Finding
kanon lint fails on akroasis main with 185 pre-existing violations (18 error-severity), blocking kanon gate --stamp — no human PR can earn the Gate-Passed trailer required by gate-attestation. The rule set evolved faster than this repo; nothing here is introduced by in-flight PRs.
Evidence
kanon lint . --report @ fix/rustsec-2026-07 (main + lockfile-only diff), 2026-07-16. Error-severity rows, in priority order:
RUST/plain-string-secret — crates/akroasis/src/vault/mod.rs:296 (a secret in a plain String in the VAULT module — burn this first)RUST/indexing-slicing — crates/kerykeion/src/crypto.rs:43 (panic path in crypto code)- 6×
RUST/indexing-slicing + 10× RUST/unwrap — crates/syntonia/src/baofeng/{codec,variant}.rs (radio codec parse paths)
Warning-tier families: 32× bare-assert, 25× shallow-struct, 17× arc-mutex-anti-pattern, 16× config-deny-unknown-fields, 16× no-result-unwrap-or-default, 10× unwrap, plus tail (full list in the committed baseline file).
Why this matters
The gate wall surfaced while landing the RUSTSEC security fix (#260): a repo that cannot stamp cannot land human work, and the two error clusters are in security-bearing code (vault, crypto).
Desired correction
Burn down by family, errors first (vault secret → kerykeion crypto indexing → baofeng parse robustness → warning families). A .kanon-lint-baseline.toml (kanon#1040 pattern) ships with #260 to unblock stamping — remove_after = 2026-08-13; an expired non-empty baseline fails the gate, so this must be cleared by then.
Done when: kanon lint . is clean on main with the baseline file deleted.
Finding
kanon lintfails on akroasis main with 185 pre-existing violations (18 error-severity), blockingkanon gate --stamp— no human PR can earn theGate-Passedtrailer required by gate-attestation. The rule set evolved faster than this repo; nothing here is introduced by in-flight PRs.Evidence
kanon lint . --report@ fix/rustsec-2026-07 (main + lockfile-only diff), 2026-07-16. Error-severity rows, in priority order:RUST/plain-string-secret—crates/akroasis/src/vault/mod.rs:296(a secret in a plain String in the VAULT module — burn this first)RUST/indexing-slicing—crates/kerykeion/src/crypto.rs:43(panic path in crypto code)RUST/indexing-slicing+ 10×RUST/unwrap—crates/syntonia/src/baofeng/{codec,variant}.rs(radio codec parse paths)Warning-tier families: 32× bare-assert, 25× shallow-struct, 17× arc-mutex-anti-pattern, 16× config-deny-unknown-fields, 16× no-result-unwrap-or-default, 10× unwrap, plus tail (full list in the committed baseline file).
Why this matters
The gate wall surfaced while landing the RUSTSEC security fix (#260): a repo that cannot stamp cannot land human work, and the two error clusters are in security-bearing code (vault, crypto).
Desired correction
Burn down by family, errors first (vault secret → kerykeion crypto indexing → baofeng parse robustness → warning families). A
.kanon-lint-baseline.toml(kanon#1040 pattern) ships with #260 to unblock stamping —remove_after = 2026-08-13; an expired non-empty baseline fails the gate, so this must be cleared by then.Done when:
kanon lint .is clean on main with the baseline file deleted.