docs: scope README/ROADMAP claims to shipped reality (ADR-0007, closes #51)

[hyperpolymath]

First executed consequence of ADR-0007 (claims-to-evidence discipline)
and ADR-0008 Option C ("scope the claim now"). Closes #51; part of the
Earn-the-Core epic #53.

No capability is removed — the claims are made true.

• README — new == Status section stating pre-production/CRG-C and
  flagging: QUIC + SNIF experimental (optional quicer/wasmex NIFs
  disabled by default), PTP hardware-gated, Idris2 proofs
  type-check-only (runtime enforcement → ADR-0008 Option C, PoC Earn-core: formal-proof runtime-enforcement PoC for one ABI module (ADR-0008 Option C) #55),
  latency/scale unbenchmarked (Earn-core: validate headline performance/scale numbers (<10ms, 500+ concurrent) #52). Comparison-table <10ms and
  <1µs cells caveated; honesty NOTE after the table.
• ROADMAP — QUIC transport/hardening flagged experimental; "Idris2
  ABI formal proofs" flagged type-check-only; Current Status references
  ADR-0007 + epic Earn the Core — foundational-hardening program (tracking) #53.
• STATE.a2ml — both open doc-reality-drift entries marked RESOLVED.
• CHANGELOG updated.

Docs-only; no code change. The strong core stops being obscured by the
augmented layer's ambition.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 21 issues detected

Severity	Count
🔴 Critical	4
🟠 High	6
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action ocaml/setup-ocaml@v3 needs attention",
    "type": "unpinned_action",
    "file": "affinescript-canary.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "No permissions declaration -- add permissions: read-all",
    "type": "missing_permissions",
    "file": "elixir-ci.yml",
    "action": "add_permissions",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "binary_to_term without :safe option -- deserialization attack (1 occurrences, CWE-502)",
    "type": "elixir_send_unsanitised",
    "file": "/home/runner/work/burble/burble/server/lib/burble/media/lmdb_playout.ex",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "SSL verify_none disables certificate validation -- MITM risk (1 occurrences, CWE-295)",
    "type": "elixir_no_ssl_verify",
    "file": "/home/runner/work/burble/burble/server/lib/burble/bridges/mumble.ex",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "believe_me undermines formal verification (2 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/burble/burble/src/interface/abi/Foreign.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Nickel file missing SPDX-License-Identifier header (1 occurrences, CWE-1104)",
    "type": "ncl_missing_spdx",
    "file": "/home/runner/work/burble/burble/configs/config.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "Lock.unwrap() without poison handling (14 occurrences, CWE-754)",
    "type": "lock_unwrap",
    "file": "/home/runner/work/burble/burble/tools/selur-compose/crates/selur-compose-driver/src/mock.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence