docs: add M2 estate audit report (2026-04-04)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

docs/reports/audit/audit-2026-04-04.md

@@ -0,0 +1,115 @@
+# Audit Report — verisimdb-data (2026-04-04)
+
+## Summary
+
+VeriSimDB Data is a Git-backed flat-file storage repository for scan results and drift detection data. The codebase functions as a data lake/index for other projects' security audit results. It exhibits strong RSR compliance with comprehensive CI/CD automation. This is a data repository, not a runtime codebase, so dangerous pattern concerns are minimal and primarily confined to recipe documentation.
+
+## Findings
+
+### Critical
+
+None identified. This is a data aggregation repo with no runtime execution code.
+
+### High
+
+- **Dangerous pattern references in recipes/registry.json** — Documentation-only references to believe_me, unsafePerformIO, unsafeCoerce patterns from upstream projects
+- These are SCAN RESULTS (not actual code) — patterns documented in registry.json are findings from audited projects
+
+### Medium
+
+- Recipe documentation is comprehensive but only examples/guidance (not executed)
+- Test coverage limited to ingest workflows
+- Drift detection data is time-series snapshots
+
+## RSR Compliance
+
+- **EXPLAINME.adoc**: present ✓
+- **0-AI-MANIFEST.a2ml**: present ✓
+- **.machine_readable/**: present ✓
+- **SECURITY.md**: present ✓
+- **CONTRIBUTING.md**: present ✓
+
+## Test Coverage
+
+VeriSimDB-data has minimal active test code (it's a data repo), but includes:
+
+- **Workflow validation**: ingest.yml (GitHub Actions triggered on workflow_dispatch)
+- **Data schema validation**: JSON validation in ingest workflow
+- **Index consistency**: jekyll.yml, jekyll-gh-pages.yml for documentation builds
+- **CI workflows**: 17 quality, security, and policy enforcement workflows
+
+Test coverage is appropriate for a data repository:
+- recipes/ — Refactoring recipes (documentation, not executable)
+- patterns/registry.json — Scan result index (data, not code)
+- scans/ — Historical scan snapshots (data artifacts)
+- drift/ — Drift detection records (time-series data)
+
+## Proof Debt
+
+**Status: N/A FOR DATA REPO**
+
+This is a **data aggregation repository**, not a proof-bearing codebase. Dangerous patterns found in registry.json are:
+
+1. **Scan result documentation** (from audited upstream repos):
+   - 14 believe_me instances in src/Proven/SafeEmail/Proofs.idr (remote project)
+   - 18 believe_me instances in src/Proven/SafeJWT/Proofs.idr (remote project)
+   - 6 believe_me instances in src/abi/Layout.idr (remote project)
+   - ... (total 87 indexed patterns across 10+ projects)
+
+2. **Recipes** (documentation/guidance):
+   - recipe-remove-believe-me.json — How to eliminate believe_me
+   - recipe-unsafe-type-coercion.json — How to eliminate unsafe casts
+   - These are **guidance documents**, not actual code violations
+
+**Conclusion**: VeriSimDB-data correctly stores and documents dangerous patterns found in OTHER projects' codebase scans. This is the intended use case.
+
+## Publication Safety
+
+**Claim**: "Data aggregation repository for security audit results"
+
+**Evidence**: 
+- registry.json documents patterns from scanned repositories
+- scans/ contains JSON results from panic-attack and other tools
+- Recipes provide remediation guidance (best practices)
+- Index is machine-readable for downstream tool consumption
+
+This is appropriate. The repo transparently documents findings from external audits.
+
+## CI Health
+
+**Status: COMPREHENSIVE**
+
+Active workflows (17 files):
+- ingest.yml — Data ingestion trigger
+- mirror.yml — Git repository mirroring
+- codeql.yml, security-policy.yml — Security scanning
+- quality.yml — Code quality
+- rsr-antipattern.yml — RSR policy enforcement
+- npm-bun-blocker.yml, ts-blocker.yml, guix-nix-policy.yml — Language/tool enforcement
+- scorecard.yml, secret-scanner.yml — Supply chain security
+- jekyll.yml, jekyll-gh-pages.yml — Documentation
+- workflow-linter.yml, wellknown-enforcement.yml — Standards compliance
+- instant-sync.yml — Mirroring
+
+**No failures detected**. All workflows properly configured.
+
+## Verdict
+
+**PUBLISHABLE NOW**
+
+VeriSimDB-data is functioning as intended: a transparent data lake documenting security findings across the estate. The dangerous patterns found in registry.json are **correctly** documented as findings from OTHER projects' scans—not code defects in this repo itself.
+
+Publication is appropriate because:
+1. Data aggregation is the intended use case
+2. Scan results are transparently documented
+3. Remediation recipes are provided
+4. Complete RSR compliance
+5. Comprehensive CI enforcement
+
+The fact that dangerous patterns appear in scans is NOT a defect—it's evidence that the audit pipeline is working correctly.
+
+---
+
+**Audited by**: M2 estate audit (2026-04-04)
+**Confidence**: HIGH
+**Recommendation**: SHIP AS-IS