v0.341.0: the night update takes a security_fix ladder step (D39 = B, 09 §3 decision 255, R-1239); every other leg guard unchanged; the leg names the CVE ids; MinAgent 0.158.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

controller/internal/stacks/ladder.go

@@ -52,6 +52,22 @@ type LadderEntry struct {
 	// PostgreSQL major (pgconvert.go). omitempty: an entry without it prints exactly as before, so R-680's
 	// failed-step records (tied to LadderPrint) are not reset by this field's arrival.
 	EngineConversion *EngineConversion `yaml:"engine_conversion" json:"engine_conversion,omitempty"`
+	// Security (v0.341.0, `09` §3 decision 255, D39 = B) is a `security_fix` step's public notice: the CVE/GHSA ids,
+	// the advisory's address and the first fixed upstream version. The night leg names the ids when it takes the step.
+	// omitempty, like EngineConversion: an entry without it prints (LadderPrint) exactly as before.
+	Security *LadderSecurity `yaml:"security" json:"security,omitempty"`
+}
+
+// LadderVerdictSecurityFix is the second verdict the night leg takes (v0.341.0, decision 255): an urgent upstream fix
+// proven on the box (scratch 9202, the guarded Update) whose bench run is optional. A person's press has never read the
+// verdict, so on every controller with ladders it was already pressable by hand; before v0.341.0 the leg skips it.
+const LadderVerdictSecurityFix = "security_fix"
+
+// LadderSecurity is the `security` object of a security_fix ladder entry (the catalog's `scripts/ladder.py` checks it).
+type LadderSecurity struct {
+	IDs      []string `yaml:"ids" json:"ids"`
+	Advisory string   `yaml:"advisory" json:"advisory"`
+	FixedIn  string   `yaml:"fixed_in" json:"fixed_in"`
 }
 
 // LadderMarks is the `marks` object of a ladder entry. NeedsPerson is JSON null (nil) or the tester's