Skills trial: cloudflare/security-audit-skill name-only for LLM-native automation; stale-upstream flags; sandbox-profile open gate

adoption/manifest.json

@@ -453,7 +453,9 @@
       "observability/grand-dashboard/README.md",
       "blueprints/us-equities/catalyst-convergence/README.md"
     ],
-    "next_action_refs": [],
+    "next_action_refs": [
+      "claude-code-sandbox-profile"
+    ],
     "next_action_scope": "Foundation required gate IDs only; an empty list does not establish comparative saturation. Optional comparison work lives in research_refs.",
     "research_refs": [
       "docs/landscape-continuation.md",

adoption/skills/manifest.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "kind": "skills_trial_manifest",
-  "checked_at": "2026-09-26",
+  "checked_at": "2026-09-27",
   "decision_record": "docs/decisions/2026-09-25-skills-trial-and-usage.md",
   "cli": {
     "package": "skills",
@@ -738,6 +738,32 @@
       "claude_listing": "on",
       "codex_enabled": true,
       "added": "2026-09-26"
+    },
+    {
+      "name": "security-audit",
+      "source": "cloudflare/security-audit-skill",
+      "url": "https://github.com/cloudflare/security-audit-skill/tree/c1c8a8c1471069fb0e188eeaff69b8e8db6564a8/skills/security-audit",
+      "ref": "c1c8a8c1471069fb0e188eeaff69b8e8db6564a8",
+      "path": "skills/security-audit",
+      "tree_sha": "ccbc33ed119b28c3ef7b44a7e2081ab191ad63af",
+      "skill_md_sha256": "5e3e96a1e438d8f35fef0a1e38f02d4f00e2bdf910401b7dfe00e6779c6dac85",
+      "skill_md_bytes": 22026,
+      "description_chars": 359,
+      "upstream_disable_model_invocation": false,
+      "license": "MIT",
+      "official": true,
+      "audits": {
+        "gen_agent_trust_hub": "Pass",
+        "socket": "Pass",
+        "snyk": "Warn",
+        "url": "https://skills.sh/cloudflare/security-audit-skill/security-audit",
+        "checked_at": "2026-09-27"
+      },
+      "status": "trial",
+      "gap": "No installed procedure audits the whole repository with a coverage ledger and a confirmed/needs_validation/rejected verdict contract. Native /security-review reviews the diff between the branch and origin's default branch; /code-review reviews a diff, PR, branch or path for correctness bugs (Claude Code commands reference, read 2026-09-27); security-best-practices is framework guidance and 'not a full security audit' (catalogs/landscape/native-practice.json). Workflow stages run it by usage policy, which no setting enforces: name-only removes only its 359-character description (which says 'Use for security questions') from Claude's listing, so Claude can still invoke it by name and /security-audit stays in the / menu (Claude Code skills docs, skillOverrides table, read 2026-09-28). Upstream user-invocable: false (absent at the pin) would remove only the user trigger; Claude could still invoke it, so stage-only use stays a usage policy (same docs, read 2026-09-28). The M5c bake-off against /security-review decides promotion.",
+      "claude_listing": "name-only",
+      "codex_enabled": false,
+      "added": "2026-09-27"
     }
   ],
   "budget": {

adoption/templates/claude.settings.template.json

@@ -338,6 +338,7 @@
     "agent-browser": "name-only",
     "find-skills": "user-invocable-only",
     "variant-analysis": "on",
-    "writing-for-agents": "on"
+    "writing-for-agents": "on",
+    "security-audit": "name-only"
   }
 }

catalogs/foundation/manifest.json

@@ -248,18 +248,17 @@
       ]
     },
     {
-      "id": "worker-cancellation-crash-resume",
+      "id": "claude-code-sandbox-profile",
       "priority": 2,
-      "status": "accepted_within_scope",
-      "scope": "One native inherited-tool child completed cancellation, same-child continuation, abrupt parent-runtime failure, automatic systemd descendant cleanup and same-parent/same-child finalization with an unchanged checkpoint and one local effect. Prior manual-cleanup and permission-refused attempts remain retained; no host/provider/distributed guarantee is implied.",
-      "next_action": "Reuse the accepted role and supervisor for matching tasks. Qualify changed application effects or host boundaries separately; do not rerun this fixture merely to refresh a green status.",
+      "status": "open",
+      "scope": "Claude Code's native sandbox is not enabled as a session profile. docs/decisions/2026-09-24-secret-storage.md (lines 91-95) defers it until a measured profile exists; decision scoped-os-isolation qualifies sandbox-runtime filesystem and HTTP fixtures for owned commands, not a session-wide profile. Registered 2026-09-27; owner: foundation coordinator; re-check 2026-10-11. Pressure evidence: security-audit trial runs (M5) record each missing sandbox capability as a needs_validation blocker, as that skill's execution-safety rule requires; those dated blockers are this gate's pressure evidence.",
+      "next_action": "Measure one trial profile through claude --settings, leaving .claude/settings.json unchanged until it is measured: sandbox.enabled true, sandbox.failIfUnavailable true, allowUnsandboxedCommands false (https://code.claude.com/docs/en/sandboxing, read 2026-09-27); a host check of bubblewrap, socat and kernel.apparmor_restrict_unprivileged_userns; writes outside the owned worktree and launches of /mnt/c Windows binaries must fail. Credentials arm: the deferral's third control, the credentials.files deny for the store (docs/secret-storage.md lines 1171-1175), is a sandbox.credentials.files entry with mode deny for <store> as docs/secret-storage.md line 29 defines it (settings reference, sandbox.credentials). The deny belongs to the filesystem layer, so filesystem isolation stays on, and a sandboxed read of a store file must fail through a ~/ path and through its absolute path. Network arms: measure the network allowlist once as configured and once in a separate arm with sandbox.network.strictAllowlist true, which CLI --settings can set; in that arm a sandboxed request to a host outside the allowlist must be denied. Without it, permission mode decides such a host, and bypassPermissions mode allows it (settings reference, sandbox.network.strictAllowlist); the permission mode itself stays the user's decision (PS-1 in docs/harness-rules-convergence-20260922.md). Both extra arms follow a 2026-09-27 peer practice sweep. The deferral also requires gh, git push, codex and the paper runner, and that sandboxed commands cannot reach the user systemd bus. Raise this gate at every wave review until it is measured.",
       "source_paths": [
-        "blueprints/convergence-practice/native-worker/README.md",
-        "blueprints/convergence-practice/native-recovery/README.md",
-        "blueprints/us-equities/worker-supervision/README.md",
-        "blueprints/convergence-practice/worker-recovery/README.md",
-        "docs/restricted-worker-compatibility.md",
-        "blueprints/convergence-practice/worker-recovery/native-exact-read-receipt.json"
+        "docs/decisions/2026-09-24-secret-storage.md",
+        "docs/secret-storage.md",
+        "docs/harness-rules-convergence-20260922.md",
+        "docs/decisions/2026-09-25-skills-trial-and-usage.md",
+        "evidence/artifacts/cloudflare-audit-skill-trial-20260927/README.md"
       ]
     },
     {
@@ -281,5 +280,10 @@
       ]
     }
   ],
-  "open_gates": []
+  "open_gates": [
+    {
+      "id": "claude-code-sandbox-profile",
+      "gap_id": "claude-code-sandbox-profile"
+    }
+  ]
 }