From 113a1eacdab23fb34460e443322c455d8118e2fc Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 6 Aug 2026 13:51:19 +0100
Subject: [PATCH] chore(hypatia): acknowledge 14 findings in the baseline
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `Validate Hypatia Baseline` gate fails on any finding not acknowledged in
.hypatia-baseline.json, at threshold `info` — so every existing finding blocks
every pull request, including ones that touch none of it.

Ruling: acknowledge the current findings and KEEP the threshold at `info`, so
only NEW findings block from here. That preserves the gate's strictness rather
than lowering the bar estate-wide, and records the debt explicitly instead of
hiding it.

Entries were taken from the gate's own job output — the findings it actually
produced, tagged `baseline_status: "new"` — rather than from a local scanner
that might be a different version. Only those entries are added; findings
already matched by the existing baseline are left alone so their
severity_override values are not lost.

Types covered: SD009, StaticAnalysis, codeql_language_matrix_mismatch, codeql_missing_actions_language, missing_timeout_minutes, secret_action_without_presence_gate.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .hypatia-baseline.json | 84 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 84 insertions(+)

diff --git a/.hypatia-baseline.json b/.hypatia-baseline.json
index 4bcc06c..cc7dd2b 100644
--- a/.hypatia-baseline.json
+++ b/.hypatia-baseline.json
@@ -76,5 +76,89 @@
     "rule_module": "workflow_audit",
     "type": "unsafe_curl_payload",
     "file": "hypatia-scan.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "scorecard",
+    "type": "StaticAnalysis",
+    "file": "."
+  },
+  {
+    "severity": "medium",
+    "rule_module": "structural_drift",
+    "type": "SD009",
+    "file": "ffi/zig/src/main.zig"
+  },
+  {
+    "severity": "high",
+    "rule_module": "workflow_audit",
+    "type": "codeql_language_matrix_mismatch",
+    "file": "codeql.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "codeql_missing_actions_language",
+    "file": "codeql.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "missing_timeout_minutes",
+    "file": "boj-build.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "missing_timeout_minutes",
+    "file": "casket-pages.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "missing_timeout_minutes",
+    "file": "codeql.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "missing_timeout_minutes",
+    "file": "dependabot-automerge.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "missing_timeout_minutes",
+    "file": "dogfood-gate.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "missing_timeout_minutes",
+    "file": "e2e.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "missing_timeout_minutes",
+    "file": "instant-sync.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "missing_timeout_minutes",
+    "file": "push-email-notify.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "missing_timeout_minutes",
+    "file": "release.yml"
+  },
+  {
+    "severity": "high",
+    "rule_module": "workflow_audit",
+    "type": "secret_action_without_presence_gate",
+    "file": "instant-sync.yml"
   }
 ]