fix: reduce hypatia raw findings 44 -> 10, honest-baseline the rest

.github/workflows/boj-build.yml

@@ -7,6 +7,7 @@ on:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.github/workflows/cargo-audit.yml

@@ -20,6 +20,7 @@ permissions: read-all
 jobs:
   audit:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
 
@@ -35,6 +36,7 @@ jobs:
   # Optional: Create issues for vulnerabilities
   create-issue:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     needs: audit
     if: failure()
     permissions:

.github/workflows/casket-pages.yml

@@ -18,6 +18,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
@@ -109,6 +110,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/cflite_batch.yml

@@ -8,6 +8,7 @@ permissions:
 jobs:
   fuzz:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1

.github/workflows/cflite_pr.yml

@@ -11,6 +11,7 @@ permissions:
 jobs:
   fuzz:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1

.github/workflows/codeql.yml

@@ -23,6 +23,7 @@ permissions:
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: read
       security-events: write

.github/workflows/dependabot-automerge.yml

@@ -50,6 +50,7 @@ jobs:
     # Only run for PRs actually authored by Dependabot.
     if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
+    timeout-minutes: 5
 
     steps:
       - name: Fetch Dependabot metadata

.github/workflows/dogfood-gate.yml

@@ -22,6 +22,7 @@ jobs:
   a2ml-validate:
     name: Validate A2ML manifests
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -66,6 +67,7 @@ jobs:
   k9-validate:
     name: Validate K9 contracts
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -115,6 +117,7 @@ jobs:
   empty-lint:
     name: Empty-linter (invisible characters)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -179,6 +182,7 @@ jobs:
   groove-check:
     name: Groove manifest check
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -237,6 +241,7 @@ jobs:
   dogfood-summary:
     name: Dogfooding compliance summary
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     needs: [a2ml-validate, k9-validate, empty-lint, groove-check]
     if: always()
 

.github/workflows/instant-sync.yml

@@ -14,8 +14,28 @@ permissions:
 jobs:
   dispatch:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
+      # Presence gate: the `secrets` context is not usable directly in a
+      # step-level `if:`, so read it into `env:` here and publish a plain
+      # boolean via $GITHUB_OUTPUT. The dispatch step below is gated on
+      # that output rather than on the secret itself. Without this, a repo
+      # where FARM_DISPATCH_TOKEN hasn't been propagated fails this
+      # workflow on every push/release instead of skipping cleanly.
+      - name: Check FARM_DISPATCH_TOKEN presence
+        id: check-secret
+        env:
+          FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
+        run: |
+          if [ -n "${FARM_DISPATCH_TOKEN}" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "::warning::FARM_DISPATCH_TOKEN secret is not set on this repo; skipping cross-forge propagation dispatch to hyperpolymath/.git-private-farm."
+          fi
+
       - name: Trigger Propagation
+        if: steps.check-secret.outputs.present == 'true'
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}
@@ -30,4 +50,5 @@ jobs:
             }
 
       - name: Confirm
+        if: steps.check-secret.outputs.present == 'true'
         run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"

.github/workflows/language-policy.yml

@@ -22,6 +22,7 @@ jobs:
   check-banned-languages:
     name: Check for Banned Languages
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
@@ -159,6 +160,7 @@ jobs:
   check-required-files:
     name: Check Required Files
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4

.github/workflows/push-email-notify.yml

@@ -13,6 +13,7 @@ jobs:
     name: Email on push
     if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' }}
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Send push notification email
         uses: dawidd6/action-send-mail@c50dc4cc848ade21f848990889906d804fae78c5 # pinned

.github/workflows/quality.yml

@@ -20,6 +20,7 @@ permissions:
 jobs:
   must-check:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:

.github/workflows/trustfile.yml

@@ -19,6 +19,7 @@ permissions:
 jobs:
   validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
     env:

.github/workflows/workflow-linter.yml

@@ -15,6 +15,7 @@ permissions: read-all
 jobs:
   lint-workflows:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
 

.hypatia-baseline.json

@@ -1,10 +1,37 @@
 [
   {
     "severity": "high",
-    "rule_module": "cicd_rules",
-    "type": "banned_language_file",
-    "file_pattern": "android/**",
-    "note": "Android/Kotlin scaffold is being migrated to Gossamer; see RFC PR #97. The android/ tree is owner-authored work-in-flight, not vendored upstream. Exempt until the Gossamer migration lands and android/ is removed.",
-    "tracking_issue": "hyperpolymath/neurophone#97"
+    "rule_module": "honest_completion",
+    "type": "no_tests",
+    "file": ".",
+    "note": "Scanner-limitation false positive: honest_completion's has_tests_dir check only looks for a root-level test/ or tests/ directory, and its test_files counter only matches .test.js/.test.ts/_test.exs/_test.res suffixes -- it has no Rust/Cargo-workspace convention (no .rs extension, no per-crate tests/ recognition). neurophone is a Cargo workspace with real, extensive tests under crates/*/tests/*.rs plus #[cfg(test)] inline modules (see e.g. crates/neurophone-core/tests/, crates/lsm/tests/); `cargo test` runs them all. Verified via hypatia source (lib/rules/honest_completion.ex collect_evidence/1) 2026-07-01 while investigating this finding -- there is no lightweight fix on the neurophone side (adding a fake root tests/ dir would be theater, not a real fix); the fix belongs in hypatia's rule. Caveat: hypatia's own `file` value for this finding is the scan root's Path.expand(path) (an absolute host path in practice, e.g. the CI runner's checkout dir), not a literal repo-relative \".\" -- exact `file` matching against this entry may not actually apply until hypatia relativizes its own output, a gap distinct from hypatia#566/standards#449 discovered while writing this entry. See hyperpolymath/neurophone PR introducing this baseline for the full writeup."
+  },
+  {
+    "severity": "high",
+    "rule_module": "code_safety",
+    "type": "unwrap_without_check",
+    "file_pattern": "crates/*/benches/**",
+    "note": "Bench-harness setup code, not an operational path. proofs/README.adoc's obligation 0.1 (panic-freedom) is explicitly scoped to operational paths; Criterion bench setup (crates/{sensors,llm,esn,bridge,neurophone-core}/benches/*.rs) legitimately panics on setup failure by design -- it is dev-only tooling that is never part of a shipped build. Rewriting bench harnesses to add defensive handling for scenarios that can't/shouldn't be handled would be needless churn (contrary to this repo's own philosophy, see MUST.contractile). Caveat: hypatia's code_safety module reports an absolute host path in `file` (built from `find <expanded-repo-path> ...`), not repo-relative as the baseline schema expects -- this file_pattern may not exact-match until hypatia relativizes its own output."
+  },
+  {
+    "severity": "medium",
+    "rule_module": "code_safety",
+    "type": "expect_in_hot_path",
+    "file_pattern": "crates/*/benches/**",
+    "note": "Same rationale and same absolute-path caveat as the unwrap_without_check entry above: crates/{lsm,neurophone-core}/benches/*.rs are bench-harness setup code, not operational paths, and are out of scope for obligation 0.1."
+  },
+  {
+    "severity": "medium",
+    "rule_module": "structural_drift",
+    "type": "SD022",
+    "file": "docs/BT-PRESENCE-PLAN.adoc",
+    "note": "Not rename-drift: this is a design-only cross-repo plan document (\"Status: Design only -- no code yet\") whose ownership-boundary table explicitly splits paths between the sibling `burble` repo (\"Lives in burble\" column) and neurophone (\"Lives in neurophone\" column). `src/Burble/ABI/NearbyPresence.idr` is listed under \"Lives in burble\" -- it describes a planned path in the OTHER repo, not a stale reference to something that used to exist here. SD022's rename-drift heuristic has no cross-repo awareness, so it flags any `src/<dir>/` it can't resolve locally. Verified via `git log` (no such path was ever committed in neurophone; nothing to rename-sweep) and via reading the doc's own explicit repo-ownership table 2026-07-01. Caveat: hypatia reports `type` as literal \"SD022\" (uppercase), which does not match the baseline schema's `^[a-z][a-z0-9_]*$` pattern for `type` -- a schema/hypatia-output mismatch discovered while writing this entry; kept as the exact uppercase value so the entry can actually match once baseline-consuming CI is wired up, at the cost of failing strict schema validation today."
+  },
+  {
+    "severity": "medium",
+    "rule_module": "git_state",
+    "type": "GS007",
+    "file": ".",
+    "note": "Operational/transient, not a code defect: this repo has an active multi-branch workflow (feature branches, workstream branches from parallel agent sessions) and the non-main remote branch count fluctuates by the hour as branches are opened and merged/deleted. Baselining the rule itself rather than a point-in-time count; do not read a specific branch-count number into this entry. Owner should periodically review `git branch -r` and delete fully-merged branches, but that is a routine housekeeping call, not something this baseline should force. Same uppercase-`type` schema caveat as the SD022 entry above (\"GS007\" vs `^[a-z][a-z0-9_]*$`)."
   }
 ]

.machine_readable/INTENT.contractile

@@ -50,15 +50,15 @@
   ; === Key Architectural Decisions That Must Not Be Reversed ===
   (architectural-invariants
     ; *REMINDER: List the foundational decisions*
-    ; ("Idris2 for ABI definitions — dependent types prove interface correctness")
-    ; ("Zig for FFI — zero-cost C ABI compatibility")
+    ; ("Rust workspace (crates/) for the core pipeline — memory safety without a GC")
+    ; ("proofs/ (TLA+/Lean/Dafny/proptest) for formal verification — see proofs/README.adoc")
     ; ("Elixir for supervision — OTP fault tolerance")
   )
 
   ; === Sensitive Areas (if in doubt, ask) ===
   (ask-before-touching
     ; *REMINDER: List areas where LLMs should check before modifying*
-    ; "src/abi/ — formal proofs, changes require re-verification"
+    ; "proofs/ — formal-verification artefacts, changes require re-verification (see proofs/README.adoc)"
     ; "ffi/zig/ — C ABI boundary, changes affect all language bindings"
     ; ".machine_readable/ — checkpoint files, format is specified"
   )

QUICKSTART-DEV.adoc

@@ -53,10 +53,9 @@ just setup-dev
 [source]
 ----
 neurophone/
-├── src/                  # Source code
-├── src/abi/              # Idris2 ABI definitions (if applicable)
+├── crates/               # Rust workspace (core pipeline, benches, tests live alongside each crate)
+├── proofs/               # Formal-verification artefacts (TLA+/Lean/Dafny) — see proofs/README.adoc
 ├── ffi/zig/              # Zig FFI bridge (if applicable)
-├── tests/                # Test suite
 ├── docs/                 # Documentation
 ├── .machine_readable/    # Checkpoint files (STATE, META, ECOSYSTEM)
 ├── Justfile              # Task runner recipes

README.adoc

@@ -352,17 +352,19 @@ adb push llama-3.2-1b-instruct-q4_k_m.gguf /data/local/tmp/
 
 === Configure
 
-Set Claude API key (for cloud fallback):
+Set your Claude API key (for cloud fallback) via the `ANTHROPIC_API_KEY`
+environment variable:
 
 ```bash
-export ANTHROPIC_API_KEY="your-api-key"
+export ANTHROPIC_API_KEY=<your-anthropic-api-key>
 ```
 
-Or in `config/default.toml`:
+Alternatively, the `api_key` field under `[claude]` in `config/default.toml`
+can hold it directly, but the environment variable is preferred so the key
+never has to live in a checked-in file:
 
 ```toml
 [claude]
-api_key = "your-api-key"
 model = "claude-sonnet-4-20250514"
 
 [llm]

config/default.toml

@@ -59,7 +59,8 @@ model_type = "Llama3_2_1B"  # Model variant
 
 # Claude Configuration (optional)
 [claude]
-# api_key = "sk-ant-..."  # Set via ANTHROPIC_API_KEY env var
+# API key is not configured here — set it via the ANTHROPIC_API_KEY
+# environment variable instead (never commit a key to this file).
 base_url = "https://api.anthropic.com/v1"
 model = "claude-sonnet-4-20250514"
 timeout_secs = 60

docs/AI_INSTALLATION_GUIDE.adoc

@@ -205,9 +205,10 @@ spike_threshold = 0.5
 reservoir_size = 300
 spectral_radius = 0.95
 
-# Uncomment to enable Claude API fallback:
+# To enable Claude API fallback, prefer exporting ANTHROPIC_API_KEY in
+# your shell rather than storing a key in this file. If you do want it
+# here instead, uncomment and fill in:
 # [claude]
-# api_key = "sk-ant-..."
 # model = "claude-sonnet-4-20250514"
 EOF
 

docs/build.adoc

@@ -39,17 +39,19 @@ adb push llama-3.2-1b-instruct-q4_k_m.gguf /data/local/tmp/
 
 === Configure
 
-Set Claude API key (for cloud fallback):
+Set your Claude API key (for cloud fallback) via the `ANTHROPIC_API_KEY`
+environment variable:
 
 ```bash
-export ANTHROPIC_API_KEY="your-api-key"
+export ANTHROPIC_API_KEY=<your-anthropic-api-key>
 ```
 
-Or in `config/default.toml`:
+Alternatively, the `api_key` field under `[claude]` in `config/default.toml`
+can hold it directly, but the environment variable is preferred so the key
+never has to live in a checked-in file:
 
 ```toml
 [claude]
-api_key = "your-api-key"
 model = "claude-sonnet-4-20250514"
 
 [llm]

scripts/install-termux.sh

@@ -10,7 +10,8 @@
 # `neurophone` CLI.
 #
 # Run inside Termux:
-#   curl -fsSL https://raw.githubusercontent.com/hyperpolymath/neurophone/main/scripts/install-termux.sh | bash
+#   curl -fsSL https://raw.githubusercontent.com/hyperpolymath/neurophone/main/scripts/install-termux.sh -o install-termux.sh
+#   bash install-termux.sh
 set -euo pipefail
 
 INSTALL_DIR="${INSTALL_DIR:-$HOME/.local/share/neurophone}"
@@ -72,7 +73,8 @@ n_threads = 4
 context_size = 2048
 
 [claude]
-# api_key = "sk-ant-..."   # uncomment + set for cloud fallback
+# For cloud fallback, set the ANTHROPIC_API_KEY environment variable
+# instead of storing a key in this file.
 model = "claude-sonnet-4-20250514"
 EOF
 fi

scripts/setup.sh

@@ -8,14 +8,18 @@ echo "=== NeuroPhone Development Setup ==="
 # Check Rust
 if ! command -v rustc &> /dev/null; then
     echo "Installing Rust..."
-# WARNING: Pipe-to-shell is unsafe — download and verify first
-# WARNING: Pipe-to-shell is unsafe — download and verify first
-# WARNING: Pipe-to-shell is unsafe — download and verify first
-# WARNING: Pipe-to-shell is unsafe — download and verify first
-# WARNING: Pipe-to-shell is unsafe — download and verify first
-# WARNING: Pipe-to-shell is unsafe — download and verify first
-# WARNING: Pipe-to-shell is unsafe — download and verify first
-    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+    # Download rustup-init to a temp file first rather than piping the
+    # remote script straight into `sh` (CWE-494). rustup.rs re-issues the
+    # installer script on every release with no stable, publishable
+    # checksum to pin, so this can't be a real signature check — but
+    # downloading first means a truncated/interrupted transfer can't
+    # partially execute, and the script is available on disk for
+    # inspection before it runs.
+    RUSTUP_INIT="$(mktemp)"
+    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -o "$RUSTUP_INIT"
+    chmod +x "$RUSTUP_INIT"
+    sh "$RUSTUP_INIT" -y
+    rm -f "$RUSTUP_INIT"
     source "$HOME/.cargo/env"
 fi