Skip to content

docs: record tech-debt audit findings (2026-05-26)#13

Closed
hyperpolymath wants to merge 1 commit into
mainfrom
claude/tech-debt-2026-05-26
Closed

docs: record tech-debt audit findings (2026-05-26)#13
hyperpolymath wants to merge 1 commit into
mainfrom
claude/tech-debt-2026-05-26

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Summary

  • Adds docs/tech-debt-2026-05-26.md with this repo's findings from the estate-wide tech-debt scan.

Companion estate-wide audits

Records findings only. Closing the debt is follow-up work.

🤖 Generated with Claude Code

Adds docs/tech-debt-2026-05-26.md with this repo's findings from the
estate-wide tech-debt scan: proof debt, licence debt, documentation
debt.

This file records the findings only — it does not close the debt.

Cross-references:
- hyperpolymath/standards#195 (estate proof-debt audit)
- hyperpolymath/standards#196 (estate licence-debt audit)
- hyperpolymath/standards#197 (estate documentation-debt audit)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@hyperpolymath
hyperpolymath deleted the claude/tech-debt-2026-05-26 branch May 26, 2026 12:28
@github-actions

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 57 issues detected

Severity Count
🔴 Critical 2
🟠 High 16
🟡 Medium 39

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "reason": "Merge artifact in root",
    "type": "stale",
    "file": "SPEC.core.scm.orig",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Backup file in root",
    "type": "stale",
    "file": "ECOSYSTEM.scm.bak",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Backup file in root",
    "type": "stale",
    "file": "META.scm.bak",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/phronesis/phronesis/editors/vscode/src/extension.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "binary_to_term without :safe option -- deserialization attack (1 occurrences, CWE-502)",
    "type": "elixir_send_unsanitised",
    "file": "/home/runner/work/phronesis/phronesis/lib/phronesis/compiler.ex",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "sorry leaves proof hole (1 occurrences, CWE-704)",
    "type": "sorry",
    "file": "/home/runner/work/phronesis/phronesis/academic/formal-verification/lean4/Phronesis.lean",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Nickel file missing SPDX-License-Identifier header (1 occurrences, CWE-1104)",
    "type": "ncl_missing_spdx",
    "file": "/home/runner/work/phronesis/phronesis/configs/config.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "Nickel file missing SPDX-License-Identifier header (1 occurrences, CWE-1104)",
    "type": "ncl_missing_spdx",
    "file": "/home/runner/work/phronesis/phronesis/examples/example-package/phronesis.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "Nominal-only SAST in phronesis: codeql.yml language matrix contains no language present in the repo and lacks `actions`, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix to `language: actions`.",
    "type": "StaticAnalysis",
    "file": "/home/runner/work/phronesis/phronesis",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Add CodeQL or equivalent SAST workflow.",
    "scorecard_check": "SAST"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant