fix(governance): TS allowlist regex + introduce .governance-allowlist (Layer 2.5)

[hyperpolymath]

Summary

Root-causes and fixes the long-standing governance / Language / package anti-pattern policy false-fail on every PR in affinescript.

The job parses per-repo TypeScript exemptions from a markdown table in .claude/CLAUDE.md, but the original heading-match regex was the literal pattern TypeScript [Ee]xemptions — accepting only the exact two-word heading. affinescript's heading is ### TypeScript / JavaScript Exemptions (Approved) — the slash and JavaScript between the two keywords mean the regex never matched, the 3 legitimate exemptions (packages/affine-js/types.d.ts, packages/affinescript-cli/mod.d.ts, affinescript-deno-test/*.ts) were silently ignored, and the check has been red on every PR in that repo for as long as the heading text has carried the extra words.

Two-layer fix

1. Regex relaxation + multi-table support. The exemption-heading regex is now (?:TypeScript|JavaScript|TS|JS|\.tsx?)\b[^#\n]*[Ee]xemption so it matches the slash-form heading, the singular form, and .ts-mentioning variants. The loop is also no longer "break on first heading" — it scans every heading and re-evaluates whether the next section is another exemption table.

2. .governance-allowlist mechanism (new Layer 2.5). Optional plain-text allowlist file at the repo root. One glob per line, #-comments supported. Decoupled from .claude/CLAUDE.md heading text. Both sources merge on every check; either alone is sufficient.

Test plan

• Python smoke: regex matches 11/11 representative heading variants
• End-to-end parse of affinescript/.claude/CLAUDE.md against patched logic yields 3 exemptions (was 0)
• docs/EXEMPTION-MECHANISMS.adoc updated with Layer 2.5 section

Cross-refs

• Refs hyperpolymath/affinescript "Known-failing baseline checks"
• Refs Track: ReScript→AffineScript migration backlog (~4,939 LOC) gitbot-fleet#148

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 118 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "deno-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence