security_scan_gate.py: govulncheck (called vulns) + gitleaks on the pushed commits in every repo's fast set and CI, warn-first, with an accepted-hits file and 8 decoys (R-986); first scan triaged: 0 real secrets, 0 called vulnerabilities; evidence for R-953 and the 0.335.0 release

scripts/test_gate_decoys.py

@@ -110,6 +110,12 @@ COVERS = {
     "one-register":    ("R-426: an open roadmap row whose state NAMES another row's CLOSED (a live hole until "
                         "2026-10-06), its id only in register prose, a suffix id; genuine: a row with a counterpart, "
                         "and an `idea` row (R-424's accepted hole, asserted BY DESIGN)"),
+    "security-scan":   ("R-986: EIGHT cases in scripts/test_security_scan_gate.py, run from here, each in a SCRATCH "
+                        "git repo: a planted token is listed by rule and file and its value never printed; a second "
+                        "secret on another line of an ACCEPTED file is still listed (acceptance is per line); an "
+                        "accepted line with no reason warns; a CALLED govulncheck finding is listed, an imported-only "
+                        "one is not; no tool anywhere is NOT CHECKED out loud, never a silent pass; the clean commit "
+                        "and the accepted line pass. Warn-first: every case exits 0, the LISTING is the fact"),
     "hub-gofmt":       ("R-1160: an unformatted .go file in a SCRATCH module dir is convicted by name; its "
                         "formatted twin passes; with no gofmt reachable, CI passes OUT LOUD and a dev machine is "
                         "INCONCLUSIVE, never a silent pass"),
@@ -786,6 +792,19 @@ decoy("due-checks/due-tomorrow", "due_checks_gate.py",
 decoy("due-checks/marker-named-in-prose", "due_checks_gate.py",
       _dc_plant(u"", prose=u"\nThe dated checks sit between the DUE-CHECKS-BEGIN and DUE-CHECKS-END markers.\n"))
 
+# ── security-scan (R-986) ────────────────────────────────────────────────────────────────────────
+#
+# Its decoys are scratch git repos, so they live in their own file and are RUN from here (script-tests' shape).
+ran += 1
+_ss = subprocess.run([sys.executable, os.path.join("scripts", "test_security_scan_gate.py")],
+                     cwd=ROOT, capture_output=True, text=True)
+if _ss.returncode != 0:
+    fails.append("security-scan: its decoy suite FAILED — a decoy did not convict\n%s"
+                 % (_ss.stdout + _ss.stderr)[-800:])
+else:
+    _n = _ss.stdout.strip().splitlines()[-1] if _ss.stdout.strip() else "?"
+    print("  ok  %-20s %s" % ("security-scan", _n))
+
 # ── script-tests (R-885) ─────────────────────────────────────────────────────────────────────────
 #
 # Its decoys are whole fake repos, so they live in their own file and are RUN from here (guide-quote's shape).