From faa00a7cace3170a37702d086a0f6040e79db6f3 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Thu, 18 Jun 2026 16:27:12 -0400 Subject: [PATCH] feat(secrev): wire full Plane-1 roster into the checker coordinator registry Register doc-drift, aws-posture, plan-groomer, confluence-doc (weekly cadence) alongside compliance-drift + dependency-cve (nightly). The coordinator canary suite now runs all 6 roles' canaries (all PASS) under the one shared budget + versioned rotation/coverage state; --squeeze-dry-run still proves defer-not-drop + COVERAGE alarm. Central integration after the parallel Phase-3/4 PRs landed. --- security-review/checker_coordinator.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/security-review/checker_coordinator.sh b/security-review/checker_coordinator.sh index 0d5fcb5..36acb68 100755 --- a/security-review/checker_coordinator.sh +++ b/security-review/checker_coordinator.sh @@ -8,7 +8,8 @@ # budget-squeeze dry-run to prove deferral-not-drop + COVERAGE ALARM"). # # WHAT IT DOES: -# Orchestrates the Plane-1 Tier-1 checkers (compliance-drift, dependency-cve) under ONE shared +# Orchestrates the Plane-1 checkers (compliance-drift, dependency-cve, doc-drift, aws-posture, +# plan-groomer, confluence-doc) under ONE shared # budget + versioned rotation/coverage state. Nightly it (mirrors nightly_sweep + §5): # 1) loads the shared budget ledger + the versioned rotation/coverage state (integrity-checked) # 2) runs the CANARY SUITE FIRST — each role's checker with --canary; a miss is a COMPLACENCY @@ -128,6 +129,10 @@ fi declare -a ROLES=( "compliance-drift|$CHECKERS_DIR/compliance-drift.sh|0.00|1" "dependency-cve|$CHECKERS_DIR/dependency-cve.sh|0.00|1" + "doc-drift|$CHECKERS_DIR/doc-drift.sh|0.00|7" + "aws-posture|$CHECKERS_DIR/aws-posture.sh|0.00|7" + "plan-groomer|$CHECKERS_DIR/plan-groomer.sh|0.00|7" + "confluence-doc|$CHECKERS_DIR/confluence-doc.sh|0.00|7" ) role_field() { echo "$1" | cut -d'|' -f"$2"; }