docs(launchpad): retire SECURITY-POSTURE.md's control-status table

[benmitchell11]

Summary

Retires SECURITY-POSTURE.md's "What is true today" section — an eleven-row Open/Implemented control-status table plus a now-false "runs on localhost only" claim — replacing it with a short explanation and a pointer to the cohort's private companion repository for real posture. Two other passages in the same file that quoted specific claims from the removed table are also fixed, so nothing dangling references content that no longer exists.

Related issue

Refs #19 — this repository's own #19 is unrelated (closed, "rehearse Host-to-community
binding and membership gating on a local VM"). Written as bare Refs #19 only because
launchpad/scripts/pr_body_check.py's REFS_RE regex (\bRefs\s+#\d+) doesn't support a
cross-repo qualifier — the real issue is
launchpad-26/buzz-infrastructure#19,
in the private companion repo, about this exact file. See Escalations.

Issue type

Task

---

Agent provenance

Field	Value
Harness / provider	Claude Code
Model	claude-sonnet-5
Session reference	N/A - not exposed by this harness
Initiating human	@benmitchell11

Objective

launchpad/SECURITY-POSTURE.md no longer states a false "localhost only" claim or a control-by-control readiness table, and nothing else in the file quotes stale claims from the removed section.

Impacted components

launchpad/SECURITY-POSTURE.md

Approach and rejected alternatives

The linked issue frames this as a choice between correcting the table or retiring it, with an explicit routing note: "If a correction cannot be written without [ports/hostnames/control-by-control status], the answer is to retire the document, not to weaken the boundary."

Rejected: correct the table with today's real status. A control-by-control readiness table in a public, world-readable file is a gap map for anyone who reads it, whether or not it's accurate — making it accurate doesn't close that problem, it makes the map more useful to an attacker, not less. This applies regardless of which direction the real numbers have moved since 2026-08-11.

Rejected: retire the whole document. Only "What is true today" (the false claim + the table) is the disclosure risk. The rest of the document — Accepted risks, the agent-execution containment gap, Open security decisions, the public-repository rule itself — is policy and decision-tracking text, not live host state, and three other public docs (ARCHITECTURE.md, REQUIREMENTS.md, VISION.md) link into those other sections specifically. Retiring the whole file would break those anchors for no disclosure benefit.

Kept the section heading ## What is true today rather than removing it, since ARCHITECTURE.md and REQUIREMENTS.md both link to SECURITY-POSTURE.md#what-is-true-today — the anchor still needs to resolve to something coherent, just not to a live-state table anymore.

Kept one control-level fact (cargo-deny check runs in this repo's own CI): it names nothing about the live host and is independently checkable by any reader from the already-public .github/workflows/ci.yml, so restating it isn't new disclosure.

Found and fixed two dangling references while reviewing the diff for stray host-state claims, per this issue's own DoD instruction to verify that specifically: the Accepted risks table's push-protection row said "None of that detection runs yet — it is OPEN" (a specific status claim from the table I'd just removed), and the public-repository-rule section repeated "detection of secret material in diffs and history is OPEN, and whether secret scanning and push protection are even switched on cannot be answered without admin" (same). Both reworded to keep their actual point (detection is scoped to need no admin permission; nothing here mechanically enforces the rule) without asserting a status the removed table no longer states.

Verification

Command run (confirming no other file links to content only the removed table carried):

grep -rn "SECURITY-POSTURE" launchpad/*.md AGENTS.md

Raw output:

launchpad/ARCHITECTURE.md:176:[SECURITY-POSTURE.md § Open security decisions](SECURITY-POSTURE.md#open-security-decisions):
launchpad/ARCHITECTURE.md:183:[SECURITY-POSTURE.md § What is true today](SECURITY-POSTURE.md#what-is-true-today), and
launchpad/README.md:138:| [`SECURITY-POSTURE.md`](SECURITY-POSTURE.md) | Where security controls stand today, which risks are accepted, and the gap nothing owns |
launchpad/REQUIREMENTS.md:94:[SECURITY-POSTURE.md § What is true today](SECURITY-POSTURE.md#what-is-true-today). Neither
launchpad/REQUIREMENTS.md:101:  person — [SECURITY-POSTURE.md § The public-repository rule](SECURITY-POSTURE.md#the-public-repository-rule).
launchpad/REQUIREMENTS.md:204:[SECURITY-POSTURE.md § The public-repository rule](SECURITY-POSTURE.md#the-public-repository-rule)
launchpad/VISION.md:117:| No secrets, keys, tokens, private hostnames or member rosters in tracked files | `IMPLEMENTED` as a binding rule, not as a checked property of the repository — [SECURITY-POSTURE.md § The public-repository rule](SECURITY-POSTURE.md#the-public-repository-rule) | [`launchpad/AGENTS.md` §8](AGENTS.md) and [#42](https://github.com/launchpad-26/buzz/issues/42) |

All four are generic pointers ("the state of controls is owned by that section," "here's where the public-repository rule is quoted") — none quote specific table rows, so none needed editing. Confirmed by reading each citation's surrounding context directly.

