docs(audits): admin-merge wrapper sweep 2026-05-26 (human + a2ml)

[hyperpolymath]

Summary

Records the single-session estate-wide CI consolidation that ran today:

• 264 hypatia-scan wrappers + 14 main-retargets + 2 elixir-ci wrappers filed.
• 278 verified landed on main (24 owner-merged in-session, 254 admin-merged after diagnosis of pre-existing baseline rot).
• ~110k lines of duplicated YAML retired estate-wide.

Files

• docs/audits/audit-admin-merge-wrapper-sweep-2026-05-26.adoc — human-readable prose audit with the diagnosis, the inventory, and the rationale for admin-merge.
• docs/audits/audit-admin-merge-wrapper-sweep-2026-05-26.a2ml — machine-readable manifest (counters, sample evidence, follow-up trackers).

Why this audit doc exists

The admin-merge log shows 254 PRs landed with --admin override in one day. Without context that looks like accidental landings of broken stuff. The audit captures the actual case:

1. PRs were red due to pre-existing baseline rot on the receiving repos' main branches (verified on 6 random samples, each with 6–22 failing checks unrelated to the wrapper).
2. pull_request-triggered CI runs the target-branch workflow file (GitHub Actions security model), so the wrapper PRs inherited those reds through no fault of their own.
3. The wrapper IS the fix. After merge, the heavy 416-line workflow is gone from main, replaced by a 29-line wrapper that delegates to the reusable.
4. Holding the merge to wait for auto-merge would have burned GitHub Actions credit indefinitely on the rotten workflow.

The a2ml manifest also records what this campaign explicitly does NOT discharge:

• Baseline-rot remediation (separate ongoing Hypatia campaign)
• standards#193 (canonical reusable) still must land on main
• standards#189 (Python eradication; held back for normal CI)

Refs standards#193, standards#189.

Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 118 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "deno-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence