fix(assail): UnboundedAllocation is Medium, not Critical

[hyperpolymath]

Summary

Changes Severity::Critical → Severity::Medium for the UnboundedAllocation weak point emitted by fn analyze_rust in src/assail/analyzer.rs. This is the only WeakPoint construction for this category; the other occurrences in analyzer.rs are .filter() calls on existing findings and are unaffected.

Motivation: The heuristic keyword match ("potential pattern") was calibrated at Critical but was ~70% of all estate Criticals in the 2026-06-11 estate-loop audit, drowning confirmed findings. Hypatia's ingest already caps it to Medium for scans produced by older binaries; this aligns the source so the raw store and PR-scan-comments also reflect the corrected severity estate-wide.

Rebased onto current main (6a814fa). Supersedes #128.

Test plan

• cargo build --release — clean
• cargo test --release assail — pass
• cargo test --release unbounded — 6 detection tests green (assert presence, not severity)
• Change adds no new clippy warnings

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 43 issues detected

Severity	Count
🔴 Critical	6
🟠 High	15
🟡 Medium	22

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (3 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/axial/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/ambush/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/attestation/evidence.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/src/attestation/chain.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (1 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/panic-attack/panic-attack/src/jit_context.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "mem::transmute bypasses type safety with unchecked bit reinterpretation (12 occurrences, CWE-704)",
    "type": "transmute",
    "file": "/home/runner/work/panic-attack/panic-attack/src/jit_context.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (3 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/kanren/strategy.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/sweep_tracker/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence