fix(security): scan runner finishes every repository; method docs current

.github/pull_request_template.md

@@ -7,4 +7,4 @@
 ## Testing
 
 ---
-Reviewed against [the review checklist](https://github.com/WireCatLabs/cli-messaging/blob/main/docs/dev/REVIEW.md) — §A for a docs PR, §B for code.
+Reviewed against [the review checklist](https://github.com/WireCatLabs/cli-core/blob/main/docs/dev/REVIEW.md) — §A for a docs PR, §B for code.

.semgrepignore

@@ -0,0 +1,26 @@
+# A .semgrepignore replaces Semgrep's built-in list, so that list (1.178.0) is repeated here.
+.git
+.svn
+.hg
+_darcs
+CVS
+build/
+vendor/
+dist/
+*.min.js
+.env/
+.tox/
+node_modules/
+.npm/
+.yarn/
+.venv/
+_opam/
+_build/
+_cargo/
+test/
+tests/
+testsuite/
+*_test.go
+
+# Saved third-party web pages for the reader benchmarks; not code, and they time the scanner out.
+performance/**/fixtures/

CHANGELOG.md

@@ -31,6 +31,21 @@ Every entry says what changed as a caller sees it, why, and what to watch for 
   discovery contracts are refused. The research report distinguishes released behavior from
   newer source changes and includes a separately authorized live Google checklist.
 
+### Fixed
+
+- `cli-testing security scan` runs its Semgrep stage from an installed package: the stage ships as
+  compiled `dist/semgrep.js`, because Node refuses to strip types under `node_modules`. Before, every
+  scan from an install failed at Semgrep; it worked only from a checkout.
+- A repository whose scanner fails no longer stops the run: `scan` records the failure, scans the
+  remaining repositories and exits 1 at the end, naming the failed ones on stderr. Watch for a
+  non-zero exit with most raw files present — the failed repository has none for that tool.
+- The Semgrep fallback covers JavaScript files the parser rejects (`.js`, `.jsx`, `.mjs`, `.cjs`,
+  plus `.mts`, `.cts`), and keeps top-level await. One rule failing on one file is recorded as a
+  coverage gap in `semgrep.json` and `SCOPE.md` instead of failing the repository; every other
+  scanner error still does.
+- This repository's saved third-party web pages under `performance/**/fixtures/` are excluded from
+  Semgrep in `.semgrepignore`, so they no longer time the scan out.
+
 ## 0.4.0 — 11.10.2026
 
 ### Changed — may break callers

CLAUDE.md

@@ -5,8 +5,9 @@ as a development dependency. Start with the one page that covers what you are ab
 
 - [`docs/dev/ARCHITECTURE.md`](docs/dev/ARCHITECTURE.md) — the suite groups and how a CLI plugs in.
 - [`docs/dev/BACKLOG.md`](docs/dev/BACKLOG.md) — what comes next, in order.
-- [`docs/security/`](docs/security/METHOD.md) — how a security audit is run and repeated; its
-  scripts are in `scripts/security/` and `scripts/agent/`.
+- [`docs/security/`](docs/security/METHOD.md) — how a security audit of every WireCat repository is
+  run and repeated; its scripts are in `scripts/security/` and `scripts/agent/`. Vulnerabilities are
+  reported as the [security policy](https://github.com/WireCatLabs/.github/blob/main/SECURITY.md) says.
 - [`docs/dev/CONVENTIONS.md`](docs/dev/CONVENTIONS.md) — the shared conventions, and what differs here.
 - [`docs/dev/TESTING.md`](docs/dev/TESTING.md) — the checks and the coverage floor.
 - [`docs/dev/agents.md`](docs/dev/agents.md) — what an agent may change here, and what stops it.
@@ -16,13 +17,14 @@ as a development dependency. Start with the one page that covers what you are ab
 1. **A suite drives a CLI from the outside.** Its binary, its MCP server, its published package —
    never its source. What a CLI must supply (its MCP command, how the test account sends and
    deletes, which chats are test chats) is config in that CLI's repository. `biome.json` refuses
-   messenger libraries and cli-messaging under `src/`.
+   messenger libraries and cli-core under `src/`.
 2. **Nothing touches a real account on its own.** `live` and the agent suite run only when the owner
    starts them, on the test profiles and test chats of a private cast that is never committed.
 3. **Public tools, private results.** Run results, the findings register and the cast live in the
    private `cli-private` repository. Nothing here names an unfixed vulnerability.
-4. **Speed of development comes first.** No suite runs on a pull request or a commit: on a release,
-   on demand or on a schedule only.
+4. **Speed of development comes first.** No suite runs on a pull request or a local commit: on a
+   release, on demand or on a schedule only. This repository's own tests run once on each merge to
+   `main`.
 5. **No message, token or phone number in a fixture, an output file or a document.** Seed data is
    synthetic.
 6. **Every external tool is pinned** — a version, and a checksum where it is a downloaded binary —
@@ -60,6 +62,7 @@ A branch off `main`, in a worktree, and a pull request. A change a caller can se
 Local commits check only staged lint and secrets. There is no pre-push check.
 Config integrity, repository lint, Markdown, and secret detection run in PR CI.
 The bounded `ci:quick` step adds typechecking for CLI packages or synthetic unit tests for the docs site.
-Full tests, coverage, builds, parity, browser and platform suites run for releases,
-explicit manual validation, and monthly nonpublishing validation. See the
+Full tests, coverage and builds also run once on each merge to `main` (Linux only, no publishing).
+Browser and platform suites run for releases, explicit manual validation, and monthly nonpublishing
+validation. See the
 [shared policy](https://github.com/WireCatLabs/community/blob/main/standards/README.md#ci-and-hooks).

