feat(storage): per-finding hexad emission (issue #33 S1)

[hyperpolymath]

Summary

First slice of #33. Adds a per-WeakPoint hexad emission path to persist_assemblyline_report so the estate sweep can persist one hexad per finding in addition to the existing aggregate hexad. Subject identity is finding:<repo>:<file>:<line>:<category> — stable across runs, which is the property the upcoming S2 (campaign register-pr) and S3 (cross-repo query) slices need to join on without diffing JSON blobs.

What's new

• HexadSemantic.finding: Option<FindingSemantic> — additive, skip_serializing_if = "Option::is_none", so older readers and stored hexads are unaffected.
• FindingSemantic struct carries the modalities the issue specified: finding_id, repo_name, file, line, category, rule_id, rule_name, severity, description, first_seen_run, last_seen_run, framework.
• rule_id / rule_name reuse the canonical SARIF mapping (src/report/sarif.rs::rule_id / rule_name lifted to pub(crate) — same PA001..PA025 codes the SARIF output already uses).
• build_finding_hexads(report) -> Vec<PanicAttackHexad> — one hexad per non-suppressed WeakPoint across every repo result.
• STORE_FINDING_HEXADS_ENV = "PANIC_ATTACK_STORE_FINDING_HEXADS" — when set non-empty AND StorageMode::VerisimDb is configured, persist_assemblyline_report writes one file per finding under <dir>/hexads/findings/ in addition to the existing aggregate hexad in <dir>/hexads/.

Behaviour preserved

• Default path unchanged: env var unset → no per-finding writes. No CLI flag added; opt-in is purely env-driven.
• Aggregate hexad still emitted in every VerisimDb run.
• Suppressed WeakPoints skipped — keeps the hexad store aligned with fleet/CI counts (same convention as elsewhere).

Out of scope (S2 / S3)

• Back-stamping first_seen_run from a prior hexad — S1 sets first_seen_run == last_seen_run. S2 is responsible.
• HTTP push for finding hexads — file-side only for S1 to keep API chattiness out of the early surface.
• New CLI subcommand (panic-attack campaign) — S2.
• panic-attack query — S3.

Test plan

• cargo test --all — 215 lib + 13 + 16 + 6 + 12 + 3 + 7 + 12 + 14 + 20 + 10 + 8 + 22 + 22 + 12 + 2 doc — all green.
• cargo clippy --all-targets -- -D warnings — clean.
• cargo fmt --all — clean.
• 7 new tests covering: id stability across calls, id discrimination by category, one-hexad-per-WeakPoint, suppression skipped, canonical PA-codes, file write + JSON round-trip, env-var default-off.

Refs #33.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 45 issues detected

Severity	Count
🔴 Critical	4
🟠 High	16
🟡 Medium	25

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Nickel file missing SPDX-License-Identifier header (1 occurrences, CWE-1104)",
    "type": "ncl_missing_spdx",
    "file": "/home/runner/work/panic-attack/panic-attack/reports/panic-attack-20260211180017.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/src/attestation/chain.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/attestation/evidence.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/ambush/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (3 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/kanren/strategy.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (3 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/axial/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "expect() in hot path (4 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/src/assail/analyzer.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (4 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/panic-attack/panic-attack/benches/scan_bench.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/benches/scan_bench.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[hyperpolymath]

Superseded — content already absorbed into main via #62 (sweep-tracker PR branched off S2 tip and carried the S1+S2 storage scaffold into main directly). All FindingSemantic / build_finding_hexads / SARIF rule_id pub(crate) changes are present in main as of 09b80f4. Closing as no-op rebase target.