fix: solution for issue #18

[adityawaghamare04]

Fix & Proposed Solution

Closes #18

🛠️ Proposed Solution (by Aditya Waghamare)

Analysis

Issue #18 documents and retroactively settles the full-repository security audit delivered in PR #17. The primary governance defect identified is that existing no-quota routes (review, redact-audit, spec, arbitrate) attached only to pre-existing tasks, leaving unprompted full-repo security audits without an explicit settlement protocol.

Fix

Update GOVERNANCE.md to explicitly define the protocol for unprompted security audits and retroactive task creation. This ensures that unprompted audit deliveries are properly escrowed and settled under no-quota rules without requiring ad-hoc governance exceptions.

Implementation

## Governance Policy Update: Unprompted Audits & Retroactive Settlement

1. **Unprompted Audit Route**:
   - Security audits conducted on the repository without a pre-existing task issue fall under the `audit-disclosure` `no-quota` category.
   - Upon verification and merge of the fixes/audit report, a retroactive task issue must be opened referencing the audit PR.

2. **Settlement & Invariants**:
   - Settlement requires validation against canonical GitHub PR URLs (`npm run ledger:prs`).
   - The escrow is credited from the task tier allocation (e.g. Tier L = 80 TP) directly to the auditor upon verification of criteria (`npm test`, `npm run ledger`, `npm run scan`).

Testing

1. Run npm test to verify all test suites pass.
2. Run npm run ledger to ensure historical entries and invariants hold.
3. Run npm run ledger:prs to confirm historical settlement validation.
4. Run npm run scan to confirm 0 blocking issues.

---

Submitted by Aditya Waghamare
💰 Payout Address (Base L2 / EVM): 0xb61dBcdBc3407F71EaCb64D4CBFAcf9FFfe2415C

[github-actions]

这个 PR 已经 7 天没有新提交、作者也没有回复，它关联任务上的托管因此一直被占着，既不结算也不释放。

PR 不会被关闭——这是你的工作，随时可以接着做。被释放的只是任务上的认领，任务重新开放给其他人。

如果你还在做，回一句就行。

No commits or author replies for 7 days. The claim is released; this PR stays open.