Green test suite; harden CI workflows; academic + wiki → AsciiDoc

[hyperpolymath]

Follow-up addressing the three remaining buckets, in order.

1 · Tests — local suite now fully green (460 tests, 0 failures, 4 skipped)

The 6 failures left after #52 are fixed:

• DocGeneratorTest (5): the AST carries no line numbers, so the generator now locates CONST/POLICY declarations by scanning the source; it captures only the contiguous comment block, populates constant examples from the signature, and lists constant/policy names in the HTML index. The documented_policy.phr fixture gains a multi-line policy comment, and sample.phr is rewritten to valid syntax (it used unimplemented list-literal syntax).
• IncrementalLexerTest "edit inside comment" (1): the re-lex window now snaps back to the start of its line, so an edit inside a comment (which produces no token) re-lexes the whole line instead of a mid-line fragment that was misread as identifiers.

(4 skipped = the ra/consensus tests, which need OTP 26 + the ra hex dep, unavailable in the sandbox.)

2 · CI workflow hardening (Hypatia findings)

• secret-scanner: pin trufflesecurity/trufflehog to a release SHA (v3.95.6) and add the missing timeout-minutes.
• scorecard-enforcer: move the score-gate run step into its own job so the publish job (which holds the OIDC id-token) has no custom run steps; the SARIF is handed over via an artifact.
• codeql.yml already uses language: actions (that finding was stale); the binary_to_term finding is a false positive (compiler.ex already passes [:safe]).

3 · academic/ + wiki/ → AsciiDoc (CC-BY-SA-4.0)

Converted the academic proof corpus (31 files) and the wiki (19 pages) from Markdown to AsciiDoc via pandoc, per the estate "docs must be .adoc" policy:

• LaTeX math preserved as [latexmath] blocks (the white-paper sets :stem: latexmath);
• stray in-body MPL SPDX lines removed (superseded by the CC-BY-SA-4.0 header);
• 127 intra-wiki cross-links repointed .md → .adoc.

Remaining root-level .md are GitHub-required (CHANGELOG / SECURITY / CONTRIBUTING / CODE_OF_CONDUCT), AI-instruction files (CLAUDE.md, copilot-instructions.md), and .github/ISSUE_TEMPLATE/* — left as-is by convention.

Verification

Built/tested on Elixir + OTP 25 (hex blocked → jason/stream_data vendored as path deps for the test run only; mix.exs/mix.lock committed unchanged). Full suite green; changed modules compile warning-clean; all three edited workflows pass yaml.safe_load.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AqMopxUsgu78rg5fhWBUkk

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 17 issues detected

Severity	Count
🔴 Critical	0
🟠 High	8
🟡 Medium	9

View findings

[
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "binary_to_term without :safe option -- deserialization attack (1 occurrences, CWE-502)",
    "type": "elixir_send_unsanitised",
    "file": "/home/runner/work/phronesis/phronesis/lib/phronesis/compiler.ex",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Nominal-only SAST in phronesis: codeql.yml language matrix contains no language present in the repo and lacks `actions`, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix to `language: actions`.",
    "type": "StaticAnalysis",
    "file": "/home/runner/work/phronesis/phronesis",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Add CodeQL or equivalent SAST workflow.",
    "scorecard_check": "SAST"
  },
  {
    "reason": "Repository has 6 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD007 -- Hypatia structural_drift: SD007 -- 8 day(s) old",
    "type": "CSA001",
    "file": ".claude/CLAUDE.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD007 -- Hypatia structural_drift: SD007 -- 8 day(s) old",
    "type": "CSA001",
    "file": ".claude/CLAUDE.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD007 -- Hypatia structural_drift: SD007 -- 8 day(s) old",
    "type": "CSA001",
    "file": ".claude/CLAUDE.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_safety/elixir_send_unsanitised -- Hypatia code_safety: elixir_send_unsanitised -- 8 day(s) old [STALE]",
    "type": "CSA001",
    "file": "lib/phronesis/compiler.ex",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/unpinned_action -- Hypatia workflow_audit: unpinned_action -- 8 day(s) old [STALE]",
    "type": "CSA001",
    "file": "secret-scanner.yml",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/scorecard_publish_with_run_step -- Hypatia workflow_audit: scorecard_publish_with_run_step -- 20 day(s) old [STALE]",
    "type": "CSA001",
    "file": "scorecard-enforcer.yml",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence