lib/review/security-engine.mjs (decisions 175, 196, 219):
- choose: Claude Security when available and base..head has committed
changes; else /security-review when origin/HEAD resolves and
origin/HEAD...HEAD is non-empty; else no engine (no-engine, no-origin,
empty-diff), which is "not measured", never 0. A git failure or bad
usage is exit 2, never a reason.
- convert: reads the newest CLAUDE-SECURITY-<ts>/ report whose stamp is a
changes scan of exactly base..head; confidence high becomes engine
findings through toReviewerPayload, the rest go to below_threshold and
never into findings. An unverified scan, missing researcher counts,
fewer researchers returned than dispatched, an empty diff or scope, or
a malformed record is exit 2.
- NO_ENGINE_REVIEWER: with no engine chosen the expected reviewer
security-engine never reports, so the verdict gate exits 2.
ENGINES gains claude-security (its own reviewer and brief_ref, the
engines' key) with a per-engine label for the written action; it is a
security engine in isSecurityFinding, RAN_ENGINES, the coordinator
contract (out-of-scope and brief-conflict rules) and the coordinator
prose; engine:below-threshold is an unverified reason fed like
engineOutOfScope. Pins of the changed coordinator prose follow.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kjell Tore Guttormsen
cb7c13b408