From faa00a7cace3170a37702d086a0f6040e79db6f3 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Thu, 18 Jun 2026 16:27:12 -0400 Subject: [PATCH 1/2] feat(secrev): wire full Plane-1 roster into the checker coordinator registry Register doc-drift, aws-posture, plan-groomer, confluence-doc (weekly cadence) alongside compliance-drift + dependency-cve (nightly). The coordinator canary suite now runs all 6 roles' canaries (all PASS) under the one shared budget + versioned rotation/coverage state; --squeeze-dry-run still proves defer-not-drop + COVERAGE alarm. Central integration after the parallel Phase-3/4 PRs landed. --- security-review/checker_coordinator.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/security-review/checker_coordinator.sh b/security-review/checker_coordinator.sh index 0d5fcb5..36acb68 100755 --- a/security-review/checker_coordinator.sh +++ b/security-review/checker_coordinator.sh @@ -8,7 +8,8 @@ # budget-squeeze dry-run to prove deferral-not-drop + COVERAGE ALARM"). # # WHAT IT DOES: -# Orchestrates the Plane-1 Tier-1 checkers (compliance-drift, dependency-cve) under ONE shared +# Orchestrates the Plane-1 checkers (compliance-drift, dependency-cve, doc-drift, aws-posture, +# plan-groomer, confluence-doc) under ONE shared # budget + versioned rotation/coverage state. Nightly it (mirrors nightly_sweep + §5): # 1) loads the shared budget ledger + the versioned rotation/coverage state (integrity-checked) # 2) runs the CANARY SUITE FIRST — each role's checker with --canary; a miss is a COMPLACENCY @@ -128,6 +129,10 @@ fi declare -a ROLES=( "compliance-drift|$CHECKERS_DIR/compliance-drift.sh|0.00|1" "dependency-cve|$CHECKERS_DIR/dependency-cve.sh|0.00|1" + "doc-drift|$CHECKERS_DIR/doc-drift.sh|0.00|7" + "aws-posture|$CHECKERS_DIR/aws-posture.sh|0.00|7" + "plan-groomer|$CHECKERS_DIR/plan-groomer.sh|0.00|7" + "confluence-doc|$CHECKERS_DIR/confluence-doc.sh|0.00|7" ) role_field() { echo "$1" | cut -d'|' -f"$2"; } -- 2.50.1 From 148fbc90a6cbbf4e467b25b4b759a94e497742bc Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Thu, 18 Jun 2026 16:28:48 -0400 Subject: [PATCH 2/2] fix(secrev): valid SAM in doc-drift fixture templates (cfn-lint E0001) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The doc-drift sample-stack fixtures declared AWS::Serverless::Function with no Properties; cfn-lint's SAM transform errored (HIGH). Added minimal valid Properties (Handler/Runtime/InlineCode). Pre-existing on main — #19 pushed with --no-verify (xargs overflow) and CI runs no cfn-lint, so it slipped through. doc-drift still detects the stack (keys on template presence). --- .../checkers/fixtures/doc-drift/clean-repo/template.yaml | 6 ++++++ .../fixtures/doc-drift/drift-omits-repo/template.yaml | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/security-review/checkers/fixtures/doc-drift/clean-repo/template.yaml b/security-review/checkers/fixtures/doc-drift/clean-repo/template.yaml index 513273c..549a326 100644 --- a/security-review/checkers/fixtures/doc-drift/clean-repo/template.yaml +++ b/security-review/checkers/fixtures/doc-drift/clean-repo/template.yaml @@ -3,3 +3,9 @@ Transform: AWS::Serverless-2016-10-31 Resources: IngestFn: Type: AWS::Serverless::Function + Properties: + Handler: app.handler + Runtime: python3.12 + InlineCode: | + def handler(event, context): + return {"statusCode": 200} diff --git a/security-review/checkers/fixtures/doc-drift/drift-omits-repo/template.yaml b/security-review/checkers/fixtures/doc-drift/drift-omits-repo/template.yaml index 9a24dce..3f49180 100644 --- a/security-review/checkers/fixtures/doc-drift/drift-omits-repo/template.yaml +++ b/security-review/checkers/fixtures/doc-drift/drift-omits-repo/template.yaml @@ -3,3 +3,9 @@ Transform: AWS::Serverless-2016-10-31 Resources: ChargeFn: Type: AWS::Serverless::Function + Properties: + Handler: app.handler + Runtime: python3.12 + InlineCode: | + def handler(event, context): + return {"statusCode": 200} -- 2.50.1