docs: P-024 security audit profile — external tools + SARIF, reject own scanner engine

[PhysShell]

Что и зачем

Фиксирует вердикт дизайн-обсуждения по идее Own.SecurityChecks: собственный scanner engine (свой YAML detection DSL, модули HTTP/SSH/DB, экспорт в NASL/OpenVAS/Nessus) не строим — это дубль Nuclei/testssl.sh/ZAP/Trivy и нарушение устава аудита из Plan.md (оркестратор-не-анализатор, запрет regex-эвристик, «берём готовое»). Вместо этого — proposal P-024 (изначально P-023; номер занял смёрженный раньше PR #171 с architecture guard): security-профиль для существующего аудит-флота (tool-run manifests + тонкие raw→SARIF адаптеры в v0.1, typed .NET config analyzer как единственная ниша собственного кода в v0.2, cross-tool correlation через oracle-скорер в v0.3). Секция Non-goals прибивает отклонённый движок, чтобы его не переизобрели.

Тип изменения

• feat — новая возможность
• fix — исправление бага
• docs — документация
• refactor / chore / test / ci — без изменения поведения

Как проверено

Docs-only изменение (новый proposal + строка в индексе), рантайм-поверхности нет.

• полный CI на ветке зелёный (tests py3.11–3.13, ruff + mypy, codegen fuzz, golden C#, validate contribution format)
• python tests/run_tests.py
• ruff check . и mypy
• селфтесты затронутых скриптов (python scripts/<...>.py --selftest)

Связанные issue

Нет. Контекст: Plan.md (аудит-оркестратор), audit/README.md (OwnAudit-split).

Чеклист

• изменение покрыто тестом/селфтестом (или объяснено, почему нет) — docs-only proposal, поведения кода не меняет; формат PR гоняет validate_contrib.py
• README/docs обновлены при необходимости (индекс docs/proposals/README.md дополнен строкой P-024)
• коммиты в conventional-commit стиле (docs:)

🤖 Generated with Claude Code

https://claude.ai/code/session_0113xowoaqfUnPEXxxi15Gpm

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds a new documentation proposal (P-023) describing a security audit profile approach based on external tools and SARIF adapters, including versioned scope (v0.1–v0.3), non-goals, a manifest sketch, and open questions. The proposals index is updated with a corresponding draft entry.

Changes

Security Audit Profile Proposal

Layer / File(s)	Summary
Proposal decision and motivation docs/proposals/P-023-security-audit-profile.md	Documents the decision to avoid an in-house scanner engine and instead use external tools with SARIF adapters, plus motivation for extending audit orchestrator scope.
Versioned scope (v0.1–v0.3) docs/proposals/P-023-security-audit-profile.md	Details v0.1 external-tool deliverables and coverage-map semantics, v0.2 typed .NET configuration audit rules, and v0.3 cross-tool correlation reuse.
Non-goals, sketch, and open questions docs/proposals/P-023-security-audit-profile.md	Lists rejected approaches, a tool-run manifest YAML sketch with proposed layout, and open implementation questions.
Proposals index update docs/proposals/README.md	Adds a new P-023 row with draft status to the proposals index.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Related PRs: None identified.

Suggested labels: documentation, proposal

Suggested reviewers: None identified.

Poem:
A rabbit scribes a proposal so neat,
No scanner engine, just tools to greet,
SARIF adapters line up in a row,
Draft status added, watch the doc grow,
Hop, hop, review — the plan's complete!

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is specific and matches the main change: documenting a security audit profile that uses external tools and SARIF instead of a custom scanner.
Description check	✅ Passed	The description follows the template and covers the change, type, testing, related issue, and checklist items.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/own-securitychecks-framework-3d7j6g

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/proposals/P-023-security-audit-profile.md`:
- Around line 167-174: The fenced manifest example in the proposal document is
missing a language label, which triggers markdownlint MD040 and reduces
readability. Update the opening fence for the directory listing snippet to
include an explicit label such as yaml or text, keeping the example content
unchanged so the snippet is properly recognized by markdown tooling.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b7328ce2-cf28-4ec8-bb2c-1f3d0f4f869e

📥 Commits

Reviewing files that changed from the base of the PR and between 368c7ba and 885c63f.

📒 Files selected for processing (2)

• docs/proposals/P-023-security-audit-profile.md
• docs/proposals/README.md

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 885c63f67e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".