is it fully
panic-attacked and safely remediated?" — **yes**).

I built + ran the `panic-attack` tool against neurophone: **9 weak
points, 0 real
vulnerabilities.** 5 `PanicPath` findings are already auto-suppressed
(test/bench code).
The 4 production-script findings are **audited-sound false positives**,
now recorded in
the user-classification registry (which lives apart from the source, so
a finding can't
self-suppress — a reviewable companion change per the panic-attack
pattern):

- `audits/assail-classifications.a2ml`:
- `scripts/{setup,install-on-phone,uninstall}.sh` **PathTraversal** —
the flagged path
is `/data/local/tmp/` (the canonical Android `adb` device-staging dir),
**not** host
    `/tmp`. `mktemp` would be *incorrect* for a device path.
- `scripts/install-termux.sh` **HardcodedSecret** — a **public**
HuggingFace model URL
+ a commented `# api_key = "sk-ant-..."` placeholder in a generated
config template.
    No secret is committed.
- `audits/audit-install-scripts.adoc` — the reviewable rationale,
cross-referenced per entry.

**Verified:** re-ran the built binary → `total weak_points=9,
suppressed=9,
unsuppressed=0`. Production code remains 0 unsafe / 0 panic-sites / 0
injection /
0 crypto-misuse. `must-check` exit 0.

## Note (flagged, not fixed here)
`panic-attack` emits `failed to read AI manifest: extra tokens after
manifest` on
`0-AI-MANIFEST.a2ml` — a minor a2ml-format nuance for a follow-up
(doesn't affect the scan).

This is workstream A of the audit-remediation plan; doc-format fixes,
RSR gaps, wikis,
android tests, and bot docs follow as separate PRs.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh

---
_Generated by [Claude
Code](https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

audits/assail-classifications.a2ml

@@ -0,0 +1,48 @@
+; SPDX-License-Identifier: MPL-2.0
+; assail-classifications.a2ml — user-classification registry for panic-attack.
+;
+; Flips audited-sound findings to `suppressed = true` AFTER the kanren
+; structural-suppression pass (see panic-attack src/assail/mod.rs ::
+; apply_user_classifications). Matching is exact on (file, category). This
+; registry lives apart from the source under scan, so a finding cannot
+; self-suppress — each entry is a reviewable companion change with a rationale
+; cross-referenced to audits/audit-install-scripts.adoc.
+;
+; All entries below are audited false positives; neurophone has 0 real
+; vulnerabilities (production: 0 unsafe, 0 panic sites, 0 injection, 0 crypto
+; misuse). The PanicPath findings are auto-suppressed (test/bench) and need no
+; classification here.
+;
+; The top-level identity/version fields below satisfy the estate a2ml-validate
+; gate (matching a2ml-ecosystem conformance/valid/sectioned-manifest.a2ml);
+; panic-attack's loader ignores everything outside `(classification …)` blocks,
+; so they do not affect suppression.
+
+project = "neurophone"
+schema_version = "1.0.0"
+
+[metadata]
+name = "assail-classifications"
+version = "1.0.0"
+
+(assail-classifications
+  (classification
+    (file "scripts/setup.sh")
+    (category "PathTraversal")
+    (audit "audits/audit-install-scripts.adoc §1")
+    (rationale "Android /data/local/tmp device-staging path (adb), not host /tmp"))
+  (classification
+    (file "scripts/install-on-phone.sh")
+    (category "PathTraversal")
+    (audit "audits/audit-install-scripts.adoc §1")
+    (rationale "adb push target on the device: /data/local/tmp/<model>, not host /tmp"))
+  (classification
+    (file "scripts/uninstall.sh")
+    (category "PathTraversal")
+    (audit "audits/audit-install-scripts.adoc §1")
+    (rationale "adb shell rm of the on-device model at /data/local/tmp, not host /tmp"))
+  (classification
+    (file "scripts/install-termux.sh")
+    (category "HardcodedSecret")
+    (audit "audits/audit-install-scripts.adoc §2")
+    (rationale "public HuggingFace model URL + commented sk-ant placeholder in a config template; no secret")))

audits/audit-install-scripts.adoc

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
+// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+= Audit: install/uninstall shell scripts — panic-attack residuals
+:toc:
+:revdate: 2026-07-01
+
+Companion audit for `audits/assail-classifications.a2ml`. Records why the
+`panic-attack assail` findings in the install/uninstall shell scripts are
+audited-sound false positives, so they may be classified `suppressed` in a
+reviewable, out-of-band way (per the panic-attack user-classification pattern —
+the registry lives apart from the source, so a finding cannot self-suppress).
+
+Scan of record: `panic-attack assail .` — 9 weak points, 0 real vulnerabilities.
+The 5 `PanicPath` findings are already auto-suppressed (test/bench code). The
+four production-script findings below are the audited residuals.
+
+== §1 PathTraversal — Android device-staging paths (not host `/tmp`)
+
+Files: `scripts/setup.sh`, `scripts/install-on-phone.sh`, `scripts/uninstall.sh`.
+
+The detector pattern-matched `/tmp/` inside `/data/local/tmp/`. That is **not**
+the host temp directory — it is the canonical Android **on-device** staging path
+used with `adb push` / `adb shell`, the standard location for pushing a model
+file to a phone:
+
+* `scripts/setup.sh` — an `echo` instruction: `Place in: /data/local/tmp/ on the device`.
+* `scripts/install-on-phone.sh` — `DEVICE_MODEL_PATH="/data/local/tmp/${MODEL_FILE}"`, the `adb push` target on the device.
+* `scripts/uninstall.sh` — `adb shell rm -f /data/local/tmp/llama-…gguf`, removing the model from the device.
+
+There is no host-side symlink/traversal surface here: the path is a device path
+addressed through `adb`, and applying `mktemp` would be **incorrect** (you cannot
+`mktemp` a device path, and `/data/local/tmp/` is the required Android location).
+Classification: audited-sound false positive.
+
+== §2 HardcodedSecret — public URL + commented key template
+
+File: `scripts/install-termux.sh`.
+
+* Line ~19: `MODEL_URL="https://huggingface.co/…/Llama-3.2-1B-Instruct-Q4_K_M.gguf"` — a **public** model download URL, not a secret.
+* The `sk-ant-…` string is a **commented-out placeholder** inside a generated
+  `config.toml` template (`# api_key = "sk-ant-..."   # uncomment + set …`),
+  showing the user where to place *their own* key. No credential is committed.
+
+No secret enters source control (corroborated by the estate secret-scanner gate).
+Classification: audited-sound false positive.