df: comprehensive security v1 rule base (judgment-tier + invariant-linked authz)

[bborbe]

Summary

Spec 011 (security-comprehensive-rules) — expand the coding security rule base from the foundational MUST-tier mechanical set to the comprehensive v1 rule set.

• 7 judgment-tier RULE blocks in docs/security/security-review-guide.md (owner go-security-specialist, IDs go-security/<slug>, MUST/SHOULD, **Trigger**: **/*.go): ssrf-user-controlled-url, xss-untrusted-html, deserialization-unsafe, open-redirect, webhook-verification (MUST); mass-assignment, insecure-defaults (SHOULD)
• 2 invariant-linked authz rules go-security/resource-ownership + go-security/tenant-isolation (MUST, **Class**: security-invariant, **Trigger**: @commits, enforcement citing security-review-pipeline.md) — fire with the derived session security model
• scripts/build-index.py gains **Class**: field parsing → optional class index key (byte-stable, non-perturbing); docs/rule-block-schema.md documents the new field + key
• rules/index.json regenerated 171 → 180 entries; all existing entries byte-stable; citations validate (existing + new)
• Cross-language detector layout decision recorded per spike Finding 2 (per-language rules/security/{go,python,node}/ target, go-first v1 stays flat)
• Guide reconciled: no tier-deferral phrasing remains; three-tier framing fully shipped
• CHANGELOG ## Unreleased feat bullet

Verification

• make precommit green (check-links/check-json/check-index/check-coverage/check-acceptance/check-rule-tests)
• make check-index green; build-index.py | jq 'length' = 180; has("class") = 2
• AC5 non-vacuous: 3 new rule_ids resolve via validate-citations.sh (findings 3, dropped 0)
• AC10 (operator rung): scenarios 007/008 walks + SSRF inline fixture at spec-verification time

Out of scope: task-5 Go agent (parallel session), --security wiring (v0.49.0), verifier/citations (v0.48.0).

[ben-s-pull-request-reviewer]

All checks complete. Let me now produce the final verdict JSON.

Summary of findings:

• Mechanical funnel: 0 findings (clean)
• Step 4c-sel: 2 applicable rules (go-security/resource-ownership, go-security/tenant-isolation — both @commits); 86 skipped; no Go source in diff so @commits is the only applicable class
• Step 4d-sel: selector clean — the applicable @commits rules require go-security-specialist review of actual Go code handling resources by ID; the diff touches only docs/prompts/specs — no resource handlers, no Go source, no authorization logic changed
• Schema: **Class**: <token> field documented, class key in rules/index.json confirmed, build-index.py updated correctly
• Index: 180 entries (171 → 180, +9 new security entries), valid JSON, both security-invariant entries have correct class key
• Example JSON: go-security/resource-ownership with class: "security-invariant" — matches the fix committed in HEAD
• Cross-references: all relative paths correct (../go-security-linting.md, ../teamvault-conventions.md, ../rule-block-schema.md, docs/security/security-review-pipeline.md)
• CHANGELOG: new entry present in ## Unreleased

{
  "verdict": "approve",
  "summary": "PR ships a comprehensive security v1 rule base across three enforcement tiers (mechanical, judgment, invariant). The diff adds 9 new judgment-tier security rules to docs/security/security-review-guide.md, extends rule-block-schema.md with the **Class** field, updates build-index.py to index it, and regenerates rules/index.json from 171 to 180 entries — all well-formed. The HEAD commit correctly fixes a dead rule ID in the schema's example JSON. No Go source files were changed, so the @commits security-invariant rules have no violations to flag in this diff.",
  "comments": [],
  "concerns_addressed": [
    "security: new security-review-guide.md rule blocks correctly formed with owner go-security-specialist, enforcement_type judgment, and Class field — not an issue",
    "security: rules/index.json class field on security-invariant entries (resource-ownership, tenant-isolation) correctly populated — not an issue",
    "correctness: build-index.py Class field parsing added correctly (lowercase key matching) — not an issue",
    "correctness: rule-block-schema.md Class field documented with example using go-security/resource-ownership (the fix from HEAD) — not an issue",
    "correctness: schema example JSON is valid and uses correct rule ID (verified in HEAD) — not an issue",
    "correctness: cross-references in security-review-guide.md use correct relative paths (../go-security-linting.md, ../teamvault-conventions.md, ../rule-block-schema.md) — not an issue"
  ]
}