security_scan_gate.py: govulncheck (called vulns) + gitleaks on the pushed commits in every repo's fast set and CI, warn-first, with an accepted-hits file and 8 decoys (R-986); first scan triaged: 0 real secrets, 0 called vulnerabilities; evidence for R-953 and the 0.335.0 release

scripts/repo_gates.py

@@ -33,6 +33,9 @@ Gates, in order (all must pass; **non-zero exit on any failure**):
  16. decoy-coverage  every registered gate in all four repos has a decoy, or a named exemption (R-421)
  17. poster-facts    WARNS (never fails) when felhom-system-poster.facts.md is newer than the poster
  17b. hub-gofmt     every hub Go file is gofmt-clean (R-1160; the controller's R-454 shape)
+ 18. security-scan   govulncheck (called vulnerabilities) + gitleaks on the pushed commits — WARN-FIRST: it
+                     lists, it never refuses; it touches the network (vuln.go.dev) and says NOT CHECKED
+                     offline, which is why it may sit in the fast set (R-986; shared, felhom.eu/scripts)
 
 **THE `GATES` TABLE BELOW IS THE LIST; THIS IS A POINTER TO IT.** It drifted once already —
 it read eleven while thirteen were registered, from 2026-08-24 until 2026-09-01, so
@@ -202,6 +205,11 @@ GATES = [
     # R-1160 (2026-10-19) — every hub Go file is gofmt-clean; the controller's gofmt_gate.py shape. Fast: one gofmt -l.
     # The CI runner has no Go: there it says NOT CHECKED out loud and passes; the pre-push hook (with Go) enforces it.
     ("hub-gofmt",       os.path.join(SCRIPTS, "hub_gofmt_gate.py"),       [],      True, False),
+    # R-986 (2026-10-19) — the dependency and secret scanner, WARN-FIRST (exit 0 whatever it finds; a hit is listed).
+    # In the fast set although it reads vuln.go.dev: it cannot refuse, so a network blink costs a NOT CHECKED line,
+    # never a push. ~10 s here (govulncheck on hub/ + gitleaks on the unpushed commits). CI fetches the pinned
+    # gitleaks (FELHOM_SCAN_FETCH=1 in gates.yml) and has no Go, so govulncheck says NOT CHECKED there, out loud.
+    ("security-scan",   os.path.join(SCRIPTS, "security_scan_gate.py"),   [ROOT],  True, False),
 ]
 
 VERDICT = {0: "OK", 1: "FAILED", 2: "INCONCLUSIVE"}