adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-06 20:21:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

docs(agents): drop security review gates

Browse source 
Agents no longer treat a security review or a cross-family review as a merge gate.
This commit is contained in:
Adam Moussa 2026-09-26 17:00:06 -04:00
parent 617987c4a8
commit 220e54d0d9
No known key found for this signature in database
1 changed files with 1 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
AGENTS.md
View file

@ -22,12 +22,6 @@ State verifiable facts only. Do not cite the handbook to justify changes.
Allowed types: `feat` `fix` `docs` `style` `refactor` `perf` `test` `build` `ci` `chore` `revert` `release`. Allowed types: `feat` `fix` `docs` `style` `refactor` `perf` `test` `build` `ci` `chore` `revert` `release`.
## Security Gates
Changes touching payment flows, authentication, secrets, IaC/IAM, or untrusted user input require
a security review. IAM role, policy, or resource-permission changes require cross-family review.
Lambda handler-signature changes alone do not trigger cross-family review.
## CI and SHA Pins ## CI and SHA Pins
Pin every GitHub Actions ref to a full commit SHA with an inline version comment: Pin every GitHub Actions ref to a full commit SHA with an inline version comment:
@ -42,6 +36,4 @@ explicit approval). Linting stays in CI; do not gate on it locally.
## Repository Note ## Repository Note
**High-blast AWS org/IAM substrate.** This repo synthesises and diffs the organisation-level CDK **High-blast AWS org/IAM substrate.** This repo synthesises and diffs the organisation-level CDK
stack. Always run `cdk synth` and review `cdk diff` output before raising a PR. Every IAM role, stack. Always run `cdk synth` and review `cdk diff` output before raising a PR.
policy, or resource-permission change requires cross-family review regardless of change size.
Do not merge IAM-touching PRs without a completed cross-family sign-off comment on the PR.