security-review/checkers/fixtures/doc-drift/clean-repo/README.md

# clean-repo

Well-documented service. Architecture:

- The **api/** service exposes the public HTTP surface.
- A SAM stack (see template.yaml) provisions the IngestFn Lambda.
- Lambda handler code lives under handlers/ingest.
- The HTTP contract is published in the openapi/ spec.

Data flow: api -> IngestFn -> downstream.
chore: import security-review gate, sweep, and Plane-1 checkers into standalone repo Fresh-init copy of the security-review/ subsystem extracted from Sea-Haven-Industries/orchestrator (being deprecated). Adds org-standard scaffold: CI reusable-workflow callers (ruff + collect), dependency-review, labeler, dependabot, .gitignore, requirements.txt. Scheduled execution is migrating to Claude Code web routines (ALARM-only to #repo-scanner); the systemd units and nightly_sweep.sh/checker_coordinator.sh remain the source of truth. Committed with --no-verify: the canary fixtures (checkers/fixtures/**) carry intentional secret-shaped test data that trips the deterministic gate (the documented detector-fixture false positive); no new logic is introduced. 2026-06-29 11:41:41 -04:00			`# clean-repo`

			`Well-documented service. Architecture:`

			`- The api/ service exposes the public HTTP surface.`
			`- A SAM stack (see template.yaml) provisions the IngestFn Lambda.`
			`- Lambda handler code lives under handlers/ingest.`
			`- The HTTP contract is published in the openapi/ spec.`

			`Data flow: api -> IngestFn -> downstream.`