[JacobStephens2]

Summary

Glossary terms and one ADR for #427 (security work), from the grilling's first five rounds. Docs only; the research notes merged in #517.

 CONTEXT.md
+  Security run      # a Pass: a Security audit, a reproduction session per finding, then, when allowed, a Run or Spec run per reproduced finding
+  Security audit    # the Security run's session; records each finding privately for the Day shift
+  Security review   # an opt-in session after a Run's opening session, or on a Spec PR after the Spec review
+  Security finding  # a vulnerability either session found; private until fixed; waits for the Day shift's triage
+  Fencing           # Security runs on a schedule with fixing allowed, as Weeding is Architect runs
~  Pass, Command, Run, Claim, Run notification, Unaddressed finding  # now include the Security run and Security findings
~  Architect run, Pickup run                                          # skipped while any other Pass on the repository runs
 docs/adr/
+└── 0015-security-findings-stay-private-until-fixed.md

Evidence

• Before: the glossary had no word for security work, and a Pass was only an Architect run or a Pickup run.
  After: the five terms the grilling settled, each with what to avoid, such as "Secure run", which reads as a run that is secure.
• ADR 0015 records why a Security finding is never an ordinary issue: GitHub's private fix path can't run unattended (no CI in the temporary private fork, and only a web-UI button merges it), so a reproduced finding is fixed in public only when allowed.

Merge Danger

Door: two-way

Blast Radius: none

Docs only: no code, prompts or skills change.

🤖 Generated with Claude Code