security: Track C — panic-attack 2.5.5 category sweep (105 live findings on main)

[hyperpolymath]

Provenance of these numbers

Measured 2026-07-28 against a pristine git archive origin/main export
(14df42270def3a45cc4bb8d4c5c8f4084ec63958, 781 files) with
panic-attack 2.5.5 assail, then cross-referenced every finding against the
(file, category) pairs in audits/assail-classifications.a2ml.

Two measurement notes for whoever re-runs this:

• Export, do not scan the live checkout. Agent worktrees under
  .claude/worktrees/ are inside the repo and get scanned, roughly doubling
  every count.
• assail always exits 0. There is no process::exit, no ExitCode and no
  --fail-on anywhere in panic-attack's 3,132-line src/main.rs, so a green
  Security Scan says nothing about findings. Read the JSON, not the exit code.

Current state

113 raw findings; 105 live after classification.

Severity	Live	Suppressed
Critical	0	2
High	1 → 0 once #201 lands	5
Medium	54	1
Low	50	0

Category	Raw
MutationGap	49
InsecureProtocol	29
PanicPath	16
UnsafeDeserialization	6
ProofDrift	5
CommandInjection	2
HardcodedSecret	2
DynamicCodeExecution	1
PathTraversal	1
SupplyChain	1
UnboundedAllocation	1

The sole live High is connectors/clients/rescript/src/VeriSimVcl.res, live only
because its classification key still reads VeriSimVql.res. #201 fixes that
and takes the repo to 0 live High / 0 live Critical. Everything below is what
remains after that.

P1 — decide, then classify or fix

• CommandInjection ×2 (Medium) — elixir-orchestration/lib/verisim/query/vcl_bridge.ex
  and .../vclt_gate.ex. Both shell out to the parser port. If the invocation
  is an argv vector with no shell interpolation this is a classification, not
  a fix — but it needs someone to actually look, because both sit on the VCL
  execution path. Note vclt_gate.ex is currently called from nowhere in
  production, which is its own open question.
• PathTraversal ×1 (Medium) — scripts/two-node-test.sh hardcodes /tmp/
  without mktemp. Genuine and trivially fixable; predictable temp paths in a
  script that runs in CI are a real symlink-race surface.
• DynamicCodeExecution ×1 (Medium) — dynamic apply/3 in
  elixir-orchestration/lib/verisim/federation/adapters/postgresql.ex. Fine if
  the module/function are compile-time constants; not fine if either is
  reachable from federation config.

P2 — structural, tracked elsewhere

• ProofDrift ×5 (Medium) — formal/Drift.v (9 axioms),
  formal/PlannerSemantic.v (2), formal/Provenance.v (1), formal/Planner.v (1),
  and connectors/clients/julia/test/runtests.jl (29 @test x isa Y
  assertions with no value check — type-only tests that can pass on a wrong value).
  The Coq half is real proof debt and is being worked: optimize_is_permutation
  is dischargeable via Coq.Sorting.Mergesort's axiom-free Permuted_sort.
  The Julia half is a genuine test-quality gap nobody has claimed.
• SupplyChain ×1 (Low) — flake.nix declares inputs with no narHash,
  no rev, and no sibling flake.lock. Worth flagging that this file was added
  on 2026-07-21 (1c0fbedc, chore(governance): land missing docs/packaging before the standards#505 gates bite #187), after the 2026-05-18 estate ruling that
  retired the Nix fallback in favour of Guix, and this repo has never had a
  guix.scm. The supply-chain finding and the packaging-policy question are the
  same item.
• HardcodedSecret ×2 (Critical, both suppressed) — currently classified.
  Re-read the rationales rather than trusting the suppression; these are the only
  two Criticals in the repo.

P3 — bulk, triage as a batch

• MutationGap 49 and InsecureProtocol 29 — 74 of 105 live findings.
  Sample a dozen of each and decide a blanket disposition; do not open 74 threads.

Guard against recurrence

• Add a check that every (file ...) key in audits/assail-classifications.a2ml
  resolves to an existing path. This issue exists because one did not, and a
  rename silently un-suppressed a High for an unknown number of weeks.
  (fix(ci): green the 8-week ClusterFuzzLite red, correct a 2-major-version pin comment, re-key a stale audit path #201 makes all 9 keys resolve today; nothing stops the next rename.)

Successor to #47, which is closed: its ten findings are all dispositioned. These
are categories that issue never covered, surfaced by a newer scanner — they are
not regressions of #47.