Phase 1: optimization story — vetted wasm-opt pass list + verifier gate (#131)

[hyperpolymath]

Implements #131 (optimization story) — the deliverable's "document" arm — plus a cleanup.

#131 — optimization story

docs/optimization.adoc: optimize with external wasm-opt (Binaryen), use typed-wasm-verify as the invariant oracle. The per-carrier analysis shows the L1–L10 invariants survive optimization iff the typedwasm.* carriers survive — and names the two hazards:

1. custom-section stripping → verification becomes vacuous;
2. function reindexing (inlining / merge / reorder / DAE) → carriers point at the wrong functions.

…with the vetted / excluded / safe pass split that avoids them, and a cleaner long-term alternative (optimize code-only, then attach carriers).

tests/optimization.rs (3 tests): pins both hazards in-repo (carrier presence vs vacuous acceptance; func_idx is load-bearing), plus an end-to-end wasm-opt → tw-verify gate that runs where wasm-opt is on PATH and skips gracefully otherwise (it's absent in this environment).

Cleanup

Added the missing SPDX header to CHANGELOG.md (clears the recurring governance / SessionStart advisory).

Verification (Actions credit exhausted → local)

cargo test --workspace --locked green — codegen 28 + verifier 80; cargo fmt --check + cargo clippy -D warnings clean; no new deps.

The deliverable is "implement passes or document the pass list that preserves L1–L10" — the document arm is complete and its claims are test-pinned, so I'll close #131 on merge. Part of Phase 1 (#49).

https://claude.ai/code/session_01Rq4da8i2uGnDUfanSB1Hx4

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 86 issues detected

Severity	Count
🔴 Critical	1
🟠 High	14
🟡 Medium	71

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in c5-regenerate.yml",
    "type": "missing_timeout_minutes",
    "file": "c5-regenerate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cargo-audit.yml",
    "type": "missing_timeout_minutes",
    "file": "cargo-audit.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence