adam/orchestrator
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
This repository has been archived on 2026-08-04. You can view files and clone it, but cannot push or open issues or pull requests.
orchestrator/security-review
History
Adam Moussa 18412c7482 Remove parked security-review CI drafts 
CI was swapped for the global git hooks + nightly VM sweep (solo dev), so
the parked ci/*.yml and CI-BACKSTOP-NOTES.md were dead weight — a defective
workflow in-tree is a foot-gun. Recover from history if the team grows.
2026-06-16 14:59:42 -04:00
..
hooks Add security-review gate (review.sh + scanners + pre-commit hook) 2026-06-15 15:52:15 -04:00
DEPLOY-R720.md Tune checkov severity, wire npm audit, add CI backstop + R720 runbook 2026-06-15 15:57:34 -04:00
install-hooks.sh Add security-review gate (review.sh + scanners + pre-commit hook) 2026-06-15 15:52:15 -04:00
README.md Add security-review gate (review.sh + scanners + pre-commit hook) 2026-06-15 15:52:15 -04:00
review.sh Tune checkov severity, wire npm audit, add CI backstop + R720 runbook 2026-06-15 15:57:34 -04:00

README.md

security-review

The Sea Haven security-review gate. One pure-code script (review.sh), many triggers. See memory project-security-review-agent for the full design.

Pieces

  • review.sh — merges deterministic-scanner findings + agent findings, dedups, applies suppressions (justification required), and makes the block decision (no agent decides). Exit 1 = BLOCK.
  • hooks/pre-commit + install-hooks.sh — fast scanners-only hook for a target repo.
  • The agentic detector/verifier pass is the interactive /sh-security-review slash command (~/.claude/commands/sh-security-review.md), schema at ~/.claude/security-review/finding.schema.json.

Triggers (one script, many entry points)

  • On-demand (primary): run /sh-security-review in a Claude Code session (Max-covered), have it write its schema JSON, then review.sh --agent-findings out.json <repo> to gate.
  • Pre-commit: install-hooks.sh <repo> — fast deterministic scanners abort the commit early.
  • CI (Phase 3): the same review.sh runs headless as the unbypassable backstop.

Scanners

review.sh runs whatever is installed and logs the rest with install commands (no silent skips). Currently wired: cfn-lint. To give the deterministic layer teeth, install:

pipx install semgrep        # SAST: injection / authz / xss
brew install gitleaks       # hardcoded secrets
pipx install pip-audit      # vulnerable Python deps
pipx install checkov        # IaC / IAM misconfig

Each needs a small normalizer added to review.sh (map its JSON to the finding schema) when installed.

Status

review.sh gate validated against the local testbed: 16 findings, correct dedup of distinct same-CWE findings, suppression-without-justification rejected and surfaced, BLOCK on confirmed crit/high.