security-scan gate (shared felhom.eu/scripts/security_scan_gate.py) in the fast set and CI, warn-first, with the accepted-hits file and decoys (R-986)

scripts/agent_gates.py

@@ -15,6 +15,9 @@ Gates (all must pass; **non-zero exit on any failure**):
                      or because someone is offline on a train. CI runs the FULL set for exactly this
                      reason: it is the machine that can afford a network check, and it is the half
                      that emails when something is wrong.
+  …  security-scan   govulncheck (called vulnerabilities) + gitleaks on the pushed commits, WARN-FIRST: it lists,
+                     it never refuses (R-986). Shared: felhom.eu/scripts/security_scan_gate.py. In the fast set
+                     although it reads vuln.go.dev — offline it says NOT CHECKED, so it cannot stop a push.
   …  gate-decoys     the decoy suite (test_gate_decoys.py): every gate here still convicts its decoys
                      (R-1116). ~20 s in the workspace, so the full run only: not the hook, but CI
                      runs the full set on every push. Scratch clones and a local fake Gitea only.
@@ -49,6 +52,9 @@ SHARED_INSTRUCTIONS = os.path.join(
 # R-389 — shared, like the two above: it lives in felhom.eu/scripts/ and is never copied.
 SHARED_OBSERVATIONS = os.path.join(
     os.path.dirname(ROOT), "felhom.eu", "scripts", "observations_gate.py")
+# R-986 — shared too: the dependency and secret scanner, warn-first.
+SHARED_SECURITY = os.path.join(
+    os.path.dirname(ROOT), "felhom.eu", "scripts", "security_scan_gate.py")
 
 # (label, absolute script path, args, fast)
 GATES = [
@@ -70,6 +76,10 @@ GATES = [
     # R-1160 (2026-10-19) — every Go file is gofmt-clean; the controller's gofmt_gate.py shape. Fast: one gofmt -l.
     # Where the runner has no Go it says NOT CHECKED out loud and passes; the pre-push hook (with Go) enforces it.
     ("gofmt", os.path.join(ROOT, "scripts", "gofmt_gate.py"), [], True),
+    # R-986 (2026-10-19) — govulncheck + gitleaks, WARN-FIRST (exit 0 whatever it finds). Fast although it reads
+    # vuln.go.dev: it cannot refuse, so a network blink is a NOT CHECKED line. ~4 s here. CI: gitleaks fetched pinned
+    # (FELHOM_SCAN_FETCH=1), no Go, so govulncheck says NOT CHECKED there.
+    ("security-scan", SHARED_SECURITY, [ROOT], True),
 ]
 
 VERDICT = {0: "OK", 1: "FAILED", 2: "INCONCLUSIVE"}

scripts/test_gate_decoys.py

@@ -69,6 +69,11 @@ COVERS = {
     "gofmt": "R-1160: an unformatted .go file planted under internal/ of a SCRATCH copy is convicted by name - vs the "
              "same tree formatted (passes); with no gofmt reachable, CI passes OUT LOUD and a dev machine is "
              "INCONCLUSIVE, never a silent pass",
+    "security-scan": "R-986: the shared gate's own decoys (felhom.eu scripts/test_security_scan_gate.py, 8 cases in "
+                     "SCRATCH git repos: a planted token listed by rule and file, its value never printed; a second "
+                     "secret on another line of an accepted file still listed; a called govulncheck finding listed, "
+                     "an imported-only one not; no tool is NOT CHECKED out loud), run from here; plus the gate on THIS "
+                     "repo's tree: exit 0 and its summary line (warn-first - the listing is the fact)",
     "gate-decoys": "this suite, run as a gate of agent_gates.py's full run, which CI runs on every push (R-1116): "
                    "every case above is a decoy of its own gate, and ONE case that stops convicting turns the run "
                    "red - red-proved 2026-10-17 by flipping a reuse-refs FACT case to expect rc 0",
@@ -372,6 +377,20 @@ def shared_cases(ws):
          u"the same minute.**\n", 0)
 
 
+def security_cases():
+    """R-986: the shared scanner's decoys (they build their own scratch repos), then the gate on this repo."""
+    suite = os.path.join(SHARED, "test_security_scan_gate.py")
+    gate = os.path.join(SHARED, "security_scan_gate.py")
+    for f in (suite, gate):
+        if not os.path.isfile(f):
+            fails.append("shared %s is MISSING beside this clone - a failure, never a skip" % f)
+            return
+    rc, out = run([sys.executable, suite], ROOT)
+    report("security-scan: the shared gate's 8 decoys", rc, out, 0, ("all 8 cases passed",))
+    rc, out = run([sys.executable, gate, ROOT], ROOT)
+    report("security-scan: GENUINE: this repo, warn-first", rc, out, 0, ("security-scan:", "govulncheck"))
+
+
 def main():
     srv = Server(("127.0.0.1", 0), Handler)
     threading.Thread(target=srv.serve_forever, daemon=True).start()
@@ -383,6 +402,7 @@ def main():
         release_cases(base, ws)
         shared_cases(ws)
         gofmt_cases(ws)
+        security_cases()
     finally:
         srv.shutdown()
         srv.server_close()