docs(security): add a chittymarket-specific SECURITY.md

[chitcommit]

Why not the boilerplate

A fleet sweep left an identical templated SECURITY.md untracked in 55 CHITTYOS repos (committed in 3: chittyentity, chittyops, chittysecrets). Stripping the service name and diffing chittymarket's copy against ch1tty-viewport's leaves exactly one differing line — the title.

It isn't merely generic here, it's false. It declares an auth provider, OAuth 2.0 PKCE, JWT verification, and Cloudflare Zero Trust for a repo whose CHARTER.md explicitly disclaims network APIs, identity generation, and token provisioning. Verified: no package.json, no src/, no wrangler.*. A compliance doc asserting controls that don't exist is worse than an absent one.

What replaces it

A policy grounded in the actual exposure — supply chain. This repo is the manifest Claude Code reads via /plugin add, so every artifact listed executes in an operator session with that operator's full tool access. A merge to main reaches developer machines with no sandbox in between.

Each claim was checked against the tree, not assumed:

Claim	Verified against
canonical/ is truth; skills/codex-skills/openclaw-agents are projections	repo layout + CLAUDE.md
4 plugin sources are external and unpinned (no ref/tag/commit)	.claude-plugin/marketplace.json — chittyhelper, chittyagent, chittycommand, legal-arsenal
hooks.json registers a PreToolUse type: command hook matching .*	plugins/chittyos-governance/hooks/hooks.json
…but its 10 gating rules live in operator-local ~/.claude/hooks/, referenced by filename only	same file's rules[]
Smoke jobs report schema-only vs real-runtime mode	local run output

The finding this surfaced

A CI job only gates if branch protection requires it.

Not hypothetical. main had protection enabled with required_status_checks.contexts: [] — no check could block a merge. PR #99 merged while openclaw runtime smoke was still pending.

Fixed: the three validate-chittymarket jobs are now required contexts on main.

{"contexts":["lint + test + manifest idempotency","codex runtime smoke","openclaw runtime smoke"],"strict":false}

Reviews are deliberately not required — that would block the non-interactive branch-completion flow, and self-approval isn't possible. Force-push and deletion were already blocked; conversation resolution was already required.

This PR is the first live test of that gate.

Deliberately not included

schema.json from the same sweep stays uncommitted (not deleted). It declares a {service,status,timestamp} API response contract for a repo that serves no API.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AKKxbsxh4tozUMzBKADSTd

Summary by CodeRabbit

• Chores

  • Validation now runs for every pull request, improving consistency across changes regardless of which files are modified.

• Documentation

  • Added a security policy covering the project’s threat model, trust boundaries, secrets handling, CI validation, and vulnerability reporting process.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 16c4c4c6-7811-46a7-838e-7842daca675c

📥 Commits

Reviewing files that changed from the base of the PR and between b6e18fe and f2912b9.

📒 Files selected for processing (2)

• .github/workflows/validate-chittymarket.yml
• SECURITY.md

---

📝 Walkthrough

Walkthrough

ChittyMarket now runs its validation workflow on every pull request. A new SECURITY.md defines the repository threat model, trust boundaries, credential rules, CI controls, and vulnerability reporting process.

Changes

Security Policy

Layer / File(s)	Summary
Policy scope and threat model SECURITY.md	Adds policy metadata and documents the absence of a runtime attack surface and the supply-chain exposure from installed plugin artifacts.
Trust boundaries and credential controls SECURITY.md	Documents canonical sources, generated projections, external plugin sources, operator-local hooks, and credential handling through ChittySecrets and ChittyConnect.
CI validation and reporting .github/workflows/validate-chittymarket.yml, SECURITY.md	Runs validation on every pull request. Documents CI gates, fallback loader behavior, branch protection requirements, and security issue reporting.

Estimated code review effort: 2 (Simple) | ~10 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/chittymarket-security

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}