feat: add security policy suppressions

Author: solomonneas

CHANGELOG.md

@@ -55,6 +55,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Cybersecurity plugin roadmap covering broad agent-workspace security checks plus Brigade-specific scanner, doctor, import, and multi-harness security checks.
 - Built-in `security` station and `brigade security scan` for read-only agent workspace security checks.
 - `brigade security scan --import-findings` to route security findings into the local work import inbox for review.
+- `brigade security init` to write gitignored local defaults to `.brigade/security.toml`.
+- Security policy presets (`personal`, `public-repo`, `strict`), template scanning controls, stable finding fingerprints, and fingerprint suppressions.
+- Security scan secret evidence is redacted before reports or work imports are written.
 - `ROADMAP.md` covering the daily-driver path, scanner-ready inbox, chat-surface scanners, memory-card decay refresh, and portable operator setup.
 - `brigade work note` to append timestamped checkpoints to the active work session without ending it.
 - `brigade work doctor` to check dogfood config, Codex availability, local artifact paths, handoff inbox, ignore coverage, and latest run context for the daily work loop.
@@ -71,7 +74,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `brigade work run` now consumes the oldest pending ledger task before falling back to the latest extracted dogfood next step, and marks consumed tasks done after successful runs.
 - `brigade work task add --from-next` now reuses an equivalent pending task instead of adding duplicates.
 - `brigade work brief` now includes pending local work imports and import counts in both text and JSON output.
-- The managed gitignore block now treats `.brigade/dogfood.toml` and `.brigade/runs/` as local state.
+- The managed gitignore block now treats `.brigade/dogfood.toml`, `.brigade/security.toml`, and `.brigade/runs/` as local state.
 - Live smoke docs now keep Codex agent execution in a trusted repo cwd while writing temporary roster, artifacts, and handoff output under `/tmp`.
 - Handoff write failures now preserve final run artifacts, print the final answer, return nonzero, and mark `run.json` as `handoff-failed`.
 - Dogfood runs default to prompt-level read-only plus Codex's `danger-full-access` sandbox setting for trusted-workspace use so repo inspection works on hosts where native read-only sandboxing blocks shell inspection; `--native-read-only-sandbox` opts into stricter native enforcement.

README.md

@@ -202,7 +202,9 @@ Inspect a completed run without opening each JSON file:
 brigade runs list --cwd /path/to/repo
 brigade runs latest --cwd /path/to/repo
 brigade runs show .brigade/runs/<run-id>
+brigade security init
 brigade security scan --target .
+brigade security scan --target . --policy public-repo
 brigade security scan --target . --import-findings
 ```
 
@@ -287,7 +289,7 @@ brigade add guard    # content-guard
 brigade add tokens   # tokenjuice
 ```
 
-`security` is a built-in station with no external managed tool yet. Run `brigade security scan --target .` for a read-only agent workspace security report, or add `--import-findings` to turn findings into local `brigade work import` review items.
+`security` is a built-in station with no external managed tool yet. Run `brigade security scan --target .` for a read-only agent workspace security report, or add `--import-findings` to turn findings into local `brigade work import` review items. Secret evidence is redacted before reports or imports are written. Use `brigade security init` to write gitignored local defaults to `.brigade/security.toml`; it supports policy presets (`personal`, `public-repo`, `strict`), `fail_on`, template scanning, and fingerprint suppressions for reviewed findings.
 
 The current managed tools:
 

ROADMAP.md

@@ -63,17 +63,18 @@ Brigade-specific additions:
 - Integrate with `brigade doctor` as a security station and with `brigade work import` so findings can become reviewable local tasks instead of only console output.
 - Provide safe auto-fix only for narrow cases such as replacing obvious hardcoded sample secrets, tightening generated allow-list examples, or adding missing ignore rules.
 - Produce Memory Handoffs for durable security findings while keeping raw secret evidence redacted.
-- Add policy packs for personal dogfooding, public-repo release checks, CI gates, and strict enterprise workspaces.
+- Add policy packs for personal dogfooding, public-repo release checks, CI gates, and strict enterprise workspaces. Status: started with `personal`, `public-repo`, and `strict`.
 - Include dependency and package-manager hardening checks for agent plugin ecosystems, MCP packages, skills, and local tool wrappers.
 - Track false-positive taxonomy, runtime-confidence rules, suppressions, and regression fixtures as first-class project artifacts.
 
 First build slice:
 
-- Create a plugin scaffold and security scan contract. Status: started with built-in `security` station and `brigade security scan`.
+- Create a plugin scaffold and security scan contract. Status: started with built-in `security` station, `brigade security init`, and `brigade security scan`.
 - Start with config discovery and read-only reporting for Brigade, Claude Code, Codex, and MCP config files. Status: started.
 - Add core rule categories for secrets, permissions, hooks, MCP servers, supply-chain patterns, and agent instructions. Status: started.
 - Output JSON plus readable text, then route selected findings into `brigade work import`. Status: started with `--import-findings`.
 - Keep all raw findings local and gitignored unless the operator explicitly exports an evidence pack. Status: current default.
+- Add local policy defaults, stable finding fingerprints, and suppressions. Status: started with `.brigade/security.toml`.
 
 ## Later Phase: Memory Card Decay And Refresh
 

src/brigade/cli.py

@@ -388,15 +388,37 @@ def _build_parser() -> argparse.ArgumentParser:
     p_security = sub.add_parser("security", help="Scan agent workspace security posture.")
     security_sub = p_security.add_subparsers(dest="security_command", metavar="<security-command>")
     security_sub.required = True
+    p_security_init = security_sub.add_parser("init", help="Write local security scan defaults.")
+    p_security_init.add_argument("--target", "-t", type=Path, default=Path("."), help="Repo or workspace to configure.")
+    p_security_init.add_argument("--force", action="store_true", help="Overwrite an existing security config.")
     p_security_scan = security_sub.add_parser("scan", help="Run a read-only agent workspace security scan.")
     p_security_scan.add_argument("--target", "-t", type=Path, default=Path("."), help="Repo or workspace to scan.")
     p_security_scan.add_argument("--json", action="store_true", help="Print machine-readable JSON.")
+    p_security_scan.add_argument(
+        "--policy",
+        choices=["personal", "public-repo", "strict"],
+        default=None,
+        help="Policy preset. Defaults to .brigade/security.toml or personal.",
+    )
     p_security_scan.add_argument(
         "--fail-on",
         choices=["none", "low", "medium", "high", "critical"],
-        default="critical",
+        default=None,
         help="Return nonzero when a finding at or above this severity exists.",
     )
+    p_security_scan.add_argument(
+        "--include-templates",
+        dest="include_templates",
+        action="store_true",
+        default=None,
+        help="Include public template files in scanner findings.",
+    )
+    p_security_scan.add_argument(
+        "--no-include-templates",
+        dest="include_templates",
+        action="store_false",
+        help="Exclude public template files from scanner findings.",
+    )
     p_security_scan.add_argument(
         "--import-findings",
         action="store_true",
@@ -761,11 +783,15 @@ def main(argv=None) -> int:
     if cmd == "security":
         from . import security_cmd
 
+        if args.security_command == "init":
+            return security_cmd.init(target=args.target, force=args.force)
         if args.security_command == "scan":
             return security_cmd.scan(
                 target=args.target,
                 json_output=args.json,
+                policy=args.policy,
                 fail_on=args.fail_on,
+                include_templates=args.include_templates,
                 import_findings=args.import_findings,
             )
         parser.error(f"unknown security command: {args.security_command}")

src/brigade/install.py

@@ -62,6 +62,7 @@ def build_gitignore_block(selection: Selection) -> str:
         "",
         "# brigade local state (logs, scrub cache, dogfood runs, work sessions).",
         ".brigade/dogfood.toml",
+        ".brigade/security.toml",
         ".brigade/logs/",
         ".brigade/runs/",
         ".brigade/scrub-cache/",