feat(baseline): pin-and-diff suppression baseline (bash + PowerShell)

[eric-sabe]

What & why

honey's verdict is worst-wins across bumblebee + every lens, and a lens flips to exposed on the first finding at any severity. A daily run over trusted, first-party agent skills emits 100+ static-analysis false positives (reference docs, LICENSE files, MCP examples) that drag OVERALL to EXPOSED every day and bury the real findings.

This adds a suppression baseline to acknowledge a reviewed-benign finding once — as a pin, not a mute. Each entry records a sha256 of the referenced file, so suppression and change-detection are the same mechanism:

State	Result
pinned, file unchanged	suppressed — dropped from the verdict, still counted
pinned, file changed	🔁 MUTATED — resurfaces loudly (the rug-pull tripwire)
pin past expiry (default 90d)	resurfaces as a normal finding

Suppression is a report-layer re-rank, never a deletion (raw run records untouched), and a suppressed run never reads as a bare all-clear — the verdict always carries the tallies, e.g. OVERALL: CLEAN (12 suppressed) or OVERALL: EXPOSED — … (12 suppressed, 2 mutated).

On last night's real run this collapses the 123 skillspector false positives to "clean — all suppressed" and lets the 3 genuine npm CVEs (osv-scanner) drive the verdict alone — honestly annotated.

Design (see docs/BASELINE.plan.md)

Draws on adjacent ecosystems: content hash (vs gitleaks' fragile location-only fingerprint), ~-relative paths (portable across machines), Semgrep-style occurrence index + deterministic ordering (no fingerprint cycling), expiry (trivy/detect-secrets), and a bumblebee opt-in guard (--all excludes known-compromised matches; pinning one requires explicit --scanner bumblebee). The baseline file is committed and reviewable — that auditability is itself an anti-gaming control. The doc is explicit about what the design does not defend (sleepers, runtime-fetched includes, image payloads — things never flagged in the first place).

Multi-OS parity preserved

Mirrored in the win/ PowerShell port, verified behavior-identical (incl. byte-identical file hashes) on macOS bash 3.2 + pwsh 7.5.4.

• bash: lib/baseline.sh (classifier), honey-baseline.sh (CLI); report.sh/daily-cycle.sh/doctor.sh integrate it; honey.baseline.json starter.
• win: win/lib/Baseline.psm1, win/honey-baseline.ps1; report.ps1/daily-cycle.ps1/doctor.ps1 updated.

Manage it

./honey-baseline.sh status                    # dry-run tally
./honey-baseline.sh add --scanner skillspector --location references/ \
    --reason "first-party docs" --expires 90
./honey-baseline.sh list [--expired|--active]
./honey-baseline.sh remove --scanner skillspector --location references/
./honey-baseline.sh prune

Quality gates

• report.sh output is byte-identical to before when the baseline is empty (no regression).
• shellcheck clean (-x, 5 bash files); PSScriptAnalyzer clean under the repo's Warning-level settings (5 PS files).
• Lifecycle verified on both platforms: suppressed / mutated / expired classification, occurrence-index disambiguation, idempotent add, verdict math, and the mutation tripwire.

Docs

New docs/BASELINE.plan.md; README (section + config var + layout); routine-prompt.md and triage-guide.md teach the CLEAN (N suppressed) / MUTATED semantics so the Claude routine won't re-alarm on pins or fold a MUTATED into "all clear"; win/TESTING.md adds a baseline test step.

🤖 Generated with Claude Code