🛡️ Sentinel: Add organization-wide default security policy

.Jules/palette.md

@@ -0,0 +1,3 @@
+## 2024-05-20 - Repository without UI Codebase
+**Learning:** This repository is a GitHub organization profile consisting entirely of Markdown documentation and static assets, and does not contain an active UI or frontend application codebase.
+**Action:** Since there is no UI, no UX enhancements can be applied. Aborting UX enhancements and PR creation as per instructions.

.github/workflows/pr-review-merge-scheduler.yml

@@ -0,0 +1,81 @@
+name: PR Review Merge Scheduler
+
+on:
+  schedule:
+    - cron: "17 */2 * * *"
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Print planned actions without mutating PRs
+        required: false
+        default: false
+        type: boolean
+      max_prs:
+        description: Maximum open PRs to inspect
+        required: false
+        default: "100"
+      trigger_reviews:
+        description: Dispatch OpenCode Review for PR heads without current approval
+        required: false
+        default: true
+        type: boolean
+      enable_auto_merge:
+        description: Enable auto-merge for current-head approved PRs
+        required: false
+        default: true
+        type: boolean
+
+concurrency:
+  group: pr-review-merge-scheduler
+  cancel-in-progress: false
+
+jobs:
+  scan-pr-queue:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      checks: read
+      contents: write
+      pull-requests: write
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+      DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run == true }}
+      MAX_PRS: ${{ inputs.max_prs || '100' }}
+      PROJECT_FLOW: ${{ vars.PROJECT_FLOW || 'git-flow' }}
+      TRIGGER_REVIEWS: ${{ github.event_name != 'workflow_dispatch' || inputs.trigger_reviews == true }}
+      ENABLE_AUTO_MERGE: ${{ github.event_name != 'workflow_dispatch' || inputs.enable_auto_merge == true }}
+    steps:
+      - name: Checkout trusted scheduler
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+
+      - name: Self-test scheduler
+        run: python3 scripts/ci/pr_review_merge_scheduler.py --self-test
+
+      - name: Inspect PR review and merge queue
+        run: |
+          set -euo pipefail
+          args=(
+            --repo "$GITHUB_REPOSITORY"
+            --base-branch "$DEFAULT_BRANCH"
+            --max-prs "$MAX_PRS"
+            --project-flow "$PROJECT_FLOW"
+            --review-workflow "OpenCode Review"
+          )
+          if [ "$DRY_RUN" = "true" ]; then
+            args+=(--dry-run)
+          fi
+          if [ "$TRIGGER_REVIEWS" = "true" ]; then
+            args+=(--trigger-reviews)
+          else
+            args+=(--no-trigger-reviews)
+          fi
+          if [ "$ENABLE_AUTO_MERGE" = "true" ]; then
+            args+=(--enable-auto-merge)
+          else
+            args+=(--no-enable-auto-merge)
+          fi
+          python3 scripts/ci/pr_review_merge_scheduler.py "${args[@]}"

.jules/bolt.md

@@ -0,0 +1,3 @@
+## 2024-06-21 - Python JSON Decoding Optimization
+**Learning:** In Python, string slicing `text[index:]` inside a loop can cause O(N^2) complexity and severe memory copying overhead. When decoding JSON incrementally from a large text blob, `json.JSONDecoder().raw_decode(text, index)` can parse from a given index without slicing. Combining this with `text.find("{", index)` to skip irrelevant characters is significantly faster than `enumerate(text)`.
+**Action:** Always prefer `raw_decode(text, index)` and `string.find()` over string slicing and character-by-character iteration when scanning large files for JSON objects.

.jules/sentinel.md

@@ -0,0 +1,8 @@
+## 2024-06-20 - Prevent HTML Comment Breakout in JSON Serialization
+**Vulnerability:** Markdown Injection / HTML Comment Breakout
+**Learning:** JSON serialized into HTML comments (like `<!-- json -->`) can contain `-->` in string values, causing GitHub's Markdown parser to close the comment prematurely and render the remaining JSON as attacker-controlled text or Markdown.
+**Prevention:** Always escape `<` and `>` as `\u003c` and `\u003e` (and `&` as `\u0026`) when embedding JSON in HTML contexts (even Markdown comments) to prevent breakout.
+## 2024-06-25 - Force Python JSON Normalizer to Prevent CI Gate Bypass
+**Vulnerability:** Workflow CI Security Bypass / Markdown Injection
+**Learning:** The GitHub Actions workflow `opencode-review.yml` attempted to optimize performance by doing a fast-path bash string extraction. If this succeeded, it skipped the Python JSON normalizer (`opencode_review_normalize_output.py`). This is a security flaw because the bash script does not escape `<, >, &` characters, allowing attackers to inject `-->` directly in JSON strings to break out of HTML comment sections.
+**Prevention:** Removed the fast-path check entirely. We must always enforce JSON normalization via `opencode_review_normalize_output.py` because it correctly parses the JSON payload and safely escapes all characters as `\u003c`, `\u003e` and `\u0026`.

.superset/config.json

@@ -0,0 +1,4 @@
+{
+  "setup": [],
+  "teardown": []
+}

SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+## Supported Versions
+
+Please check the security policy of individual repositories for specific version support details. In general, we only provide security updates for the latest major version of our active projects.
+
+## Reporting a Vulnerability
+
+We take the security of our systems seriously, and we value the security community. The disclosure of security vulnerabilities helps us ensure the security and privacy of our users.
+
+If you believe you have found a security vulnerability in any Contextual Wisdom Lab repository, please report it to us as described below.
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+Instead, please report them via [GitHub's private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) if enabled on the specific repository, or email the lab maintainers directly.
+
+When reporting a vulnerability, please include:
+* A description of the vulnerability and its impact.
+* The repository and specific version where it was found.
+* Steps to reproduce the vulnerability.
+* Any relevant logs, code snippets, or proof-of-concept.
+
+We will endeavor to respond to your report promptly, verify the vulnerability, and work on a fix as quickly as possible.