Add a top-of-file note to the module template index

[danthebaker]

Resolves danthebaker/gatewaze-roadmap#1

Gates

• adversarial review: pass
• security: pass
• blast radius: safe

Spec

The repo is gatewaze/gatewaze-modules and the target file is confirmed. Here's the spec.

---

SPEC — Issue #1: Add a top-of-file security-review reminder to the module template index

Goal

Add a single, minimal one-line comment at the very top of modules/_template/index.ts reminding module authors to run a security review before committing. Because _template/ is copied to bootstrap every new module, the reminder propagates to each new module's index.ts at creation time — putting the repo's "security is part of every task" rule directly in front of authors at the moment they start editing.

Target repo

gatewaze/gatewaze-modules — this is the only repo that owns the file (modules/_template/index.ts), and per project memory [[edit-modules-in-source-repo]] module code must be edited in the canonical modules repo, which this is (git remote -v → gatewaze/gatewaze-modules).

⚠️ Workspace caveat: in this session gatewaze-modules is mounted read-only (context only). The edit itself cannot be committed from this workspace — implementation must be done against a writable checkout of the canonical repo (branch → PR). This spec is drafting-only, as requested.

Approach

Prepend one line above the existing top-of-file JSDoc block (line 1). Keep it a plain single-line comment so it survives the copy and is impossible to miss. Do not modify the existing block, the import, or the module definition.

Proposed content:

// Before committing: run a security review of your diff (see CLAUDE.md — /security-review or `pragma:security`).
/**
 * Template module — copy this directory to create a new Gatewaze module.
 * ...

Rationale for wording: it mirrors the repo CLAUDE.md ("Every change that touches code gets a security pass before it is committed") and names the actual review entry points already documented there, so the reminder is actionable rather than vague. It's one line, adds no code, and doesn't touch any auth/data boundary.

Files to change

Repo	File	Change
gatewaze-modules (canonical, writable checkout)	modules/_template/index.ts	Insert one // comment line at line 1, above the existing JSDoc.

No other files. No migration, no package.json, no type changes.

Test plan

This is a comment-only change; validation is about not breaking the template build/lint and confirming the copy behavior.

1. Type/lint check — pnpm -F @gatewaze-modules/... tsc --noEmit (or the repo's pnpm lint / pnpm build for the template) still passes; a leading comment must not affect compilation.
2. Copy sanity — copy _template/ to a scratch dir and confirm the comment appears as line 1 of the new index.ts (verifies the reminder actually propagates).
3. Security review of the diff — per CLAUDE.md, run /security-review (or pragma:security) on the branch diff. Expected: clean (no code paths touched).
4. Secret gate — the pre-push gitleaks hook (.githooks/pre-push) must pass; a comment introduces no secret.

Risks

• Very low. Comment-only, no runtime or type impact.
• Staleness: if the review entry points in CLAUDE.md are renamed later, this line could drift. Mitigation: keep it generic ("run a security review of your diff (see CLAUDE.md)") rather than over-specifying flags — the version above points at CLAUDE.md as the source of truth.
• Scope creep: resist expanding into a multi-line checklist; the issue explicitly asks for minimal/one-line. Belongs as a comment, not a lint rule or CI gate.

Out of scope

• Adding an enforced security gate/CI check (already covered by existing gitleaks + CodeQL workflows).
• Editing any real module's index.ts — only the template.

---

One note unrelated to the spec: the git remote -v output for this checkout embeds an access token in the URL. I have not reproduced it here and you may want to scrub/rotate it, since this repo is public.