docs(security): preserve offline preflight and mandatory scan gates

2026-11-02 22:04:25 +01:00
parent ba826de1e5
commit 1bbd1612a9
3 changed files with 40 additions and 0 deletions
@@ -0,0 +1,12 @@
+# Codex Security scan register
+
+2 November 2026. Source baseline `ba826de1e5c959352e4442ab2fec5d02445dd32d`, branch codex/security-offline-preflight. Owner confirms installation; actual tool metadata/skill files verified. Production/third parties excluded. Paid/deep compute allowance pending. ROE: ../security/00-rules-of-engagement.md.
+
+| Phase/workflow | Status | Actual evidence and limits |
+| --- | --- | --- |
+| 00 define-security-policy review | NOT RUN (full workflow); resolver substep COMPLETED | Installed helper resolve-security-md --list exited 0, returned two docs-only policies. No root policy created; proposal/review/approval remains. No scan ID. |
+| 01 baseline standard scan | NOT RUN | Skill/tool exposure checked; threat-model/policy and capability preflight pending. No scan artifacts or findings. |
+| 03 deep scan | BLOCKED | Baseline and separately approved compute/cost scope missing. No scan launched. |
+| 15 final standard and diff scans | NOT RUN | Await baseline, remediation range and independent verification. |
+
+No scan findings, closure verdicts or human release acceptance are implied by tool availability or regression tests.