From 7f83cb6534e67f59b23d721edeed1b9bc2ed1781 Mon Sep 17 00:00:00 2001
From: Harish Seshadri <harish.seshadri@gmail.com>
Date: Sat, 24 Oct 2026 11:32:22 -0700
Subject: [PATCH 1/2] fix(ci): make the lint gate read-only

`poe lint` ran `ruff check --fix` and `ruff format` in place, so the hosted
gate could rewrite a dirty tree and still exit 0. It now runs `ruff check` and
`ruff format --check`, matching the three module gates: a formatting regression
fails instead of being silently repaired inside the container.

Tests: uv run poe lint.
---
 .dagger/pyproject.toml | 2 +-
 CHANGELOG.md           | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.dagger/pyproject.toml b/.dagger/pyproject.toml
index 724d871..4f06587 100644
--- a/.dagger/pyproject.toml
+++ b/.dagger/pyproject.toml
@@ -64,7 +64,7 @@ branch = true
 omit = ["src/ci/fleet_cli.py"]
 
 [tool.poe.tasks]
-lint = { shell = "ruff check --fix src tests && ruff format src tests" }
+lint = { shell = "ruff check src tests && ruff format --check src tests" }
 typecheck = "mypy --strict src tests"
 complexity = "xenon --max-absolute A --max-modules A --max-average A src"
 test = "pytest tests --cov=ci --cov-branch --cov-fail-under=90"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 64bced5..2299b02 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@
 
 ### Fixed
 
+- `poe lint` is now read-only. It ran `ruff check --fix` and `ruff format` in place, so
+  `dagger call ci` could rewrite a dirty tree and still exit 0; the gate now runs
+  `ruff check` and `ruff format --check`, matching the three module gates. A formatting
+  regression fails the gate instead of being silently repaired inside the container.
 - The image mirror now publishes to `ghcr.io/gainratio/mirror/...`. Since the org move, ci's
   `GITHUB_TOKEN` cannot create packages under the `hseshadr` user account
   (`DENIED: The requested installation does not exist`, run 37993357418, 12/16 proven).

From 52c3ea5ea64f58e7d4064cb1d98a7564815edb3a Mon Sep 17 00:00:00 2001
From: Harish Seshadri <harish.seshadri@gmail.com>
Date: Sat, 24 Oct 2026 11:39:35 -0700
Subject: [PATCH 2/2] docs: add a vulnerability disclosure policy

The control plane reads cross-repo state and writes packages but had no
SECURITY.md. Document the private channel and the in-scope bypasses: source
guard, secret scan, fleet evidence, and workflow injection.
---
 SECURITY.md | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..7184141
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,38 @@
+# Security Policy
+
+`gainratio/ci` is the shared CI control plane for the public `gainratio` repositories. It
+holds no application data, but it does read repository state with a GitHub token, builds
+artifacts, and pushes OCI images to GHCR. A bypass of its source guard, secret scan, or
+release-lineage checks affects every consumer.
+
+## Reporting a vulnerability
+
+Please do not open a public issue, pull request, or discussion for a security
+vulnerability. Report it privately to:
+
+> **harish.seshadri@gmail.com**
+
+Include the affected workflow or module, the commit, the impact on a consumer repository,
+and a minimal reproduction if you have one. You can expect an acknowledgement within a few
+days.
+
+## Scope
+
+In scope:
+
+- A way to make `guard` accept a workspace that is not the claimed commit, or to make the
+  generated envelope describe different bytes than the artifact.
+- A way to make the full-history secret scan miss a credential, or to make a canary pass
+  without being detected.
+- A way to make `fleet` report green for a repository that is not green, or to skip a
+  repository that pins a module from here.
+- A workflow injection, expression injection, or permission escalation in
+  `.github/workflows/`.
+
+Out of scope: findings in a consumer repository's own code (report those to that
+repository), and the design choice that consumers pin this repository at a commit SHA.
+
+## Supported versions
+
+Consumers pin an exact commit; fixes land on `main` and consumers upgrade by changing the
+pin. There is no supported-version table because there are no floating releases.