diff --git a/security-review/checker_coordinator.sh b/security-review/checker_coordinator.sh index 0d5fcb5..36acb68 100755 --- a/security-review/checker_coordinator.sh +++ b/security-review/checker_coordinator.sh @@ -8,7 +8,8 @@ # budget-squeeze dry-run to prove deferral-not-drop + COVERAGE ALARM"). # # WHAT IT DOES: -# Orchestrates the Plane-1 Tier-1 checkers (compliance-drift, dependency-cve) under ONE shared +# Orchestrates the Plane-1 checkers (compliance-drift, dependency-cve, doc-drift, aws-posture, +# plan-groomer, confluence-doc) under ONE shared # budget + versioned rotation/coverage state. Nightly it (mirrors nightly_sweep + §5): # 1) loads the shared budget ledger + the versioned rotation/coverage state (integrity-checked) # 2) runs the CANARY SUITE FIRST — each role's checker with --canary; a miss is a COMPLACENCY @@ -128,6 +129,10 @@ fi declare -a ROLES=( "compliance-drift|$CHECKERS_DIR/compliance-drift.sh|0.00|1" "dependency-cve|$CHECKERS_DIR/dependency-cve.sh|0.00|1" + "doc-drift|$CHECKERS_DIR/doc-drift.sh|0.00|7" + "aws-posture|$CHECKERS_DIR/aws-posture.sh|0.00|7" + "plan-groomer|$CHECKERS_DIR/plan-groomer.sh|0.00|7" + "confluence-doc|$CHECKERS_DIR/confluence-doc.sh|0.00|7" ) role_field() { echo "$1" | cut -d'|' -f"$2"; } diff --git a/security-review/checkers/fixtures/doc-drift/clean-repo/template.yaml b/security-review/checkers/fixtures/doc-drift/clean-repo/template.yaml index 513273c..549a326 100644 --- a/security-review/checkers/fixtures/doc-drift/clean-repo/template.yaml +++ b/security-review/checkers/fixtures/doc-drift/clean-repo/template.yaml @@ -3,3 +3,9 @@ Transform: AWS::Serverless-2016-10-31 Resources: IngestFn: Type: AWS::Serverless::Function + Properties: + Handler: app.handler + Runtime: python3.12 + InlineCode: | + def handler(event, context): + return {"statusCode": 200} diff --git a/security-review/checkers/fixtures/doc-drift/drift-omits-repo/template.yaml b/security-review/checkers/fixtures/doc-drift/drift-omits-repo/template.yaml index 9a24dce..3f49180 100644 --- a/security-review/checkers/fixtures/doc-drift/drift-omits-repo/template.yaml +++ b/security-review/checkers/fixtures/doc-drift/drift-omits-repo/template.yaml @@ -3,3 +3,9 @@ Transform: AWS::Serverless-2016-10-31 Resources: ChargeFn: Type: AWS::Serverless::Function + Properties: + Handler: app.handler + Runtime: python3.12 + InlineCode: | + def handler(event, context): + return {"statusCode": 200}