migration: wave 3 — 5 integer brains (NetworkZones, Terminal, VmState, VMNetwork, VMMessageBus)

[hyperpolymath]

Migration wave 3 — integer brains from string-gated + de-quarantined idaptik modules

Third extraction wave. Continues the C1–C12 + waves 1/2 pattern: pure-integer "brains" extracted to .affine (compiled to wasm, verified by independent-oracle parity + assail), all string/float/async/state kept host-side. Notably includes files previously quarantined on String.startsWith — confirmed a host-side sense the brains don't touch.

Migrated — 5 kernels (verified: I re-ran every gate myself)

Kernel	What	Parity	Assail
NetworkZones	zone taxonomy (0..7) + ISP routing-class	64/64	clean
Terminal	command taxonomy (0..23) + SSH-stack bounds + output ring-buffer + cursor-blink FSM + backspace clamp (16 exports)	421/421	clean
VmState	flat-memory addressing/introspection (256-cell bound, validity, range guard, stack depth, port-input remaining; 8 exports)	38577/38577	clean
VMNetwork	Tier-5 causal-ordering core: tick/sync/merge_timestamp/merge_register/can_undo/route_kind	251/251	clean
VMMessageBus	message-routing dispatch over two enum bands (messageTarget 0..7 + coopEvent 0..6; 9 exports)	84/84	clean

VMNetwork/VMMessageBus match existing host coprocessor contracts (VMNetworkCoprocessor.res). Terminal is the standout — a 1115-LOC, ~90%-string module still yielded a clean separable integer brain (the 700-line command switch, tokenising, SSH parsing, Pixi rendering all stay ReScript).

Already-migrated / no brain

• PortNames → already migrated in a prior session (re-verified 52/52; left untouched).
• CoprocessorBridge, VMBridge → NO_NEW_BRAINS (pure host-side bridges; every integer transform they route to is already a migrated brain — Coprocessor_Compute/Security, VmArith/VmBitwise/VmStack/VmMemory/VmState).

Playbook by-product

VmState hit two real parse traps worth recording: a nested else { if <cond-with-subtraction> } parse-errors (flatten to early-return guards), and total is a reserved keyword (rename accumulators).

https://claude.ai/code/session_01WoKhFQePiRsAj7aqnxbG8s

[github-actions]

🔍 Hypatia Security Scan

Findings: 40 issues detected

Severity	Count
🔴 Critical	2
🟠 High	22
🟡 Medium	16

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/packages/affinescript-cli/mod.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (2 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/packages/affine-vscode/mod.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-vite/src/affine-plugin-improved.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (32 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/wasm_gen.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (29 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/affine_gen.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (2 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/panic.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (1 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/alloc.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence