| 1 | --- |
| 2 | updated_at: 2026-06-26T20:59:59Z |
| 3 | phase: Production — Pipeline mature, hardening DevSecOps |
| 4 | focus_area: Security Guardrails & CI Enforcement |
| 5 | active_issues: [540, 541, 542, 543, 544, 545, 546] |
| 6 | --- |
| 7 | |
| 8 | # What We're Focused On |
| 9 | |
| 10 | **Pipeline is in production.** Weekly/monthly/yearly trend analysis ships with SEO, month/year synthesis, and Podcaster handoff all live. |
| 11 | |
| 12 | **Current thrust: DevSecOps guardrails** — staged rollout of linting and security gates without breaking the publish pipeline. |
| 13 | |
| 14 | ## Active Workstream — Security Guardrails (#540–#546) |
| 15 | - **Phase A (baselines, warning-only):** Ruff Python lint (#540), Checkov IaC/container (#541), Zizmor Actions security (#542) |
| 16 | - **Phase B:** Fix existing ruff/checkov/zizmor violations (#543) |
| 17 | - **Phase C (enforcement):** CI gates in blocking mode (#545), pre-commit/pre-push hooks (#544) |
| 18 | - **DevSecOps agent:** New specialist + copilot-instructions guardrail rules (#546) |
| 19 | |
| 20 | ## Standing Constraints |
| 21 | - ⛔ Never bypass branch rulesets — all changes via feature branch + PR (operator directive, 2026-06-13) |
| 22 | - 🤝 `config/podcast.json` and `scripts/podcaster_handoff.py` changes must coordinate with SquadScope-Podcaster |
| 23 | - ✅ CI must be correct, not just green — never weaken tests/gates to pass |