feat(rules): BaselineHealth (BH001-BH003) — detect red-baseline conditions estate-wide

[hyperpolymath]

Summary

Three new detection rules in lib/rules/baseline_health.ex, each addressing a failure mode that combined into the breakage of hyperpolymath/reasonably-good-token-vault main. The originating fix is r-g-t-v#89; these rules detect that class of failure across the estate so the next occurrence is caught before it lands.

• BH001 — main branch protection has no required_status_checks (or empty contexts/checks). :critical. Dispatch: sustainabot :report. Strictly stronger than ERR-SEC-001 in cicd_rules.ex (which fires only when there's no protection at all); BH001 fires when protection exists but doesn't gate on CI — the exact gap that let r-g-t-v#82 merge red.
• BH002 — Local Cargo.toml / package.json scan for lines where a dependency declaration carries a TODO/FIXME mentioning migration / rename / API / breaking / major. :high. Dispatch: rhodibot :open_followup_pr. Catches the exact pattern that left r-g-t-v#82 stuck: ureq = { version = "3" } # TODO: migrate to 3.x API.
• BH003 — A workflow run targeting main has been failing for longer than threshold_hours (default 24). :critical. Dispatch: sustainabot :escalate. Distinguishes flakes (<24h) from real baseline outages.

Conventions matched

From dependabot_alerts.ex and git_state.ex:

• System.cmd("curl", [...]) for GitHub API (per the HTTPoison-TLS comment in rules.ex:287)
• Auth via GITHUB_TOKEN or HYPATIA_DISPATCH_PAT, clean [] return on missing token (matches DA001/DA002 test pattern)
• extract_owner_repo/1 parses git remote get-url origin (SSH + HTTPS forms)
• Finding shape: %{rule:, file:, severity:, reason:, action:, detail:}
• scan/2 facade returns %{findings, total, by_severity, dispatch} matching GitState.scan/1
• Hypatia.Rules.scan_baseline_health/2 defdelegated from the facade

Why these belong in Hypatia (not elsewhere)

Per the survey:

• .git-private-farm has no branch-protection authority — strictly mirroring + dispatch. Not a placement candidate.
• gitbot-fleet documents required-status-checks wiring (docs/BRANCH-PROTECTION-SETUP.md) but no bot actively enforces it; the safety triangle in Hypatia routes BH001/BH003 advisories to sustainabot for owner action, and BH002 to rhodibot for follow-up PR creation.
• echidnabot is downstream of proof_obligation.ex only — proves mathematical/logical properties of code, no stake in branch-protection / dep / CI-color invariants.

Test plan

12 tests in test/baseline_health_test.exs:

• no-token paths for BH001 and BH003 return [] cleanly
• all four positive BH002 patterns (TODO migrate, FIXME rename, etc.)
• benign-TODO negative case
• subdirectory walking
• target/ and node_modules/ exclusion
• scan/2 facade shape (:findings, :total, :by_severity, :dispatch)
• owner_repo: opt override

Excluding tags: [:verisim_data]
............
Finished in 0.1 seconds (0.1s async, 0.00s sync)
12 tests, 0 failures

Follow-ups (not in this PR)

• Estate-wide sweep: run mix hypatia.scan after merge to surface BH001/BH002/BH003 findings across the 302 scanned repos, route via existing safety triangle.
• gitbot-fleet could grow a rhodibot recipe for BH002 (auto-open follow-up PR with the migration TODO discharged) once a few BH002 findings have been triaged manually for confidence calibration.
• Branch protection itself (the BH001 fix) is owner-level and remains manual; the eventual play is a Mix task hypatia.fix.bh001 that uses gh api -X PUT against a known-good policy doc.

🤖 Generated with Claude Code

[ghost]

🔍 Hypatia Security Scan

Findings: 117 issues detected

Severity	Count
🔴 Critical	0
🟠 High	16
🟡 Medium	101

View findings

[
  {
    "reason": "Docker reference in Nickel config -- Podman/Containerfile highly preferred (Docker permitted) (1 occurrences, CWE-1104)",
    "type": "ncl_docker_not_podman",
    "file": "/home/runner/work/hypatia/hypatia/.machine_readable/svc/k9/hypatia-metadata.k9.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (2 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/commands/batch.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/commands/batch.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (1 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/commands/scan.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/commands/scan.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (2 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/commands/fleet.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (2 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/output.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (2 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/hypatia/hypatia/cli/build.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (3 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/hypatia/hypatia/fixer/src/main.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "expect() in hot path (5 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/hypatia/hypatia/fixer/src/scanner.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[ghost]

🔍 Hypatia Security Scan

Findings: 113 issues detected

Severity	Count
🔴 Critical	0
🟠 High	6
🟡 Medium	107

View findings

[
  {
    "reason": "Docker reference in Nickel config -- Podman/Containerfile highly preferred (Docker permitted) (1 occurrences, CWE-1104)",
    "type": "ncl_docker_not_podman",
    "file": "/home/runner/work/hypatia/hypatia/.machine_readable/svc/k9/hypatia-metadata.k9.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (2 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/commands/batch.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/commands/batch.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (1 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/commands/scan.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/commands/scan.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (2 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/commands/fleet.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (2 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/output.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (2 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/hypatia/hypatia/cli/build.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (3 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/hypatia/hypatia/fixer/src/main.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "expect() in hot path (5 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/hypatia/hypatia/fixer/src/scanner.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence