fix(security-auditor,close): hotfix no-verifier carve-out documented; close enumerates STEP 5C + --no-push passthrough

2026-08-26 21:59:08 +02:00
parent c983f1ff94
commit ad4985f410
2 changed files with 8 additions and 4 deletions
@@ -147,7 +147,9 @@ In audit mode, ALSO write this same block (plus per-finding detail) to
 ## ORCHESTRATOR PROTOCOL (consumer contract — wiring reference)

 - The security gate runs AFTER the request-conformity verdict is CONFORME
-  (verifier), never before.
+  (verifier), never before — EXCEPT under /hotfix, which by design runs no
+  verifier: there the gate fires directly on the smoke-passed diff (its
+  one-attempt model reverts on BLOCK instead of looping).
 - Dispatch a FRESH auditor each iteration — no context reuse. Input = mode +
  scope + (report) + (context), nothing else.
 - Parse the `SECURITY — VERDICT:` line: