docs: truthfulness audit 2026-06-01 — counts, paths, layer classification, changelog

[hyperpolymath]

Summary

A multi-subagent audit of idaptik's human-readable and machine-readable documentation against the actual repo state on 2026-06-01 surfaced several stale counts, broken paths, and missing classifications. This PR brings the canonical docs back in sync.

Human-readable corrections

File	What was wrong	Now
README.adoc	"Idris2 (15 modules)" + "Zig (12 exports)"	"17 in idaptik-ums/src/abi/ + 1 in src/abi/Types.idr" + "11 source files, 12 C-ABI exports"
EXPLAINME.adoc	Same counts; root src/abi/Types.idr undocumented in the file map	Same corrections + file-map entry for the root main-game ABI module
PROOF-NEEDS.md	Path src/abi/*.idr was right for one file, missed the 17 UMS modules entirely; no layer classification	Full L1/L2/L3/L4 classification + echo-types verdict recorded
PANIC-ATTACK-ANALYSIS-SUMMARY.md	Looked authoritative but dated 2026-03-20, well before the 2026-05-26 panic-attack re-scan + the PR #115 cleanup	Marked as historical baseline pending re-run after PR #115 lands

Machine-readable corrections

0-AI-MANIFEST.a2ml:

Key	Was	Now	Reason
dev-port	8080	1984	Matches vite.config.js server.port: 1984, strictPort: true. Playwright config also corrected in PR #114 to align with this.
escape-hatch (canonical-location)	escape-hatch/	idaptik-developers/src/escape-hatch/	The top-level path was a phantom — escape-hatch only lives under idaptik-developers/src/. Confirmed via repo tree walk.
modding-studio	Tauri 2 (idaptik-ums)	Gossamer (idaptik-ums) — Ephapax-based webview shell; replaced Tauri	Matches .machine_readable/6a2/STATE.a2ml line 13 which already recorded the Tauri → Gossamer pivot.
Tier-0 ref to .claude/CLAUDE.md	Listed in [context-tiers]	Removed	File does not exist in the repo (404 from gh api).

Provenance

CHANGELOG.md had no entry for any 2026-04, 2026-05, or 2026-06 work — last entry was 2026-03-14. Backfilled the 2026-06-01 block covering PR #112 (baseline sweep), PR #114 (Playwright fundamental fix), PR #115 (Track C security cleanup), issue #116 (idaptik-ums .res corruption), and the echo-types audit. Future sessions inherit this as the seam.

Echo-types audit

Per the 2026-06-01 owner directive "every proof in ephapax (and any sibling repo with an echo-types link) must first audit hyperpolymath/echo-types, reuse if applicable… L1/L4-only obligations audit-and-record-as-not-relevant":

• 17 Idris2 modules in idaptik-ums/src/abi/ + 1 root src/abi/Types.idr + ProvenBridge.idr's dependency on proven — all classified
• 17 modules L1 (region-local validation, entity placement, IP-reference integrity, level-data invariants); 1 module L4 (Multiplayer.idr — asymmetric co-op via enums + records, no temporal echo claims); zero L3
• Zero hits for "echo"/"Echo" in idaptik codebase; zero echo-types links in the proven dependency surface idaptik uses
• Verdict: RECORD-AS-NOT-RELEVANT — recorded in PROOF-NEEDS.md so future sessions don't re-derive the audit

Subagent reports backing this PR

• a22e2f5 — docs truthfulness audit (14 files surveyed)
• aa58c61 — idaptik-ums .res corruption sweep (10/11 corrupt; filed as bug(idaptik-ums): EditorEngine.res is the compiled .mjs output misnamed as the .res source #116)
• af5fac9 — cross-estate idaptik reference audit (3 stale refs identified)
• a0b4a4e — echo-types layer classification (per-module verdict above)

No risk to LIVE

This PR only touches documentation files. No code, no CI workflow, no rescript.json/deno.json/vite.config.js. Builds and tests are not affected.

Test plan

• All 6 files committed are GPG-signed + DCO-signed-off
• git diff confirms only doc files modified
• No required-check regression (all 16 required-on-main checks should pass — only doc changes)

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 72 issues detected

Severity	Count
🔴 Critical	11
🟠 High	19
🟡 Medium	42

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in build-validation.yml",
    "type": "missing_timeout_minutes",
    "file": "build-validation.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cflite-pr.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite-pr.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in containers.yml",
    "type": "missing_timeout_minutes",
    "file": "containers.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in containers.yml",
    "type": "missing_timeout_minutes",
    "file": "containers.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dco.yml",
    "type": "missing_timeout_minutes",
    "file": "dco.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence