feat: add Kilo Gastown methodology spec and SAST tooling

.github/RULESET_BASELINE.md

@@ -0,0 +1,43 @@
+# cliproxyapi-plusplus Ruleset Baseline
+
+This repository now has a checked-in baseline that matches the repaired remote `Main` ruleset.
+
+## Enforced Branch Protection Baseline
+
+- require pull requests before merge on the default branch
+- no branch deletion
+- no force push / non-fast-forward updates
+- require at least 1 approval
+- dismiss stale approvals on new push
+- require resolved review threads before merge
+- allow merge methods: `merge`, `squash`
+- enable GitHub `code_quality`
+- enable GitHub `copilot_code_review`
+
+## Repo-Local Governance Gates
+
+The repo-local workflow set remains the main CI and policy contract:
+
+- `policy-gate`
+- `pr-path-guard`
+- `pr-test-build`
+- `required-check-names-guard`
+- `quality-gate`
+- `security-guard`
+- `codeql`
+- `sast-quick`
+- `sast-full`
+
+Current required check manifests:
+
+- `.github/required-checks.txt`
+- `.github/release-required-checks.txt`
+
+Those manifests should drive the next remote ruleset wave once the stable job names are re-verified
+against live workflow output.
+
+## Exception Policy
+
+- only documented billing or quota failures may be excluded from blocking CI evaluation
+- review threads and blocking comments must be resolved before merge
+- PRs must not rely on local `--no-verify` bypasses instead of server-side checks

.github/rulesets/main.json

@@ -0,0 +1,41 @@
+{
+  "name": "Main",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 1,
+        "dismiss_stale_reviews_on_push": true,
+        "required_reviewers": [],
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": true,
+        "allowed_merge_methods": ["merge", "squash"]
+      }
+    },
+    {
+      "type": "code_quality",
+      "parameters": {
+        "severity": "errors"
+      }
+    },
+    {
+      "type": "copilot_code_review",
+      "parameters": {
+        "review_on_push": true,
+        "review_draft_pull_requests": true
+      }
+    }
+  ]
+}

.github/workflows/sast-full.yml

@@ -0,0 +1,86 @@
+name: SAST Full Analysis
+
+on:
+  schedule:
+    - cron: "0 2 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  codeql:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      matrix:
+        language: [python, cpp, javascript]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+
+  trivy-repo:
+    name: Trivy Repository Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: sarif
+          output: trivy-results.sarif
+        continue-on-error: true
+
+      - name: Upload Trivy SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: trivy-results.sarif
+          category: trivy
+
+  full-semgrep:
+    name: Full Semgrep Analysis
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: returntocorp/semgrep-action@v1
+        with:
+          config: >-
+            p/security-audit
+            p/owasp-top-ten
+            p/cwe-top-25
+            .semgrep-rules/
+          generateSarif: true
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: semgrep.sarif
+          category: semgrep-full
+
+  full-secrets:
+    name: Full Secret Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: trufflesecurity/trufflehog@main
+        with:
+          path: ./
+          extra_args: --only-verified --fail
+        continue-on-error: true

.github/workflows/sast-quick.yml

@@ -0,0 +1,69 @@
+name: SAST Quick Check
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  security-events: write
+  pull-requests: write
+
+jobs:
+  semgrep:
+    name: Semgrep Scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: returntocorp/semgrep-action@v1
+        with:
+          config: >-
+            p/security-audit
+            p/owasp-top-ten
+            p/cwe-top-25
+            .semgrep-rules/
+          generateSarif: true
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: semgrep.sarif
+          category: semgrep
+
+  secrets:
+    name: Secret Scanning
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: trufflesecurity/trufflehog@main
+        with:
+          path: ./
+          extra_args: --only-verified --fail
+        continue-on-error: true
+
+  lint-rust:
+    name: Rust Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo clippy --all-targets --all-features -- -D warnings
+
+  license-check:
+    name: License Compliance
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: licensefinder/license_finder_action@v2
+        continue-on-error: true

.github/workflows/security-guard.yml

@@ -1,9 +1,18 @@
-name: security-guard
-on: [workflow_dispatch]
+name: Security Guard
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
 jobs:
-  audit:
+  ggshield-scan:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Run security audit
-        run: echo "Security audit placeholder - no script available yet"
+      - uses: actions/setup-python@v5
+      - name: Install ggshield
+        run: pip install ggshield
+      - name: Run ggshield secret scan
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
+        run: ggshield secret scan path . --recursive

.semgrep-rules/architecture-violations.yml

@@ -0,0 +1,52 @@
+rules:
+  - id: circular-module-dependency
+    patterns:
+      - pattern-either:
+          - pattern: |
+              use crate::domain::*;
+          - pattern: |
+              use crate::adapters::*;
+    message: Potential circular dependency. Check module import hierarchy.
+    languages: [rust]
+    severity: MEDIUM
+
+  - id: layer-violation-adapter-accessing-domain
+    patterns:
+      - pattern: |
+          mod adapters {
+              ...
+              use crate::domain::...
+              ...
+          }
+    message: Adapter layer should not directly access domain logic. Use ports/traits instead.
+    languages: [rust]
+    severity: MEDIUM
+
+  - id: mixed-concerns-in-handler
+    patterns:
+      - pattern: |
+          async fn $HANDLER(...) {
+              ...
+              database.query(...)
+              ...
+              api.call(...)
+              ...
+              filesystem.write(...)
+              ...
+          }
+    message: Handler mixes database, API, and filesystem concerns. Consider dependency injection.
+    languages: [rust]
+    severity: LOW
+
+  - id: direct-database-in-tests
+    patterns:
+      - pattern: |
+          #[test]
+          fn $TEST(...) {
+              ...
+              Database::connect(...)
+              ...
+          }
+    message: Tests should use mocks/fixtures, not direct database connections.
+    languages: [rust]
+    severity: MEDIUM

.semgrep-rules/secrets-detection.yml

@@ -0,0 +1,58 @@
+rules:
+  - id: hardcoded-aws-key
+    patterns:
+      - pattern-either:
+          - pattern: |
+              "AKIA[0-9A-Z]{16}"
+          - pattern: |
+              AKIA[0-9A-Z]{16}
+    message: Potential AWS Access Key detected. Use environment variables instead.
+    languages: [generic]
+    severity: CRITICAL
+
+  - id: hardcoded-api-key-env
+    patterns:
+      - pattern-either:
+          - pattern: |
+              api_key = "..."
+          - pattern: |
+              apiKey = "..."
+          - pattern: |
+              API_KEY = "..."
+    message: Hardcoded API key detected. Use environment variables or secrets management.
+    languages: [generic]
+    severity: HIGH
+
+  - id: hardcoded-password
+    patterns:
+      - pattern-either:
+          - pattern: |
+              password = "..."
+          - pattern: |
+              passwd = "..."
+          - pattern: |
+              pwd = "..."
+    message: Hardcoded password detected. Use environment variables or secrets management.
+    languages: [generic]
+    severity: CRITICAL
+
+  - id: hardcoded-slack-webhook
+    patterns:
+      - pattern: |
+          https://hooks.slack.com/services/[A-Z0-9/]+
+    message: Slack webhook URL detected. This should be in environment variables.
+    languages: [generic]
+    severity: HIGH
+
+  - id: hardcoded-github-token
+    patterns:
+      - pattern-either:
+          - pattern: |
+              ghp_[A-Za-z0-9_]{36,255}
+          - pattern: |
+              gho_[A-Za-z0-9_]{36,255}
+          - pattern: |
+              ghu_[A-Za-z0-9_]{36,255}
+    message: GitHub token detected. Never commit tokens to code.
+    languages: [generic]
+    severity: CRITICAL