docs(pkg): canonical Nix-retirement inventory worklist (Wave 0)

[hyperpolymath]

Closes the actionable of #103 (Wave 0 of campaign #102; policy #101).

Read-only discovery over all 379 hyperpolymath repos (top-level HEAD), committed as the durable worklist rhodium-standard-repositories/spec/nix-retirement-inventory.adoc:

Class	Count
Candidate (→ 14 waves)	277
Monorepo → handle at source	8
Excluded (standards, echidna #73)	2
Out-of-scope (no flake / no Guix)	92

Verdicts are provisional — final keep/remove is per-repo at wave time (flake inputs vs Guix ∪ sealed-container). The .guix-channel-only and flake-without-Guix traps were checked and are empty; the earlier triage's "my-lang = channel-only" was inaccurate (my-lang has no flake.nix → out-of-scope). The Wave column is authoritative for slicing the wave sub-issues.

Gate rules are not duplicated here — the artifact links to #102 / LANGUAGE-POLICY.adoc.

Refs #103
Refs #101

[github-actions]

🔍 Hypatia Security Scan

Findings: 100 issues detected

Severity	Count
🔴 Critical	62
🟠 High	28
🟡 Medium	10

⚠️Action Required: Critical security issues found!

View findings

[
{
"reason": "Issue in quality.yml",
"type": "missing_workflow",
"file": "quality.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in security-policy.yml",
"type": "missing_workflow",
"file": "security-policy.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
"type": "unpinned_action",
"file": "governance-reusable.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
"type": "believe_me",
"file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
},
{
"reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
"type": "js_wildcard_cors",
"file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (1 occurrences, CWE-79)",
"type": "js_innerhtml",
"file": "/home/runner/work/standards/standards/axel-protocol/src/Tea.res.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
}
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence