Fix pre-existing test bugs; narrative docs → AsciiDoc; version 0.9.0

[hyperpolymath]

Follow-up to #51, addressing the three buckets I flagged there.

1 · Test / Hypatia fixes (local suite 17 → 6 failures, no regressions)

Fixed the clean, decisive bugs:

• Debugger (8): read variable bindings from State.environment (the code referenced a non-existent State.variables), and add the missing Phronesis.Trace.merge/2.
• Parser (1): a parenthesised group now parses the full logical expression, so (is_valid == true AND enabled) works — fixes conformance 04_boolean_logic.
• IncrementalLexer (1): clamp the edit window so an out-of-bounds delta can't crash binary_part/3.
• Lexer fuzz (1): now passes.

Not fixed — fixture/feature decisions, not clean bugs (flagged)

• DocGeneratorTest (5): the AST carries no line numbers (comment descriptions can't be located), const examples is hard-coded [], the test has a "Risk"/"risk" case typo, and examples/sample.phr uses unimplemented list-literal syntax ([64496, ...]). Making these green needs AST line-number plumbing (risky — changes the tuple shape used across the interpreter / type-checker / reflexion) or fixture/test redesign. Happy to do it with your steer on intended behaviour.
• IncrementalLexerTest "edit inside comment" (1): incremental re-lex correctness around comment tokens — an LSP-optimisation edge case.

The binary_to_term Hypatia finding is a false positive — compiler.ex:166 already passes [:safe].

2 · mix.exs version

0.1.0 → 0.9.0, matching STATE.a2ml and resolving the three-way version disagreement.

3 · Narrative docs → AsciiDoc (CC-BY-SA-4.0)

Converted the top-level narrative docs from Markdown to AsciiDoc (via pandoc) per the estate "docs must be .adoc" policy, licensed CC-BY-SA-4.0: ANALYSIS-COMPLETE, IMPLEMENTATION-ROADMAP, LSP-IMPLEMENTATION-SUMMARY, TEST-NEEDS, TOOLCHAIN-WISHLIST, TOPOLOGY, WOKELANG-FEATURE-COMPARISON. Left as-is (intentionally): GitHub-required .md (CHANGELOG / SECURITY / CONTRIBUTING / CODE_OF_CONDUCT), AI-instruction files (CLAUDE.md, copilot-instructions.md), .github/ISSUE_TEMPLATE/*, the wiki/ (GitHub wiki) and the academic/ proof corpus — say the word if you want those swept too.

Verification

Built/tested on Elixir + OTP 25 (hex blocked in the sandbox → jason/stream_data vendored as path deps for the test run only; mix.exs/mix.lock committed unchanged). Changed modules compile warning-clean; the previously-failing debugger/conformance tests plus the reflexion suite are green (reflexion still 32/32); 6 known failures remain as above.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AqMopxUsgu78rg5fhWBUkk

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 19 issues detected

Severity	Count
🔴 Critical	0
🟠 High	9
🟡 Medium	10

View findings

[
  {
    "reason": "Action trufflesecurity/trufflehog@main needs attention",
    "type": "unpinned_action",
    "file": "secret-scanner.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_timeout_minutes",
    "file": "secret-scanner.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "binary_to_term without :safe option -- deserialization attack (1 occurrences, CWE-502)",
    "type": "elixir_send_unsanitised",
    "file": "/home/runner/work/phronesis/phronesis/lib/phronesis/compiler.ex",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Nominal-only SAST in phronesis: codeql.yml language matrix contains no language present in the repo and lacks `actions`, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix to `language: actions`.",
    "type": "StaticAnalysis",
    "file": "/home/runner/work/phronesis/phronesis",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Add CodeQL or equivalent SAST workflow.",
    "scorecard_check": "SAST"
  },
  {
    "reason": "Repository has 6 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD007 -- Hypatia structural_drift: SD007 -- 8 day(s) old",
    "type": "CSA001",
    "file": ".claude/CLAUDE.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD007 -- Hypatia structural_drift: SD007 -- 8 day(s) old",
    "type": "CSA001",
    "file": ".claude/CLAUDE.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD007 -- Hypatia structural_drift: SD007 -- 8 day(s) old",
    "type": "CSA001",
    "file": ".claude/CLAUDE.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_safety/elixir_send_unsanitised -- Hypatia code_safety: elixir_send_unsanitised -- 8 day(s) old [STALE]",
    "type": "CSA001",
    "file": "lib/phronesis/compiler.ex",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence