diff --git a/docs/pre-phase10-ux/SECURITY_REVIEW.md b/docs/pre-phase10-ux/SECURITY_REVIEW.md
new file mode 100644
index 0000000..fdc0d27
--- /dev/null
+++ b/docs/pre-phase10-ux/SECURITY_REVIEW.md
@@ -0,0 +1,19 @@
+# Cumulative security qualification
+
+28 October 2026. Static frozen-diff review, not production security acceptance.
+
+Codex Security scan `9772bf28-2e7a-4061-8e31-b016e1056f1b` completed and sealed for range `4a8c907d70cbed235728f7d690b5409e72b93abe..d52403dba873a17c83cbc18f0f87d544b72bd3d2`. All 136 changed files are accounted for: 58 server/test/provider paths, 48 frontend/test/configuration paths, and 30 local operator/documentation/Python/proof paths. The compact tool inventory contained 106 paths; the remaining Git changes were reviewed explicitly. No plausible new candidates or reportable findings remained. No application execution, production access or network fetch was performed by security reviewers.
+
+The generated report is the primary scan artifact:
+`C:/Users/Connor/.codex/state/plugins/codex-security/scans/Job-tracker/d52403dba873a17c83cbc18f0f87d544b72bd3d2_20261028T183155Z_3t6aiz6n/report.md`.
+Canonical sealed `scan-manifest.json`, `findings.json`, `coverage.json`, `threatmodel.md` and `exports/results.sarif` are alongside it. These are plugin-owned artifacts; this document is a repository evidence pointer, not a replacement scan report. Daybreak access was reported not granted, so protected result display may require account enrollment.
+
+The model records actual owner-denying filters, Admin metadata authority, expected-revision/transaction boundaries, HTML/style normalization, image bounds/re-encoding, sidecar privacy controls, parser process limits and guarded local helper authority. It also preserves architecture discrepancies: the old overview's no-leasing statement is stale relative to current claim/heartbeat code; direct sidecar startup can omit a service token while Compose requires one; PDF Chromium uses existing no-sandbox/local-file flags; local-only/offline model settings do not establish a host egress firewall. No newly reachable exploit was established for those unchanged paths. This review does not silently close them or certify unrelated mail/OAuth/backup/release implementations.
+
+Follow-up `4dcc07b4f978737cbba941230366bfb9c0923379` updates only the synthetic Linux qualification lifecycle fixture (compiled test API URL and the existing optional corpus flag). It was separately reviewed, with all 11 lifecycle tests passing; it lies outside the frozen scan. No PDF oracle tolerance or cleanup assertion was weakened.
+
+Separate fresh advisory evidence: `.artifacts/pre-phase10-ux/integration-independent-01/` records zero production npm advisories and zero known vulnerabilities in the 48-dependency Python import lock. Full npm audit retains five low-severity development-tool entries; no automatic Jest downgrade was applied. These are point-in-time advisory checks, not proof against unknown vulnerabilities. NuGet and final integrated evidence are recorded separately when complete.
+
+Security/privacy remains CONDITIONAL: native decoder/parser fuzzing, Windows parser memory enforcement, actual deployed model/provider parity, production filesystem/backup/cache qualification and human privacy review are not supplied by this static diff scan. Local synthetic inference is not factual CV extraction qualification. Production remains NO-GO.
+
+The workbench reports token usage from its rollout accounting: 10,878,261 total, 10,855,335 input and 10,457,856 cached input tokens (`coverage=complete`, three threads). These are the tool's measured accounting values, not a cost estimate or a claim that all prior thread input was caused by this review. The scan goal separately reported 489,500 tokens over 423 seconds; the accounting scopes differ and must not be added.