docs(security): record first-release security review

[CompleteDotTech]

Assignee: @CompleteDotTech

Advances OpenCoven#40 (ship/block disposition for OpenCoven#41)

Upstream PR (one click for a maintainer): https://github.com/OpenCoven/sdk/compare/main...CompleteDotTech:sdk:security/first-release-review-40?expand=1

Summary

Records the issue OpenCoven#40 first-release security review as a dated doc:
docs/security/2026-08-29-first-release-security-review.md.

• Reviewed commit: 4736bf2e0d5b16272d79ecf7784c75f376b39b94 (origin/main HEAD at review time), fixed 0.1.0 group (@opencoven/sdk-core, @opencoven/cave-client, @opencoven/coven-client, @opencoven/sdk, all private: true), Node >=24.18.0 <25, native-conformance matrix darwin-arm64 / linux-x64 / win32-x64.
• All four threat boundaries reviewed with file:line evidence (Cave, Coven, native/CLI, release/supply-chain). No in-repo finding on any boundary.
• Release negative review: publish mode, the publish script (with/without authorization env, with a placeholder token exported), and every workflow path fail closed while publishingEnabled is false; token-based npm auth is forbidden by construction (scripts/publish-release-artifacts.mjs:58-62); publication is OIDC trusted publishing only.
• Diagnostics/retained evidence verified secret-safe; full git log -p --all history scan found no real credentials (only synthetic test constants).
• Findings: 1 x blocks-publication (F-1: inherited [SDK 0.1.0][P0] Prove the packed SDK with cross-repository real-authority conformance OpenCoven/sdk#38 gap — no passing aggregate conformance record until Chat produces schema-v2 records on darwin-arm64/linux-x64/win32-x64; PR feat: enforce cross-repository conformance evidence OpenCoven/sdk#74's fail-closed conformanceEvidence.aggregateRecord gate enforces this), 2 x accepted-with-owner (F-2: no security-response SLA promised, revisit 2026-09-30; F-3: authorization env var is workflow-internal, superseded by PR feat: enforce cross-repository conformance evidence OpenCoven/sdk#74 environment-approval receipts), 0 x fixed-and-verified.
• Recommendation: block publication until F-1 clears (block-until-records); the commit itself is approved as the security basis for [SDK 0.1.0][P0] Execute the first public release and validate registry provenance OpenCoven/sdk#41 once the named aggregate record exists. To be linked from [SDK 0.1.0] Ship a secure read-only OpenCoven SDK OpenCoven/sdk#31.

Advances OpenCoven#40 (ship/block disposition gating OpenCoven#41).

Assignee: @CompleteDotTech

Validation performed

On the reviewed commit, in a clean worktree under Node 24.18.1 / pnpm 10.34.0:

• corepack pnpm@10.34.0 verify (canonical gate): exit 0 — typecheck, 58 test files / 1213 tests passed, verify:contracts, verify:package, verify:release, coverage 90.11% statements, operation-property stress, lint --max-warnings=0.
• corepack pnpm@10.34.0 audit: "No known vulnerabilities found".
• corepack pnpm@10.34.0 pack:public: exactly four tarballs (private CLI excluded), dist/fixtures/metadata only, no install lifecycle scripts; packed tarballs installed offline into a throwaway dir and @opencoven/sdk / @opencoven/cave-client imported successfully.
• node ./scripts/verify-release-readiness.mjs --mode publish …: exit 1 — "Release publishing is disabled by release.config.json" (also via the publish script in all env-var permutations). No publish, tag, unlock, or workflow dispatch was performed.
• Secret/history scan: no credential-shaped strings in 267 commits; only synthetic test constants.

[CompleteDotTech]

Recreated upstream as OpenCoven#76: OpenCoven#76. Closing this duplicate fork PR; review continues upstream.