feat: add Kilo Gastown methodology spec and SAST tooling

.github/workflows/sast-full.yml

@@ -0,0 +1,86 @@
+name: SAST Full Analysis
+
+on:
+  schedule:
+    - cron: "0 2 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  codeql:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      matrix:
+        language: [python, cpp, javascript]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+
+  trivy-repo:
+    name: Trivy Repository Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: sarif
+          output: trivy-results.sarif
+        continue-on-error: true
+
+      - name: Upload Trivy SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: trivy-results.sarif
+          category: trivy
+
+  full-semgrep:
+    name: Full Semgrep Analysis
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: returntocorp/semgrep-action@v1
+        with:
+          config: >-
+            p/security-audit
+            p/owasp-top-ten
+            p/cwe-top-25
+            .semgrep-rules/
+          generateSarif: true
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: semgrep.sarif
+          category: semgrep-full
+
+  full-secrets:
+    name: Full Secret Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: trufflesecurity/trufflehog@main
+        with:
+          path: ./
+          extra_args: --only-verified --fail
+        continue-on-error: true

.github/workflows/sast-quick.yml

@@ -0,0 +1,69 @@
+name: SAST Quick Check
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  security-events: write
+  pull-requests: write
+
+jobs:
+  semgrep:
+    name: Semgrep Scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: returntocorp/semgrep-action@v1
+        with:
+          config: >-
+            p/security-audit
+            p/owasp-top-ten
+            p/cwe-top-25
+            .semgrep-rules/
+          generateSarif: true
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: semgrep.sarif
+          category: semgrep
+
+  secrets:
+    name: Secret Scanning
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: trufflesecurity/trufflehog@main
+        with:
+          path: ./
+          extra_args: --only-verified --fail
+        continue-on-error: true
+
+  lint-rust:
+    name: Rust Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo clippy --all-targets --all-features -- -D warnings
+
+  license-check:
+    name: License Compliance
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: licensefinder/license_finder_action@v2
+        continue-on-error: true

.semgrep-rules/architecture-violations.yml

@@ -0,0 +1,52 @@
+rules:
+  - id: circular-module-dependency
+    patterns:
+      - pattern-either:
+          - pattern: |
+              use crate::domain::*;
+          - pattern: |
+              use crate::adapters::*;
+    message: Potential circular dependency. Check module import hierarchy.
+    languages: [rust]
+    severity: MEDIUM
+
+  - id: layer-violation-adapter-accessing-domain
+    patterns:
+      - pattern: |
+          mod adapters {
+              ...
+              use crate::domain::...
+              ...
+          }
+    message: Adapter layer should not directly access domain logic. Use ports/traits instead.
+    languages: [rust]
+    severity: MEDIUM
+
+  - id: mixed-concerns-in-handler
+    patterns:
+      - pattern: |
+          async fn $HANDLER(...) {
+              ...
+              database.query(...)
+              ...
+              api.call(...)
+              ...
+              filesystem.write(...)
+              ...
+          }
+    message: Handler mixes database, API, and filesystem concerns. Consider dependency injection.
+    languages: [rust]
+    severity: LOW
+
+  - id: direct-database-in-tests
+    patterns:
+      - pattern: |
+          #[test]
+          fn $TEST(...) {
+              ...
+              Database::connect(...)
+              ...
+          }
+    message: Tests should use mocks/fixtures, not direct database connections.
+    languages: [rust]
+    severity: MEDIUM

.semgrep-rules/secrets-detection.yml

@@ -0,0 +1,58 @@
+rules:
+  - id: hardcoded-aws-key
+    patterns:
+      - pattern-either:
+          - pattern: |
+              "AKIA[0-9A-Z]{16}"
+          - pattern: |
+              AKIA[0-9A-Z]{16}
+    message: Potential AWS Access Key detected. Use environment variables instead.
+    languages: [generic]
+    severity: CRITICAL
+
+  - id: hardcoded-api-key-env
+    patterns:
+      - pattern-either:
+          - pattern: |
+              api_key = "..."
+          - pattern: |
+              apiKey = "..."
+          - pattern: |
+              API_KEY = "..."
+    message: Hardcoded API key detected. Use environment variables or secrets management.
+    languages: [generic]
+    severity: HIGH
+
+  - id: hardcoded-password
+    patterns:
+      - pattern-either:
+          - pattern: |
+              password = "..."
+          - pattern: |
+              passwd = "..."
+          - pattern: |
+              pwd = "..."
+    message: Hardcoded password detected. Use environment variables or secrets management.
+    languages: [generic]
+    severity: CRITICAL
+
+  - id: hardcoded-slack-webhook
+    patterns:
+      - pattern: |
+          https://hooks.slack.com/services/[A-Z0-9/]+
+    message: Slack webhook URL detected. This should be in environment variables.
+    languages: [generic]
+    severity: HIGH
+
+  - id: hardcoded-github-token
+    patterns:
+      - pattern-either:
+          - pattern: |
+              ghp_[A-Za-z0-9_]{36,255}
+          - pattern: |
+              gho_[A-Za-z0-9_]{36,255}
+          - pattern: |
+              ghu_[A-Za-z0-9_]{36,255}
+    message: GitHub token detected. Never commit tokens to code.
+    languages: [generic]
+    severity: CRITICAL

.semgrep-rules/unsafe-patterns.yml

@@ -0,0 +1,59 @@
+rules:
+  - id: unsafe-deserialization
+    patterns:
+      - pattern-either:
+          - pattern: |
+              serde_json::from_str($X)
+          - pattern: |
+              bincode::deserialize($X)
+    message: Unsafe deserialization without validation. Consider using `serde` with validation attributes.
+    languages: [rust]
+    severity: MEDIUM
+
+  - id: unwrap-without-context
+    patterns:
+      - pattern: |
+          $X.unwrap()
+      - metavariable-comparison:
+          metavariable: $X
+          comparison: match_regex
+          regex: |
+            (?!(log|debug|info|warn|error)).*
+    message: Use of unwrap() without error handling context. Prefer `?` operator or explicit error handling.
+    languages: [rust]
+    severity: MEDIUM
+
+  - id: todo-without-issue
+    patterns:
+      - pattern: |
+          todo!($MSG)
+    message: Untracked todo!() macro. Please file an issue and reference it in a comment.
+    languages: [rust]
+    severity: LOW
+
+  - id: unsafe-sql
+    patterns:
+      - pattern: |
+          format!($QUERY, $ARG)
+    message: SQL queries built with format!() are vulnerable to injection. Use parameterized queries.
+    languages: [rust]
+    severity: CRITICAL
+
+  - id: hardcoded-localhost
+    patterns:
+      - pattern-either:
+          - pattern: |
+              "localhost:$PORT"
+          - pattern: |
+              "127.0.0.1:$PORT"
+    message: Hardcoded localhost in production code. Use environment variables or configuration.
+    languages: [rust]
+    severity: MEDIUM
+
+  - id: missing-error-context
+    patterns:
+      - pattern: |
+          return Err(e)
+    message: Error propagated without context. Consider using `.context()` from `anyhow` or `.map_err()`.
+    languages: [rust]
+    severity: LOW

.semgrep.yaml

@@ -0,0 +1,27 @@
+rules:
+  - id: config
+    include:
+      - .semgrep-rules/
+
+exclude:
+  - tests/
+  - "**/*_test.rs"
+  - "**/*_test.go"
+  - "**/*.test.ts"
+  - "**/*.test.js"
+  - "**/__pycache__"
+  - "**/__tests__"
+  - node_modules/
+  - target/
+  - build/
+  - dist/
+
+max-lines-per-finding: 10
+paths:
+  exclude:
+    - ".git/"
+    - "target/"
+    - ".archive/"
+    - "node_modules/"
+    - "dist/"
+    - "build/"