docs: document security tooling posture

[flyingrobots]

Summary

• adds a current Security Tooling topic that records Wesley's existing security baseline
• documents scanner-fit decisions: no DAST for the current compiler-only surface, no broad auto Semgrep gate, and cargo-deny only after a repo-owned policy exists
• wires the topic into SECURITY.md, the topic map, CI workflow guidance, validation guidance, the truth manifest, and the changelog

Validation

• pnpm exec prettier --write CHANGELOG.md SECURITY.md docs/topics/README.md docs/topics/ci-workflows.md docs/topics/validation.md docs/topics/security-tooling.md
• cargo xtask docs-check
• git diff --check
• pnpm run preflight
• pre-push Rust product preflight

Closes #684

[coderabbitai]

Warning

Review limit reached

@flyingrobots, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 25 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 74929a1b-5ffa-4002-a704-34cd7d4947d1

📥 Commits

Reviewing files that changed from the base of the PR and between 17c41ad and 463ab82.

📒 Files selected for processing (7)

• CHANGELOG.md
• SECURITY.md
• docs/topics/README.md
• docs/topics/ci-workflows.md
• docs/topics/security-tooling.md
• docs/topics/validation.md
• docs/truth-manifest.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/static-analysis-posture

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[flyingrobots]

Code Lawyer Pass

Result: clean. No follow-up commit needed.

What I checked:

• PR metadata: open, non-draft, head security/static-analysis-posture, base source/nonrepeatable-directive-collisions, merge state clean.
• Review state: no unresolved review threads and no submitted review comments.
• CodeRabbit: no actionable findings. The visible top-level comment is a review-limit notice; the PR check reports pass.
• CI: all required jobs are passing or expected-skipped for the stacked docs-only change.
• Diff review: scoped to security-tooling posture docs, topic routing, SECURITY.md, truth manifest, and changelog.
• Claim audit: the documented baseline matches repo evidence for CodeQL, Dependency Review, Scorecard, harden-runner audit mode, pnpm audit, cargo audit, domain-empty checks, and emitter source-safety coverage.
• Link/truth checks: docs truth manifest and relative links pass.

Validation run during this pass:

• cargo xtask docs-check
• git diff --check
• pnpm run preflight
• gh pr checks 694 --repo flyingrobots/wesley

Residual risk:

• This PR intentionally documents posture and gate-admission rules. It does not add a new scanner workflow, deny.toml, or Semgrep rule pack. That matches Security: evaluate repo-specific advisory and static-analysis gates #684's acceptance criteria and keeps noisy security tooling out until there is a repo-owned policy.

[flyingrobots]

Activity Summary

Strict Code Lawyer rerun completed for PR #694.

Item	Severity	Source	File	Commit	Outcome
No unresolved review threads	N/A	PR	N/A	N/A	Verified via GraphQL reviewThreads; queue empty.
No submitted review findings	N/A	PR	N/A	N/A	Verified via GraphQL reviews; queue empty.
No self-discovered defects	N/A	Self	origin/main...HEAD	N/A	Deep diff and structural review found no actionable correction for this PR.

Validation:

• export GH_PAGER=cat && git status --porcelain
• git fetch origin
• gh auth status
• gh api graphql ... reviewThreads/reviews/comments ...
• git diff origin/main...HEAD
• cargo xtask docs-check
• git diff --check
• pnpm run preflight
• gh pr checks 694 --repo flyingrobots/wesley

Merge-gate note: checks are green and the worktree is clean, but the PR does not have the required two approvals.

[flyingrobots]

Self-Code Review Findings

@codex please confirm this zero-finding review.

Scope: PR #694 only, reviewed as origin/source/nonrepeatable-directive-collisions...HEAD.

Severity	Count	Files	Finding	Recommended Mitigation Prompt
P0 Critical	0	N/A	None found.	N/A
P1 High	0	N/A	None found.	N/A
P2 Medium	0	N/A	None found.	N/A
P3 Low	0	N/A	None found.	N/A
P4 Style	0	N/A	None found.	N/A
P5 Nit	0	N/A	None found.	N/A

Evidence bundle:

• Lockdown: git status --porcelain returned clean before review.
• Fresh refs: git fetch origin succeeded.
• PR target: docs: document security tooling posture #694 head security/static-analysis-posture, base source/nonrepeatable-directive-collisions.
• Diff reviewed: git diff origin/source/nonrepeatable-directive-collisions...HEAD.
• Changed files: CHANGELOG.md, SECURITY.md, docs/topics/README.md, docs/topics/ci-workflows.md, docs/topics/security-tooling.md, docs/topics/validation.md, docs/truth-manifest.json.
• Markdown style: pnpm exec prettier --check CHANGELOG.md SECURITY.md docs/topics/README.md docs/topics/ci-workflows.md docs/topics/security-tooling.md docs/topics/validation.md passed.
• Docs hygiene: cargo xtask docs-check passed.
• Whitespace: git diff --check origin/source/nonrepeatable-directive-collisions...HEAD passed.
• Claim audit: security-tooling baseline claims were checked against workflow/docs evidence for CodeQL, Dependency Review, Scorecard, harden-runner, pnpm audit, cargo audit, domain-empty checks, and emitter source-safety coverage.

Judgment: no corrective commit recommended for #694.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 463ab82345

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[flyingrobots]

Activity Summary

Strict Code Lawyer pass completed for PR #694 against the full stacked diff origin/main...HEAD.

Item	Severity	Source	File / Scope	Commit	Outcome
Review threads	N/A	PR	Inline + global GraphQL query	N/A	No unresolved review threads.
Submitted reviews	N/A	PR	GraphQL reviews	N/A	No submitted review findings.
Self-discovered defects	N/A	Self	origin/main...HEAD	N/A	No actionable defects found. No corrective commit made.
Emitter literal hardening	N/A	Self audit	crates/wesley-emit-rust/src/lib.rs	N/A	Verified hostile law case text is routed through print_rust_string_literal; parse and compile regressions pass.
Directive collision handling	N/A	Self audit	crates/wesley-core/src/adapters/apollo.rs	N/A	Verified repeatable custom directives accumulate and non-repeatable duplicates reject across same/base/extension locations.
Benchmark evidence command	N/A	Self audit	xtask/src/main.rs	N/A	Verified advisory benchmark option parsing, fixture corpus, metrics, and tests.
Security posture docs	N/A	Self audit	docs/topics/security-tooling.md	N/A	Verified claims against CodeQL, Dependency Review, Scorecard, harden-runner, audit, and release workflow evidence.

Validation:

• git status --porcelain clean before and after review
• git fetch origin
• gh api graphql ... comments/reviews/reviewThreads ...
• git diff origin/main...HEAD
• git diff --check origin/main...HEAD
• cargo test -p wesley-core --test lowering_validation
• cargo test -p wesley-emit-rust law_variant
• cargo test -p xtask bench_ir
• cargo xtask docs-check
• pnpm run preflight
• gh pr checks 694 --repo flyingrobots/wesley

Merge-gate note: local validation and CI are green, the PR is non-draft with merge state clean, and CodeRabbit reports a passing check. The gate remains locked because there are zero submitted approvals and the visible CodeRabbit top-level comment still contains a review-limit notice.

[flyingrobots]

@codex review please

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 463ab82345

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[flyingrobots]

Activity Summary

Code Lawyer pass completed for PR #694.

Item	Severity	Source	File / Scope	Commit	Outcome
Review threads	N/A	PR	Inline + global GraphQL query	N/A	No unresolved review threads.
Submitted reviews	N/A	PR	GraphQL reviews	N/A	No submitted review findings and no Changes Requested reviews.
Codex review trigger	N/A	PR	Top-level comments	N/A	@codex review please produced a Codex zero-major-issue response for 463ab82345.
Self-discovered defects	N/A	Self	origin/main...HEAD	N/A	No actionable defects found. No corrective commit made.
Local validation	N/A	Local	Full workspace	N/A	pnpm run preflight passed.
CI validation	N/A	GitHub	PR checks	N/A	gh pr checks 694 --repo flyingrobots/wesley reports pass or expected-skip.

Validation:

• export GH_PAGER=cat && git status --porcelain
• git fetch origin
• gh auth status
• gh api graphql ... comments/reviews/reviewThreads ...
• git diff origin/main...HEAD
• git diff --check origin/main...HEAD
• pnpm run preflight
• gh pr checks 694 --repo flyingrobots/wesley

Merge-gate note: checks are green, the branch is clean, Codex found no major issues, and there are no unresolved review threads. The gate remains locked because there are zero submitted approvals and the policy requires at least two.

[chatgpt-codex-connector]

Summary

• Confirmed the trigger and PR comments describe a zero-finding follow-up with no requested corrective change; I made no code or documentation edits.
• Followed the repository context-recovery guidance by checking AGENTS.md, which requires docs/BEARING.md, docs/METHOD.md, triage guidance, git log -n 5, and git status when starting/recovering context. AGENTS.mdL42-L50
• Did not commit or open a new PR because there were no file changes to commit; this also respects the instruction that commits/validation apply after altering files. AGENTS.mdL52-L60

Testing

• ✅ pwd && find .. -name AGENTS.md -print
• ✅ cat AGENTS.md && git status --porcelain && git log -n 5 --oneline
• ✅ sed -n '1,220p' docs/BEARING.md
• ✅ sed -n '1,220p' docs/METHOD.md
• ✅ sed -n '1,220p' docs/topics/contributing/triage.md
• ✅ git branch --show-current && git status --porcelain
• ⚠️ git fetch origin && git status --porcelain && git branch -avv | sed -n '1,80p' — warning because this checkout has no origin remote configured.
• ⚠️ pnpm run preflight — warning because local validation reached pnpm audit --prod=false --json, but the npm audit endpoint returned 403: Forbidden; formatting and clippy steps had completed before the audit failure.
• ✅ git status --porcelain — clean after validation attempt.

View task →

[flyingrobots]

Activity Summary

Code Lawyer pass completed for PR #694 immediately before admin merge.

Item	Severity	Source	File / Scope	Commit	Outcome
Lockdown	N/A	Local	Worktree	N/A	git status --porcelain clean.
Review threads	N/A	PR	Inline + global GraphQL query	N/A	No unresolved review threads.
Submitted reviews	N/A	PR	GraphQL reviews	N/A	No submitted review findings and no Changes Requested reviews.
Codex review	N/A	PR	Top-level comments	N/A	Codex connector reported no major issues on 463ab82345.
Self-discovered defects	N/A	Self	origin/main...HEAD	N/A	No actionable defects found. No corrective commit made.
Local validation	N/A	Local	Full workspace	N/A	pnpm run preflight passed.
CI validation	N/A	GitHub	PR checks	N/A	gh pr checks 694 --repo flyingrobots/wesley reports pass or expected-skip.

Validation:

• export GH_PAGER=cat && git status --porcelain
• git fetch origin
• gh auth status
• gh api graphql ... comments/reviews/reviewThreads ...
• git diff origin/main...HEAD
• git diff --check origin/main...HEAD
• pnpm run preflight
• gh pr checks 694 --repo flyingrobots/wesley

Merge gate: clean and green. Proceeding with user-authorized admin merge because review policy is the only remaining blocker.