From a1ecfc0aef85bbd82c2e1346cc775d7a896616a6 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 6 Aug 2026 13:50:24 +0100
Subject: [PATCH] chore(hypatia): acknowledge 23 findings in the baseline
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `Validate Hypatia Baseline` gate fails on any finding not acknowledged in
.hypatia-baseline.json, at threshold `info` — so every existing finding blocks
every pull request, including ones that touch none of it.

Ruling: acknowledge the current findings and KEEP the threshold at `info`, so
only NEW findings block from here. That preserves the gate's strictness rather
than lowering the bar estate-wide, and records the debt explicitly instead of
hiding it.

Entries were taken from the gate's own job output — the findings it actually
produced, tagged `baseline_status: "new"` — rather than from a local scanner
that might be a different version. Only those entries are added; findings
already matched by the existing baseline are left alone so their
severity_override values are not lost.

Types covered: DependencyPinning, unpinned_action.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .hypatia-baseline.json | 138 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 138 insertions(+)

diff --git a/.hypatia-baseline.json b/.hypatia-baseline.json
index f1dfaf8..7940332 100644
--- a/.hypatia-baseline.json
+++ b/.hypatia-baseline.json
@@ -2016,5 +2016,143 @@
     "type": "SD022",
     "file": "docs/SSG_ROADMAP.adoc",
     "note": "Roadmap doc: paths are planned future modules, not renames"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "scorecard",
+    "type": "DependencyPinning",
+    "file": "."
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "agda-meta-checker.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "boj-build.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "bridge-gate.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "cargo-audit.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "cflite_batch.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "cflite_pr.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "chapel-ci.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "codeql.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "container-ci.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "dogfood-gate.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "dogfood-proofs-ci.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "formal-verification.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "generator-generic-ossf-slsa3-publish.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "ghcr-publish.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "idris2-abi-ci.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "live-provers.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "mvp-smoke.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "pages.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "s4-loop.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "server-boot-gate.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "verification-proofs-cron.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "workflow-linter.yml"
   }
 ]