secrev/Plane-1: Phase 0 shared substrate + compliance-drift checker #14

Merged

amoussa1229 merged 2 commits from feature/agent-team-plane1-phase0 into main

2026-06-18 18:09:35 +00:00

Author SHA1 Message Date

Author	SHA1	Message	Date
Adam Moussa	28553d86f7	feat(secrev): compliance-drift Plane-1 Tier-1 checker (ALARM-only) Read-only org compliance checker on the shared substrate (no re-clone; scans existing mirrors). Checklist grounded in handbook/github-standards: kebab repo name, README, CI/CD, Dependabot config+alerts, tracked-.env secrets, branch protection, merge settings; handbook exceptions (docs-only, compliance-exempt) honored. Mode-600 reports, ALARM-only (clean=silent). Includes planted-drift canary (asserts 6). Review fixes folded in: branch-protection + dependabot are status-code-aware (only a real 404 is drift; transient API failure -> skip, no false alarm); secrets-committed fires only on secret-shaped values (not benign config). NOT scheduled (provisioning gated).	2026-06-18 14:06:31 -04:00
Adam Moussa	1a1facd945	refactor(secrev): factor shared sweep substrate out of nightly_sweep.sh (Plane-1 Phase 0) Extract discovery/mirror/budget-ledger/rotation/Slack-ALARM(redaction)/canary into security-review/lib/sweep_substrate.sh (sourceable, bash, stdlib only); nightly_sweep.sh (415->362) now sources it. Zero behavior change proven: shellcheck -x clean, offline two-tier dry-run byte-identical before/after, token discipline (read-only PAT, REST-only, no gh CLI, origin scrubbed) preserved, review.sh untouched. Revert point: `73e35f3`. Foundation both planes' scheduled side reuses.	2026-06-18 14:06:31 -04:00

Adam Moussa

28553d86f7

feat(secrev): compliance-drift Plane-1 Tier-1 checker (ALARM-only)

Read-only org compliance checker on the shared substrate (no re-clone; scans existing mirrors). Checklist grounded in handbook/github-standards: kebab repo name, README, CI/CD, Dependabot config+alerts, tracked-.env secrets, branch protection, merge settings; handbook exceptions (docs-only, compliance-exempt) honored. Mode-600 reports, ALARM-only (clean=silent). Includes planted-drift canary (asserts 6). Review fixes folded in: branch-protection + dependabot are status-code-aware (only a real 404 is drift; transient API failure -> skip, no false alarm); secrets-committed fires only on secret-shaped values (not benign config). NOT scheduled (provisioning gated).

2026-06-18 14:06:31 -04:00

Adam Moussa

1a1facd945

refactor(secrev): factor shared sweep substrate out of nightly_sweep.sh (Plane-1 Phase 0)

Extract discovery/mirror/budget-ledger/rotation/Slack-ALARM(redaction)/canary into security-review/lib/sweep_substrate.sh (sourceable, bash, stdlib only); nightly_sweep.sh (415->362) now sources it. Zero behavior change proven: shellcheck -x clean, offline two-tier dry-run byte-identical before/after, token discipline (read-only PAT, REST-only, no gh CLI, origin scrubbed) preserved, review.sh untouched. Revert point: 73e35f3. Foundation both planes' scheduled side reuses.

2026-06-18 14:06:31 -04:00