chore(security): ratchet silent-success-masking gate + clear 5 Category 3 findings (#756)

[ClintEastman02]

Scopes issue #756 to the two pieces from @scottschreckengaust's triage that weren't claimed for follow-up issues: the missing PR-level gate (the actual cause of the drift) and the 5 genuinely-defensible Category 3 suppressions. Categories 0–2 (rule false positives, registry parse failures, best-effort lookups) are left for the separate issues proposed in the triage.

Area

• agent — Python runtime / Docker image
• cdk — infrastructure, handlers, constructs
• tooling — root mise.toml, scripts, CI workflows

Related

• Part of chore(security): clean up 21 pre-existing silent-success-masking findings on main #756 (Category 3 + gate scope) — chore(security): clean up 21 pre-existing silent-success-masking findings on main #756 stays open as the tracking umbrella
• Follows the triage split — Categories 0/1/2 now tracked in chore(security): masking rule precision — stop flagging correct fail-closed code + fix mis-placed suppression (#756 Cat 0) #790 (Cat 0, rule precision), fix(security): registry frontmatter parse failure erases publisher attribution — surface as typed rejection, don't suppress (#756 Cat 1) #791 (Cat 1, registry attribution-erasure — security), refactor(handlers): encode failure in best-effort lookups — 13 silent-success-masking sites (#756 Cat 2) #792 (Cat 2, best-effort lookups)
• Context: fix(security): clear the two security:sast findings blocking pre-push (#729) #730 (anti-blanket-suppression precedent), feat(registry): federate agent tools behind an AgentCore Gateway — P1 (#641) #755 (--no-verify bypass), feat(registry): agent asset catalog on AgentCore — provisioning, port/adapter, API, CLI (#246) #664 (the drift source)

Changes

The gate — a ratchet, not a full scan (fixes the drift). The blocking full-repo masking scan (security:sast:masking) only runs in security.yml (workflow_dispatch + weekly Monday cron only — not push-to-main) and the pre-push hook. security-pr.yml never ran it, so new findings land on main unchecked while every contributor is blocked on untouched debt on git push. That asymmetry is why the count grew 21 → 25 (the #664 registry stack) and why #755 needed --no-verify.

• Add security:sast:masking:range to mise.toml — semgrep --baseline-commit, so it reports only findings a branch ADDS relative to the base. Mirrors the existing security:secrets:range. Defaults baseline to origin/main so it's safe to run anywhere.
• Wire it into security-pr.yml: the existing range-resolution step now also emits a baseline SHA (PR base / merge-group base / HEAD on dispatch), and a new step runs the ratchet. A PR that adds a masking finding now fails at PR time; the 25 pre-existing findings on main are not re-flagged.

The 5 Category 3 suppressions — genuinely-contract fail-open / feature-detect only, justified inline on the return line (repo convention; a comment above doesn't bind under the rule's focus-metavariable: $RET). Not blanket-annotated, per #730.

Site	Why fail-open is the contract
cdk/.../jira-webhook-processor.ts (comments)	Third-party comments are advisory enrichment; a screening outage drops them (logged), the reporter's task proceeds.
cdk/.../linear-webhook-processor.ts (project docs + comments)	Same posture, mirrors the Jira processor.
agent/src/clarification_tool.py	Optional-dependency feature detect for claude_agent_sdk; None is the documented "server not registered" signal, marker fallback covers it.
agent/src/hooks.py	The stuck guard is advisory-only (see docstring); max_turns is the real backstop, so [] is "no steer this turn", not a masked failure.

Masking scan drops 25 → 20 active findings (semgrep test .semgrep/ still 2/2).

Scope note — this does not green main. The gate stops new masking findings at PR time; it does not clear the pre-existing debt. The full security:sast:masking scan (weekly security.yml + the pre-push hook) still reports the remaining findings, so main's weekly security suite stays red and the pre-push hook keeps forcing --no-verify until the follow-ups land. #790 (Cat 0), #791 (Cat 1 — registry attribution-erasure, security), and #792 (Cat 2) carry that remainder.

Verification

semgrep (scan + fixtures), ruff check/format, eslint (cdk), zizmor, and python -m py_compile all pass on the changed files. The security:sast:masking:range task was confirmed to exit non-zero on a newly-introduced finding and zero when only pre-existing debt remains.

⚠️ Committed/pushed with --no-verify: the agent-quality pre-push suite has an environment-specific test-isolation bug — test_registry_loader.py::TestMcpJsonNotCommittable::test_untracked_mcp_json_cannot_be_staged corrupts the real repo HEAD (commits a tree-deleting "init" commit and rewrites user.name/user.email) when run from the repo root, though it passes in isolation. Flagging separately; not touched by this PR.

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 0% with 4 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@780161b). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
cdk/src/handlers/linear-webhook-processor.ts	0.00%	2 Missing ⚠️
agent/src/hooks.py	0.00%	1 Missing ⚠️
cdk/src/handlers/jira-webhook-processor.ts	0.00%	1 Missing ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #788   +/-   ##
=======================================
  Coverage        ?   92.34%           
=======================================
  Files           ?      320           
  Lines           ?    90433           
  Branches        ?     8994           
=======================================
  Hits            ?    83508           
  Misses          ?     6925           
  Partials        ?        0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[isadeks]

Clean ratchet, and the five nosemgrep justifications each carry a concrete "why this is not a bug" rationale — that's exactly the right pattern for Category 3. One tiny nit:

• echo "Resolved SEMGREP_MASKING_BASELINE='$(grep '^baseline=' "$GITHUB_OUTPUT" | ...)'" re-reads $GITHUB_OUTPUT after writing to it. Works, but if a future case block writes another baseline= line the tail -n1 masks that. Consider capturing the value in a shell variable before the echo … >> "$GITHUB_OUTPUT" and echoing the variable. Same for the gitleaks range= echo above.

Otherwise LGTM — glad to see the required-status-check binding called out in the comment above the step.

[ClintEastman02]

Good catch — fixed in 586a7a0. The Resolve commit range step now captures range/baseline in shell variables, writes each to $GITHUB_OUTPUT once, and echoes the variables directly, so the log lines no longer depend on grep … | tail -n1 re-reading the file (which a future case block writing another baseline=/range= line could have masked). Applied to both the gitleaks range= and the semgrep baseline= echoes.