feat: security-sensitive bootstrap mode (0.13.0)#151
Merged
Conversation
This was referenced May 19, 2026
…cation warnings (0.13.0) - `charter bootstrap --security-sensitive` seeds SECURITY.md, hard-fail drift deny patterns, and a doctor check for security test coverage - `charter drift` surfaces security-deny violations as BLOCKER severity with a new `securityBlockers` JSON field; CI mode fails on any blocker - Build commands (login, run, architect, scaffold) now share a single `printBuildCommandDeprecationWarning` helper; suppressed via CHARTER_NO_DEPRECATION_WARNING=1 or --no-deprecation-warning Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…gelog - mergeReports no longer recomputes score; preserves base.score from scanForDrift - Internal cross-dep ranges updated from ^0.12.1 to ^0.13.0 across all packages - loadSecurityDenyPatterns reads createdAt from pattern file instead of new Date() - CHANGELOG: add deprecation-warning refactor to Changed section; add [0.13.0] compare link Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
stackbilt-admin
force-pushed
the
codex/security-sensitive-bootstrap
branch
from
c3e608e to
788d9b7
Compare
This was referenced May 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
charter bootstrap --security-sensitiveflag that seeds aSECURITY.mddisclosure template, hard-fail drift deny patterns (timing equality, optional security bindings, auth TODOs, token JSON exposure), and adoctorcheck that warns when nosecurity*orl4*test file is foundcharter driftnow surfaces security-deny violations asBLOCKERseverity with a newsecurityBlockersfield in JSON output; CI mode exits non-zero on any blocker regardless of drift scorelogin,run,architect,scaffold) into a sharedprintBuildCommandDeprecationWarninghelper, suppressible viaCHARTER_NO_DEPRECATION_WARNING=1or--no-deprecation-warning@stackbilt/*packages to0.13.0(minor — additive only, no breaking changes)Test plan
charter bootstrap --security-sensitive --yes --preset worker --skip-install --skip-doctorcreatesSECURITY.mdand.charter/patterns/security-deny.jsoncharter doctorin a security-sensitive repo warns on missing security test files, passes once one existscharter drift --ciin a security-sensitive repo exits 1 when a timing-equality or other deny pattern is matchedcharter login,run,architect,scaffold; suppressed withCHARTER_NO_DEPRECATION_WARNING=1🤖 Generated with Claude Code