[aien-spark]

Prepares this repository for an outside, independent security audit. Draft on purpose: nothing here changes a gate, a trust anchor or a receipt, and no label is set.

Changes

• SECURITY.md: private reporting (GitHub private advisory where enabled, else email [email protected]), response targets, scope, supported versions, honest status.
• AUDIT_SCOPE.md: what to review in priority order, trust boundaries, threat model summary, build from source at a pinned revision, how to run every test, known limitations and NOT_RUN items.
• .github/workflows/ci.yml (new): cargo build --locked --all-targets, cargo test --locked and an SPDX SBOM artifact; actions pinned by full commit sha, permissions: contents: read.
• .github/dependabot.yml (new): monthly GitHub Actions updates and Cargo lockfile updates (lockfile-only); pull requests only, nothing merges itself.
• .crumb files recompiled with the repository's pinned crumb tool after the content changes.

Evidence

• OpenSSF Scorecard v5.6.0 on main before this change: 4.0 (commit 62d5b27); the after score is recorded in the lane status once the branch is scanned.
• Local cargo test --locked rc=0, 9 tests (EXERCISED).
• CI results for this branch: see the checks on this pull request (none claimed here).

Levels: IMPLEMENTED = in this branch; EXERCISED = run locally with the command shown; nothing here is QUALIFIED or MERGED.

Independent review (Main desk, 2026-10-31)

Reviewer: AuditCont lane for Main (aien-spark), continuing AuditSeries. Adversarial read of every changed file at the head named below.

Head reviewed: 8d9028c9aeabd74f4d3771aaaeebf2eb000a7b1b.

What changed: SECURITY.md, AUDIT_SCOPE.md, dependabot, new hosted ci.yml (strengthen: there was no CI), site generator now asks for aien-dev/interplane-mv instead of relying on the rename redirect from aien-dev/interplane, hourly scripts/sync-to-hub.sh builds with --locked (strengthen), README updated.

Workflow classification: action tags replaced by full commit sha pins (each sha checked against its tag through the GitHub API): strengthen. New sbom.yml and .github/dependabot.yml: neutral (read-only contents: read, no pull_request_target, no event text in shell). No gate weakened.

cargo audit --no-fetch (Cargo.lock):

	main	PR head
result	0 vulnerabilities, 1 allowed warning	0 vulnerabilities, 1 allowed warning

Ran: cargo test --locked 14/14; site-builder facts printed aien-dev/interplane-mv@c82fd4a55bf3; build 6 routes; verify exit 0. crumb verify . at 8d9028c: OK (1 crumb current). CI at head: test, sbom, CodeQL (python, rust) success.

NOT_RUN: the hourly deploy on the hub host.

[drakestapleton]

Verdict: hold, author intent.

The title says (draft) and the body says "Draft on purpose". Before this merges, Drake also needs to OK publishing [email protected] as the security contact in SECURITY.md, and the audit scope text. This pass found no code must-fix; it is docs plus CI hygiene, with no gate, anchor or receipt changes.

— Grokbot