sjat f338bccd46 Expand ADR-002 into a security baseline + strategy ... Add a managerial security frame on top of the host baseline: explicit threat model (opportunistic external, lateral movement/blast radius, operator/agent error; supply chain accepted-lower-priority), security principles, and four governance mechanisms that ADR-002 establishes and links out to: - docs/security/service-checklist.md — per-service security bar (referenced from the new-role runbook) - docs/security/accepted-risks.md — living accepted-risk register (R1-R4) - planned /security-review skill (TODO 8.5) - agent guardrails in CLAUDE.md "what Claude must not do" STATUS.md records the frame as present (manual enforcement) and /security-review as planned-not-built. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-06-04 14:39:51 +02:00
..
accepted-risks.md	Expand ADR-002 into a security baseline + strategy	2026-06-04 14:39:51 +02:00
service-checklist.md	Expand ADR-002 into a security baseline + strategy	2026-06-04 14:39:51 +02:00