docs/ci/MONTHLY.md

@@ -13,15 +13,15 @@ and CodeQL. Messaging includes C/C++ analysis as well as JavaScript/TypeScript a
 | --- | --- |
 | cli-base / monthly.yml | 02:17 |
 | cli-memo / monthly.yml | 02:31 |
-| cli-messaging / monthly.yml | 02:38 |
+| cli-core / monthly.yml | 02:38 |
 | drive-cli / monthly.yml | 02:45 |
 | cli-testing / monthly.yml | 02:52 |
 | max-cli / monthly.yml | 02:59 |
 | tg-cli / monthly.yml | 03:06 |
 | zoom-cli / monthly.yml | 03:13 |
 | cli-docs / monthly.yml | 03:20 |
-| cli-messaging / onnx.yml | 03:27 |
-| cli-messaging / sqlite.yml | 03:37 |
+| cli-core / onnx.yml | 03:27 |
+| cli-core / sqlite.yml | 03:37 |
 | community / security-release.yml | 03:47 |
 
 GitHub runs schedules on the latest default-branch commit. Times are staggered away from the
@@ -49,8 +49,8 @@ gh run list --repo WireCatLabs/cli-testing --workflow monthly.yml --limit 5
 Native probes use their individual workflows with publication disabled:
 
 ```sh
-gh workflow run onnx.yml --repo WireCatLabs/cli-messaging --ref main -f publish=false
-gh workflow run sqlite.yml --repo WireCatLabs/cli-messaging --ref main -f publish=false
+gh workflow run onnx.yml --repo WireCatLabs/cli-core --ref main -f publish=false
+gh workflow run sqlite.yml --repo WireCatLabs/cli-core --ref main -f publish=false
 ```
 
 Community security can be started from its **Security release** workflow without publishing.

docs/security/LESSONS.md

@@ -1,6 +1,6 @@
 # What the tools taught us
 
-Facts learned during the 2026-10-09 audit, with their source. Each cost time once.
+Facts learned during the audits, with their source. Each cost time once.
 
 ## Scanners
 
@@ -18,6 +18,15 @@ Facts learned during the 2026-10-09 audit, with their source. Each cost time onc
   `semgrep/mcp/hooks/post_tool.py`, read in semgrep 1.180.0). The CLI with `--metrics=off` avoids it.
 - **The Socket CLI prints the start of the API token in its banner.** `--no-banner` hides it, and it
   must come after the command — before it, the flag is not parsed.
+- **A `.semgrepignore` replaces Semgrep's built-in ignore list** instead of adding to it: with a
+  one-line file, `test/`, `dist/` and `node_modules/` are scanned again (ran on semgrep 1.178.0). A
+  repository's file repeats the built-in list before its own lines.
+- **gitleaks reads `.gitleaksignore` from the current folder**, not from the repository it scans.
+  Run it from the repository's root, or a scan from elsewhere reports the ignored hits again.
+- **CodeQL 2.27 SARIF keeps the rules in `tool.extensions[].rules`**, and `tool.driver.rules` is
+  empty. A result points at its rule through `rule.toolComponent.index` and `rule.index`; a gate
+  that looks rules up in `driver.rules` by `ruleId` finds none and never fails. Resolve every
+  result to a rule, and fail when one has no rule.
 - **Trail of Bits `supply-chain-risk-auditor` does not read `pnpm-lock.yaml`**; it covers direct
   dependencies only (its `SKILL.md`). osv-scanner covers the tree.
 - **Trail of Bits `fp-check` installs a Stop hook on every session** that blocks stopping until the
@@ -33,6 +42,12 @@ Facts learned during the 2026-10-09 audit, with their source. Each cost time onc
 - **zizmor runs against `.github`**; given a nested path it can exit 3, "no inputs collected".
 - **Restricting the `npm` environment to `main`** keeps trusted publishing working from `main` (token
   exchange `201`) and stops branch dry runs from reaching npm.
+- **A new repository does not inherit settings applied repository by repository.** Secret
+  scanning, push protection, security updates and private reporting start off unless an
+  organisation code security configuration is the default for new repositories.
+- **CodeQL default setup and workflow CodeQL do not mix**: with default setup on, GitHub refuses
+  the SARIF a workflow uploads for the same languages
+  ([docs](https://docs.github.com/en/code-security/code-scanning/troubleshooting-sarif-uploads/default-setup-enabled)).
 - **A CodeQL alert number is per repository**; check every dismissed alert's path after dismissing
   by number.