ci(governance): green the hypatia baseline — adopt #466 + baseline 4 verified false-positives#173
Merged
Conversation
…-scan fix (#466) The last step to turn validate-hypatia-baseline green — honestly. With the estate gate now fully working (standards #455 consult-baseline + #464 filter-runs + #466 clean-scan-tree), re-pinning to standards 412a703 lets the gate see neurophone's true native finding set (no more .standards-checkout tooling pollution). That set had 4 findings not yet in .hypatia-baseline.json, all AUDITED as false-positives at source and baselined here (none blind-baselined): - crates/claude-client/src/egress_gate.rs (secret_detected, CRITICAL) — the unit test `hardcoded_secret_is_blocked_even_in_an_otherwise_allowed_class` asserts the gate BLOCKS the literal placeholder `sk-not-a-real-secret-value`. Not a secret. - audits/audit-install-scripts.adoc (secret_detected, CRITICAL) — this audit doc QUOTES the commented `# api_key = "sk-ant-..."` placeholder to document it as a sound false-positive. Not a secret. - android/README.adoc (SD022) — references gossamer's cross-repo src/interface/ paths. - audits/assail-classifications.a2ml (SD022) — references panic-attack's src/assail/. Both criticals verified at source; both SD022s are cross-repo references with no local drift (same class as the existing docs/BT-PRESENCE-PLAN.adoc entry). Suppression confirmed locally against standards' apply-baseline.sh: all 4 -> kept=0. After this, the scan sees 14 findings (10 prior + these 4), all suppressed, zero pollution -> the gate goes green. Other five standards reusables stay at 7c9db0e. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh
|
hyperpolymath
marked this pull request as ready for review
July 3, 2026 04:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The final step: turn neurophone's long-standing
governance / Validate Hypatia Baselinered green — honestly.With the estate gate now fully repaired (standards #455 consult-baseline + #464 filter-actually-runs + #466 scan-a-clean-tree), this:
governance-reusablef81bb04→412a703(adopts #466's pollution fix — the gate no longer scans the.standards-checkout/tooling).crates/claude-client/src/egress_gate.rshardcoded_secret_is_blocked_even_in_an_otherwise_allowed_classasserts the gate blocks the literal placeholdersk-not-a-real-secret-value. Not a secret.audits/audit-install-scripts.adoc# api_key = "sk-ant-..."placeholder to document it as sound. Not a secret.android/README.adocsrc/interface/…paths (like the existing baselined BT-PRESENCE entry).audits/assail-classifications.a2mlsrc/assail/mod.rs(correct cross-repo reference).Both criticals were read at source and confirmed to be a test fixture and a documentation quote — not real credentials.
Verified before pushing
Ran the 4 native findings through standards'
apply-baseline.shagainst the extended baseline locally:Post-#466 the scan sees 14 findings (10 prior + these 4), all suppressed, zero tooling pollution → the gate goes green for real.
No silent-green
apply-baseline.shkeeps any finding not matched by a baseline entry, so a genuinely-new finding still fails the gate. This only suppresses the four exact, audited entries above. The five other standards reusables stay at7c9db0e.Draft pending the CI confirmation (which is the point — I'll verify the check is finally green).
🤖 Generated with Claude Code
https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh
Generated by Claude Code