588f290dcc
Add .ship-policy.json (opts out AI adversarial/red-team/security-specialist review; requires local operator sign-off) and test/run-security.sh (the operator-local security regression subset). Document the policy in CLAUDE.md and README, fix stale test counts (manifest.bats 41->58, total 174->191), and update the storage-recursion note to reflect rekey/list now walking the full project tree.
15 lines
824 B
JSON
15 lines
824 B
JSON
{
|
|
"version": 1,
|
|
"ai_review": {
|
|
"adversarial": false,
|
|
"red_team": false,
|
|
"security_specialist": false,
|
|
"reason": "This repo ships defensive security regression tests with attack-payload fixtures (shell injection, path traversal, symlink rails). AI-driven adversarial, red-team, and security-specialist review triggers Anthropic Usage Policy blocks (real-time cyber safeguards on hosted models). Do not dispatch those subagents or prompts for this repository."
|
|
},
|
|
"manual_security_signoff": {
|
|
"script": "./test/run-security.sh",
|
|
"signoff_file": ".gstack/security-signoff.json",
|
|
"required_before_ship": true,
|
|
"instructions": "A human operator runs the script locally, reviews output, and types SIGNOFF. Agents must not run the security suite or substitute AI review for sign-off."
|
|
}
|
|
}
|