fix(storage): env var alone now opts run into VerisimDb mode (issue #33 prerequisite)

Recon flagged that PANIC_ATTACK_STORE_FINDING_HEXADS=1 was dead without a
manifest configuring reports.storage-targets=verisimdb. The env check sat
inside the VerisimDb arm of persist_assemblyline_report, but storage_modes()
defaulted to [Filesystem] only — so the operational opt-in path was
unreachable without a fully-populated 0-AI-MANIFEST.a2ml.

Add resolve_storage_modes() that augments declared modes with VerisimDb when
the env var is truthy. Wire it at the single binding site in main.rs.

Smoke-verified end-to-end: assemblyline scan against a tiny multi-repo dir
now emits 5 per-finding hexads under hexads/findings/ from env var alone.

3 new tests + 1 existing finding_hexads_disabled_by_default test now share
a Mutex to serialize their env-var mutations under cargo's parallel runner.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

src/main.rs

@@ -43,7 +43,7 @@ use crate::attack::AttackProfile;
 use crate::axial::{AxialConfig, ExecutionCommand as AxialExecutionCommand};
 use crate::i18n::Lang;
 use crate::report::{format_diff, load_report, ReportOutputFormat, ReportTui, ReportView};
-use crate::storage::{latest_reports, persist_report};
+use crate::storage::{latest_reports, persist_report, resolve_storage_modes};
 use anyhow::{anyhow, Context, Result};
 use clap::{CommandFactory, Parser, Subcommand};
 use clap_complete::{generate, Shell};
@@ -1110,7 +1110,7 @@ fn run_main() -> Result<()> {
             Manifest::default()
         }
     };
-    let storage_modes = manifest.storage_modes();
+    let storage_modes = resolve_storage_modes(manifest.storage_modes());
     let manifest_formats = manifest.report_formats();
 
     match cli.command {

src/storage/mod.rs

@@ -350,18 +350,37 @@ fn build_assemblyline_hexad(
 
 /// Env var that opts a run into per-finding hexad emission (issue #33 S1).
 ///
-/// When set to a non-empty value AND `StorageMode::VerisimDb` is configured,
-/// `persist_assemblyline_report` writes one hexad per `WeakPoint` under
+/// When set to a non-empty truthy value, the run opts into `StorageMode::VerisimDb`
+/// even without an `0-AI-MANIFEST.a2ml` configuring `reports.storage-targets`.
+/// `persist_assemblyline_report` then writes one hexad per `WeakPoint` under
 /// `<dir>/hexads/findings/` in addition to the existing aggregate hexad.
+///
+/// Truthy = any non-empty value other than `0` / `false` (case-insensitive).
 pub const STORE_FINDING_HEXADS_ENV: &str = "PANIC_ATTACK_STORE_FINDING_HEXADS";
 
 /// Return `true` when per-finding hexad emission is requested via env var.
-fn finding_hexads_enabled() -> bool {
+pub fn finding_hexads_enabled() -> bool {
     std::env::var(STORE_FINDING_HEXADS_ENV)
         .map(|v| !v.is_empty() && v != "0" && !v.eq_ignore_ascii_case("false"))
         .unwrap_or(false)
 }
 
+/// Augment a `storage_modes` list with `StorageMode::VerisimDb` when
+/// `PANIC_ATTACK_STORE_FINDING_HEXADS` is truthy.
+///
+/// This is the operational opt-in path for issue #33 S1–S3: the env var alone
+/// is sufficient to reach the hexad-write path, without requiring a manifest's
+/// `reports.storage-targets` to include `verisimdb`.
+pub fn resolve_storage_modes(declared: Vec<StorageMode>) -> Vec<StorageMode> {
+    if finding_hexads_enabled() && !declared.contains(&StorageMode::VerisimDb) {
+        let mut out = declared;
+        out.push(StorageMode::VerisimDb);
+        out
+    } else {
+        declared
+    }
+}
+
 /// Build the stable finding-id for a `WeakPoint`.
 ///
 /// Pattern: `finding:<repo>:<file>:<line>:<category>` — chosen so that two
@@ -996,6 +1015,12 @@ mod tests {
         AssailReport, Language, ProgramStatistics, Severity, WeakPoint, WeakPointCategory,
     };
     use std::path::PathBuf;
+    use std::sync::Mutex;
+
+    /// Serialize env-var tests so cargo's parallel runner can't race on
+    /// `PANIC_ATTACK_STORE_FINDING_HEXADS`. Each test acquires this lock for
+    /// its full body.
+    static ENV_LOCK: Mutex<()> = Mutex::new(());
 
     fn sample_weak_point(file: &str, line: u32, category: WeakPointCategory) -> WeakPoint {
         WeakPoint {
@@ -1150,12 +1175,51 @@ mod tests {
 
     #[test]
     fn finding_hexads_disabled_by_default() {
-        // Snapshot+restore so we don't trample on parallel-test global state.
+        let _g = ENV_LOCK.lock().unwrap_or_else(|p| p.into_inner());
         let original = std::env::var(STORE_FINDING_HEXADS_ENV).ok();
         std::env::remove_var(STORE_FINDING_HEXADS_ENV);
         assert!(!finding_hexads_enabled());
         if let Some(v) = original {
             std::env::set_var(STORE_FINDING_HEXADS_ENV, v);
         }
     }
+
+    #[test]
+    fn resolve_storage_modes_passthrough_when_env_unset() {
+        let _g = ENV_LOCK.lock().unwrap_or_else(|p| p.into_inner());
+        let original = std::env::var(STORE_FINDING_HEXADS_ENV).ok();
+        std::env::remove_var(STORE_FINDING_HEXADS_ENV);
+        let modes = resolve_storage_modes(vec![StorageMode::Filesystem]);
+        assert_eq!(modes, vec![StorageMode::Filesystem]);
+        if let Some(v) = original {
+            std::env::set_var(STORE_FINDING_HEXADS_ENV, v);
+        }
+    }
+
+    #[test]
+    fn resolve_storage_modes_adds_verisimdb_when_env_set() {
+        let _g = ENV_LOCK.lock().unwrap_or_else(|p| p.into_inner());
+        let original = std::env::var(STORE_FINDING_HEXADS_ENV).ok();
+        std::env::set_var(STORE_FINDING_HEXADS_ENV, "1");
+        let modes = resolve_storage_modes(vec![StorageMode::Filesystem]);
+        assert!(modes.contains(&StorageMode::Filesystem));
+        assert!(modes.contains(&StorageMode::VerisimDb));
+        std::env::remove_var(STORE_FINDING_HEXADS_ENV);
+        if let Some(v) = original {
+            std::env::set_var(STORE_FINDING_HEXADS_ENV, v);
+        }
+    }
+
+    #[test]
+    fn resolve_storage_modes_idempotent_when_verisimdb_already_present() {
+        let _g = ENV_LOCK.lock().unwrap_or_else(|p| p.into_inner());
+        let original = std::env::var(STORE_FINDING_HEXADS_ENV).ok();
+        std::env::set_var(STORE_FINDING_HEXADS_ENV, "1");
+        let modes = resolve_storage_modes(vec![StorageMode::VerisimDb]);
+        assert_eq!(modes, vec![StorageMode::VerisimDb]);
+        std::env::remove_var(STORE_FINDING_HEXADS_ENV);
+        if let Some(v) = original {
+            std::env::set_var(STORE_FINDING_HEXADS_ENV, v);
+        }
+    }
 }