Audit follow-up: external reviewer availability and scanner coverage limits

PR #360 records the November 6, 2026 audit and actual executed checks. These external limitations remain explicit rather than being represented as green verification.

CodeRabbit comment 6685429337 skipped the 138-file review against its 100-file limit; account usage availability was also reported. No review approval was obtained. Supported scoped review batches may be used after account availability is established; no paid purchase was authorized by this audit.
Several registered app suites have no completed check runs. Registration alone is not health. Installation inventory returned HTTP 403 for the audit credential. GitGuardian, Semgrep, CodeQL and native Hypatia actual check results are recorded separately.
PANIC source revision 6d3d52a632626109ceef1102a8141b2cfa27fe70 contains tracked historical report filenames with colons that prevent a complete Windows checkout. Scanner source built and the local static scan ran; omitted report files were not claimed as a pristine complete checkout.
PONS revision b9ab55c6973514a731c7659a2fbee21b5037b1ef skipped the JSX prototype with a parser error; Bun parsed/bundled it successfully with dependencies externalized. This is not browser-runtime verification. Agda is outside PONS native coverage; eight remaining banner warnings concern bounded constant-size loops.
SMTP notification is dormant, so no credentialed delivery claim is made. Re-enable only with the configured explicit endpoint and blocking egress policy intact.

Acceptance: obtain real scoped reviewer/app results where applicable; fix owning scanner portability/parser gaps with regression examples; preserve unsupported/not-run states and exact tool revisions. Do not invent service registrations, certifications or independent human approvals to close this issue.

Related: #191 (OpenSSF registration), #330 (historical arena actor authorization), #361 (standards/fleet compatibility). Ordinal work is excluded.

Progress — 7 November 2026

Status checked again for handover on 7 November 2026. This issue remains open; merged PRs do not by themselves establish complete closure.

The linked documentation finding was fixed in Prove finite residue bounds and explicit consumption/measurement contracts #365. The dated scanner receipt Record completed scanner repairs and remaining review configuration #366 has since merged, but its pending-configuration wording is superseded by the update below.
PANIC's Windows checkout, portable report names and native CI-helper repairs are on main through Fix recon's real baseline and simplify ledger verification panic-attack#271, revision f2a6a70eaec0cb02331e3264e05f185b5faab0f7. Five unfinished mirrors are dormant with the owner's authorization; GitLab and Radicle remain enabled. Its separate Pages build still times out at 20 minutes.
PONS's JSX and initial portability repairs are on main through Make scan-root semantics explicit across report producer platforms pons-asinorum#73, revision 612145d805c6ec519d60fc65e406e9c091462848. The exact Echo JSX input scans without findings or skips; the whole input retains partial coverage (3 analysed files, 8 heuristic warnings, 21 skips).
A further review finding on Pillar E primer + related work + estate PMPL→MPL-2.0 sweep (harden integration) #73 remains actionable: component-equivalent paths such as root repo and file repo/./a.php can be written with a key that the reader rejects. The component-parser follow-up is only a local, unpublished candidate. It requires further adversarial review, hosted Linux/Windows checks and a reviewed PR. Do not count it as deployed.
With explicit owner approval, the 15 archived analyses belonging only to obsolete CodeQL category .github/workflows/codeql.yml:analyze/build-mode:none/language:actions were deleted. The active /language:actions and /language:rust configurations were preserved. The old missing-permissions alert is no longer in the open-alert list. Fresh CodeQL run 42400643452, attempt 2, completed successfully for both Actions and Rust after removal. Historical PR check records are not rewritten; no further deletion approval is pending.
CodeRabbit quota limits are not approvals, and the original 138-file audit has not acquired retrospective full app review. The remaining theory: AntiEcho × IsArgmin tropical decomposition #72 review-thread dispositions and Pillar E primer + related work + estate PMPL→MPL-2.0 sweep (harden integration) #73 follow-up must be reconciled against current source, then the receipt updated before closure.

Agda remains outside PONS coverage; SMTP remains intentionally dormant. Creusot with Pearlite contracts and Verus are OPEN/not run for these scanner repairs. Tests and related-tool agreement are not independent formal proofs. Mirror-delivery setup remains separately tracked in #363.

🔗 Related PRs

#366 - Record completed scanner repairs and remaining review configuration [closed]

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

Successfully generated implementation plan.

Use @coderabbitai <feedback> to replan

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

Merged-main follow-up at 007d749ec02b3836b45a2183ebbbaf72935c9d91: Scorecard run 42235492211 succeeded, artifact 13512040203. Both raw and reconciled SARIF contain the same five remaining findings; actions-lock-audit.json is empty. GitHub automatically fixed the sixteen pinning alerts, both token-permission alerts, and CI-test-history alert. No manual dismissals were used.

Remaining bounded obligations:

Alert governance: 6a2/0-AI-MANIFEST.a2ml is not TOML #189, BranchProtection (4): Scorecard requests approvers, CODEOWNERS review and last-push approval. It also reports administrator enforcement absent. Live repository rulesets are active with no bypass actors, so that administrator wording must be compared with the ruleset implementation rather than treated as proof that administrators can bypass. Current canonical Base uses zero required approvals; stronger independent-review policy requires an identified reviewer and an explicit policy change, not a fabricated approval.
Alert Claude/add ordinal notation layer 9qh sf #3, CodeReview (3): 8/23 historical changesets counted as reviewed. Automated checks and agent review are not independent human approval, and history cannot be retroactively manufactured.
Alert E5 scaffolding: Omega markers and Buchholz core modules #5, SAST (9): 22/28 historical commits counted. Actual merged-main CodeQL Actions and JavaScript analyses pass; Agda remains outside CodeQL coverage.
Alert E5: make ν operational and add Buchholz example/smoke modules #6, Fuzzing (0): no recognized fuzzing integration. Add a justified harness for supported executable tooling if warranted; proof checks and negative controls are not advertised as fuzzing.
Alert E3 CNF trichotomy + E4 pedagogical psi least-gap #4, Best Practices (0): real registration remains docs: OpenSSF badge is a registration placeholder #191; no invented badge or identifier.

These findings remain open. PANIC/PONS, native metadata and proof results retain the limitations already recorded in this issue and the audit ledger.

A bounded follow-up review now has concrete evidence: CodeRabbit reviewed the seven-file licensing PR #364 at d0d6ac01e653143a35e4b01724c674fa109a763f (review 5802086120) and found one legacy-scope clarification. That finding is addressed in d401c2f7494d47a22b8790a10df8b612ee2273b5, with baseline evidence in the resolved review thread. CodeRabbit's review of the three-file follow-up was skipped because the free OSS review quota was exhausted; no final-head CodeRabbit approval is claimed. The Codex connector completed final-head code review with no findings (comment 6687864789). This is an automated scoped review, not independent human approval and not retrospective coverage of all files in #360. The remaining coverage and account limitations in this issue stay open.

PR #365 review receipt: CodeRabbit found one documentation scope issue at add94f8. The report now distinguishes CanonicalEcho (Echo/EchoResidue), EchoComparison (Echo), and EpistemicComparison (residual–epistemic, no Echo import), at signed head d968dbc. CodeRabbit automatically resolved its thread. Its subsequent review is rate-limited, so the obsolete change request was dismissed with an explicit rationale; no fresh CodeRabbit approval or independent human review is claimed. Codex completed review of d968dbc with no findings. Required CI remains enforced before merge. This issue remains open for the existing independent-review/scanner coverage obligations.

Prove finite residue bounds and explicit consumption/measurement cont…

Fix Windows checkout paths and prevent non-portable mass-panic reports (

Fix Echo JSX parsing and all-parse-error coverage classification (#69)

Finish Windows portability review controls without Git-dependent Carg…

Finish Echo scanner review with a targeted current-grammar patch (#70)

Replace legacy Python CI helpers with tested Rust equivalents (#270)

Fix recon's real baseline and simplify ledger verification (#271)

Finish scanner review: portable grammar, evidence compatibility and H…

Preserve portable report paths and Unicode JavaScript boundaries (#72)

Make scan-root semantics explicit across report producer platforms (#73)

Record completed scanner repairs and remaining review configuration (#…

Coding Plan

Summary

First establish reproducible, dated evidence: Git ancestry, the executed Rust probe, the writer-to-reader reproducer, the thread dispositions and the CodeQL read-back. Then change the documents.
Fix the PONS defect in its owning repository. The reader must model the writer's component semantics so that existing current and frozen report keys stay valid. Add exact-string regression examples and an adversarial negative control.
Record the results in Echo as an append-only, dated supersession of the 7 November receipt. Correct the per-PR attribution. Keep every unsupported, not-run, neutral and inaccessible state explicit.
Keep #362 open until the follow-up is merged and reviewed. Do not invent approvals, registrations or certifications.

Design Choices

Design Choice 1: How must the Echo repository record evidence that supersedes the merged 7 November receipt?

Options Considered:

Edit the existing receipt paragraphs in place.
Append a dated "Update" section to docs/audit/2026-11-07-scanner-follow-up.adoc. The section states which earlier claims it supersedes and leaves the original text unchanged.
Create a new dated receipt file in docs/audit/ and link it from the old receipt and the index.

Chosen Option: 2

Rationale: The receipt (#366) is merged. The ticket says that its pending-configuration wording is superseded. Repository precedent preserves dated assertions and appends corrections.

It matches the append-only precedent in docs/foundation.adoc and docs/bridges/cross-repo-bridge-status.adoc, and the ticket asks for "the receipt" to be updated. If the update is written on a date later than 7 November, use Option 3 with that date in the file name.

Design Choice 2: Which side of the PONS writer/reader pair must change to fix the component-equivalent path mismatch?

Options Considered:

Change the writer to emit a lexical spelling (./a.php).
Make the reader component-aware, so that each style interpretation (POSIX and Windows) reproduces the writer's component-based remainder.
Add the component-based spelling as an extra reader candidate, and keep the lexical candidate.

Chosen Option: 2

Rationale: The writer emits the Path::strip_prefix remainder. For root repo and file repo/./a.php, the remainder is expected to be a.php, because the Components::as_path trimming removes the interior . component. Phase 1 must confirm this by execution. The reader strips the literal repo/ prefix and produces ./a.php. The record path and the fingerprint input then disagree.

The receipt contract says that native writers retain historical path behaviour, so existing current and frozen reports must keep their keys. Option 3 widens acceptance without a producer that emits the lexical form, and it weakens the rule that requires one interpretation.

Design Choice 3: Which record is authoritative for the status of PONS `#73`?

Options Considered:

Treat the PR page state as authoritative.
Treat Git ancestry in a fresh clone of main as authoritative for "on main". Record the PR page state as an observed, dated, conflicting record.

Chosen Option: 2

Rationale: The web evidence conflicts. The #73 PR page still shows "open" with commits 2350991 and bb4cc76. The CodeQL run 42400643452 shows 612145d on main, with parent 0112b2a, which is the #72 merge.

Ancestry is reproducible. The receipt must not claim a PR-merge disposition that the PR record does not show.

Design Choice 4: How must the receipt treat the CodeRabbit review gap for the original 138-file audit?

Options Considered:

Split the merged audit into artificial review PRs of 100 files or fewer.
Approve paid on-demand review.
Record the retrospective review as "not obtained". Use only in-quota @coderabbitai review requests on the new PONS follow-up PR.

Chosen Option: 3

Rationale: CodeRabbit has no documented file-batch command. On-demand review of a large PR needs approval for paid usage, and the audit did not authorise that.

It satisfies "obtain real scoped reviewer/app results where applicable" and does not invent approvals or authorise purchases.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Re-establish current evidence without assuming deployment

Collect reproducible, dated evidence for every claim in the ticket's 7 November progress note before changing documents. All steps are read-only for the Echo checkout. Record the tool, revision, command, result and access limits for each step.

Task 1: Task 1.1: Confirm PONS and PANIC revisions on `main`

Establish exactly which scanner source is on main and how it relates to the tested source in the receipt.

In a fresh clone of hyperpolymath/pons-asinorum, verify that 612145d805c6ec519d60fc65e406e9c091462848 is an ancestor of main. Record its tree identifier and its parent (0112b2a…).
Compare that tree with the tested tree 28d2068a3ce40e67daea50090a175d351e7c56ce from the receipt.
- If the trees are equal, the recorded JSX and whole-input scan results apply to main.
- If the trees differ, rescan the Echo input at the current Echo HEAD. Use the exact single-file command with --no-speculative --fail-on error --fail-on-skips --require-language javascript, and the whole-input command with --no-speculative --fail-on error. Record the complete command lines, which the earlier receipt omitted.
Record the observed #73 PR page state with its date as a conflicting record. Do not state that #73 "merged" as a PR.
In a fresh clone of hyperpolymath/panic-attack, confirm that f2a6a70eaec0cb02331e3264e05f185b5faab0f7 is the #271 merge on main. Confirm that it contains #268, #269 and #270.

Task 2: Task 1.2: Reproduce the component-equivalent path defect

Turn the ticket's report into an executed reproducer at the main revision.

Run the minimal Rust probe for Path::new("repo/./a.php").strip_prefix("repo") in a scratch directory outside the Echo checkout. Use installed rustc 1.99.1 on x86_64-unknown-linux-gnu. Record the as_os_str() bytes and the debug output. Do not use Path equality.
At 612145d, drive a complete evidence-bearing report through the writer and the validator:
- Use report::fixture::report(), evidence::contract, or an explicit scan_files call with root label repo.
- Validate with report::validate::validate for the current 0.5.0 schema and for the frozen 0.4.0 projection.
Record the serialised record path, the reader candidates, the error text and which check rejects the report: record-path equality or fingerprint recomputation.
Probe the nearby variants derived from the source: repo/./sub/a.php, repo//a.php, a trailing repo/., and the Windows-style repo\.\a.php. Record each one as reproduced or not reproduced.

Task 3: Task 1.3: Reconcile `#72` and `#73` review threads against current source

Give each review thread an individual disposition. The earlier receipt did not provide these dispositions.

Use an authorised credential to list the review threads on #72 and #73 with their resolution state, author and commit.
Map each thread to one disposition at 612145d:
- addressed in source, with the regression test name;
- checked and not adopted, with the reason, for example the frozen-format proposal and /tmp/a\b.py;
- still open.
Classify the forward-slash UNC-root finding at bb4cc76. Classify the component-equivalent finding as open until Phase 2 merges.
If threads or pages cannot be retrieved, record them as inaccessible. Do not treat a missing record as resolved.

Task 4: Task 1.4: Read back CodeQL, app-suite and reviewer state

Verify the owner-reported CodeQL clean-up and the reviewer and app status. Do not invent results.

Use an authorised credential to list the code-scanning analyses for pons-asinorum. Confirm that no analyses remain in category .github/workflows/codeql.yml:analyze/build-mode:none/language:actions. Confirm that /language:actions and /language:rust remain.
List the open alerts. Confirm that the main-estate-audit.yml missing-permissions alert is absent.
Record run 42400643452, attempt 2, with its repository, revision 612145d, conclusion and job names.
Record the deletion approval as owner-reported. Do not record it as independently verified unless an audit-log record is available.
Try the installation inventory and the check-suite listing for the relevant heads again. If the request returns HTTP 403 again, record the 403 unchanged.
Record the latest CodeRabbit state on #73 as rate-limited or neutral. Record that state as not approval.

Prompt to implement phase

Collect dated, reproducible evidence before changing the Echo documents. Keep
the Echo checkout read-only during this phase.

- In fresh scanner clones, verify PONS ancestry, tree and parent, and the PANIC
#271 merge and its contents. Compare the PONS tree with the receipt's tested
tree. If the trees differ, run the specified single-file and whole-input scans
at current Echo HEAD and record complete commands.
- Record the dated, conflicting #73 PR page state without claiming a PR merge.
- Run the specified Rust `strip_prefix` probe outside the Echo checkout. At
`612145d`, reproduce writer-to-validator behaviour for current and frozen
reports and the listed path variants. Record exact strings, bytes, candidates,
errors and rejecting checks.
- Retrieve and individually classify the #72 and #73 review threads. Record
inaccessible records as inaccessible.
- Read back CodeQL analyses, alerts and run 42400643452 attempt 2. Record
owner-reported approval separately from independently verified evidence. Retry
the app inventory and check-suite listings, and record the CodeRabbit state
without treating it as approval.
- For each cited scan or test, record the full command line, tool version and
revision or tree. Record sources, dates and access limits for external statuses.
Do not count skips, neutral checks or registrations as execution. Do not request
deletions of security records.

Phase 2: Repair the PONS component-equivalent path defect upstream

Fix the parser and reader gap in the owning repository, pons-asinorum. Add regression examples and take the fix through hosted checks and review. Use the existing unpublished local candidate as input. The candidate does not count as deployed until this phase merges it.

Task 1: Task 2.1: Make reader path candidates component-aware

Make the reader derive each style candidate with the same component semantics as the writer.

In crates/pons-core/src/evidence.rs, replace the literal string-prefix strip in path_for_style with a component-prefix strip for each style.
- Model Rust Components: skip interior . components, collapse repeated separators, keep .., and keep a leading . only where Rust keeps it.
- Then slash-normalise the remainder, as relative_path does.
Preserve the existing special cases unchanged:
- the parent base when the file equals the root;
- the drive and UNC roots as Windows;
- the absolute POSIX roots as POSIX;
- the /tmp/a\b.py → a/b.py historical behaviour;
- the forward-slash UNC root with a Windows child.
Keep the path_candidates rule that de-duplicates candidates. Keep the rule in crates/pons-core/src/report/validate.rs that requires the record path and the fingerprint to agree on one interpretation. Do not change validate.rs unless the Task 1.2 reproducer shows a second check at fault.
Do not change relative_path, corroborate::semantic_fingerprint or the frozen 0.4.0 schema.

Task 2: Task 2.2: Add regression examples for current and frozen reports

Make the defect and its variants permanent controls.

Extend the portable_paths unit tests in crates/pons-core/src/evidence.rs with the Task 1.2 cases: repo + repo/./a.php, repo/./sub/a.php, repo//a.php, and repo\.\a.php under Windows interpretation. Assert that the writer output equals the reader candidate as an exact string.
Add a writer-to-reader contract test in crates/pons-cli/tests/contracts.rs. Keep a relative root label repo. Validate both the current 0.5.0 report and its frozen 0.4.0 projection.
Keep the existing controls green:
- ambiguous_legacy_paths_require_one_consistent_record_and_fingerprint;
- a_forged_corroboration_key_is_rejected;
- a_relative_windows_report_validates_on_every_reader_host;
- the UNC and colon/backslash coverage tests.
Add one adversarial negative control. Reject a record that uses ./a.php while the fingerprint uses a.php, or the reverse.

Task 3: Task 2.3: Publish, review and merge the follow-up

Turn the local candidate into reviewed, hosted evidence.

Open a focused PR in pons-asinorum that references #73's finding and Echo #362. Use Conventional Commits, DCO sign-off and signed commits.
Require the hosted Linux and Windows checks to pass. Request in-quota Codex and @coderabbitai review reviews. Do not approve paid usage.
Dispose of each new review thread individually before the merge.
Update docs/echo-362-verification.adoc in pons-asinorum with the reproducer and its result.
After the merge, record the merge revision and tree. Rescan the Echo JSX input and the whole Echo input with the exact commands from Task 1.1.
State that Creusot/Pearlite and Verus remain OPEN/not run. State that the tests are not formal proofs.

Prompt to implement phase

Repair the component-equivalent path defect in `pons-asinorum` and take the
follow-up through hosted review and merge. Use the unpublished local candidate
as input, but do not treat it as deployed before merge.

- In `crates/pons-core/src/evidence.rs`, make `path_for_style` strip component
prefixes for each path style using the specified Rust `Components` semantics.
Slash-normalise the remainder. Preserve all listed root, UNC and historical
backslash special cases and candidate de-duplication.
- Preserve the validator's single-interpretation rule. Change
`crates/pons-core/src/report/validate.rs` only if Task 1.2 shows a second check
at fault. Do not change `relative_path`, `corroborate::semantic_fingerprint` or
the frozen 0.4.0 schema.
- Extend `portable_paths` with the specified exact-string cases. Add current and
frozen writer-to-reader contract tests with root `repo` and an adversarial
mismatched-path negative control. Keep the named existing controls green.
- Record the reproducer and result in `docs/echo-362-verification.adoc`. Open
the focused signed, DCO-compliant PR with the specified references. Require
hosted Linux and Windows checks, request in-quota reviews, and dispose of each
new thread before merge. Do not approve paid CodeRabbit usage.
- After merge, record the revision and tree and rescan the Echo JSX and whole
inputs with the Task 1.1 commands. Record the full command lines, tool versions
and revisions or trees for cited tests and scans. Keep Creusot/Pearlite and
Verus OPEN/not run, and do not describe the tests as formal proofs.

Phase 3: Update the Echo audit record

Write the verified evidence into the tracked Echo receipt and index without altering historical text. Make a first pass after Phase 1 and mark the component follow-up "open, not deployed". Make the final pass after Phase 2 merges.

Task 1: Task 3.1: Append a dated supersession section to the scanner receipt

Record the newer evidence and identify exactly which earlier claims it supersedes.

Append a dated "Update" section to docs/audit/2026-11-07-scanner-follow-up.adoc. Leave lines 1–145 unchanged. Preserve the existing SPDX notice.
Use the existing issue → evidence → disposition layout. Include these rows:
- PANIC attribution per PR: #268 renames eight colon-named reports and adds portable Chapel report names. #269 adds the Windows checkout controls and the fresh full checkout. #270 replaces the Python helpers with native Rust helpers. #271 is the recon and ledger follow-up, merged as f2a6a70. Keep 56 successful checks and 11 declared skips. Keep the mirror pauses, tracked in #363, and the Pages timeout as unresolved.
- PONS main revision: 612145d, with the ancestry and tree comparison from Task 1.1. Record the conflicting PR page state.
- Component-equivalent path defect: the reproducer from Task 1.2. Record the Phase 2 status as open, or as merged with its revision.
- Individual #72 and #73 thread dispositions from Task 1.3.
- CodeQL: supersede "approval is pending" in receipt lines 113–120. Record deletion of the obsolete category as owner-approved and owner-reported. Record the read-back of the preserved categories and the alert state. Record run 42400643452, attempt 2, with its result. State that historical PR check records were not rewritten.
Keep these states explicit:
- the CodeRabbit retrospective review is not obtained, and quota limits are not approvals;
- the app suites have no completed runs, and the inventory returns 403 unless a read-back succeeded;
- Agda is outside PONS coverage;
- SMTP is dormant;
- Creusot/Pearlite and Verus are OPEN/not run;
- no independent human approval is claimed.
End with a status statement. Issue #362 stays open until the component follow-up merges and the update receives its final review.

Task 2: Task 3.2: Link the receipt from the audit index

Make the 7 November receipt and its update discoverable.

Add an entry to docs/AUDIT.adoc in the existing link:audit/…adoc[…] style. Give a short scope description: the scanner follow-up and its dated update apply to their stated revisions and limits.
If the update uses a new dated file under the Assumption 1 fallback, add an entry for that file too. Add a forward link from the 7 November receipt.

Task 3: Task 3.3: Verify the documentation change and report status on `#362`

Check the Echo change and communicate the bounded result.

Run sh scripts/verify.sh, or at least just guard, on the changed revision. Keep stdout and stderr. In the PR description, state that the change is documentation only and that no Agda proof claims change.
Open a focused Echo PR with Conventional Commits, DCO sign-off and signed commits.
Post a dated comment on #362 that lists the remaining closure criteria. Close #362 only when the component follow-up is merged with hosted checks, all threads have a disposition, and the receipt update has received its final review.

Prompt to implement phase

Record the verified evidence in an append-only Echo audit update and make the
receipt discoverable. Make the first pass after Phase 1 with the component
follow-up marked open and not deployed; make the final pass after Phase 2
merges.

- Append the dated supersession section to
`docs/audit/2026-11-07-scanner-follow-up.adoc`, preserving lines 1–145 and the
SPDX notice. If the update is written later than 7 November, use the new dated
file fallback in Assumption 1 and link it from the original receipt and index.
- Follow the issue → evidence → disposition layout. Include the specified PANIC
per-PR attribution, PONS ancestry and conflicting PR state, component reproducer
and status, individual review-thread dispositions, and CodeQL read-back.
Identify the pending-approval wording that the CodeQL evidence supersedes.
- Preserve the specified unresolved, unsupported, inaccessible, neutral and
not-run states. Do not claim approval, deployment, a merge or a pass without a
retrieved record. Keep #362 open until the stated closure criteria are met.
- Add the receipt entry to `docs/AUDIT.adoc` in the existing link style. Include
the dated file entry when the fallback is used. Do not change the excluded Echo
files.
- Run `sh scripts/verify.sh`, or at least `just guard`, and retain stdout and
stderr. Record the full command line, tool version and revision or tree for
cited tests. Open the focused signed, DCO-compliant Echo PR with the
documentation-only and Agda-proof statements. Post a dated #362 comment with the
remaining closure criteria.

Research

Ticket Summary

Close the remaining evidence gaps for Echo issue #362. Repair and review the PONS component-equivalent path defect in the owning scanner repository. The root is repo and the file is repo/./a.php. Then append a dated, evidence-bounded update to the 7 November 2026 scanner receipt. The update must supersede the pending-configuration wording, correct the PANIC and PONS attribution, and preserve all unsupported and not-run states.

Codebase Summary

Echo Types is an Agda proof library. It invokes PANIC (panic-attack) and PONS (pons-asinorum) as external executables through just panic and just pons. This checkout contains no scanner source or scanner tests.

The authoritative audit records are dated AsciiDoc receipts in docs/audit/:

2026-11-06-repository-readiness.adoc
2026-11-06-evidence.adoc
2026-11-06-research-cycle.adoc
2026-11-07-scanner-follow-up.adoc

docs/AUDIT.adoc is the navigation index. It does not link the 7 November receipt. The receipts follow an issue → evidence → disposition pattern. They record exact revisions, flags, counts, skips and limits. They keep "configured", "skipped", "neutral" and "not run" separate from "passed".

The PONS defect is in two places upstream in pons-asinorum:

crates/pons-core/src/evidence.rs contains the writer relative_path, which uses native Path::strip_prefix. It also contains the reader helpers path_for_style and path_candidates, which use literal string-prefix stripping.
crates/pons-core/src/report/validate.rs contains validate_value, which checks record-path equality and semantic fingerprints.

Existing contract tests are in crates/pons-cli/tests/contracts.rs and crates/pons-cli/tests/coverage.rs.

File-level change summary

Echo Types (this repository)

docs/audit/2026-11-07-scanner-follow-up.adoc: append a dated supersession section only. Do not edit the earlier text.
docs/AUDIT.adoc: add an index entry for the 7 November receipt. Also add an entry for a new dated file if one is used.
Exclude CHANGELOG.adoc, Agda sources, workflows (codeql.yml, push-email-notify.yml) and Justfile. No library-visible or configuration change is needed.

pons-asinorum (external repository)

crates/pons-core/src/evidence.rs: make path_for_style component-aware. Add portable_paths regression tests.
crates/pons-cli/tests/contracts.rs: add the writer-to-reader test for current and frozen reports. Use a relative repo root and an adversarial negative control.
docs/echo-362-verification.adoc: record the reproducer and its result.
crates/pons-core/src/report/validate.rs: change only if Task 1.2 shows that a second check is at fault.

Instructions for follow-up agents

Treat every external status as dated evidence. Record the source, date and access limit for each status.
Do not write "merged", "approved", "deployed" or "passed" unless a retrieved record shows that state.
Record inaccessible records as inaccessible. Do not record them as negative results or as resolved.
Do not approve paid CodeRabbit usage. Do not request deletions of security records.
Record the full command line, tool version and revision or tree for every scan or test that you cite.
Do not count skips, neutral checks or registrations as execution.

🚀 Next Steps

Prompt to implement full plan

Task: 1

Collect dated, reproducible evidence before changing the Echo documents. Keep
the Echo checkout read-only during this phase.

- In fresh scanner clones, verify PONS ancestry, tree and parent, and the PANIC
#271 merge and its contents. Compare the PONS tree with the receipt's tested
tree. If the trees differ, run the specified single-file and whole-input scans
at current Echo HEAD and record complete commands.
- Record the dated, conflicting #73 PR page state without claiming a PR merge.
- Run the specified Rust `strip_prefix` probe outside the Echo checkout. At
`612145d`, reproduce writer-to-validator behaviour for current and frozen
reports and the listed path variants. Record exact strings, bytes, candidates,
errors and rejecting checks.
- Retrieve and individually classify the #72 and #73 review threads. Record
inaccessible records as inaccessible.
- Read back CodeQL analyses, alerts and run 42400643452 attempt 2. Record
owner-reported approval separately from independently verified evidence. Retry
the app inventory and check-suite listings, and record the CodeRabbit state
without treating it as approval.
- For each cited scan or test, record the full command line, tool version and
revision or tree. Record sources, dates and access limits for external statuses.
Do not count skips, neutral checks or registrations as execution. Do not request
deletions of security records.
===============================================================================

Task: 2

Repair the component-equivalent path defect in `pons-asinorum` and take the
follow-up through hosted review and merge. Use the unpublished local candidate
as input, but do not treat it as deployed before merge.

- In `crates/pons-core/src/evidence.rs`, make `path_for_style` strip component
prefixes for each path style using the specified Rust `Components` semantics.
Slash-normalise the remainder. Preserve all listed root, UNC and historical
backslash special cases and candidate de-duplication.
- Preserve the validator's single-interpretation rule. Change
`crates/pons-core/src/report/validate.rs` only if Task 1.2 shows a second check
at fault. Do not change `relative_path`, `corroborate::semantic_fingerprint` or
the frozen 0.4.0 schema.
- Extend `portable_paths` with the specified exact-string cases. Add current and
frozen writer-to-reader contract tests with root `repo` and an adversarial
mismatched-path negative control. Keep the named existing controls green.
- Record the reproducer and result in `docs/echo-362-verification.adoc`. Open
the focused signed, DCO-compliant PR with the specified references. Require
hosted Linux and Windows checks, request in-quota reviews, and dispose of each
new thread before merge. Do not approve paid CodeRabbit usage.
- After merge, record the revision and tree and rescan the Echo JSX and whole
inputs with the Task 1.1 commands. Record the full command lines, tool versions
and revisions or trees for cited tests and scans. Keep Creusot/Pearlite and
Verus OPEN/not run, and do not describe the tests as formal proofs.
===============================================================================

Task: 3

Record the verified evidence in an append-only Echo audit update and make the
receipt discoverable. Make the first pass after Phase 1 with the component
follow-up marked open and not deployed; make the final pass after Phase 2
merges.

- Append the dated supersession section to
`docs/audit/2026-11-07-scanner-follow-up.adoc`, preserving lines 1–145 and the
SPDX notice. If the update is written later than 7 November, use the new dated
file fallback in Assumption 1 and link it from the original receipt and index.
- Follow the issue → evidence → disposition layout. Include the specified PANIC
per-PR attribution, PONS ancestry and conflicting PR state, component reproducer
and status, individual review-thread dispositions, and CodeQL read-back.
Identify the pending-approval wording that the CodeQL evidence supersedes.
- Preserve the specified unresolved, unsupported, inaccessible, neutral and
not-run states. Do not claim approval, deployment, a merge or a pass without a
retrieved record. Keep #362 open until the stated closure criteria are met.
- Add the receipt entry to `docs/AUDIT.adoc` in the existing link style. Include
the dated file entry when the fallback is used. Do not change the excluded Echo
files.
- Run `sh scripts/verify.sh`, or at least `just guard`, and retain stdout and
stderr. Record the full command line, tool version and revision or tree for
cited tests. Open the focused signed, DCO-compliant Echo PR with the
documentation-only and Agda-proof statements. Post a dated #362 comment with the
remaining closure criteria.

💡 Iterate on the plan with: @coderabbitai <feedback>

Example Feedback
- @coderabbitai You can skip phase 3. Add a simple unit test case for phase 2.
- @coderabbitai For design choice 1 go ahead with option 3 and replan.

Start Coding →

Navigation Menu

Repository navigation

Audit follow-up: external reviewer availability and scanner coverage limits #362

Progress — 7 November 2026

Coding Plan

Summary

Implementation Steps

Phase 1: Re-establish current evidence without assuming deployment

Phase 2: Repair the PONS component-equivalent path defect upstream

Phase 3: Update the Echo audit record

Ticket Summary

Codebase Summary

File-level change summary

Instructions for follow-up agents

🚀 Next Steps

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Audit follow-up: external reviewer availability and scanner coverage limits #362

Description

Progress — 7 November 2026

Activity

coderabbitai commented on Nov 6, 2026

hyperpolymath commented on Nov 6, 2026

hyperpolymath commented on Nov 6, 2026

hyperpolymath commented on Nov 6, 2026

coderabbitai commented on Nov 7, 2026

Coding Plan

Summary

Implementation Steps

Phase 1: Re-establish current evidence without assuming deployment

Phase 2: Repair the PONS component-equivalent path defect upstream

Phase 3: Update the Echo audit record

Ticket Summary

Codebase Summary

File-level change summary

Instructions for follow-up agents

🚀 Next Steps

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions