[yeongseon]

Summary

Finish disclosure-safe scanner evidence and explicit scan-scope checks for the secure logging baseline.

Changes

• Preserve the existing pinned Semgrep action and add a pinned CLI evidence scan over shipped/executable Python scopes; incomplete, empty or errored scans cannot pass.
• Publish allowlisted numeric Bandit/Semgrep summaries, never source snippets, diagnostic messages or original payloads; retain summaries on failed jobs.
• Document production versus anonymous/local demonstration boundaries and the conservative all-runtime-advisories release policy.
• Preserve required contexts, CodeQL, SBOM, OIDC publishing, candidate-wheel reuse and Azure certification gates.

Validation

• Tests were added before the new report helper; initial collection failed because that implementation did not exist.
• Python 3.11.15 make check-all and make build passed after review fixes: 976 passed, 4 skipped, 4 deselected, 13 warnings in 12.38s; coverage 96.48%.
• Real Bandit summary: 39/39 files, zero findings/errors, 24 targeted suppressions. All eight real-Bandit regression cases exercise the new helper and retained safe summaries. Synthetic report tests reject incomplete scopes, preserve parse-error counts and verify secret canaries are absent from summaries.
• Local Semgrep 1.182.1 engine exited with signal 11; the guard reported tool-error, not success. Its required GitHub CI run must pass before merge. No local Semgrep clean result is claimed.
• No real Azure deployment was run. Local LSP rejects private-worktree paths; repository mypy passed.
• Exact head 0d517e8391d157d5eeff99d8e5cb8b6be69fbe02 passed all five required contexts, including the real Semgrep evidence scan, full interpreter matrix and wheel/host lanes. Three valid review findings were fixed, replied to and resolved.

Related Issues

Closes #615

Runtime secure preset and sink regressions merged in #617; nonempty Bandit scope and candidate runtime-advisory policy merged in #629/#630. This PR completes remaining scanner evidence and production-boundary documentation. Exact-head CI and review now substantiate the local baseline acceptance. Live deployment-log proof remains separately open in #625; it is not claimed here.

Merge authorized by the maintainer's explicit instruction, subject to exact-head required CI and resolved conversations.

[Copilot]

🟡 Changes recommended

Bandit evidence underreports suppressions and errors, and the real-scanner regression suite still tests the replaced guard.

3 open issues

• Migrate Bandit regression tests to security_reports.py · New
• Preserve Bandit parse error counts in failed scan summaries · New
• Count targeted Bandit suppressions in published evidence · New

What changed in this PR

This PR strengthens the secure logging baseline with disclosure-safe scanner evidence and explicit checks that scans cover the shipped and executable Python code.

Changes:

• Adds allowlisted Bandit and Semgrep summaries with scope and failure checks.
• Adds a pinned Semgrep CLI evidence scan alongside the existing action, retaining sanitized artifacts on failed jobs.
• Documents scan boundaries, runtime-advisory policy, and production versus demonstration configurations.

File	Description
tools/​security_reports.py	Validates scanner reports and generates sanitized evidence.
tests/​test_security_reports.py	Tests summaries, incomplete scans, and workflow evidence retention.
SECURITY.md	Documents scanner evidence and production security boundaries.
Makefile	Routes Bandit through the summary helper and adds the Semgrep evidence target.
.github/​workflows/​security.yml	Installs the pinned CLI scanner and uploads sanitized Semgrep evidence.

_{Review effort: Balanced}

[yeongseon]

Final review: exact head 0d517e8 has successful bandit, semgrep, Analyze, PR title and ci-required; branch CLEAN. All three valid findings fixed and resolved, with real-Bandit regression migration, parse-error retention and targeted suppression counts. Required Semgrep evidence scan passed in GitHub (local engine failure was not represented as clean). Combined with merged #617/#629/#630 this completes local #615 acceptance; live Azure deployment-log proof remains #625. Merge authorized by the maintainer’s explicit instruction.