Command run (checking for remaining dangling issue-number references from the removed table):

grep -n "#29\]\|#30\]\|#31\]\|#32\]\|#34\]\|#35\]\|#37\]\|#67\]\|#68\]\|#70\]\|#71\]\|localhost\|dependabot\|Dependabot" launchpad/SECURITY-POSTURE.md

Raw output:

30:already drifted from reality — it stated the cohort ran Buzz on `localhost` only, which
124:| adr: dependency update path for this fork — Dependabot, Renovate, or neither | `OPEN` — [#64](https://github.com/launchpad-26/buzz/issues/64) |

Only remaining hits are: line 30, my own retrospective description of the removed claim (accurate, historical); line 124, an unrelated ADR row about dependency tooling choice, not the removed section.

Command run (host-specifics and credential sweep, since this issue's own DoD requires reading the diff specifically for this):

grep -niE "(-----BEGIN|password\s*=|secret\s*=|api[_-]?key|token\s*=|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{20,}|xox[baprs]-|:[0-9]{2,5}\b|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})" launchpad/SECURITY-POSTURE.md

Raw output: (no matches, exit code 1)

• Tests or checks were run and the raw output is pasted above
• The diff is confined to the scope of the linked issue
• No secrets, keys, tokens or hostnames were added to tracked files

Not verified

Whether the disclosure-boundary wording I wrote ("tracked in the cohort's private companion repository, buzz-infrastructure") is itself acceptable to state. Verified that buzz-infrastructure is already named in several other already-merged, already-public files in this repo (launchpad/decisions/ADR-0001-*.md, launchpad/agents/the-professor/README.md, and others) — so naming it isn't new disclosure — but didn't get explicit sign-off on this exact phrasing beyond that precedent check.

Two of the linked issue's DoD items are outside this PR's own scope, by the issue's own design: "The accurate posture lives here instead, in security/" refers to content that already exists in buzz-infrastructure's security/ directory (EXPOSURE-ASSESSMENT.md, SECURITY-REVIEW-2026-08-14.md, etc.), not something this PR needs to create — not independently re-verified here since it's a different repo. "Noted in #12 as a worked example" is a separate action in buzz-infrastructure, not something a buzz PR can do — handled as a follow-up comment there, not part of this PR.

Security implications

Reduces disclosure surface: removes a control-by-control readiness table and a false operational claim from a public, world-readable file. No code or runtime change — documentation only.

Escalations

The correct-vs-retire question itself needed no new judgment call — the linked issue's own routing note already resolved it in advance.

The PR-body checker's Refs #<n> pattern has no cross-repo form, which this PR ran into directly: the real related issue lives in buzz-infrastructure, and the checker's regex (\bRefs\s+#\d+) only matches a bare #<n>, which GitHub would then auto-link to this repo's own, unrelated issue #19. Worked around above by writing the bare form only to satisfy the regex, immediately followed by an explicit correction and the real cross-repo link — not filing a fix for the checker itself as part of this PR, since that's a tooling change outside this issue's scope, but flagging it here in case it's worth its own small issue.

[tucktuck101]

Request changes

High — the retired claim still discloses the current deployment state

launchpad/SECURITY-POSTURE.md:30-35 says the former localhost-only statement “stopped being true.” That establishes that the cohort now runs Buzz beyond localhost. The linked private issue requires the public PR to contain no host state explaining the correction, and specifically requires that the false localhost claim no longer appear in the public repository.

Replace this retrospective with disclosure-neutral language: state that the dated status table was retired because it no longer met the public-document boundary, without describing what changed operationally.

High — the replacement retains a control-status claim the issue requires removing

launchpad/SECURITY-POSTURE.md:48-51 says that cargo-deny check runs in CI and states its coverage. It is independently verifiable, but it is still a current control-status assertion. The linked issue's definition of done requires this PR to contain no control status, not merely no host-specific status.

Remove this assertion from the retired-status section. The public document can retain policy, accepted risks, and disclosure-boundary guidance without carrying a live control fact.

Medium — surrounding documents still send readers here for the now-private posture

launchpad/ARCHITECTURE.md:181-184 says #34's security-event-visibility status is carried by this section. launchpad/REQUIREMENTS.md:91-95 and launchpad/README.md:138 likewise describe SECURITY-POSTURE.md as owning the current state of controls. After this change, the retained anchor deliberately no longer carries current control posture. The links resolve but their claims are materially stale.

Update these descriptions to identify the remaining public content—policy, accepted risks, execution gap, and open decisions—without replacing the removed material with private operational details.

What looks good

• The eleven-row gap table is removed, and the What is true today anchor remains for existing links.
• The Accepted-risks and public-repository-rule passages no longer quote status claims from the removed table.
• No direct link to private posture material or other host-specific detail is added.

Panel: fable + codex.

[serina-mcfall]

Reviewing this alongside the other six PRs carrying CHANGES_REQUESTED. I have not
pushed anything to this branch — it is @benmitchell11's, and its findings turn on a
disclosure boundary that is his and the reviewer's call, not mine. Analysis only.

All three findings look addressed in 6e9c2d845, which landed after the review.

High — the retired claim still discloses the current deployment state. Addressed. The
retrospective no longer says the claim "stopped being true". It now says a dated,
present-tense operational claim of that kind is what a public document should not carry,
and explicitly declines to answer whether it is current either way. That is
disclosure-neutral in the sense the finding asked for: it gives a reader no way to infer
what changed.

High — the replacement retains a control-status claim. Addressed. The cargo-deny
assertion is gone; grep finds no occurrence of it anywhere in the file.

Medium — surrounding documents send readers here for the now-private posture.
Addressed in all three. README.md:138, ARCHITECTURE.md:183 and REQUIREMENTS.md:95 now
each say current control status is tracked privately and that this document carries policy
rather than a status reading. The links resolve and their claims match what the anchor now
holds.

One residual question, raised rather than assumed

The linked private issue's definition of done includes, as its own clause, that the false
localhost claim no longer appears in the public repo. Read literally, the retirement
explanation still restates it — in the past tense, as the thing being retired.

I do not think that is obviously wrong: naming what was removed is ordinary, and the
current wording is careful not to assert the claim became false. But it is the one place
where the file and that clause can be read as disagreeing, so it is worth a deliberate
answer rather than leaving it to inference. Two options: name the retired content
generically ("a dated present-tense operational claim") without restating it, or keep it
and note in the PR why restating a retired claim satisfies the clause.

Related, and not yet raised anywhere: this PR's own body describes the removed
material as a "now-false" localhost claim. The PR body is public and permanent. That phrase
does the thing the file was corrected to stop doing — it tells a reader the claim was true
and is not any more. The same private issue's routing note is explicit that the public PR
must not carry the host state that explains the correction. Worth editing the body, which
costs nothing and needs no code change.

The diff clause, checked

That definition of done asks for one thing to be verified by reading the diff specifically.
Doing that across all of launchpad/ on this branch, 36 added lines:

Check	Result
Port-like :NNNN tokens	0
Hostname-like tokens	1 distinct — github.com
Open / Implemented / Closed status-table cells	0
localhost mentions	1 — the retirement explanation discussed above

So the diff is clean on ports, hostnames and control status. The only open item is the one
above.

[benmitchell11]

The two commits on this branch address all three findings from the review:

• Localhost claim (High): the retired-table paragraph no longer asserts the claim "stopped being true." It now states the table made a present-tense operational claim that "a reader has no way to tell... whether a present-tense claim like that is still current" — disclosure-neutral, doesn't confirm or deny current deployment state.
• cargo-deny status (High): the assertion is removed entirely; SECURITY-POSTURE.md no longer mentions cargo-deny or any live control fact.
• Stale cross-references (Medium): ARCHITECTURE.md, REQUIREMENTS.md, and README.md all now explicitly state that current control status is tracked privately, not in SECURITY-POSTURE.md, which "carries policy rather than a status reading."

This also closes out buzz-infrastructure#19's definition of done (the false localhost claim and the open-control gap table are both gone from this repo, and no PR content here reveals host state). Requesting re-review.

Fixed since this review, by a follow-up commit already on this branch (6e9c2d8). Verified directly: the 'stopped being true' disclosure sentence is gone (replaced with disclosure-neutral wording), the retained cargo-deny control-status paragraph was deleted outright, and ARCHITECTURE.md/REQUIREMENTS.md/README.md were all updated in the same commit to point at the private control-status tracking instead. Dismissing as stale/resolved.