Repository navigation
Hypatia AssailReport ingestion path: design + implement #117
Description
Context
The 2026-06-02 v2.5.5 cohort wired panicbot (gitbot-fleet#252) to honour panic-attack's new test_context field. Hypatia ALSO consumes panic-attack scan output — but currently only via rule-mention references (lib/rules/workflow_audit.ex, lib/rules/dogfooding.ex). There is no AssailReport ingestion path in the Hypatia codebase as of 2026-06-02.
What's needed
A Hypatia ingestion module that:
- Parses
AssailReportJSON frompanic-attack assail <target> --output-format json. - Indexes findings by
(PA-code, file:line)for cross-referencing with other Hypatia signals (Github Actions runs, CodeQL alerts, Dependabot alerts, etc.). - Routes by classification:
suppressed: true→HypatiaBucket.SuppressedByRule(existing kanren-driven)suppressed: trueANDtest_context: 'test_only' | 'doc'→HypatiaBucket.ContextSuppressed(new — surfaces in audit-trail mode, NOT in dashboard counts)suppressed: falseANDtest_context: 'production' | null→HypatiaBucket.ActiveFinding
- Surfaces correlation hits: if a Hypatia rule flagged file:line independently of panic-attack, AND panic-attack also flagged it, raise a 'duplicate signal' marker for the operator.
Why not done in this cohort
Designing a Hypatia ingestion path is a separate scope from the panic-attack-side foundation. Hypatia is Elixir; the schema work + GenServer wire-up is non-trivial. Filing here so the v2.5.5 test_context work has a clear next consumer.
Acceptance
PR in hyperpolymath/hypatia repo that:
- Adds
Hypatia.Ingest.AssailReportmodule + tests against captured panic-attack JSON fixtures - Adds
Hypatia.Rules.AssailRouter(or similar) implementing the 4-way routing - Documents the integration in Hypatia's wiki
Refs
- gitbot-fleet#252 (panicbot translator — the parallel consumer that DID land)
- panic-attack#102 / feat(suppression): v2.5.5 Phase 2 — analyzer wire-up #110 (test_context foundation + analyzer wire-up)
- panic-attack PROOF-PROGRAMME.md (the soundness justification for the routing rules)
Activity
release(v2.5.5): tag the 11-PR context-awareness cohort (#118)
hyperpolymath commentedon Nov 4, 2026
Fresh ingestion controls are available in hyperpolymath/proven-cicd-and-workflows#77 and malformed-evidence repairs in hyperpolymath/proven-tests-and-benches#103.
Strict assail runs on cicd-suite, proven-tests-and-benches, Pons and panic itself all returned partial coverage / exit 2. Findings counts were 4, 3, 35 and 16 respectively, including deliberate fixtures and heuristics; they are not confirmed defect counts. A consumer must retain coverage and execution outcome rather than reducing these to a findings array.
The shared gate now invokes assail --fail-on-incomplete, records refusal distinctly, and runs both tools with a bounded deadline. Assail findings remain report-only here: the gate has not invented a severity-blocking policy. The 49-pair exit matrix includes 0/1/2/124/127/137/139 for each scanner.
Please use these cases for the Hypatia adapter: malformed envelope, valid findings with partial coverage, missing binary, timeout, signal exit, replayed report, and same heuristic lineage across tools. The audit's machine receipts and limitations are in the suite PR; this comment does not assert the adapter is already implemented.