migration: 6 integer-brain kernels (wave 2) from string-gated idaptik modules

[hyperpolymath]

Migration wave 2 — 6 integer-brain kernels from string-gated idaptik modules

Continues the integer-brain extraction (the C1–C12 pattern: pure-integer decision logic crosses to .affine/wasm; strings/floats/async stay host-side as "senses"). Each kernel is a four-gate deliverable — G1 compile, G2 independent-oracle differential parity, G4 assail-clean — and every one was re-verified by me, not just self-reported by the agent that wrote it:

Kernel	Exports	Parity
DLCLoader	tier_count/clamp/of_number, par_moves, hint_threshold	46/46
CharacterSelectScreen	csel_trunc_* / grid placement	161/161
StateDiff	change_flag, matches_target, is_mismatch	108/108
InstructionParser	min/max/accepts_arg_count, is_parseable_opcode	297/297
Coprocessor_Compute	gcd, mod_nonneg, is_prime, fib, pow_clamped, signal, thermal, cablesag, power_*	4839/4839
Coprocessor_Security	LCG spine + XOR-fold/checksum bit-arithmetic	1533/1533

All assail-clean (0 findings). Re-decompositions, not transliterations — e.g. CharacterSelectScreen sees only the length Int (the string stays host-side), InstructionParser reuses the canonical VmInstruction 0..22 opcode band (text parse host-side), Coprocessor_Security's LCG models i32 wraparound with Math.imul/|0 in its independent oracle.

NO_NEW_BRAINS this wave (honest non-results): GossamerFs (%raw IPC senses), KernelMonitor (already covered by the uirenderlogic cross-cutting coprocessor), SafeJson (pure JSON-text parsing — no integer core).

A 7th kernel (Moletaire) is still extracting and will be added to this branch when verified.

https://claude.ai/code/session_01WoKhFQePiRsAj7aqnxbG8s

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 40 issues detected

Severity	Count
🔴 Critical	2
🟠 High	22
🟡 Medium	16

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/packages/affinescript-cli/mod.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (2 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/packages/affine-vscode/mod.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-vite/src/affine-plugin-improved.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (32 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/wasm_gen.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (29 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/affine_gen.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (2 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/panic.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (1 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/alloc.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence