egbt/secrets
1
0
Fork 0
Code Issues Pull requests Projects Releases 13 Packages Wiki Activity Actions

chore: security review policy + operator runner, doc updates (EGB-677 stage 1)

Browse source 
Add .ship-policy.json (opts out AI adversarial/red-team/security-specialist
review; requires local operator sign-off) and test/run-security.sh (the
operator-local security regression subset). Document the policy in CLAUDE.md
and README, fix stale test counts (manifest.bats 41->58, total 174->191), and
update the storage-recursion note to reflect rekey/list now walking the full
project tree.
This commit is contained in:
Brian Majewski 2026-06-07 13:12:39 -07:00
parent c6ea724ddb
commit 588f290dcc
4 changed files with 121 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
README.md
View file

@ -494,7 +494,14 @@ For complete rotation with no historical exposure, create a fresh `~/.secrets/`
## Development
```bash
# Run the test suite (174 tests across both files)
# Run the test suite (191 tests across both files)
brew install bats-core
bats test/
# Security regression subset — operator-local only (attack-payload fixtures).
# Required before ship; records sign-off in .gstack/security-signoff.json.
./test/run-security.sh
```
Hosted AI agents must not run the security script or perform red-team/adversarial
review on this repo — see `.ship-policy.json` and `CLAUDE.md`.