Skip to content

Commit e4cae83

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
authored
audit: classify 8 FFI/systems unsafe findings as legitimate (PA001/PA007) (#32)
panic-attack assail flags 8 UnsafeCode/UnsafeFFI Critical/High findings under impl/rust-cli/src/, impl/zig/, ffi/rust/src/ — all at the C-ABI / syscall boundary. Rationale: valence-shell is a Unix shell. impl/rust-cli is the Rust shell front-end calling libc::{chown,getpwnam,getgrnam,getpgrp,kill,pipe,WIFSTOPPED} + File::from_raw_fd — required POSIX job-control + permission syscalls. impl/zig is the Zig daemon-client FFI; ffi/rust contains the Rust FFI shim to the Lean-verified core via lean_wrapper.zig. Adds: - audits/assail-classifications.a2ml (entries=8, classification=legitimate-ffi) - audits/audit-ffi-2026-05-26.md Anti-gameability: registry is separate from source under scan; new unsafe inside a classified root requires a companion classification entry. Refs hyperpolymath/panic-attack#32 (estate sweep tracker). Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent 5c062e1 commit e4cae83

2 files changed

Lines changed: 91 additions & 0 deletions

File tree

‎audits/assail-classifications.a2ml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
;; SPDX-License-Identifier: MPL-2.0
2+
;; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
3+
;;
4+
;; Assail Classifications — valence-shell
5+
;; See panic-attack/.claude/CLAUDE.md § "User-Classification Registry".
6+
7+
(assail-classifications
8+
(metadata
9+
(version "1.0.0")
10+
(project "valence-shell")
11+
(last-updated "2026-05-26")
12+
(entries 8)
13+
(status "active"))
14+
15+
(classification
16+
(file "impl/rust-cli/src/process_sub.rs")
17+
(category "UnsafeCode")
18+
(classification "legitimate-ffi")
19+
(audit "audits/audit-ffi-2026-05-26.md")
20+
(rationale "valence-shell is a Unix shell. impl/rust-cli is the Rust shell front-end calling libc::{chown,getpwnam,getgrnam,getpgrp,kill,pipe,WIFSTOPPED} + File::from_raw_fd — required POSIX job-control + permission syscalls. impl/zig is the Zig daemon-client FFI; ffi/rust contains the Rust FFI shim to the Lean-verified core via lean_wrapper.zig."))
21+
(classification
22+
(file "impl/rust-cli/src/external.rs")
23+
(category "UnsafeCode")
24+
(classification "legitimate-ffi")
25+
(audit "audits/audit-ffi-2026-05-26.md")
26+
(rationale "valence-shell is a Unix shell. impl/rust-cli is the Rust shell front-end calling libc::{chown,getpwnam,getgrnam,getpgrp,kill,pipe,WIFSTOPPED} + File::from_raw_fd — required POSIX job-control + permission syscalls. impl/zig is the Zig daemon-client FFI; ffi/rust contains the Rust FFI shim to the Lean-verified core via lean_wrapper.zig."))
27+
(classification
28+
(file "impl/rust-cli/src/commands.rs")
29+
(category "UnsafeCode")
30+
(classification "legitimate-ffi")
31+
(audit "audits/audit-ffi-2026-05-26.md")
32+
(rationale "valence-shell is a Unix shell. impl/rust-cli is the Rust shell front-end calling libc::{chown,getpwnam,getgrnam,getpgrp,kill,pipe,WIFSTOPPED} + File::from_raw_fd — required POSIX job-control + permission syscalls. impl/zig is the Zig daemon-client FFI; ffi/rust contains the Rust FFI shim to the Lean-verified core via lean_wrapper.zig."))
33+
(classification
34+
(file "impl/zig/src/daemon_client.zig")
35+
(category "UnsafeCode")
36+
(classification "legitimate-ffi")
37+
(audit "audits/audit-ffi-2026-05-26.md")
38+
(rationale "valence-shell is a Unix shell. impl/rust-cli is the Rust shell front-end calling libc::{chown,getpwnam,getgrnam,getpgrp,kill,pipe,WIFSTOPPED} + File::from_raw_fd — required POSIX job-control + permission syscalls. impl/zig is the Zig daemon-client FFI; ffi/rust contains the Rust FFI shim to the Lean-verified core via lean_wrapper.zig."))
39+
(classification
40+
(file "impl/zig/src/lib.zig")
41+
(category "UnsafeCode")
42+
(classification "legitimate-ffi")
43+
(audit "audits/audit-ffi-2026-05-26.md")
44+
(rationale "valence-shell is a Unix shell. impl/rust-cli is the Rust shell front-end calling libc::{chown,getpwnam,getgrnam,getpgrp,kill,pipe,WIFSTOPPED} + File::from_raw_fd — required POSIX job-control + permission syscalls. impl/zig is the Zig daemon-client FFI; ffi/rust contains the Rust FFI shim to the Lean-verified core via lean_wrapper.zig."))
45+
(classification
46+
(file "impl/zig/lean_wrapper.zig")
47+
(category "UnsafeCode")
48+
(classification "legitimate-ffi")
49+
(audit "audits/audit-ffi-2026-05-26.md")
50+
(rationale "valence-shell is a Unix shell. impl/rust-cli is the Rust shell front-end calling libc::{chown,getpwnam,getgrnam,getpgrp,kill,pipe,WIFSTOPPED} + File::from_raw_fd — required POSIX job-control + permission syscalls. impl/zig is the Zig daemon-client FFI; ffi/rust contains the Rust FFI shim to the Lean-verified core via lean_wrapper.zig."))
51+
(classification
52+
(file "ffi/rust/src/operations.rs")
53+
(category "UnsafeCode")
54+
(classification "legitimate-ffi")
55+
(audit "audits/audit-ffi-2026-05-26.md")
56+
(rationale "valence-shell is a Unix shell. impl/rust-cli is the Rust shell front-end calling libc::{chown,getpwnam,getgrnam,getpgrp,kill,pipe,WIFSTOPPED} + File::from_raw_fd — required POSIX job-control + permission syscalls. impl/zig is the Zig daemon-client FFI; ffi/rust contains the Rust FFI shim to the Lean-verified core via lean_wrapper.zig."))
57+
(classification
58+
(file "ffi/rust/src/audit.rs")
59+
(category "UnsafeCode")
60+
(classification "legitimate-ffi")
61+
(audit "audits/audit-ffi-2026-05-26.md")
62+
(rationale "valence-shell is a Unix shell. impl/rust-cli is the Rust shell front-end calling libc::{chown,getpwnam,getgrnam,getpgrp,kill,pipe,WIFSTOPPED} + File::from_raw_fd — required POSIX job-control + permission syscalls. impl/zig is the Zig daemon-client FFI; ffi/rust contains the Rust FFI shim to the Lean-verified core via lean_wrapper.zig."))
63+
)

‎audits/audit-ffi-2026-05-26.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<!--
2+
SPDX-License-Identifier: MPL-2.0
3+
Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
4+
-->
5+
6+
# Audit: FFI / systems `unsafe` blocks (valence-shell)
7+
8+
**Auditor**: Jonathan D.A. Jewell
9+
**Date**: 2026-05-26
10+
**Scope**: panic-attack assail Critical/High `UnsafeCode` (PA001) and `UnsafeFFI` (PA007) findings located under: `impl/rust-cli/src/, impl/zig/, ffi/rust/src/`.
11+
**Cross-reference**: campaign tracker [hyperpolymath/panic-attack#32](https://github.com/hyperpolymath/panic-attack/issues/32).
12+
**Registry**: `audits/assail-classifications.a2ml`.
13+
14+
## Rationale
15+
16+
valence-shell is a Unix shell. impl/rust-cli is the Rust shell front-end calling libc::{chown,getpwnam,getgrnam,getpgrp,kill,pipe,WIFSTOPPED} + File::from_raw_fd — required POSIX job-control + permission syscalls. impl/zig is the Zig daemon-client FFI; ffi/rust contains the Rust FFI shim to the Lean-verified core via lean_wrapper.zig.
17+
18+
The classification is scoped to the listed root(s). Any `unsafe` block outside those roots remains visible to assail.
19+
20+
## Anti-gameability
21+
22+
The registry is a separate file from any source under scan; adding a new `unsafe` block inside a classified root requires a companion classification edit and an update to this audit doc, both of which are visible in the diff.
23+
24+
## Verification
25+
26+
Locally on this branch: `panic-attack assail . --headless` reports the listed PA001/PA007 findings as `suppressed: true`. Any new `unsafe` outside the listed roots remains unsuppressed.
27+
28+
Refs hyperpolymath/panic-attack#32.

0 commit comments

Comments
 (0)