(MOT-3732) feat(security-scan): add durable repository security reviews

README.md

@@ -42,6 +42,7 @@ npx skills add iii-hq/iii --all
 | [`approval-gate`](approval-gate/) | Rust | Human-in-the-loop approval gate — evaluates each function call (continue / deny / hold), holds pending calls for a human, and emits `approval::pending-*` events. Binds the harness `pre_trigger` hook. See [`approval-gate/architecture/`](approval-gate/architecture/). |
 | [`harness`](harness/) | Node | TS port of the iii harness stack — bundles `harness` (provider registry + credentials/settings/permissions via the `configuration` worker), `turn-orchestrator`, `hook-fanout`, `models-catalog`, the `provider-*` workers, `llm-budget`, and `context-compaction` as one pnpm monorepo. Approval is delegated to the standalone `approval-gate` worker via the `pre_trigger` hook. Conversations persist in `session-manager`. See [`harness/README.md`](harness/README.md). |
 | [`eval`](eval/) | Rust | Durable same-model A/B evaluation for prompts and system prompts — runs paired harness sessions, delegates correctness to iii evaluator functions, and reports pass rates with token, cost, latency, function-call, trace, and span metrics. |
+| [`security-scan`](security-scan/) | Rust | Report-only security reviews of operator-configured repositories at immutable Git commits, using a read-only Harness policy and durable deduplication. |
 | [`codex`](codex/) | Rust | OpenAI Codex as an iii worker — `codex::*` spawn the codex CLI for headless turns, mirror raw thread events onto `codex::events`, and stream AgentEvent frames onto `agent::events`. |
 | [`grok`](grok/) | Rust | xAI Grok CLI as an iii worker — `grok::*` spawn the grok CLI for headless turns (`grok --print --output-format streaming-json`), mirror raw events onto `grok::events`, and stream AgentEvent frames onto `agent::events`. |
 | [`devin`](devin/) | Rust | Devin as an iii worker: `devin::run` drives the local devin CLI and streams AgentEvent frames onto `agent::events`, `devin::session::*` wrap the Devin cloud session lifecycle, and `devin::api` reaches any v3 endpoint. |

iii-permissions.yaml

@@ -119,6 +119,12 @@ rules:
   - '!eval::step'
   - '!eval::on-turn-completed'
   - '!eval::sweep'
+  # security-scan: durable queue, cron, and Harness callback targets trust
+  # private State checkpoints or operator configuration. Agents must use the
+  # report-only request/list/read surface.
+  - '!security-scan::execute'
+  - '!security-scan::on-turn-completed'
+  - '!security-scan::on-schedule'
   # The shaping hop for a trigger bound to an ordinary function: the engine
   # fires it, agents never call it. Agents name their real target in
   # engine::register_trigger's `function_id`, which is checked against the

pnpm-workspace.yaml

@@ -27,6 +27,7 @@ packages:
   - iii-directory/ui
   - shell/ui
   - worktree/ui
+  - security-scan/ui
   - github/ui
   - llm-router/ui
   - provider-openai-codex/ui