chore: audit-remediation batch — panic/unsafe, CI test-gating + coverage, doc drift (#154)

## What & why

Closes the short list of low-risk fixes surfaced by the repo audit.
Everything Rust-side is **verified locally**: `cargo build` + `cargo
clippy` clean on the touched files (modulo one pre-existing `parser.rs`
`let_and_return` lint that only the newest clippy flags — not in this
diff), **766 tests pass** in `impl/rust-cli` + **24** in `ffi/rust`, **0
failures**.

### 1. Panic-safety & `unsafe` (`impl/rust-cli/src`, `ffi/rust/src`)
- Removed the **3 startup panics**: `enhanced_repl.rs` (history file,
Ctrl-C handler) and `repl.rs` (Ctrl-C handler) now **degrade
gracefully** — warn + fall back to in-memory history / default Ctrl-C
behaviour — instead of `.expect()`-aborting the shell on a degraded
environment (e.g. read-only `$HOME`).
- Added `// SAFETY:` comments to the **4 previously-undocumented
`unsafe` libc blocks** (`audit.rs` `getuid`; `operations.rs` +
`commands.rs` ×2 `chown`). Also clears the matching Hypatia
`code_safety` findings.

### 2. CI (`rust-cli.yml`)
- **Gate the full suite**: the `test` job previously ran only 3 of ~18
suites (`--lib`, one integration suite, `property_tests`). Now runs
`cargo test` (all suites + doctests) plus a dedicated `ffi/rust` step —
so every test that passes locally is enforced on push.
- **New `coverage` job** using `cargo-llvm-cov` (self-contained; all
actions SHA-pinned to the versions already used in the repo). Runs the
suite under instrumentation, writes the summary to the job summary, and
uploads `lcov.info`. **Measured/reported, not a hard gate** — closes the
"coverage is unmeasured" gap without a brittle threshold.

### 3. Docs / metadata drift
- `security.txt`: fixed the **RFC 9116 §2.5.3 `Canonical`** URL — was a
non-served `github.com/.../.well-known/...` blob path; now the served
`raw.githubusercontent.com` location (Pages only publishes the README,
so `.well-known` isn't served there).
- `README.adoc`: added a **"Run the shell (Rust CLI)"** section as the
*first* install step — the front door previously only documented
compiling the six proof systems, not how to `cargo build`/run the actual
shell.
- `0-AI-MANIFEST.a2ml` + `6a2/STATE.a2ml`: **reconciled counts to
measured reality** — `idris2-holes 22 → 0` (closed in #152),
`tests-passing 757 → 766`, source files `32 → 33`, LoC `21331 → 22574`,
`last-updated → 2026-07-01`. The manifest had been contradicting its own
authoritative `docs/PROOF_HOLES_AUDIT.md`.

## Verification
```
cd impl/rust-cli && cargo build && cargo test        # 766 pass / 0 fail / 14 ignored
cd ffi/rust && cargo test                            # 24 pass / 0 fail
python3 -c "import glob,yaml; [yaml.safe_load(open(f)) for f in glob.glob('.github/workflows/*.yml')]"  # all parse
```

## Not included (deliberately out of scope)
The larger audit items — missing marketer/journalist + lay-person docs
and a real audience-segmented wiki, the ABI/FFI consolidation (C NIF /
Rust `ffi/rust` / ReScript MCP not being Zig), the absent launcher, and
the RSR template/`RSR_COMPLIANCE.md` inflation — are each their own
scoped pass, not smuggled into this hygiene batch.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01KfgJznd6jzSeDYsSXGAXkU

---
_Generated by [Claude
Code](https://claude.ai/code/session_01KfgJznd6jzSeDYsSXGAXkU)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/rust-cli.yml

@@ -42,17 +42,13 @@ jobs:
         working-directory: impl/rust-cli
         run: cargo clippy --all-targets --all-features -- -D warnings
 
-      - name: Run unit tests
+      - name: Run all tests (unit + every integration suite + doctests)
         working-directory: impl/rust-cli
-        run: cargo test --lib --verbose
+        run: cargo test --verbose
 
