From a0679d9d50f61b6cc68b8974a360edff6ca615ae Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 3 Jul 2026 04:01:48 +0000 Subject: [PATCH] ci(governance): baseline 4 verified false-positives + adopt the clean-scan fix (#466) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The last step to turn validate-hypatia-baseline green — honestly. With the estate gate now fully working (standards #455 consult-baseline + #464 filter-runs + #466 clean-scan-tree), re-pinning to standards 412a703 lets the gate see neurophone's true native finding set (no more .standards-checkout tooling pollution). That set had 4 findings not yet in .hypatia-baseline.json, all AUDITED as false-positives at source and baselined here (none blind-baselined): - crates/claude-client/src/egress_gate.rs (secret_detected, CRITICAL) — the unit test `hardcoded_secret_is_blocked_even_in_an_otherwise_allowed_class` asserts the gate BLOCKS the literal placeholder `sk-not-a-real-secret-value`. Not a secret. - audits/audit-install-scripts.adoc (secret_detected, CRITICAL) — this audit doc QUOTES the commented `# api_key = "sk-ant-..."` placeholder to document it as a sound false-positive. Not a secret. - android/README.adoc (SD022) — references gossamer's cross-repo src/interface/ paths. - audits/assail-classifications.a2ml (SD022) — references panic-attack's src/assail/. Both criticals verified at source; both SD022s are cross-repo references with no local drift (same class as the existing docs/BT-PRESENCE-PLAN.adoc entry). Suppression confirmed locally against standards' apply-baseline.sh: all 4 -> kept=0. After this, the scan sees 14 findings (10 prior + these 4), all suppressed, zero pollution -> the gate goes green. Other five standards reusables stay at 7c9db0e. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh --- .github/workflows/governance.yml | 2 +- .hypatia-baseline.json | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 33 insertions(+), 1 deletion(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 88d52b9..623d08d 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -31,4 +31,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@f81bb0453ab7fda0cea94127d3855f83968fb9e8 # bumped 2026-07-03: standards#455 wired apply-baseline.sh into validate-hypatia-baseline AND #464 fixed it actually running (the #455 wire-in aborted under `bash -e` on the scan's exit-on-findings before the filter ran). Other standards reusables intentionally left at 7c9db0e. + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@412a7031577112b31ee287cc6060179d638d6500 # bumped 2026-07-03: standards #455 (baseline consulted) + #464 (filter runs under bash -e) + #466 (scan a clean caller tree, not the .standards-checkout tooling). Other standards reusables intentionally left at 7c9db0e. diff --git a/.hypatia-baseline.json b/.hypatia-baseline.json index 8b4e247..873ae1f 100644 --- a/.hypatia-baseline.json +++ b/.hypatia-baseline.json @@ -41,5 +41,37 @@ "type": "GS007", "file": ".", "note": "Operational/transient, not a code defect: this repo has an active multi-branch workflow (feature branches, workstream branches from parallel agent sessions) and the non-main remote branch count fluctuates by the hour as branches are opened and merged/deleted. Baselining the rule itself rather than a point-in-time count; do not read a specific branch-count number into this entry. Owner should periodically review `git branch -r` and delete fully-merged branches, but that is a routine housekeeping call, not something this baseline should force. Same uppercase-`type` schema caveat as the SD022 entry above (\"GS007\" vs `^[a-z][a-z0-9_]*$`)." + }, + { + "severity": "critical", + "rule_module": "security_errors", + "type": "secret_detected", + "file": "crates/claude-client/src/egress_gate.rs", + "note": "Audited false positive -- NOT a real secret. The unit test `hardcoded_secret_is_blocked_even_in_an_otherwise_allowed_class` (line 292) uses the literal placeholder `api_key = \"sk-not-a-real-secret-value\"` as its fixture, asserting the egress gate BLOCKS a hardcoded-secret pattern regardless of declared class. The string literally reads 'sk-not-a-real-secret-value'; no credential is committed (corroborated by the estate secret-scanner gate, which is green). Verified at source 2026-07-03. hypatia's Generic-API-key regex cannot distinguish a test/demo placeholder from a real key. First flagged in #168; baselined here. Same absolute-path caveat as the code_safety entries above -- the finding is matched on its repo-relative file after the gate relativises hypatia's output.", + "tracking_issue": null + }, + { + "severity": "critical", + "rule_module": "security_errors", + "type": "secret_detected", + "file": "audits/audit-install-scripts.adoc", + "note": "Audited false positive -- NOT a real secret. This audit document (introduced in #166) QUOTES the commented-out placeholder `# api_key = \"sk-ant-...\"` from scripts/install-termux.sh (around line 41) precisely to record it as an audited-sound false positive; the `sk-ant-...` is a literal ellipsis placeholder showing users where their OWN key goes, not a committed credential. hypatia's Generic-API-key regex matches the quoted example. Verified at source 2026-07-03.", + "tracking_issue": null + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "android/README.adoc", + "note": "Cross-repo reference, not local drift. The gossamer-migration README (introduced in #167 / epic #83) references gossamer's own `src/interface/abi/Types.idr` and `src/interface/ffi/src/main.zig` (around lines 96 and 119) when describing gossamer's Zig/Idris2 core -- those paths live in the sibling `gossamer` repo, not here. SD022's rename-drift heuristic has no cross-repo awareness, so it flags any `src//` it cannot resolve locally. Same class as the docs/BT-PRESENCE-PLAN.adoc entry. Uppercase-`type` schema caveat applies (\"SD022\" vs `^[a-z][a-z0-9_]*$`). Verified at source 2026-07-03.", + "tracking_issue": null + }, + { + "severity": "medium", + "rule_module": "structural_drift", + "type": "SD022", + "file": "audits/assail-classifications.a2ml", + "note": "Cross-repo reference, not local drift. This classification file (introduced in #166) references `panic-attack src/assail/mod.rs` (line 5) -- the analyzer module in the sibling `panic-attack` repo that produces these classifications -- not a path that exists (or ever existed) in neurophone. SD022 has no cross-repo awareness. Same class as the docs/BT-PRESENCE-PLAN.adoc and android/README.adoc entries. Uppercase-`type` schema caveat applies. Verified at source 2026-07-03.", + "tracking_issue": null } ]