audit: classify Track C panic-attack findings (#138)

[hyperpolymath]

Summary

Triages all 8 panic-attack Track C findings from the 2026-05-26 estate sweep. Creates `audits/assail-classifications.a2ml` (ephapax did not yet have this audit registry — sister boj-server has had one since the FFI sweep #154 / #155).

File:line	Category	Classification	Why
flake.nix	SupplyChain	legitimate-template-scaffold	Dormant placeholder flake (`{project-description}`, `REMINDER:`), no workflow consumes it. Pinning before activation is premature — activate-then-pin should be one PR.
ephapax-package/src/registry.rs:98	UnboundedAllocation	legitimate-user-config-file	Reads local registry index — user's own `.ephapax/registry/index.json`
ephapax-package/src/registry.rs:261	UnboundedAllocation	legitimate-local-hash-walk	Inside `compute_directory_hash`; reads files this process just wrote to disk
ephapax-package/src/manifest.rs:130	UnboundedAllocation	legitimate-user-manifest	Reads user's own `ephapax.toml`
ephapax-repl/src/lib.rs:170	UnboundedAllocation	legitimate-repl-load-command	REPL `:load ` — interactive user input
ephapax-cli/src/main.rs:245 (+ 257, 327)	UnboundedAllocation	legitimate-cli-arg-path	CLI arg path read; standard CLI tool pattern
ephapax-cli/src/import_resolver.rs:125 (+ 195)	UnboundedAllocation	legitimate-project-source	Import resolver reading project source files
ephapax-tools/src/formatter.rs:311 (+ documenter.rs:211)	UnboundedAllocation	legitimate-cli-source-input	`ephapax fmt` / `ephapax doc` reading user-supplied paths

Sister-issue parallelism

Same template + vocabulary as boj-server#155 (merged 2026-06-01 11:31Z) so cross-repo audit summaries read fluently. Same trust-boundary reasoning ports cleanly:

• `legitimate-user-config-file` (registry.rs:98) ≈ `legitimate-user-config-file` (tray/src/server.rs:130 in boj-server#155)
• The flake.nix branch in both — but boj-server's flake.lock IS present (`legitimate-flake-lock-pinned`) while ephapax's flake.nix is template-scaffold (`legitimate-template-scaffold`).

Test plan

• String-aware paren balance check on the new a2ml file (62 = 62)
• CI parses the new file (whatever a2ml-validation workflow ephapax runs)
• Spot-check each cited line in the live source

Closes#138
Refs hyperpolymath/panic-attack#32, hyperpolymath/boj-server#155

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 71 issues detected

Severity	Count
🔴 Critical	9
🟠 High	14
🟡 Medium	48

⚠️Action Required: Critical security issues found!

View findings

[
{
"reason": "Issue in abi-verify.yml",
"type": "missing_timeout_minutes",
"file": "abi-verify.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in coq-build.yml",
"type": "missing_timeout_minutes",
"file": "coq-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in coq-build.yml",
"type": "missing_timeout_minutes",
"file": "coq-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in coq-build.yml",
"type": "missing_timeout_minutes",
"file": "coq-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in governance.yml",
"type": "missing_timeout_minutes",
"file": "governance.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in hypatia-scan.yml",
"type": "missing_timeout_minutes",
"file": "hypatia-scan.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in mirror.yml",
"type": "missing_timeout_minutes",
"file": "mirror.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in rust-ci.yml",
"type": "missing_timeout_minutes",
"file": "rust-ci.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard-enforcer.yml",
"type": "missing_timeout_minutes",
"file": "scorecard-enforcer.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence