panic-attack estate sweep — 2026-05-26

@hyperpolymath

panic-attack estate sweep — 2026-05-26

Owner: @hyperpolymath
Scope: 284-repo estate at ~/developer/repos/
Driver: panic-attack assemblyline + per-repo panic-attack assail --headless + manual triage

Summary

Estate-wide panic-attack scan run on 2026-05-26 using canonical panic-attack v2.5.0 binary. Findings turned into narrow per-(repo × file × category) PRs.

Generic modes (everywhere): assail (static analysis, 49 langs, PA001–PA025), assault (where binary materialises).
Specialised modes (case-by-case): bridge triage --offline (Cargo.lock repos), signatures (C/C++/Rust unsafe-heavy), temporal (where prior snapshots exist).
Proof repos (13): assail-only first pass; proof-file fixes go through DRAFT PR + local rebuild verification.

Guardrails honoured

❌ features/panic-attacker/ stub dirs untouched (references to canonical tool, not separate copies).
❌ vcl-ut/_wt-vclut* worktrees untouched (parallel session).
❌ hypatia/.claude/worktrees/agent-* untouched (locked agent sessions).
❌ ephapax _wt-eph-* worktrees untouched (proof-debt parallel work).
❌ Known parked debts NOT refiled (ephapax preservation formal/Semantics.v:3327, betlang substTop_preserves_typing, boj-server class-J primitives).
✅ Honour each repo's audits/assail-classifications.a2ml.
✅ All commits GPG-signed; no auto-merge; base=main; SSH remote for .github/workflows/ edits.

Baseline (2026-04-12 system-image)

303 repos scanned
15,554 weak points (1,898 critical)
29.7M lines / 21,018 files

This sweep

Filled in after Pass 1 completes.

Repos scanned: …
Repos with findings: …
Total weak points: …
Critical: …
High: …

PRs filed

Updated after each batch.

#	Repo	PR	Category	File / Module	Status
1

Issues filed (findings requiring redesign / human judgement)

#	Repo	Issue	Category	Notes
1

Proof-aware PRs (DRAFT until rebuild passes)

#	Repo	PR	Proof file	Rebuild status
1

Findings parked (already tracked elsewhere)

ephapax preservation (Semantics.v:3327) → ephapax-preservation-closure-plan
betlang substTop_preserves_typing → discharge recipe in betlang#27
boj-server class-J primitive axioms → boj-server-backend-assurance-harness

Related work proposed

panic-attack: complete VeriSimDB hexad persistence (issue to be filed). The current campaign hits the JSON ceiling — AssemblylineReport.results[].report is #[serde(skip)] so per-finding detail needs a second pass; cross-run PR-state has no native datastore. Finishing the VeriSimDB integration (60% → 100%) would make this kind of campaign cheaper to run next time.