| 1 | # URL — History |
| 2 | |
| 3 | ## Core Context |
| 4 | - Owns the DevSecOps guardrails toolchain and its phased rollout |
| 5 | (Phase A baseline → Phase B fixes → Phase C enforcement). |
| 6 | - Complements Hermes: URL owns pipeline/tooling/hooks; Hermes owns security |
| 7 | review, threat modeling, and alert triage. |
| 8 | |
| 9 | ## Learnings |
| 10 | - Phase A rollout pattern: introduce a tool warning-only (`continue-on-error`, |
| 11 | `--soft-fail`), capture a baseline in `docs/devsecops/`, then tighten later. |
| 12 | - Pin every action by commit SHA and pin tool versions so local and CI match. |
| 13 | - Keep CI correct, not just green — never weaken, skip, or soft-fail a real gate |
| 14 | to make a check pass. |
| 15 | |
| 16 | ## Establishment (Epic: jmservera/SquadScope-Coordinator#33) — 2026-06-26 |
| 17 | - Phase A baselines landed for ruff (#540), checkov (#541), and zizmor (#542). |
| 18 | - copilot-instructions guardrail rules and this charter added (#546). |