security-auditlisted

# Security audit sweep A read-only sweep over the tree, run as a **workflow**: Claude and Codex review the same shards concurrently and independently, every finding is then attacked by verifiers, and one adjudication pass merges what survives. **The sweep ends at a report.** Steps 0–3 change nothing in the tree; step 3 hands the ranked list to the user and waits. Steps 4–5 run only over the findings they named. Not `/security-review`, which reviews the pending diff on a branch — that never finds anything older than the newest branch. Not the [nightly-tidy skill](../nightly-tidy/SKILL.md), which may not change behaviour. No model is pinned here. The workflow inherits the session's; pinning one is how a runbook ages into naming something that no longer exists. --- ## 0. Preconditions ```bash git fetch origin git status --short # must print nothing git log --oneline -1 origin/main # must equal local main command -v codex && codex exec --sandbox read-only "Reply with exactly: OK" ``` A dirty tree is disqualifying: findings quote `file:line`, and an uncommitted edit invalidates every citation. Reviewing code an open worktree is about to change is fine — the sweep reads. Codex absent or unauthenticated: run single-engine and say so at the top of the report. No finding may then be ranked `confirmed` by engine agreement — that rank is unavailable, not satisfied by default. Without the throwaway call, an expired login fails identically to a bad pro