docs(governance): resolve CONFIRM-08/09, add ADR-0010 security-gate trust model#201
Merged
Merged
Conversation
Runs the paperwork lane of the tribunal remediation campaign, unblocking dependent code work in parallel with the code lanes. - ADR-0010: security-gate pass is a cooperative-agent attestation, not a non-fabricable proof (resolves appsec-003). No producer change; the trust boundary is documented rather than machinery added for a threat the cooperative-orchestrator model does not claim to stop. - CONFIRM-08: approve LGPL-3.0-or-later + 0BSD build-time site/ deps with a docs-site/build-time scope note; neither reaches the shipped plugin payload. - CONFIRM-09: audit-completeness = strategy (a), a staleness *warn* paired with the #186 gate-events sink; implementation rides with #186. - open-questions CONFIRM count drops 3 -> 1 (only CONFIRM-05 remains). Closes #196 Ref: ADR-0010 Claude-Session: https://claude.ai/code/session_01PVTCDji6bEuf9SifQ8tfsa
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Paperwork lane of the tribunal remediation campaign — runs in parallel with the code lanes, unblocking dependent work.
Decisions recorded (all user-attributed, BY SUaDtL@users.noreply.github.com, 2026-07-02)
security-controls.md. Declined binding the marker to a reviewer-signed artifact (defends a non-cooperating Bash-capable agent already outside the threat model).LGPL-3.0-or-later(18@img/sharp-libvips-*) +0BSD(tslib), scoped to build-timesite/only. Neither reaches the shipped plugin payload.Effect
open-questions.mdCONFIRM count drops 3 → 1 (only CONFIRM-05, the farm promotion bar, remains)..codearbiter/project state — no plugin payload change, no version bump, no CI code-suite impact.Conflict-hierarchy note: level 1 (audit-trail/security) vs level 3 (maintainability) — chose the documented-boundary posture over brittle machinery.
Closes #196
https://claude.ai/code/session_01PVTCDji6bEuf9SifQ8tfsa