security-scan gate (shared felhom.eu/scripts/security_scan_gate.py) in the fast set and CI, warn-first, with the accepted-hits file and decoys (R-986)

controller/scripts/controller_gates.py

@@ -18,6 +18,9 @@ Gates, in order (all must pass; **non-zero exit on any failure**):
   8. debug-routes       every debug-page control resolves to a handler, and back (R-400)
   9. reuse-refs         every path cited by this repo's REUSE.md still resolves
   …  gofmt              every Go file is gofmt-clean (R-454)
+  …  security-scan      govulncheck (called vulnerabilities) + gitleaks on the pushed commits, WARN-FIRST: it
+                        lists, it never refuses (R-986; shared, felhom.eu/scripts/security_scan_gate.py). Fast
+                        although it reads vuln.go.dev: offline it says NOT CHECKED, so it cannot stop a push
   …  gate-decoys        the decoy suite (test_gate_decoys.py): every gate above still convicts its
                         decoys (R-1116). ~22 s and it edits real files in this tree for a moment, so
                         the full run only, never --fast (never the hook, never CI)
@@ -60,6 +63,8 @@ SHARED_REUSE = os.path.join(SHARED_DIR, "reuse_refs_check.py")
 SHARED_INSTRUCTIONS = os.path.join(SHARED_DIR, "instructions_gate.py")
 # R-389 — shared, like the two above: it lives in felhom.eu/scripts/ and is never copied.
 SHARED_OBSERVATIONS = os.path.join(SHARED_DIR, "observations_gate.py")
+# R-986 — shared too: the dependency and secret scanner, warn-first.
+SHARED_SECURITY = os.path.join(SHARED_DIR, "security_scan_gate.py")
 
 # R-404 — the golden NOTICE. Lives here, beside the runner, because it is about THIS repo's
 # releases; it imports the felhom.eu gate rather than copying its comparison.
@@ -105,6 +110,10 @@ GATES = [
     # R-454 — every Go file is gofmt-clean. `go vet` does not check formatting; nothing did. Fast:
     # the toolchain's own formatter, no network, no container runtime.
     ("gofmt",           os.path.join(SCRIPTS, "gofmt_gate.py"),                [],       True, True),
+    # R-986 (2026-10-19) — govulncheck + gitleaks, WARN-FIRST (exit 0 whatever it finds; a hit is listed). Fast
+    # although it reads vuln.go.dev: it cannot refuse, so a network blink is a NOT CHECKED line. ~8 s here. CI fetches
+    # the pinned gitleaks (FELHOM_SCAN_FETCH=1) and has no Go, so govulncheck says NOT CHECKED there.
+    ("security-scan",   SHARED_SECURITY,                                       [REPO],   True, True),
     # R-404 — ADVISORY. Reports the golden debt where it is created; never refuses.
     ("golden-notice", GOLDEN_NOTICE, [REPO], True, False),
     # R-1116 (2026-10-17) — the gates' OWN decoy suite: every gate above, red-proved against its decoys. It was

controller/scripts/test_gate_decoys.py

@@ -50,6 +50,11 @@ COVERS = {
                          "key left out of the map (v0.252.0, R-557); a call that lost an argument, and a key glued "
                          "to more text with + (R-576)",
     "gofmt":             "R-454: a planted unformatted .go file in internal/ is convicted; the clean tree passes",
+    "security-scan":     ("R-986: the shared gate's own decoys (felhom.eu scripts/test_security_scan_gate.py, 8 cases "
+                          "in SCRATCH git repos: a planted token listed by rule and file, its value never printed; a "
+                          "second secret on another line of an accepted file still listed; a called govulncheck "
+                          "finding listed, an imported-only one not; no tool is NOT CHECKED out loud), run from here; "
+                          "plus the gate on THIS repo: exit 0 and its summary line (warn-first)"),
     "offbox-rename":     "R-425: NAS branding in a NEW backups*.html, and in a bundle value an offbox Go file "
                          "names; control: the same token in the network-storage feature's copy is accepted",
     "docker-v":          "R-426: an unallowlisted `-v /etc:/x` in a NEW .go file two directories down "
@@ -506,6 +511,28 @@ def shared_cases():
 
 shared_cases()
 
+
+def security_cases():
+    """R-986: the shared scanner's decoys (they build their own scratch repos), then the gate on this repo."""
+    global ran
+    suite, gate_ = os.path.join(SHARED, "test_security_scan_gate.py"), os.path.join(SHARED, "security_scan_gate.py")
+    for f in (suite, gate_):
+        if not os.path.isfile(f):
+            fails.append("shared %s is MISSING beside this clone - a failure, never a skip" % f)
+            return
+    for name, argv, must in (("security-scan: the shared gate's 8 decoys", [sys.executable, suite], "all 8 cases passed"),
+                             ("security-scan: GENUINE: this repo, warn-first", [sys.executable, gate_, REPO],
+                              "security-scan:")):
+        ran += 1
+        rc, out = _run(argv, REPO)
+        if rc != 0 or must not in out:
+            fails.append("%s: rc=%d, %r missing\n%s" % (name, rc, must, out[-700:]))
+        else:
+            print("  ok  %s" % name)
+
+
+security_cases()
+
 print()
 if fails:
     for f in fails: