Quality only, no behaviour change (four cleanup reviewers, one implementer;
npm test 2480/0 on the working tree):
- threat-model.mjs splitBacked(): the one known_outside backing check of
plan-gate (record and bare gate), verdict-gate and review-finalize, with
one why-text; the engines' security keys derived from ENGINES; isSecurity.
- coordinator-contract: "not a security engine" read from ENGINES (a string
engine only), not the code-review literal.
- review-rounds owns trailingBlock, findingsBlockSha, isMajor, isBlocker;
review-answers imports them (review-rounds still imports nothing from it).
prepare keeps the archive bytes it read instead of reading the previous
archive again.
- engine-compare exports rowIn and payloadEngine; finalize uses them.
- plan-gate: one accepted_open builder; the stop-rule check hoisted; one
top-level lookup for --record --brief.
- security-engine: notFullShas(), runCli's usage flag, readScopeList shared
with engine-findings; findReport and reviewRoundSummary module-private;
two dead defaults gone.
- tests: shared plan-gate harness and threat-model brief helpers; the [CNV]
table cases call convertReport in-process, one CLI case per exit path.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two fail-closed checks in security-engine.mjs convert (decision 224), both
"not measured" (exit 2, the reason on stderr, nothing on stdout):
- the stamp's findings.total is not a non-negative integer, or the JSONL
holds another number of records (a JSONL that lost the only BLOCKER line
converted clean before; part 3 verifier, F3);
- the stamp's scope is not an empty list: a scan limited by --scope, an
absent scope or a non-list scope (Claude Security 0.12.0 writes scope: []
for an unscoped scan; F4).
The real Claude Security 0.12.0 probe report still converts: exit 0, one
BLOCKER, two below_threshold.
Decision 223, text only: the module header and SECURITY.md keep the
head/base check and say it is a trace, not a signature: code the reviewed
run executed can write a report folder of its own (convert reads the
matching one whose name sorts last) or delete the real one first (F2, a
known issue). /trekreview's not-measured list names the two new reasons.
The test helper writes the real stamp shape by default (findings.total =
the records in the JSONL written, scope: []). New tests for behaviour that
had none (F6): no fallback from an unverified newest match, a two-stamp
folder passed over, a symlinked stamp, JSONL or folder refused, a malformed
or absent scan_prefix, an unrecorded empty_diff or empty_scope.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
lib/review/security-engine.mjs (decisions 175, 196, 219):
- choose: Claude Security when available and base..head has committed
changes; else /security-review when origin/HEAD resolves and
origin/HEAD...HEAD is non-empty; else no engine (no-engine, no-origin,
empty-diff), which is "not measured", never 0. A git failure or bad
usage is exit 2, never a reason.
- convert: reads the newest CLAUDE-SECURITY-<ts>/ report whose stamp is a
changes scan of exactly base..head; confidence high becomes engine
findings through toReviewerPayload, the rest go to below_threshold and
never into findings. An unverified scan, missing researcher counts,
fewer researchers returned than dispatched, an empty diff or scope, or
a malformed record is exit 2.
- NO_ENGINE_REVIEWER: with no engine chosen the expected reviewer
security-engine never reports, so the verdict gate exits 2.
ENGINES gains claude-security (its own reviewer and brief_ref, the
engines' key) with a per-engine label for the written action; it is a
security engine in isSecurityFinding, RAN_ENGINES, the coordinator
contract (out-of-scope and brief-conflict rules) and the coordinator
prose; engine:below-threshold is an unverified reason fed like
engineOutOfScope. Pins of the changed coordinator prose follow.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