-      - name: Run integration tests
-        working-directory: impl/rust-cli
-        run: cargo test --test integration_test --verbose
-
-      - name: Run property tests
-        working-directory: impl/rust-cli
-        run: cargo test --test property_tests --verbose
+      - name: Run ffi/rust tests
+        working-directory: ffi/rust
+        run: cargo test --verbose
 
       - name: Build release binary
         working-directory: impl/rust-cli
@@ -98,3 +94,44 @@ jobs:
           SORRY_COUNT=$(grep -r "sorry" *.lean | wc -l || echo "0")
           echo "Found $SORRY_COUNT sorry placeholders in proofs"
           # Note: Some sorry placeholders are expected during development
+
+  coverage:
+    name: Code coverage (llvm-cov)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b  # stable
+        with:
+          components: llvm-tools-preview
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@baf1a810e98b6a3001d0d7234864ed75a17c42fb  # v2
+        with:
+          workspaces: impl/rust-cli
+
+      - name: Install cargo-llvm-cov
+        run: cargo install cargo-llvm-cov --locked
+
+      - name: Measure coverage (impl/rust-cli)
+        working-directory: impl/rust-cli
+        run: |
+          # Run the full suite once under instrumentation, then emit reports.
+          # Measured and surfaced as a regression signal — not a hard gate.
+          cargo llvm-cov --no-report
+          cargo llvm-cov report --lcov --output-path lcov.info
+          {
+            echo '### Coverage — impl/rust-cli'
+            echo '```'
+            cargo llvm-cov report --summary-only
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload coverage (lcov)
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
+        with:
+          name: coverage-lcov
+          path: impl/rust-cli/lcov.info

.machine_readable/6a2/STATE.a2ml

@@ -6,7 +6,7 @@
 [metadata]
 project = "valence-shell"
 version = "0.9.0"
-last-updated = "2026-06-02"
+last-updated = "2026-07-01"
 status = "active"
 
 [project-context]
@@ -17,6 +17,23 @@ bridge-status = "documentation-and-orientation-only (echo-types + ochrance; NOT
 bridge-doc = "docs/ECHO-TYPES-OCHRANCE-BRIDGE.adoc"
 bridge-a2ml = ".machine_readable/ECHO_TYPES_OCHRANCE_BRIDGE.a2ml"
 
+[recent-work-2026-07-01]
+session = "2026-07-01 — Idris2 proof-hole closure at the root + CI hardening + drift reconcile"
+focus = "Close all Idris2 ABI proof holes; harden CI workflows; reconcile machine-readable counts to measured reality"
+prs-merged-2026-07-01 = [
+  "#152 proofs(idris2): close ALL proof holes — 17 -> 0, zero new axioms, builds under --total (root of #151)",
+  "#153 ci: workflow hardening — timeout caps, pinned+SHA256-verified elan, CodeQL js/ts -> actions, presence-gate instant-sync dispatch"
+]
+idris2-holes = 0
+idris2-axioms = 2
+tests-passing = 766
+tests-ignored = 14
+tests-failing = 0
+ffi-rust-tests = 24
+rust-source-files = 33
+rust-loc = 22574
+note = "idris2-holes 22 -> 0 (via #152) supersedes the 2026-06-02 tallies below; older dated test totals (703/757/764) are historical snapshots, not current claims."
+
 [recent-work-2026-06-02]
 session = "2026-06-02 morning + afternoon sweep — inbox cleanup + root-cause main fixes"
 focus = "Clear governance reds inherited by 4 open PRs; LICENSE SPDX prepend; annotate 4 admits in rmo_operations.v; Idris2 0.8.0 keyword/parse fixes"

.well-known/security.txt

@@ -5,5 +5,5 @@
 Contact: mailto:j.d.a.jewell@open.ac.uk
 Expires: 2027-03-08T23:59:59.000Z
 Preferred-Languages: en
-Canonical: https://github.com/hyperpolymath/valence-shell/.well-known/security.txt
+Canonical: https://raw.githubusercontent.com/hyperpolymath/valence-shell/main/.well-known/security.txt
 Policy: https://github.com/hyperpolymath/valence-shell/blob/main/SECURITY.md

0-AI-MANIFEST.a2ml

@@ -10,7 +10,7 @@ project = "valence-shell"
 version = "0.9.0"
 status = "Advanced research prototype — NOT production-ready"
 license = "MPL-2.0"
-last-updated = "2026-06-02"
+last-updated = "2026-07-01"
 
 # What this project IS — one-line summary; for the full statement read
 # .machine_readable/INTENT.contractile (the load-bearing artefact).
@@ -38,16 +38,16 @@ deep-audit-log-dir   = "docs/audits/"
 latest-deep-audit    = "docs/audits/2026-06-01-deep-audit.adoc"
 
 [counts-as-of-last-audit]
-# Per docs/audits/2026-06-01-deep-audit.adoc + issue #42 + 2026-06-02 sweep.
+# Per docs/audits/2026-06-01-deep-audit.adoc + issue #42 + measured 2026-07-01.
 theorem-candidates       = 478
 proof-systems            = 6
 coq-admits-remaining     = 3       # #56 + #57 + #58 (3 surfaced post-#55)
 coq-axioms-justified     = 1       # is_empty_dir_dec
-idris2-holes-remaining   = 22      # was 21 + 8 partial; now 22 holes + 0 partial post-PRs #105/#108/#109/#115
+idris2-holes-remaining   = 0       # all closed 2026-07-01 (#152); builds under --total, 2 registered primitive-eq axioms
 idris2-partial-markers   = 0       # cleared 2026-06-02
-rust-source-files        = 32
-rust-loc                 = 21331
-tests-passing            = 757     # +21 via PR #72 (2026-06-01)
+rust-source-files        = 33      # measured 2026-07-01 (impl/rust-cli/src)
+rust-loc                 = 22574   # measured 2026-07-01 (impl/rust-cli/src)
+tests-passing            = 766     # measured 2026-07-01 (impl/rust-cli); +24 in ffi/rust
 tests-ignored            = 14
 tests-failing            = 0
 fuzz-targets             = 7

README.adoc

@@ -117,7 +117,24 @@ Nix (recommended)
 
 === Installation
 
-==== With Nix (Recommended)
+==== Run the shell (Rust CLI) — the primary deliverable
+
+The interactive shell lives in `impl/rust-cli/` and only needs a Rust toolchain
+(1.88+). The proof systems below are optional — they are needed only to
+re-check the formal proofs, not to build or run the shell.
+
+[source,bash]
+----
+git clone https://github.com/Hyperpolymath/valence-shell.git
+cd valence-shell/impl/rust-cli
+
+cargo build --release           # builds the `vsh` binary
+cargo run                       # start the interactive shell
+./target/release/vsh --version  # or run the release binary directly
+cargo test                      # run the test suite (766 passing)
+----
+
+==== With Nix (proof systems)
 
 [source,bash]
 ----

ffi/rust/src/audit.rs

@@ -134,6 +134,8 @@ impl AuditLog {
             hash: String::new(),
             pid: std::process::id(),
             #[cfg(unix)]
+            // SAFETY: `getuid` takes no arguments, cannot fail, and only reads
+            // the calling process's real UID — no pointers or invariants.
             uid: unsafe { libc::getuid() },
             result,
             proof_ref: proof_ref.map(String::from),

ffi/rust/src/operations.rs

@@ -271,6 +271,10 @@ pub fn chown(path: &Path, uid: Option<u32>, gid: Option<u32>) -> FfiResult<()> {
     let uid = uid.map(|u| u as libc::uid_t).unwrap_or(u32::MAX as libc::uid_t);
     let gid = gid.map(|g| g as libc::gid_t).unwrap_or(u32::MAX as libc::gid_t);
 
+    // SAFETY: `path_cstr` is a valid, NUL-terminated `CString` that outlives
+    // this call, so `as_ptr()` is a live pointer for the call's duration;
+    // `uid`/`gid` are plain integers. `chown` only borrows the pointer and
+    // returns a status code we check below.
     let result = unsafe { libc::chown(path_cstr.as_ptr(), uid, gid) };
 
     if result != 0 {

impl/rust-cli/src/commands.rs

@@ -1000,6 +1000,10 @@ pub fn undo(state: &mut ShellState, count: usize, verbose: bool) -> Result<()> {
                     let gid: u32 = parts[1].parse().context("Invalid gid")?;
                     let c_path = std::ffi::CString::new(path.to_str().context("Invalid path")?)
                         .context("Path contains null bytes")?;
+                    // SAFETY: `c_path` is a valid, NUL-terminated `CString` that
+                    // outlives the call, so `as_ptr()` is live; `uid`/`gid` are
+                    // plain integers. `chown` only borrows the pointer and
+                    // returns a status code we check below.
                     let ret = unsafe { libc::chown(c_path.as_ptr(), uid, gid) };
                     if ret != 0 {
                         let err = std::io::Error::last_os_error();
@@ -1523,6 +1527,11 @@ pub fn rollback_transaction(state: &mut ShellState) -> Result<()> {
                                 let gid: u32 = parts[1].parse().context("Invalid gid")?;
                                 let c_path = std::ffi::CString::new(path.to_str().unwrap_or(""))
                                     .context("Path contains null bytes")?;
+                                // SAFETY: `c_path` is a valid, NUL-terminated
+                                // `CString` that outlives the call, so `as_ptr()`
+                                // is live; `uid`/`gid` are plain integers. `chown`
+                                // only borrows the pointer and returns a status
+                                // code we check below.
                                 let ret = unsafe { libc::chown(c_path.as_ptr(), uid, gid) };
                                 if ret != 0 {
                                     Err(anyhow::anyhow!(

impl/rust-cli/src/enhanced_repl.rs

@@ -246,10 +246,6 @@ pub fn run(state: &mut ShellState) -> Result<()> {
         .unwrap_or_else(|| PathBuf::from("/tmp"))
         .join(".vsh_history");
 
-    let history = Box::new(
-        FileBackedHistory::with_file(1000, history_file).expect("Failed to initialize history"),
-    );
-
     // Set up completion menu
     let completion_menu = Box::new(ColumnarMenu::default().with_name("completion_menu"));
 
@@ -268,7 +264,6 @@ pub fn run(state: &mut ShellState) -> Result<()> {
 
     // Create reedline instance
     let mut line_editor = Reedline::create()
-        .with_history(history)
         .with_completer(Box::new(VshCompleter))
         .with_highlighter(Box::new(VshHighlighter::new()))
         .with_hinter(Box::new(
@@ -278,11 +273,20 @@ pub fn run(state: &mut ShellState) -> Result<()> {
         .with_edit_mode(edit_mode)
         .with_menu(ReedlineMenu::EngineCompleter(completion_menu));
 
-    // Install SIGINT handler
-    ctrlc::set_handler(move || {
+    // Attach a file-backed history if it opens; otherwise fall back to
+    // reedline's in-memory history instead of aborting the shell.
+    match FileBackedHistory::with_file(1000, history_file) {
+        Ok(h) => line_editor = line_editor.with_history(Box::new(h)),
+        Err(e) => eprintln!("vsh: warning: history disabled ({e}); using in-memory history"),
+    }
+
+    // Install SIGINT handler; a failure only means Ctrl-C keeps its default
+    // behaviour, so warn and continue rather than panicking.
+    if let Err(e) = ctrlc::set_handler(move || {
         signals::request_interrupt();
-    })
-    .expect("Error setting Ctrl-C handler");
+    }) {
+        eprintln!("vsh: warning: could not install Ctrl-C handler ({e})");
+    }
 
     let mut accumulated_input = String::new();
 

impl/rust-cli/src/repl.rs

@@ -43,11 +43,13 @@ use crate::state::ShellState;
 /// # Ok::<(), anyhow::Error>(())
 /// ```
 pub fn run(state: &mut ShellState) -> Result<()> {
-    // Install SIGINT handler for graceful Ctrl+C handling
-    ctrlc::set_handler(move || {
+    // Install SIGINT handler for graceful Ctrl+C handling; a failure only
+    // means Ctrl-C keeps its default behaviour, so warn and continue.
+    if let Err(e) = ctrlc::set_handler(move || {
         signals::request_interrupt();
-    })
-    .expect("Error setting Ctrl-C handler");
+    }) {
+        eprintln!("vsh: warning: could not install Ctrl-C handler ({e})");
+    }
 
     let stdin = io::stdin();
     let mut stdout = io::stdout();