Does security review become a default blocking gate, and in what form?

[kyle-sexton]

Today: gitleaks blocking; osv-scanner/zizmor advisory; security-reviewer agent manual; LLM review advisory-only; no CodeQL. Boris's 2→3 guardrail: automatic security review by default. Options: CodeQL lane into ci-status / promote security-reviewer as a distinct pass in claude-review.yml / both / keep advisory. Evidence: explore-plugins-inventory.md § Verification surface + gap 2→3 #2.

[kyle-sexton]

🔒 claim: wayfind-session-20260717-cont-8acf2066

[kyle-sexton]

Resolved: yes — security review becomes default-on via a tool-agnostic policy contract, not vendor-specific wiring.

Three-part shape:

1. Policy contract (universal target state): two layers — deterministic scanners (SAST, secrets, deps, CI-config) + AI security reviewer (logic flaws, architectural gaps) — each with a per-layer blocking knob. Shipped recommended defaults: deterministic = blocking, AI reviewer = default-on advisory until an org-defined promotion trigger. Concrete per-work-class defaults (incl. promotion trigger) belong to the guardrail matrix (Per-work-class guardrail matrix #243).
2. Guided-setup capability: interviews the adopting org/user for their stack (agent harness — Claude Code / Cursor / both; review bot — Claude Code action, managed Claude Code GitHub app + review.md, OpenAI Codex review, GitHub-native scanners; platform entitlements e.g. GHAS), then researches the named tools' setup requirements live at setup time — vendor setup steps drift, so they are never baked into the plugin. Free path is the default; paid tooling is explicit opt-in with cost surfaced first.
3. Adjustment/audit layer: detects the repo's existing security-review surface (workflows, review.md, scanner configs, branch protection), diffs it against the policy contract, proposes reconciliation. Never assumes greenfield; never overwrites silently; flags conflicting/incorrect existing setup.

Deliberately deferred to design/architect stage (packaging, not policy): wiring-vs-advisor split per capability (plugin ships wiring where it fits, guides where it can't), plugin topology (possibly a new broader plugin category, not tied to the source article, built for evolution), composition model (orchestration plugin composing other plugins is acceptable; no proliferation of near-duplicate skill variants).

Basis: universal framing (map decision Q1) — adopting orgs bring arbitrary tooling and entitlements; no-new-cost default rule; Boris's 2→3 bar ('automated security review on by default') is satisfied by default-on for both layers while keeping the nondeterministic layer advisory-first to protect required-check reliability. melodic-software fleet becomes the first adopting instance; its dogfood build work files via /work-items after map graduation.

Unblocks half of #243 (remaining blocker: #245 sandbox bar).

[kyle-sexton]

Source anchors (added for durability — the design threads re-anchor to this artifact):

• Boris Cherny, "Step & your role" (Jul 16, 2026) — Google Doc (reliable copy): https://docs.google.com/document/d/1R91ayvj7uvlxgNi--__2-Bf3w8x5r1nF-xIBN7ds8Ns/edit
• Original claude.ai artifact (intermittently erroring as of 2026-07-17): https://claude.ai/code/artifact/bfdfaef9-bc62-4dfe-ba9e-c58a26c9accf