From a84525d3224f3772875f51024479d30ba5c5c90d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 7 Nov 2026 16:55:26 +0000 Subject: [PATCH 1/5] Record repaired scanner defects and remaining external review states --- docs/audit/2026-11-07-scanner-follow-up.adoc | 107 +++++++++++++++++++ 1 file changed, 107 insertions(+) create mode 100644 docs/audit/2026-11-07-scanner-follow-up.adoc diff --git a/docs/audit/2026-11-07-scanner-follow-up.adoc b/docs/audit/2026-11-07-scanner-follow-up.adoc new file mode 100644 index 0000000..1d6c91f --- /dev/null +++ b/docs/audit/2026-11-07-scanner-follow-up.adoc @@ -0,0 +1,107 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 += Scanner and review follow-up — 7 November 2026 + +This receipt supplements `2026-11-06-repository-readiness.adoc` and issue #362. +The documentation finding in comment 6691063465 was corrected by #365. +The scanner defects were fixable source and configuration problems, not a +failure of Echo's type theory or a requirement to change the assistant model. +This follow-up does not rerun or expand the earlier Agda proof claims. + +== Revisions and repairs + +Echo input: `ebde9ac4e1a9f115b441c642c82aced1316c5983`. + +PANIC: `f2a6a70eaec0cb02331e3264e05f185b5faab0f7`, incorporating +https://github.com/hyperpolymath/panic-attack/pull/268[268], +https://github.com/hyperpolymath/panic-attack/pull/269[269], +https://github.com/hyperpolymath/panic-attack/pull/270[270] and +https://github.com/hyperpolymath/panic-attack/pull/271[271]. +Eight colon-containing historical filenames were renamed without changing +their Git blobs. A complete native Windows checkout succeeded. Portable-path +CI controls cover reserved devices, superscripts and case/prefix collisions; +ordinary source-archive tests no longer require Git. New report filenames are +portable while timestamps within report contents retain their original format. +Native Rust CI helpers replace policy-prohibited Python helpers. Inventory +producer errors propagate, test identities include their binary, empty runs +cannot claim coverage, and recon reads the actual baseline's metadata without +turning unavailable reports into clean results. + +PONS: `0112b2a407b0fa97190c92f5676aa80ac7048b68`, incorporating +https://github.com/hyperpolymath/pons-asinorum/pull/70[70], +https://github.com/hyperpolymath/pons-asinorum/pull/71[71] and +https://github.com/hyperpolymath/pons-asinorum/pull/72[72]. +The final reviewed source head is +`f8becf2948b310eedd127a0e14a03c51a645a6a0`; it and the merge commit have +the same Git tree, `66e647aacc1111c835d505232e91bb7d654eeacc`. +Its receipt is `tree-sitter 0.27.0 / javascript 0.25.0+jsx-keywords.3`. +The targeted vendored patch preserves modern resource declarations, accepts +JSX keyword attributes/member names, rejects invalid export expressions, and +handles CR and Unicode operator boundaries. Generated files are reproduced +with a digest-pinned generator and HTTPS-only download/redirects. A direct +dependency carries the patch to downstream Git/path consumers; registry +publication is disabled until the patched grammar is separately distributable. + +PONS reports supported parse failures as partial coverage, preserves valid +frozen 0.4.0 reports, and checks portable root-relative evidence paths without +consulting the reader's filesystem. POSIX filename boundaries and in-root +colon names remain distinguishable from escaping/drive-qualified paths. + +== Executed evidence + +* PANIC's final helper follow-up passed ten local test executions and + all-target Clippy with warnings denied. Its PR recorded 56 successful + checks and eleven declared skips before the guarded merge. The wider + migration's checks include native tests, Chapel, Hypatia, governance, + K9/DEED and the executed-test ledger; skipped work is not counted as executed. +* PONS passed 258 native Windows workspace test executions, all-target Clippy, + eight parser regressions, the unchanged upstream 116-parse corpus, and an + independent downstream Cargo consumer. Hosted Linux/Windows and grammar + regeneration checks passed. PR #72 recorded 21 successful checks, one + declared skip and two neutral external checks described below. +* The exact `docs/echo-types/prototypes/warrant_debugger_prototype.jsx` source + now yields one analysed JavaScript file, no findings, no skips and exit 0 + with `--no-speculative --fail-on error --fail-on-skips --require-language javascript`. + Its SHA-256 is + `74131a8f4d9e6941157132c58abfe3c8d6f1e49da314c7655432512f06253672`. +* Scanning the complete Echo input with `--no-speculative --fail-on error` + yields three analysed JavaScript/JSX files, eight existing heuristic + warnings and 21 explicit skips. Exit 0 reflects that severity policy; + overall coverage remains `partial`. Agda remains outside PONS coverage. +* The local JSON receipts have SHA-256 + `b237f17f9edd38d53f25d032064ebfe061efd124c5787dd24b111ab59a3af9de` + (single JSX file) and + `9ecc74686b589b61634f3eaa9438f40c4623b469857984c721842e5316428df0` + (repository). These hashes identify those invocations, including their + local paths and timestamps; they are not claimed as reproducible byte output. + +== External review and remaining configuration + +CodeRabbit and Codex supplied real scoped findings on the scanner changes. +Those findings were addressed through the follow-ups and their review threads +resolved. CodeRabbit's final #72 pass was rate limited and remains neutral; +it is not a fresh approval or retrospective review of the original 138-file +audit. The final PONS source PR currently has no unresolved review threads. + +CodeQL's Rust and Actions analysis jobs passed, but its aggregate PR check is +neutral because the default branch retains an obsolete configuration named +`.github/workflows/codeql.yml:analyze/build-mode:none/language:actions`. +Its last analysis was 16 August 2026; its sole open finding concerns missing +permissions in `.github/workflows/main-estate-audit.yml`, which now declares +`contents: read`. The 15 historical analyses and alert were archived locally. +Retiring that configuration deletes historical security records, so approval +is pending. This warning is not represented as a passing aggregate check. + +The scanner repositories' live Actions allowlists were missing the already +approved standards reusable-workflow pattern. It was appended and read back, +retaining the existing GitHub-owned/verified settings and SHA-pinning policy. +PANIC's separate post-merge mirror job still lacks an approved SourceHut SSH +fingerprint; successful source checks do not establish mirror delivery. + +SMTP remains intentionally dormant with endpoint and egress containment +unchanged. No credentialed delivery, browser execution, service registration, +certification or independent human approval is claimed. Creusot with Pearlite +contracts and Verus remain OPEN/not run for these scanner repairs. Regression +tests and agreement between related scanners are not formal proofs. + +Issue #362 remains open for the external configuration disposition and this +receipt's final review; the original JSX/Windows defects are repaired. From 368dda37dd54662bec3ed3cfa89228395666ae53 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 7 Nov 2026 17:03:33 +0000 Subject: [PATCH 2/5] Record the verified pause of unconfigured PANIC mirrors --- docs/audit/2026-11-07-scanner-follow-up.adoc | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/docs/audit/2026-11-07-scanner-follow-up.adoc b/docs/audit/2026-11-07-scanner-follow-up.adoc index 1d6c91f..ecbfa03 100644 --- a/docs/audit/2026-11-07-scanner-follow-up.adoc +++ b/docs/audit/2026-11-07-scanner-follow-up.adoc @@ -94,8 +94,13 @@ is pending. This warning is not represented as a passing aggregate check. The scanner repositories' live Actions allowlists were missing the already approved standards reusable-workflow pattern. It was appended and read back, retaining the existing GitHub-owned/verified settings and SHA-pinning policy. -PANIC's separate post-merge mirror job still lacks an approved SourceHut SSH -fingerprint; successful source checks do not establish mirror delivery. +PANIC's separate post-merge mirror run exposed five unconfigured destinations. +Following the owner's direction to pause unfinished mirrors, repository flags +for Bitbucket, Codeberg, Disroot, Gitea and SourceHut were set to `false` and +read back. GitLab and Radicle remained enabled after their successful jobs. +The failed-job recheck of run `42388362649`, attempt 2, completed successfully +with the paused destinations dormant. It does not establish delivery to those +five destinations; reactivation still requires approved host/credential setup. SMTP remains intentionally dormant with endpoint and egress containment unchanged. No credentialed delivery, browser execution, service registration, From 7899bba0f53d3d8d0144f363f183662802ef620a Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 7 Nov 2026 17:35:09 +0000 Subject: [PATCH 3/5] Correct source-byte evidence and record the final portability review --- docs/audit/2026-11-07-scanner-follow-up.adoc | 49 +++++++++++++------- 1 file changed, 33 insertions(+), 16 deletions(-) diff --git a/docs/audit/2026-11-07-scanner-follow-up.adoc b/docs/audit/2026-11-07-scanner-follow-up.adoc index ecbfa03..246d904 100644 --- a/docs/audit/2026-11-07-scanner-follow-up.adoc +++ b/docs/audit/2026-11-07-scanner-follow-up.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell = Scanner and review follow-up — 7 November 2026 This receipt supplements `2026-11-06-repository-readiness.adoc` and issue #362. @@ -26,13 +27,14 @@ producer errors propagate, test identities include their binary, empty runs cannot claim coverage, and recon reads the actual baseline's metadata without turning unavailable reports into clean results. -PONS: `0112b2a407b0fa97190c92f5676aa80ac7048b68`, incorporating +PONS tested source: `2350991fd196f49aa1d8afb36dc20483557ff284`, building on https://github.com/hyperpolymath/pons-asinorum/pull/70[70], https://github.com/hyperpolymath/pons-asinorum/pull/71[71] and -https://github.com/hyperpolymath/pons-asinorum/pull/72[72]. -The final reviewed source head is -`f8becf2948b310eedd127a0e14a03c51a645a6a0`; it and the merge commit have -the same Git tree, `66e647aacc1111c835d505232e91bb7d654eeacc`. +https://github.com/hyperpolymath/pons-asinorum/pull/72[72], with the final +path corrections in https://github.com/hyperpolymath/pons-asinorum/pull/73[73]. +The tested source tree is `a39e14eabfcfd7de27c0fa0b76a2edeba5b5b888`. +PR #73 must complete its final review and merge; the previous merged baseline +is `0112b2a407b0fa97190c92f5676aa80ac7048b68`. Its receipt is `tree-sitter 0.27.0 / javascript 0.25.0+jsx-keywords.3`. The targeted vendored patch preserves modern resource declarations, accepts JSX keyword attributes/member names, rejects invalid export expressions, and @@ -43,8 +45,13 @@ publication is disabled until the patched grammar is separately distributable. PONS reports supported parse failures as partial coverage, preserves valid frozen 0.4.0 reports, and checks portable root-relative evidence paths without -consulting the reader's filesystem. POSIX filename boundaries and in-root -colon names remain distinguishable from escaping/drive-qualified paths. +consulting the reader's filesystem. New normal and forced-language CLI scans +and `Engine::scan` use absolute roots. This disambiguates relative POSIX +colon/backslash filenames, and relative Windows directory reports are read +independently of the reader host. POSIX filename boundaries and in-root colon +names remain distinguishable from escaping/drive-qualified paths. Older +intrinsically ambiguous relative single-file roots lack producer-platform +metadata; no universal historical filesystem-identity guarantee is claimed. == Executed evidence @@ -53,7 +60,7 @@ colon names remain distinguishable from escaping/drive-qualified paths. checks and eleven declared skips before the guarded merge. The wider migration's checks include native tests, Chapel, Hypatia, governance, K9/DEED and the executed-test ledger; skipped work is not counted as executed. -* PONS passed 258 native Windows workspace test executions, all-target Clippy, +* PONS passed 260 native Windows workspace test executions, all-target Clippy, eight parser regressions, the unchanged upstream 116-parse corpus, and an independent downstream Cargo consumer. Hosted Linux/Windows and grammar regeneration checks passed. PR #72 recorded 21 successful checks, one @@ -62,25 +69,34 @@ colon names remain distinguishable from escaping/drive-qualified paths. now yields one analysed JavaScript file, no findings, no skips and exit 0 with `--no-speculative --fail-on error --fail-on-skips --require-language javascript`. Its SHA-256 is - `74131a8f4d9e6941157132c58abfe3c8d6f1e49da314c7655432512f06253672`. + `b69afe5842fc9b4b9b0713f92bbcdfc75200d1f4133c69f25efca52b3c4dde99`. + This run used a fresh checkout with automatic CRLF conversion disabled; + the earlier Windows-checkout hash was not the Git blob's byte hash. * Scanning the complete Echo input with `--no-speculative --fail-on error` yields three analysed JavaScript/JSX files, eight existing heuristic warnings and 21 explicit skips. Exit 0 reflects that severity policy; overall coverage remains `partial`. Agda remains outside PONS coverage. * The local JSON receipts have SHA-256 - `b237f17f9edd38d53f25d032064ebfe061efd124c5787dd24b111ab59a3af9de` + `db96a4d67c57215c5a2fc33d597f59a4eb36b660a2d264d037b63d9110e89f3d` (single JSX file) and - `9ecc74686b589b61634f3eaa9438f40c4623b469857984c721842e5316428df0` + `beb0d60dc0a7c67cdc6791c814ed7f63862c3e82cf42ae50499e409f34a39c72` (repository). These hashes identify those invocations, including their local paths and timestamps; they are not claimed as reproducible byte output. == External review and remaining configuration CodeRabbit and Codex supplied real scoped findings on the scanner changes. -Those findings were addressed through the follow-ups and their review threads -resolved. CodeRabbit's final #72 pass was rate limited and remains neutral; +Earlier findings were addressed through the follow-ups. Codex's post-merge +review of #72 identified three additional findings: two relative-path issues +are addressed by #73, and the proposed frozen-format compatibility change +was checked against the actual historical source. Commits `6a20ca7` and +`84f58f9` selected the parent before replacing backslashes, so a POSIX +single-file `/tmp/a\b.py` originally produced `a/b.py`. The current control +preserves that behaviour; a later temporary normalization bug is not adopted +as the 0.4.0 contract. Final #73 review remains required. CodeRabbit's final #72 pass was rate limited and remains neutral; it is not a fresh approval or retrospective review of the original 138-file -audit. The final PONS source PR currently has no unresolved review threads. +audit. The #72 review disposition is therefore recorded explicitly rather than +claiming its post-merge findings never existed. CodeQL's Rust and Actions analysis jobs passed, but its aggregate PR check is neutral because the default branch retains an obsolete configuration named @@ -108,5 +124,6 @@ certification or independent human approval is claimed. Creusot with Pearlite contracts and Verus remain OPEN/not run for these scanner repairs. Regression tests and agreement between related scanners are not formal proofs. -Issue #362 remains open for the external configuration disposition and this -receipt's final review; the original JSX/Windows defects are repaired. +Issue #362 remains open for #73's final review/merge, the external configuration +disposition and this receipt's final review. The original JSX/Windows defects +are repaired. From 36162f61cf9b3d8c6931d0f0b18f2b79a8b23724 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 7 Nov 2026 18:01:41 +0000 Subject: [PATCH 4/5] Pin the validated portable reader and distinguish deployment status --- docs/audit/2026-11-07-scanner-follow-up.adoc | 22 +++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/docs/audit/2026-11-07-scanner-follow-up.adoc b/docs/audit/2026-11-07-scanner-follow-up.adoc index 246d904..334c9be 100644 --- a/docs/audit/2026-11-07-scanner-follow-up.adoc +++ b/docs/audit/2026-11-07-scanner-follow-up.adoc @@ -27,12 +27,12 @@ producer errors propagate, test identities include their binary, empty runs cannot claim coverage, and recon reads the actual baseline's metadata without turning unavailable reports into clean results. -PONS tested source: `2350991fd196f49aa1d8afb36dc20483557ff284`, building on +PONS tested source: `bb4cc76cc17b810098544e11d5da3a583a1a43d9`, building on https://github.com/hyperpolymath/pons-asinorum/pull/70[70], https://github.com/hyperpolymath/pons-asinorum/pull/71[71] and https://github.com/hyperpolymath/pons-asinorum/pull/72[72], with the final path corrections in https://github.com/hyperpolymath/pons-asinorum/pull/73[73]. -The tested source tree is `a39e14eabfcfd7de27c0fa0b76a2edeba5b5b888`. +The tested source tree is `1cd5b93a6a056194ccfc910c1f714dde09b365ae`. PR #73 must complete its final review and merge; the previous merged baseline is `0112b2a407b0fa97190c92f5676aa80ac7048b68`. Its receipt is `tree-sitter 0.27.0 / javascript 0.25.0+jsx-keywords.3`. @@ -49,9 +49,13 @@ consulting the reader's filesystem. New normal and forced-language CLI scans and `Engine::scan` use absolute roots. This disambiguates relative POSIX colon/backslash filenames, and relative Windows directory reports are read independently of the reader host. POSIX filename boundaries and in-root colon -names remain distinguishable from escaping/drive-qualified paths. Older -intrinsically ambiguous relative single-file roots lack producer-platform -metadata; no universal historical filesystem-identity guarantee is claimed. +names remain distinguishable from escaping/drive-qualified paths. For older +ambiguous relative roots, the reader retains both POSIX and Windows +interpretations and requires the record path and semantic fingerprint to +agree on the same one. Native writers retain the historical path behaviour. +Both current and frozen-envelope controls cover these cases and reject mixed +interpretations. Missing producer-platform metadata still prevents a universal +historical filesystem-identity guarantee. == Executed evidence @@ -60,7 +64,7 @@ metadata; no universal historical filesystem-identity guarantee is claimed. checks and eleven declared skips before the guarded merge. The wider migration's checks include native tests, Chapel, Hypatia, governance, K9/DEED and the executed-test ledger; skipped work is not counted as executed. -* PONS passed 260 native Windows workspace test executions, all-target Clippy, +* PONS passed 261 native Windows workspace test executions, all-target Clippy, eight parser regressions, the unchanged upstream 116-parse corpus, and an independent downstream Cargo consumer. Hosted Linux/Windows and grammar regeneration checks passed. PR #72 recorded 21 successful checks, one @@ -81,7 +85,7 @@ metadata; no universal historical filesystem-identity guarantee is claimed. (single JSX file) and `beb0d60dc0a7c67cdc6791c814ed7f63862c3e82cf42ae50499e409f34a39c72` (repository). These hashes identify those invocations, including their - local paths and timestamps; they are not claimed as reproducible byte output. + local path spelling; they are not claimed as portable byte-for-byte output. == External review and remaining configuration @@ -117,6 +121,10 @@ read back. GitLab and Radicle remained enabled after their successful jobs. The failed-job recheck of run `42388362649`, attempt 2, completed successfully with the paused destinations dormant. It does not establish delivery to those five destinations; reactivation still requires approved host/credential setup. +PANIC's separate Pages workflow still times out during its cold Haskell +`casket-ssg` build: run `42388362313` was cancelled at its 20-minute build +limit in both attempts. This deployment workflow was already cancelling on +older source revisions and is not represented as a successful source check. SMTP remains intentionally dormant with endpoint and egress containment unchanged. No credentialed delivery, browser execution, service registration, From c90c01a950596cf9b9208cf793a8591d0b122147 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 7 Nov 2026 18:16:19 +0000 Subject: [PATCH 5/5] Record tested UNC fix and preserve