Merge branch 'main' into docs/readme-hygiene

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 name: CodeQL Security Analysis
 
 on:
@@ -30,7 +30,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          # Repo is pure Rust; CodeQL does not support Rust as a target.
+          # We analyse `actions` (GitHub Actions workflow files) so the
+          # SAST capability still adds value — workflow files are a real
+          # supply-chain surface for this repo.
+          - language: actions
             build-mode: none
 
     steps:

.github/workflows/dogfood-gate.yml

@@ -90,6 +90,19 @@ jobs:
         with:
           path: '.'
           strict: 'false'
+          # Preserves the action's default carve-outs and adds generated/ —
+          # k9iser output in generated/ uses a scaffold dialect that lacks
+          # the K9! magic + pedigree block the validator requires. Track the
+          # generator fix in the k9iser repo, not here.
+          paths-ignore: |
+            vendor/
+            vendored/
+            verified-container-spec/
+            .audittraining/
+            integration/fixtures/
+            test/fixtures/
+            tests/fixtures/
+            generated/
 
       - name: Write summary
         run: |

.github/workflows/secret-scanner.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 # Prevention workflow - scans for hardcoded secrets before they reach main
 name: Secret Scanner
 
@@ -67,9 +67,17 @@ jobs:
             'password.*=.*"[^"]+"'
           )
 
+          # panic-attack is itself a static-analysis tool: src/assail/ and
+          # src/signatures/ contain the secret-detection regexes by design.
+          # Excluding them prevents the scanner from flagging its own pattern
+          # definitions (see hyperpolymath/hypatia#243 — the same fixture-vs-
+          # target carve-out the k9-validate-action documents).
+          EXCLUDE_RE='^src/(assail|signatures)/'
           found=0
           for pattern in "${PATTERNS[@]}"; do
-            if grep -rn --include="*.rs" -E "$pattern" src/; then
+            matches=$(grep -rn --include="*.rs" -E "$pattern" src/ | grep -vE "$EXCLUDE_RE" || true)
+            if [ -n "$matches" ]; then
+              echo "$matches"
               echo "WARNING: Potential hardcoded secret found matching: $pattern"
               found=1
             fi

FUTURE-IMPROVEMENTS.md

@@ -3,8 +3,28 @@
 # Future Improvements: Insights from Scanning the Eclexia Compiler Toolchain
 
 **Date:** 2026-02-08
+**Audit refreshed:** 2026-05-26 (4 of 10 items shipped; status block at top)
 **Author:** Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-**Context:** panic-attack v1.0.0, scanning Eclexia (10 crates, ~20,000 lines of Rust)
+**Context:** panic-attack v1.0.0 at time of scan; current v2.5.0
+
+---
+
+## Status at 2026-05-26
+
+| # | Improvement | Status | Evidence |
+|---|-------------|--------|----------|
+| 1 | Test Code Exclusion | **Shipped** | `Analyzer::strip_cfg_test_modules_rs` — `src/assail/analyzer.rs:923-934`. Applied globally before pattern counting; CLAUDE.md confirms cfg(test) skip behaviour. |
+| 2 | Framework Detection Accuracy | **Shipped** | `Analyzer::detect_frameworks` — `src/assail/analyzer.rs:4993`. Dependency-aware classification supersedes the heuristic-only path that misfired on Eclexia. |
+| 3 | Safe Unwrap Variant Distinction | **Shipped** | `safe_unwrap_calls` field on `ProgramStatistics` (`src/types.rs:518`) and `FileStatistics` (`src/types.rs:451`). Counted but excluded from PA006 (PanicPath) per CLAUDE.md. |
+| 4 | Language-Specific Severity Calibration | Outstanding | No "Hardened" or "Clean" severity tier in `src/types.rs`. Still gated on items 1 + 3 being trustworthy, which they now are. |
+| 5 | Workspace-Level Consolidated Reporting | Outstanding | No Cargo workspace mode in `src/main.rs`. `mass-panic` covers cross-repo but not single-workspace aggregation. |
+| 6 | Differential Scanning | **Shipped** | `Commands::Diff` — `src/main.rs:483`; logic in `src/report/diff.rs`. Listed in ROADMAP v2.2.0 as `[x]`. |
+| 7 | Allocation Site Context and Classification | Outstanding | No `AllocationCategory` enum in `src/types.rs`. Site counts still raw. |
+| 8 | Resource Dimension Awareness for DSLs | Outstanding | Long-term; no plugin-extension surface yet. |
+| 9 | Pattern Detection for Safe Error Handling | Outstanding | No "error handling maturity" metric. |
+| 10 | Configurable Severity Thresholds for CI | Outstanding | No `[thresholds]` parser; no `panic-attack.toml` consumer. Now unblocked because 1, 2, 3 are accurate. |
+
+**Net:** 4/10 shipped (1, 2, 3, 6). Items 4 and 10 are now genuinely unblocked because their stated dependencies (1, 2, 3) have landed; the original "depends on" notes are still accurate but no longer blocking. Items 5, 7, 8, 9 remain as written.
 
 ---
 
@@ -70,7 +90,7 @@ The following observations were made during the Eclexia scan session:
 
 ### 1. Test Code Exclusion
 
-**Priority:** HIGH
+**Priority:** HIGH — **Status: SHIPPED** (`Analyzer::strip_cfg_test_modules_rs`, `src/assail/analyzer.rs:923-934`)
 
 **Problem:** panic-attack counts `unwrap()` and `panic!()` calls inside
 `#[cfg(test)]` modules, `#[test]` functions, and files in `tests/`
@@ -95,7 +115,7 @@ well-tested Rust codebases.
 
 ### 2. Framework Detection Accuracy
 
-**Priority:** HIGH
+**Priority:** HIGH — **Status: SHIPPED** (`Analyzer::detect_frameworks`, `src/assail/analyzer.rs:4993`)
 
 **Problem:** panic-attack reports "WebServer" as the detected framework for
 pure compiler crates with zero I/O operations. This is a misdetection that
@@ -123,7 +143,7 @@ the overall report.
 
 ### 3. Safe Unwrap Variant Distinction
 
-**Priority:** HIGH
+**Priority:** HIGH — **Status: SHIPPED** (`safe_unwrap_calls` field on `ProgramStatistics`/`FileStatistics`, `src/types.rs:451,518`)
 
 **Problem:** The Rust analyzer counts `.unwrap_or(value)`,
 `.unwrap_or_default()`, and `.unwrap_or_else(|| ...)` toward the
@@ -205,7 +225,7 @@ represent the majority of non-trivial Rust codebases.
 
 ### 6. Differential Scanning (Before/After Comparison)
 
-**Priority:** MEDIUM
+**Priority:** MEDIUM — **Status: SHIPPED** (`Commands::Diff`, `src/main.rs:483`; logic in `src/report/diff.rs`)
 
 **Problem:** There is no way to compare two scans to show what improved or
 regressed between them. This limits the tool's usefulness in CI pipelines,

benches/scan_bench.rs

@@ -5,8 +5,9 @@
 //!
 //! Measures: language detection, pattern matching, full analysis pipeline.
 
-use criterion::{black_box, criterion_group, criterion_main, Criterion};
+use criterion::{criterion_group, criterion_main, Criterion};
 use panic_attack::types::Language;
+use std::hint::black_box;
 
 /// Benchmark language detection from file extension
 fn bench_language_detect(c: &mut Criterion) {
@@ -223,6 +224,7 @@ fn bench_statistics_calculation(c: &mut Criterion) {
             unsafe_blocks: 5,
             panic_sites: 0,
             unwrap_calls: 50,
+            safe_unwrap_calls: 0,
             allocation_sites: 12,
             io_operations: 4,
             threading_constructs: 3,

docs/figures/generate_histogram.py

@@ -3966,7 +3966,7 @@ impl Analyzer {
 
             // Detect function definitions
             if line.trim().starts_with("fn ") && !line.trim().starts_with("fn test") {
-                if let Some(func_name) = line.trim().split_whitespace().nth(1) {
+                if let Some(func_name) = line.split_whitespace().nth(1) {
                     let func_name = func_name.split('(').next().unwrap_or(func_name);
                     current_function = func_name.to_string();
                     function_calls
@@ -5174,12 +5174,11 @@ impl Analyzer {
                     }
                 }
 
-                Language::Erlang => {
-                    if content.contains("-behaviour(gen_server)")
-                        || content.contains("-behaviour(supervisor)")
-                    {
-                        frameworks.insert(Framework::OTP);
-                    }
+                Language::Erlang
+                    if (content.contains("-behaviour(gen_server)")
+                        || content.contains("-behaviour(supervisor)")) =>
+                {
+                    frameworks.insert(Framework::OTP);
                 }
 
                 Language::Go => {
@@ -6007,7 +6006,7 @@ func main() {
                     && wp
                         .location
                         .as_deref()
-                        .map_or(false, |loc| loc.contains("node_modules"))
+                        .is_some_and(|loc| loc.contains("node_modules"))
             })
             .collect();
 

src/assail/analyzer.rs

@@ -432,7 +432,7 @@ pub fn run_with_cache(
         .count();
 
     // Sort by weak point count descending (riskiest repos first)
-    results.sort_by(|a, b| b.weak_point_count.cmp(&a.weak_point_count));
+    results.sort_by_key(|r| std::cmp::Reverse(r.weak_point_count));
 
     // Apply filters
     if config.findings_only {

src/assemblyline.rs

@@ -17,10 +17,12 @@ use std::path::Path;
 /// order. All successful parses are merged into a single list. Errors from
 /// individual parsers are logged as warnings and skipped so one malformed
 /// lockfile does not abort triage of the whole project.
+type LockfileParser = fn(&Path) -> Result<Vec<LockedDependency>>;
+
 pub fn discover_and_parse(dir: &Path) -> Vec<LockedDependency> {
     let mut all = Vec::new();
 
-    let candidates: &[(&str, fn(&Path) -> Result<Vec<LockedDependency>>)] = &[
+    let candidates: &[(&str, LockfileParser)] = &[
         ("Cargo.lock", parse_cargo_lock),
         ("mix.lock", parse_mix_lock),
         ("package-lock.json", parse_package_lock_json),
@@ -66,7 +68,7 @@ pub fn parse_cargo_lock(path: &Path) -> Result<Vec<LockedDependency>> {
             if let (Some(name), Some(version)) = (current_name.take(), current_version.take()) {
                 if current_source
                     .as_ref()
-                    .map_or(false, |s| s.contains("registry"))
+                    .is_some_and(|s| s.contains("registry"))
                 {
                     deps.push(LockedDependency {
                         name,
@@ -94,7 +96,7 @@ pub fn parse_cargo_lock(path: &Path) -> Result<Vec<LockedDependency>> {
     if let (Some(name), Some(version)) = (current_name, current_version) {
         if current_source
             .as_ref()
-            .map_or(false, |s| s.contains("registry"))
+            .is_some_and(|s| s.contains("registry"))
         {
             deps.push(LockedDependency {
                 name,

src/bridge/lockfile.rs

@@ -54,7 +54,7 @@ pub fn check_reachability(project_dir: &Path, crate_name: &str) -> Result<Reacha
         }
 
         let path = entry.path();
-        if path.extension().map_or(true, |ext| ext != "rs") {
+        if path.extension().is_none_or(|ext| ext != "rs") {
             continue;
         }