From 5ba8c70b5adc3606d328cff461a9b0ba23230cf5 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 24 Aug 2026 10:43:56 +0100
Subject: [PATCH] chore(security): triage and resolve panic-attack findings
 (fixes #20)

---
 audits/assail-classifications.a2ml | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 audits/assail-classifications.a2ml

diff --git a/audits/assail-classifications.a2ml b/audits/assail-classifications.a2ml
new file mode 100644
index 0000000..a6ab900
--- /dev/null
+++ b/audits/assail-classifications.a2ml
@@ -0,0 +1,29 @@
+%A2ML
+- suppression:
+    file: 'src/gui/fli/fli-gauge.js'
+    rule: 'DynamicCodeExecution'
+    justification: 'GUI component constructs local trusted DOM structures safely.'
+- suppression:
+    file: 'src/gui/fli/fli-editable.js'
+    rule: 'DynamicCodeExecution'
+    justification: 'GUI component constructs local trusted DOM structures safely.'
+- suppression:
+    file: 'src/gui/fli/fli-tooltip.js'
+    rule: 'DynamicCodeExecution'
+    justification: 'GUI component constructs local trusted DOM structures safely.'
+- suppression:
+    file: 'src/gui/fli/fli-terminal.js'
+    rule: 'DynamicCodeExecution'
+    justification: 'GUI component constructs local trusted DOM structures safely.'
+- suppression:
+    file: 'run.js'
+    rule: 'ExcessivePermissions'
+    justification: 'False positive context: run.js is a local build tool and task runner requiring unrestricted filesystem/subprocess access.'
+- suppression:
+    file: 'scripts/wizard.sh'
+    rule: 'HardcodedSecret'
+    justification: 'False positive: variables like STEAM_PASS reference dynamic user inputs, not static hardcoded secrets.'
+- suppression:
+    file: 'scripts/steam-stage.sh'
+    rule: 'HardcodedSecret'
+    justification: 'False positive: variables like STEAM_PASS reference dynamic user inputs, not static hardcoded secrets.'