outstanding closure conditions --- docs/audit/2026-11-07-scanner-follow-up.adoc | 22 +++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/docs/audit/2026-11-07-scanner-follow-up.adoc b/docs/audit/2026-11-07-scanner-follow-up.adoc index 334c9be..18a2cda 100644 --- a/docs/audit/2026-11-07-scanner-follow-up.adoc +++ b/docs/audit/2026-11-07-scanner-follow-up.adoc @@ -27,12 +27,12 @@ producer errors propagate, test identities include their binary, empty runs cannot claim coverage, and recon reads the actual baseline's metadata without turning unavailable reports into clean results. -PONS tested source: `bb4cc76cc17b810098544e11d5da3a583a1a43d9`, building on +PONS tested source: `0736865c667870731ef757c66287d136598212f7`, building on https://github.com/hyperpolymath/pons-asinorum/pull/70[70], https://github.com/hyperpolymath/pons-asinorum/pull/71[71] and https://github.com/hyperpolymath/pons-asinorum/pull/72[72], with the final path corrections in https://github.com/hyperpolymath/pons-asinorum/pull/73[73]. -The tested source tree is `1cd5b93a6a056194ccfc910c1f714dde09b365ae`. +The tested source tree is `28d2068a3ce40e67daea50090a175d351e7c56ce`. PR #73 must complete its final review and merge; the previous merged baseline is `0112b2a407b0fa97190c92f5676aa80ac7048b68`. Its receipt is `tree-sitter 0.27.0 / javascript 0.25.0+jsx-keywords.3`. @@ -53,8 +53,9 @@ names remain distinguishable from escaping/drive-qualified paths. For older ambiguous relative roots, the reader retains both POSIX and Windows interpretations and requires the record path and semantic fingerprint to agree on the same one. Native writers retain the historical path behaviour. -Both current and frozen-envelope controls cover these cases and reject mixed -interpretations. Missing producer-platform metadata still prevents a universal +Both current and frozen-envelope controls cover these cases, including +forward-slash UNC roots, and reject mixed interpretations. Missing +producer-platform metadata still prevents a universal historical filesystem-identity guarantee. == Executed evidence @@ -67,8 +68,10 @@ historical filesystem-identity guarantee. * PONS passed 261 native Windows workspace test executions, all-target Clippy, eight parser regressions, the unchanged upstream 116-parse corpus, and an independent downstream Cargo consumer. Hosted Linux/Windows and grammar - regeneration checks passed. PR #72 recorded 21 successful checks, one - declared skip and two neutral external checks described below. + regeneration checks passed. The final UNC correction passed eight contract + tests and three portable-path tests locally. At the recorded #73 revision, + hosted Linux/Windows checks passed: 21 successful checks, one declared skip + and two neutral external checks described below. * The exact `docs/echo-types/prototypes/warrant_debugger_prototype.jsx` source now yields one analysed JavaScript file, no findings, no skips and exit 0 with `--no-speculative --fail-on error --fail-on-skips --require-language javascript`. @@ -97,7 +100,12 @@ was checked against the actual historical source. Commits `6a20ca7` and `84f58f9` selected the parent before replacing backslashes, so a POSIX single-file `/tmp/a\b.py` originally produced `a/b.py`. The current control preserves that behaviour; a later temporary normalization bug is not adopted -as the 0.4.0 contract. Final #73 review remains required. CodeRabbit's final #72 pass was rate limited and remains neutral; +as the 0.4.0 contract. Codex's review of #73 at `bb4cc76` then identified +a forward-slash UNC-root case (`//server/share` with a native Windows child +path) rejected by the reader. The recorded `0736865` source adds the Windows +interpretation and regression controls for both current and frozen reports. +Final #73 review disposition and merge remain required. CodeRabbit's latest +#73 pass was rate limited and remains neutral; it is not a fresh approval or retrospective review of the original 138-file audit. The #72 review disposition is therefore recorded explicitly rather than claiming its post-merge findings never existed.