@cloverleaf/reference-impl 0.7.4 → 0.8.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cloverleaf",
   "description": "Cloverleaf reference implementation — Claude Code skills for task scaffolding and the Delivery pipeline (implementer, documenter, reviewer, UI reviewer with multi-viewport visual diff, QA, merge, release).",
-  "version": "0.7.4",
+  "version": "0.8.0",
   "author": {
     "name": "Renato D'Arrigo",
     "email": "renato.darrigo@gmail.com"

package/README.md

@@ -43,6 +43,7 @@ v0.2 implements both paths of the Delivery track:
 - `/cloverleaf-ui-review` — run UI Reviewer *(new in v0.2)*
 - `/cloverleaf-approve-baselines` — human baseline-approval gate; clears `baselines_pending` and advances `ui-review → qa` *(new in CLV-19)*
 - `/cloverleaf-qa` — run QA *(new in v0.2)*
+- `/cloverleaf-security-review` — Security Reviewer: deterministic secret scan + LLM vulnerability judgment; runs when `security_class` is `high`
 - `/cloverleaf-merge` — human gate (branches on state)
 - `/cloverleaf-run` — orchestrator (dispatches by `risk_class`)
 - `/cloverleaf-release` — publish a new `@cloverleaf/reference-impl` release; runs pre-flight checks then executes `git tag -a` / `git push origin main` / `git push origin <tag>` / `npm publish` / `gh release create`; accepts `[--dry-run] [--yes]` *(new in CLV-63)*
@@ -166,6 +167,50 @@ npm test        # run the Vitest suite
 npm run test:watch
 ```
 
+## Plans vs RFC-direct tasks
+
+Cloverleaf has two ways to get from an approved RFC to executed Tasks. Both are first-class; the right one depends on the size and shape of the work.
+
+**Plan-task (Discovery flow):** Operator invokes `/cloverleaf-discover`. The Plan agent decomposes the RFC into a Plan with a `task_dag`; the operator approves the decomposition at `task_batch_gate`; tasks are materialised under the Plan; the walker drives them through Delivery. Use this when the work spans ≥3 related tasks AND there's value in reviewing the decomposition before any task materializes (the gate is a checkpoint, not ceremony).
+
+**RFC-direct task (skip the Plan layer):** Operator invokes `/cloverleaf-new-task --rfc=<RFC-ID> "<brief>"`. A single task is created with `context.rfc` set and `parent` absent — no Plan, no `task_batch_gate`. Use this for:
+
+- **Hotfixes after a Plan has delivered** — a small bug or polish item surfaces after the Plan's tasks are all merged. Creating a new Plan for one task is pure overhead; an RFC-direct task is faster and equally trackable.
+- **Incremental RFC progress without batch decomposition** — operator hasn't yet decided how to decompose the next chunk of work, but a single concrete task is clear. Create it now; defer the Plan formation until later (or skip Plans entirely if the work continues to arrive one task at a time).
+
+### Auto-advance: how the walker treats them
+
+When the walker (`/cloverleaf-run-plan`) finishes a Plan's final task, it asks `cloverleaf-cli rfc-tasks <repo_root> <RFC-ID>` whether the parent RFC can also advance from `approved` to `completed`. The check considers BOTH sibling Plans AND RFC-direct tasks under the same RFC:
+
+- An **in-flight** Plan (`drafting`/`gate-pending`/`approved`) OR standalone task (any non-terminal state) blocks the RFC advance — there's still work pending under this RFC.
+- A **delivered** Plan (`completed`) OR standalone task (`merged`) counts toward the at-least-one-delivered requirement — the RFC must have produced at least one successful piece of work to advance.
+- If all delivered work was rejected/escalated, the operator decides: abandon the RFC, re-decompose, or accept the RFC as not-shippable. The walker won't auto-advance.
+
+### Operator visibility
+
+```bash
+cloverleaf-cli rfc-tasks <repo_root> <RFC-ID>            # compact JSON
+cloverleaf-cli rfc-tasks <repo_root> <RFC-ID> --pretty   # indented for humans
+```
+
+Returns the RFC's status, all sibling Plans (with their child tasks), all standalone tasks, and a summary block with in-flight/delivered counts plus `can_auto_advance_rfc`. Pure read; no side effects.
+
+### The tradeoff to name
+
+Skipping the Plan = skipping `task_batch_gate`. That's the right tradeoff for hotfixes (one task; no decomposition to review) and for one-task-at-a-time incremental work. It's the wrong tradeoff for a large multi-task scope where the human's review of the decomposition is the load-bearing checkpoint. Plans are a checkpoint, not ceremony.
+
+## Security review
+
+The **Security Reviewer** (8th agent) runs when a task's effective `security_class` is `high`, off the `automated-gates` hub in both lanes — so it covers fast-lane backend work, not just full-pipeline UI work.
+
+**What triggers it.** `security_class` (`low`/`high`, independent of the UI-keyed `risk_class`) is inferred at task creation from sensitive markers (keywords + paths) and re-checked against the actual diff at review time (defense in depth — a task whose brief never says "credential" but whose diff touches `engine/exchange.py` is caught). Override at creation with `--security=high|low`.
+
+**Two passes.** (A) a deterministic secret scan (`cloverleaf-cli secret-scan`) over the diff's added lines — cloud keys, tokens, PEM headers, credentialed connection strings; (B) an LLM judgment pass reasoning about injection, broken authz, unsafe deserialization, SSRF, missing input validation, weak crypto.
+
+**Routing.** Findings merge into one feedback envelope; the max severity sets the verdict — any `blocker` (e.g. a leaked credential) → `escalated` (a human must review); `error`/`warning` → `implementing` (the Implementer fixes); clean → `automated-gates` → onward.
+
+**Customizing.** Both pattern sets are consumer-overridable: `.cloverleaf/config/security-paths.json` (sensitive paths + keywords) and `.cloverleaf/config/secret-patterns.json` (secret regexes + placeholder excludes).
+
 ## License
 
 MIT — see [../LICENSE](../LICENSE).

package/VERSION

@@ -1 +1 @@
-0.7.4
+0.8.0

package/config/secret-patterns.json

@@ -0,0 +1,14 @@
+{
+  "patterns": [
+    { "name": "aws-access-key-id", "regex": "AKIA[0-9A-Z]{16}", "severity": "blocker" },
+    { "name": "github-token", "regex": "gh[pousr]_[A-Za-z0-9]{36,}", "severity": "blocker" },
+    { "name": "github-pat", "regex": "github_pat_[A-Za-z0-9_]{60,}", "severity": "blocker" },
+    { "name": "slack-token", "regex": "xox[baprs]-[A-Za-z0-9-]{10,}", "severity": "blocker" },
+    { "name": "stripe-live-key", "regex": "sk_live_[A-Za-z0-9]{24,}", "severity": "blocker" },
+    { "name": "google-api-key", "regex": "AIza[0-9A-Za-z_-]{35}", "severity": "blocker" },
+    { "name": "private-key-header", "regex": "-----BEGIN (RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----", "severity": "blocker" },
+    { "name": "credentialed-conn-string", "regex": "(postgres(ql)?|mysql|mongodb(\\+srv)?|redis|amqp)://[^:@/\\s]+:[^@/\\s]+@", "severity": "error" },
+    { "name": "generic-secret-assignment", "regex": "(?i)(password|passwd|secret|api[_-]?key|access[_-]?token)\\s*[=:]\\s*[\"'][^\"'$<{][^\"']{7,}[\"']", "severity": "error" }
+  ],
+  "placeholder_excludes": ["\\$\\{", "process\\.env", "<[^>]+>", "(?i)[=:\\s][\"']?(changeme|example|placeholder|xxx+|your[-_])"]
+}

package/config/security-paths.json

@@ -0,0 +1,13 @@
+{
+  "path_patterns": [
+    "**/*.env*", "**/secrets*", "**/*secret*", "**/*credential*",
+    "**/*.pem", "**/*.key", "**/id_rsa*", "**/auth*",
+    "**/deploy*.sh", "**/*.sql", "**/migrations/**",
+    "**/prompts/**", "**/skills/**", "**/*policy*.json"
+  ],
+  "keyword_patterns": [
+    "secret", "credential", "api[ _-]?key", "\\btoken\\b", "password",
+    "private key", "oauth", "exchange", "binance", "\\bsql\\b",
+    "\\beval\\b", "subprocess", "deserialize"
+  ]
+}

package/dist/cli.mjs

@@ -20,6 +20,7 @@
  *   load-rfc <repoRoot> <id>
  *   save-rfc <repoRoot> <filePath>
  *   advance-rfc <repoRoot> <id> <toStatus> <agent|human> [gate]
+ *   rfc-tasks <repoRoot> <rfcId> [--pretty]
  *   load-spike <repoRoot> <id>
  *   save-spike <repoRoot> <filePath>
  *   advance-spike <repoRoot> <id> <toStatus> <agent|human>
@@ -37,6 +38,8 @@
  *   walker-default-concurrency [--explain]
  *   check-scope <repoRoot> <taskId> --branch <branchName>
  *   extend-scope <repoRoot> <taskId> --add <file>... --reason <text>
+ *   secret-scan <repoRoot> --branch <branch>
+ *   classify-security <repoRoot> <taskId> [--branch <branch>]
  */
 import { readFileSync, mkdirSync, copyFileSync, appendFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
@@ -63,6 +66,9 @@ import { computeReadyTasks, detectCycle } from './dag-walker.mjs';
 import { readWalkState, writeWalkState, walkStatePath } from './walk-state.mjs';
 import { loadWalkerConfig } from './walker-config.mjs';
 import { classifyFiles } from './scope-check.mjs';
+import { computeRfcTasksView } from './rfc-tasks.mjs';
+import { loadSecretPatternsConfig, scanSecrets } from './secret-scan.mjs';
+import { loadSecurityPathsConfig, computeSecurityClassification } from './security-classify.mjs';
 function die(msg, code = 1) {
     process.stderr.write(msg + '\n');
     process.exit(code);
@@ -87,6 +93,7 @@ function usage(msg) {
         '  load-rfc <repoRoot> <id>\n' +
         '  save-rfc <repoRoot> <filePath>\n' +
         '  advance-rfc <repoRoot> <id> <toStatus> <agent|human> [gate]\n' +
+        '  rfc-tasks <repoRoot> <rfcId> [--pretty]\n' +
         '  load-spike <repoRoot> <id>\n' +
         '  save-spike <repoRoot> <filePath>\n' +
         '  advance-spike <repoRoot> <id> <toStatus> <agent|human>\n' +
@@ -103,7 +110,9 @@ function usage(msg) {
         '  walk-state-write <repoRoot> <walkStateJsonPath>\n' +
         '  walker-default-concurrency [--explain]\n' +
         '  check-scope <repoRoot> <taskId> --branch <branchName>\n' +
-        '  extend-scope <repoRoot> <taskId> --add <file>... --reason <text>\n');
+        '  extend-scope <repoRoot> <taskId> --add <file>... --reason <text>\n' +
+        '  secret-scan <repoRoot> --branch <branch>\n' +
+        '  classify-security <repoRoot> <taskId> [--branch <branch>]\n');
     process.exit(2);
 }
 const [, , command, ...rest] = process.argv;
@@ -367,6 +376,25 @@ try {
             advanceRfcStatus(repoRoot, id, toStatus, actor, opts);
             break;
         }
+        case 'rfc-tasks': {
+            const positional = rest.filter((a) => !a.startsWith('--'));
+            const flags = rest.filter((a) => a.startsWith('--'));
+            const [repoRoot, rfcId] = positional;
+            if (!repoRoot || !rfcId)
+                usage('rfc-tasks <repoRoot> <rfcId> [--pretty]');
+            const pretty = flags.includes('--pretty');
+            let view;
+            try {
+                view = computeRfcTasksView(repoRoot, rfcId);
+            }
+            catch (err) {
+                process.stderr.write(`cloverleaf-cli rfc-tasks: ${err instanceof Error ? err.message : String(err)}\n`);
+                process.exit(2);
+            }
+            process.stdout.write(pretty ? JSON.stringify(view, null, 2) : JSON.stringify(view));
+            process.stdout.write('\n');
+            break;
+        }
         case 'load-spike': {
             const positional = rest.filter((a) => !a.startsWith('--'));
             const flags = rest.filter((a) => a.startsWith('--'));
@@ -701,6 +729,58 @@ try {
             appendFileSync(auditPath, JSON.stringify(auditEntry) + '\n');
             process.exit(0);
         }
+        case 'secret-scan': {
+            const positional = rest.filter((a) => !a.startsWith('--'));
+            const branchIdx = rest.indexOf('--branch');
+            const branch = branchIdx >= 0 ? rest[branchIdx + 1] : undefined;
+            const [repoRoot] = positional;
+            if (!repoRoot || !branch)
+                usage('secret-scan <repoRoot> --branch <branch>');
+            const cfg = loadSecretPatternsConfig(repoRoot);
+            // Scan added/changed lines only (the '+' lines of the diff, minus the +++ header),
+            // so we flag what THIS task introduced, not pre-existing secrets.
+            const diff = execSync(`git -C ${repoRoot} diff --unified=0 main..${branch}`, { encoding: 'utf-8' });
+            const addedByFile = {};
+            let curFile = '';
+            for (const line of diff.split('\n')) {
+                if (line.startsWith('+++ b/')) {
+                    curFile = line.slice(6);
+                    addedByFile[curFile] = [];
+                }
+                else if (line.startsWith('+') && !line.startsWith('+++')) {
+                    (addedByFile[curFile] ||= []).push(line.slice(1));
+                }
+            }
+            const findings = Object.entries(addedByFile).flatMap(([f, lines]) => scanSecrets(lines.join('\n'), cfg, f));
+            process.stdout.write(JSON.stringify({ findings }) + '\n');
+            break;
+        }
+        case 'classify-security': {
+            const positional = rest.filter((a) => !a.startsWith('--'));
+            const branchIdx = rest.indexOf('--branch');
+            const branch = branchIdx >= 0 ? rest[branchIdx + 1] : undefined;
+            const [repoRoot, taskId] = positional;
+            if (!repoRoot || !taskId)
+                usage('classify-security <repoRoot> <taskId> [--branch <branch>]');
+            let task;
+            try {
+                task = loadTask(repoRoot, taskId);
+            }
+            catch (err) {
+                process.stderr.write(`cloverleaf-cli classify-security: ${err instanceof Error ? err.message : String(err)}\n`);
+                process.exit(2);
+            }
+            const declared = task.security_class === 'high' ? 'high' : 'low';
+            const cfg = loadSecurityPathsConfig(repoRoot);
+            let changed = [];
+            if (branch) {
+                const out = execSync(`git -C ${repoRoot} diff --name-only main..${branch}`, { encoding: 'utf-8' });
+                changed = out.split('\n').filter(Boolean);
+            }
+            const result = computeSecurityClassification(declared, changed, cfg);
+            process.stdout.write(JSON.stringify(result) + '\n');
+            break;
+        }
         default:
             usage(`Unknown command: ${command}`);
     }

package/dist/rfc-tasks.mjs

@@ -0,0 +1,83 @@
+import { readFileSync, existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { plansDir, tasksDir, rfcsDir } from './paths.mjs';
+/**
+ * A task is "standalone" (RFC-direct) iff it has no parent (absent or null)
+ * AND it has a non-empty context.rfc.id. See
+ * docs/superpowers/specs/2026-05-12-rfc-direct-tasks-design.md §"Discriminator".
+ */
+export function isStandaloneTask(task) {
+    const parent = task.parent;
+    if (parent != null)
+        return false;
+    const ctx = task.context;
+    const rfc = ctx?.rfc;
+    return !!(rfc && typeof rfc.id === 'string' && rfc.id.length > 0);
+}
+const PLAN_INFLIGHT = new Set(['drafting', 'gate-pending', 'approved']);
+const TASK_TERMINAL = new Set(['merged', 'rejected', 'escalated']);
+export function computeRfcTasksView(repoRoot, rfcId) {
+    const rfcPath = join(rfcsDir(repoRoot), `${rfcId}.json`);
+    if (!existsSync(rfcPath)) {
+        throw new Error(`rfc ${rfcId} not found at ${rfcPath}`);
+    }
+    const rfc = JSON.parse(readFileSync(rfcPath, 'utf-8'));
+    // Load all plans of this RFC + their child task statuses
+    const plans = [];
+    const plansDirPath = plansDir(repoRoot);
+    if (existsSync(plansDirPath)) {
+        for (const f of readdirSync(plansDirPath)) {
+            if (!f.endsWith('.json'))
+                continue;
+            const plan = JSON.parse(readFileSync(join(plansDirPath, f), 'utf-8'));
+            if (plan.parent_rfc?.project !== rfc.project || plan.parent_rfc.id !== rfc.id)
+                continue;
+            const tasks = [];
+            for (const node of plan.task_dag?.nodes ?? []) {
+                const taskPath = join(tasksDir(repoRoot), `${node.id}.json`);
+                if (!existsSync(taskPath))
+                    continue;
+                const t = JSON.parse(readFileSync(taskPath, 'utf-8'));
+                tasks.push({ id: t.id, status: t.status });
+            }
+            plans.push({ project: plan.project, id: plan.id, status: plan.status, tasks });
+        }
+    }
+    plans.sort((a, b) => a.id.localeCompare(b.id));
+    // Load standalone tasks: parent absent/null AND context.rfc matches
+    const standalone = [];
+    const tasksDirPath = tasksDir(repoRoot);
+    if (existsSync(tasksDirPath)) {
+        for (const f of readdirSync(tasksDirPath)) {
+            if (!f.endsWith('.json'))
+                continue;
+            const t = JSON.parse(readFileSync(join(tasksDirPath, f), 'utf-8'));
+            if (!isStandaloneTask(t))
+                continue;
+            const ctxRfc = t.context.rfc;
+            if (ctxRfc.project !== rfc.project || ctxRfc.id !== rfc.id)
+                continue;
+            standalone.push({ id: t.id, status: t.status });
+        }
+    }
+    standalone.sort((a, b) => a.id.localeCompare(b.id));
+    const inflight_plans = plans.filter(p => PLAN_INFLIGHT.has(p.status)).length;
+    const inflight_standalone = standalone.filter(t => !TASK_TERMINAL.has(t.status)).length;
+    const delivered_plans = plans.filter(p => p.status === 'completed').length;
+    const delivered_standalone = standalone.filter(t => t.status === 'merged').length;
+    const can_auto_advance_rfc = rfc.status === 'approved' &&
+        inflight_plans + inflight_standalone === 0 &&
+        delivered_plans + delivered_standalone > 0;
+    return {
+        rfc: { project: rfc.project, id: rfc.id, status: rfc.status },
+        plans,
+        standalone_tasks: standalone,
+        summary: {
+            inflight_plans,
+            inflight_standalone,
+            delivered_plans,
+            delivered_standalone,
+            can_auto_advance_rfc,
+        },
+    };
+}

package/dist/secret-scan.mjs

@@ -0,0 +1,75 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+const here = dirname(fileURLToPath(import.meta.url));
+const DEFAULT_CONFIG = join(here, '..', 'config', 'secret-patterns.json');
+function normalize(doc) {
+    const raw = Array.isArray(doc.patterns) ? doc.patterns : [];
+    const validSeverities = new Set(['error', 'blocker']);
+    const patterns = raw.filter((p) => typeof p.name === 'string' && p.name.length > 0 &&
+        typeof p.regex === 'string' && p.regex.length > 0 &&
+        validSeverities.has(p.severity));
+    return {
+        patterns,
+        placeholder_excludes: Array.isArray(doc.placeholder_excludes)
+            ? doc.placeholder_excludes.filter((s) => typeof s === 'string')
+            : [],
+    };
+}
+export function loadSecretPatternsConfig(repoRoot) {
+    const consumerPath = join(repoRoot, '.cloverleaf', 'config', 'secret-patterns.json');
+    const path = existsSync(consumerPath) ? consumerPath : DEFAULT_CONFIG;
+    if (!existsSync(path))
+        throw new Error(`secret-patterns config not found at ${path}`);
+    return normalize(JSON.parse(readFileSync(path, 'utf-8')));
+}
+/**
+ * Scan text (typically the added/changed lines of a diff) for secrets.
+ * A line that matches any placeholder_exclude is skipped entirely (env refs,
+ * templates, obvious placeholders), keeping precision high.
+ */
+function compileRegex(pattern) {
+    // Support (?i) inline flag prefix (not valid in JS) by converting to the 'i' flag.
+    // Only a *leading* (?i) is supported; any occurrence elsewhere is almost certainly
+    // a mistake (it would be a JS syntax error) — reject it with a clear message.
+    const original = pattern;
+    let flags = '';
+    if (pattern.startsWith('(?i)')) {
+        pattern = pattern.slice(4);
+        flags = 'i';
+    }
+    if (pattern.includes('(?i)')) {
+        throw new Error('secret-scan: inline (?i) flag is only supported as a leading prefix: ' + original);
+    }
+    try {
+        return new RegExp(pattern, flags);
+    }
+    catch (err) {
+        throw new Error('secret-scan: invalid pattern regex /' + pattern + '/: ' + err.message);
+    }
+}
+export function scanSecrets(text, config, file) {
+    const excludes = config.placeholder_excludes.map((p) => compileRegex(p));
+    const compiled = config.patterns.map((p) => ({ ...p, re: compileRegex(p.regex) }));
+    const findings = [];
+    const lines = text.split('\n');
+    lines.forEach((line, idx) => {
+        // Deliberate line-level tradeoff: a line matching any exclude pattern is
+        // skipped entirely.  If a real secret happens to share a line with a
+        // placeholder token (e.g. a comment), it becomes a false-negative.
+        // This keeps precision high and avoids alert fatigue from generated files.
+        if (excludes.some((re) => re.test(line)))
+            return;
+        for (const p of compiled) {
+            if (p.re.test(line)) {
+                findings.push({
+                    severity: p.severity,
+                    rule: p.name,
+                    message: `Possible hardcoded secret (${p.name}) on line ${idx + 1}`,
+                    location: { ...(file ? { file } : {}), line: idx + 1 },
+                });
+            }
+        }
+    });
+    return findings;
+}

package/dist/security-classify.mjs

@@ -0,0 +1,61 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+const here = dirname(fileURLToPath(import.meta.url));
+const DEFAULT_CONFIG = join(here, '..', 'config', 'security-paths.json');
+function globToRegex(pattern) {
+    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    const regex = escaped
+        .replace(/\*\*/g, '\u0000')
+        .replace(/\*/g, '[^/]*')
+        .replace(/\u0000/g, '.*');
+    return new RegExp(`^${regex}$`);
+}
+function normalize(doc) {
+    return {
+        path_patterns: Array.isArray(doc.path_patterns) ? doc.path_patterns.filter((p) => typeof p === 'string') : [],
+        keyword_patterns: Array.isArray(doc.keyword_patterns) ? doc.keyword_patterns.filter((k) => typeof k === 'string') : [],
+    };
+}
+function loadDefaultConfig() {
+    if (!existsSync(DEFAULT_CONFIG)) {
+        throw new Error(`security-paths config not found at ${DEFAULT_CONFIG}`);
+    }
+    return normalize(JSON.parse(readFileSync(DEFAULT_CONFIG, 'utf-8')));
+}
+export function loadSecurityPathsConfig(repoRoot) {
+    const consumerPath = join(repoRoot, '.cloverleaf', 'config', 'security-paths.json');
+    if (existsSync(consumerPath)) {
+        try {
+            return normalize(JSON.parse(readFileSync(consumerPath, 'utf-8')));
+        }
+        catch {
+            // fall through
+        }
+    }
+    return loadDefaultConfig();
+}
+export function matchesSensitivePath(file, cfg) {
+    return cfg.path_patterns.some((p) => globToRegex(p).test(file));
+}
+export function matchesSensitiveKeyword(text, cfg) {
+    return cfg.keyword_patterns.some((k) => {
+        try {
+            return new RegExp(k, 'i').test(text);
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/**
+ * Compute effective security classification. `declared` is the task's
+ * security_class (default low). `changedFiles` (e.g. from `git diff --name-only`)
+ * are matched against path_patterns for diff-detection.
+ */
+export function computeSecurityClassification(declared, changedFiles, cfg) {
+    const matched = changedFiles.filter((f) => matchesSensitivePath(f, cfg));
+    const diff_detected = matched.length > 0;
+    const effective = declared === 'high' || diff_detected ? 'high' : 'low';
+    return { declared, diff_detected, effective, matched_paths: matched };
+}

package/lib/cli.ts

@@ -20,6 +20,7 @@
  *   load-rfc <repoRoot> <id>
  *   save-rfc <repoRoot> <filePath>
  *   advance-rfc <repoRoot> <id> <toStatus> <agent|human> [gate]
+ *   rfc-tasks <repoRoot> <rfcId> [--pretty]
  *   load-spike <repoRoot> <id>
  *   save-spike <repoRoot> <filePath>
  *   advance-spike <repoRoot> <id> <toStatus> <agent|human>
@@ -37,6 +38,8 @@
  *   walker-default-concurrency [--explain]
  *   check-scope <repoRoot> <taskId> --branch <branchName>
  *   extend-scope <repoRoot> <taskId> --add <file>... --reason <text>
+ *   secret-scan <repoRoot> --branch <branch>
+ *   classify-security <repoRoot> <taskId> [--branch <branch>]
  */
 
 import { readFileSync, mkdirSync, copyFileSync, appendFileSync, existsSync } from 'node:fs';
@@ -66,6 +69,9 @@ import { readWalkState, writeWalkState, walkStatePath } from './walk-state.js';
 import { loadWalkerConfig } from './walker-config.js';
 import { classifyFiles } from './scope-check.js';
 import type { SiblingScope } from './scope-check.js';
+import { computeRfcTasksView, type RfcTasksView } from './rfc-tasks.js';
+import { loadSecretPatternsConfig, scanSecrets } from './secret-scan.js';
+import { loadSecurityPathsConfig, computeSecurityClassification } from './security-classify.js';
 
 function die(msg: string, code = 1): never {
   process.stderr.write(msg + '\n');
@@ -92,6 +98,7 @@ function usage(msg?: string): never {
       '  load-rfc <repoRoot> <id>\n' +
       '  save-rfc <repoRoot> <filePath>\n' +
       '  advance-rfc <repoRoot> <id> <toStatus> <agent|human> [gate]\n' +
+      '  rfc-tasks <repoRoot> <rfcId> [--pretty]\n' +
       '  load-spike <repoRoot> <id>\n' +
       '  save-spike <repoRoot> <filePath>\n' +
       '  advance-spike <repoRoot> <id> <toStatus> <agent|human>\n' +
@@ -108,7 +115,9 @@ function usage(msg?: string): never {
       '  walk-state-write <repoRoot> <walkStateJsonPath>\n' +
       '  walker-default-concurrency [--explain]\n' +
       '  check-scope <repoRoot> <taskId> --branch <branchName>\n' +
-      '  extend-scope <repoRoot> <taskId> --add <file>... --reason <text>\n'
+      '  extend-scope <repoRoot> <taskId> --add <file>... --reason <text>\n' +
+      '  secret-scan <repoRoot> --branch <branch>\n' +
+      '  classify-security <repoRoot> <taskId> [--branch <branch>]\n'
   );
   process.exit(2);
 }
@@ -383,6 +392,24 @@ try {
       break;
     }
 
+    case 'rfc-tasks': {
+      const positional = rest.filter((a) => !a.startsWith('--'));
+      const flags = rest.filter((a) => a.startsWith('--'));
+      const [repoRoot, rfcId] = positional;
+      if (!repoRoot || !rfcId) usage('rfc-tasks <repoRoot> <rfcId> [--pretty]');
+      const pretty = flags.includes('--pretty');
+      let view: RfcTasksView;
+      try {
+        view = computeRfcTasksView(repoRoot, rfcId);
+      } catch (err) {
+        process.stderr.write(`cloverleaf-cli rfc-tasks: ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(2);
+      }
+      process.stdout.write(pretty ? JSON.stringify(view, null, 2) : JSON.stringify(view));
+      process.stdout.write('\n');
+      break;
+    }
+
     case 'load-spike': {
       const positional = rest.filter((a) => !a.startsWith('--'));
       const flags = rest.filter((a) => a.startsWith('--'));
@@ -723,6 +750,52 @@ try {
       process.exit(0);
     }
 
+    case 'secret-scan': {
+      const positional = rest.filter((a) => !a.startsWith('--'));
+      const branchIdx = rest.indexOf('--branch');
+      const branch = branchIdx >= 0 ? rest[branchIdx + 1] : undefined;
+      const [repoRoot] = positional;
+      if (!repoRoot || !branch) usage('secret-scan <repoRoot> --branch <branch>');
+      const cfg = loadSecretPatternsConfig(repoRoot);
+      // Scan added/changed lines only (the '+' lines of the diff, minus the +++ header),
+      // so we flag what THIS task introduced, not pre-existing secrets.
+      const diff = execSync(`git -C ${repoRoot} diff --unified=0 main..${branch}`, { encoding: 'utf-8' });
+      const addedByFile: Record<string, string[]> = {};
+      let curFile = '';
+      for (const line of diff.split('\n')) {
+        if (line.startsWith('+++ b/')) { curFile = line.slice(6); addedByFile[curFile] = []; }
+        else if (line.startsWith('+') && !line.startsWith('+++')) { (addedByFile[curFile] ||= []).push(line.slice(1)); }
+      }
+      const findings = Object.entries(addedByFile).flatMap(([f, lines]) => scanSecrets(lines.join('\n'), cfg, f));
+      process.stdout.write(JSON.stringify({ findings }) + '\n');
+      break;
+    }
+
+    case 'classify-security': {
+      const positional = rest.filter((a) => !a.startsWith('--'));
+      const branchIdx = rest.indexOf('--branch');
+      const branch = branchIdx >= 0 ? rest[branchIdx + 1] : undefined;
+      const [repoRoot, taskId] = positional;
+      if (!repoRoot || !taskId) usage('classify-security <repoRoot> <taskId> [--branch <branch>]');
+      let task;
+      try {
+        task = loadTask(repoRoot, taskId);
+      } catch (err) {
+        process.stderr.write(`cloverleaf-cli classify-security: ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(2);
+      }
+      const declared = (task as Record<string, unknown>).security_class === 'high' ? 'high' : 'low';
+      const cfg = loadSecurityPathsConfig(repoRoot);
+      let changed: string[] = [];
+      if (branch) {
+        const out = execSync(`git -C ${repoRoot} diff --name-only main..${branch}`, { encoding: 'utf-8' });
+        changed = out.split('\n').filter(Boolean);
+      }
+      const result = computeSecurityClassification(declared, changed, cfg);
+      process.stdout.write(JSON.stringify(result) + '\n');
+      break;
+    }
+
     default:
       usage(`Unknown command: ${command}`);
   }

package/lib/rfc-tasks.ts

@@ -0,0 +1,112 @@
+import { readFileSync, existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { plansDir, tasksDir, rfcsDir } from './paths.js';
+import type { TaskDoc } from './task.js';
+import type { PlanDoc } from './plan.js';
+
+/**
+ * A task is "standalone" (RFC-direct) iff it has no parent (absent or null)
+ * AND it has a non-empty context.rfc.id. See
+ * docs/superpowers/specs/2026-05-12-rfc-direct-tasks-design.md §"Discriminator".
+ */
+export function isStandaloneTask(task: TaskDoc): boolean {
+  const parent = (task as Record<string, unknown>).parent;
+  if (parent != null) return false;
+  const ctx = task.context as Record<string, unknown> | undefined;
+  const rfc = ctx?.rfc as { project?: string; id?: string } | undefined;
+  return !!(rfc && typeof rfc.id === 'string' && rfc.id.length > 0);
+}
+
+export interface RfcSummary {
+  inflight_plans: number;
+  inflight_standalone: number;
+  delivered_plans: number;
+  delivered_standalone: number;
+  can_auto_advance_rfc: boolean;
+}
+
+export interface RfcTasksView {
+  rfc: { project: string; id: string; status: string };
+  plans: Array<{
+    project: string;
+    id: string;
+    status: string;
+    tasks: Array<{ id: string; status: string }>;
+  }>;
+  standalone_tasks: Array<{ id: string; status: string }>;
+  summary: RfcSummary;
+}
+
+const PLAN_INFLIGHT = new Set(['drafting', 'gate-pending', 'approved']);
+const TASK_TERMINAL = new Set(['merged', 'rejected', 'escalated']);
+
+export function computeRfcTasksView(repoRoot: string, rfcId: string): RfcTasksView {
+  const rfcPath = join(rfcsDir(repoRoot), `${rfcId}.json`);
+  if (!existsSync(rfcPath)) {
+    throw new Error(`rfc ${rfcId} not found at ${rfcPath}`);
+  }
+  const rfc = JSON.parse(readFileSync(rfcPath, 'utf-8')) as {
+    project: string; id: string; status: string;
+  };
+
+  // Load all plans of this RFC + their child task statuses
+  const plans: RfcTasksView['plans'] = [];
+  const plansDirPath = plansDir(repoRoot);
+  if (existsSync(plansDirPath)) {
+    for (const f of readdirSync(plansDirPath)) {
+      if (!f.endsWith('.json')) continue;
+      const plan = JSON.parse(readFileSync(join(plansDirPath, f), 'utf-8')) as PlanDoc;
+      if (plan.parent_rfc?.project !== rfc.project || plan.parent_rfc.id !== rfc.id) continue;
+
+      const tasks: Array<{ id: string; status: string }> = [];
+      for (const node of plan.task_dag?.nodes ?? []) {
+        const taskPath = join(tasksDir(repoRoot), `${node.id}.json`);
+        if (!existsSync(taskPath)) continue;
+        const t = JSON.parse(readFileSync(taskPath, 'utf-8')) as { id: string; status: string };
+        tasks.push({ id: t.id, status: t.status });
+      }
+      plans.push({ project: plan.project, id: plan.id, status: plan.status, tasks });
+    }
+  }
+  plans.sort((a, b) => a.id.localeCompare(b.id));
+
+  // Load standalone tasks: parent absent/null AND context.rfc matches
+  const standalone: Array<{ id: string; status: string }> = [];
+  const tasksDirPath = tasksDir(repoRoot);
+  if (existsSync(tasksDirPath)) {
+    for (const f of readdirSync(tasksDirPath)) {
+      if (!f.endsWith('.json')) continue;
+      const t = JSON.parse(readFileSync(join(tasksDirPath, f), 'utf-8')) as TaskDoc;
+      if (!isStandaloneTask(t)) continue;
+      const ctxRfc = (t.context as Record<string, unknown>).rfc as {
+        project?: string; id?: string;
+      };
+      if (ctxRfc.project !== rfc.project || ctxRfc.id !== rfc.id) continue;
+      standalone.push({ id: t.id, status: t.status });
+    }
+  }
+  standalone.sort((a, b) => a.id.localeCompare(b.id));
+
+  const inflight_plans = plans.filter(p => PLAN_INFLIGHT.has(p.status)).length;
+  const inflight_standalone = standalone.filter(t => !TASK_TERMINAL.has(t.status)).length;
+  const delivered_plans = plans.filter(p => p.status === 'completed').length;
+  const delivered_standalone = standalone.filter(t => t.status === 'merged').length;
+
+  const can_auto_advance_rfc =
+    rfc.status === 'approved' &&
+    inflight_plans + inflight_standalone === 0 &&
+    delivered_plans + delivered_standalone > 0;
+
+  return {
+    rfc: { project: rfc.project, id: rfc.id, status: rfc.status },
+    plans,
+    standalone_tasks: standalone,
+    summary: {
+      inflight_plans,
+      inflight_standalone,
+      delivered_plans,
+      delivered_standalone,
+      can_auto_advance_rfc,
+    },
+  };
+}

package/lib/secret-scan.ts

@@ -0,0 +1,90 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const DEFAULT_CONFIG = join(here, '..', 'config', 'secret-patterns.json');
+
+export interface SecretPattern { name: string; regex: string; severity: 'error' | 'blocker'; }
+export interface SecretPatternsConfig { patterns: SecretPattern[]; placeholder_excludes: string[]; }
+
+export interface SecretFinding {
+  severity: 'error' | 'blocker';
+  message: string;
+  rule: string;
+  location?: { file?: string; line?: number };
+}
+
+function normalize(doc: Partial<SecretPatternsConfig>): SecretPatternsConfig {
+  const raw = Array.isArray(doc.patterns) ? doc.patterns : [];
+  const validSeverities = new Set(['error', 'blocker']);
+  const patterns = raw.filter(
+    (p): p is SecretPattern =>
+      typeof (p as SecretPattern).name === 'string' && (p as SecretPattern).name.length > 0 &&
+      typeof (p as SecretPattern).regex === 'string' && (p as SecretPattern).regex.length > 0 &&
+      validSeverities.has((p as SecretPattern).severity),
+  );
+  return {
+    patterns,
+    placeholder_excludes: Array.isArray(doc.placeholder_excludes)
+      ? (doc.placeholder_excludes as unknown[]).filter((s): s is string => typeof s === 'string')
+      : [],
+  };
+}
+
+export function loadSecretPatternsConfig(repoRoot: string): SecretPatternsConfig {
+  const consumerPath = join(repoRoot, '.cloverleaf', 'config', 'secret-patterns.json');
+  const path = existsSync(consumerPath) ? consumerPath : DEFAULT_CONFIG;
+  if (!existsSync(path)) throw new Error(`secret-patterns config not found at ${path}`);
+  return normalize(JSON.parse(readFileSync(path, 'utf-8')) as Partial<SecretPatternsConfig>);
+}
+
+/**
+ * Scan text (typically the added/changed lines of a diff) for secrets.
+ * A line that matches any placeholder_exclude is skipped entirely (env refs,
+ * templates, obvious placeholders), keeping precision high.
+ */
+function compileRegex(pattern: string): RegExp {
+  // Support (?i) inline flag prefix (not valid in JS) by converting to the 'i' flag.
+  // Only a *leading* (?i) is supported; any occurrence elsewhere is almost certainly
+  // a mistake (it would be a JS syntax error) — reject it with a clear message.
+  const original = pattern;
+  let flags = '';
+  if (pattern.startsWith('(?i)')) {
+    pattern = pattern.slice(4);
+    flags = 'i';
+  }
+  if (pattern.includes('(?i)')) {
+    throw new Error('secret-scan: inline (?i) flag is only supported as a leading prefix: ' + original);
+  }
+  try {
+    return new RegExp(pattern, flags);
+  } catch (err) {
+    throw new Error('secret-scan: invalid pattern regex /' + pattern + '/: ' + (err as Error).message);
+  }
+}
+
+export function scanSecrets(text: string, config: SecretPatternsConfig, file?: string): SecretFinding[] {
+  const excludes = config.placeholder_excludes.map((p) => compileRegex(p));
+  const compiled = config.patterns.map((p) => ({ ...p, re: compileRegex(p.regex) }));
+  const findings: SecretFinding[] = [];
+  const lines = text.split('\n');
+  lines.forEach((line, idx) => {
+    // Deliberate line-level tradeoff: a line matching any exclude pattern is
+    // skipped entirely.  If a real secret happens to share a line with a
+    // placeholder token (e.g. a comment), it becomes a false-negative.
+    // This keeps precision high and avoids alert fatigue from generated files.
+    if (excludes.some((re) => re.test(line))) return;
+    for (const p of compiled) {
+      if (p.re.test(line)) {
+        findings.push({
+          severity: p.severity,
+          rule: p.name,
+          message: `Possible hardcoded secret (${p.name}) on line ${idx + 1}`,
+          location: { ...(file ? { file } : {}), line: idx + 1 },
+        });
+      }
+    }
+  });
+  return findings;
+}

package/lib/security-classify.ts

@@ -0,0 +1,80 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const DEFAULT_CONFIG = join(here, '..', 'config', 'security-paths.json');
+
+export interface SecurityPathsConfig { path_patterns: string[]; keyword_patterns: string[]; }
+
+function globToRegex(pattern: string): RegExp {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+  const regex = escaped
+    .replace(/\*\*/g, '\u0000')
+    .replace(/\*/g, '[^/]*')
+    .replace(/\u0000/g, '.*');
+  return new RegExp(`^${regex}$`);
+}
+
+function normalize(doc: Partial<SecurityPathsConfig>): SecurityPathsConfig {
+  return {
+    path_patterns: Array.isArray(doc.path_patterns) ? doc.path_patterns.filter((p) => typeof p === 'string') : [],
+    keyword_patterns: Array.isArray(doc.keyword_patterns) ? doc.keyword_patterns.filter((k) => typeof k === 'string') : [],
+  };
+}
+
+function loadDefaultConfig(): SecurityPathsConfig {
+  if (!existsSync(DEFAULT_CONFIG)) {
+    throw new Error(`security-paths config not found at ${DEFAULT_CONFIG}`);
+  }
+  return normalize(JSON.parse(readFileSync(DEFAULT_CONFIG, 'utf-8')) as Partial<SecurityPathsConfig>);
+}
+
+export function loadSecurityPathsConfig(repoRoot: string): SecurityPathsConfig {
+  const consumerPath = join(repoRoot, '.cloverleaf', 'config', 'security-paths.json');
+  if (existsSync(consumerPath)) {
+    try {
+      return normalize(JSON.parse(readFileSync(consumerPath, 'utf-8')) as Partial<SecurityPathsConfig>);
+    } catch {
+      // fall through
+    }
+  }
+  return loadDefaultConfig();
+}
+
+export function matchesSensitivePath(file: string, cfg: SecurityPathsConfig): boolean {
+  return cfg.path_patterns.some((p) => globToRegex(p).test(file));
+}
+
+export function matchesSensitiveKeyword(text: string, cfg: SecurityPathsConfig): boolean {
+  return cfg.keyword_patterns.some((k) => {
+    try {
+      return new RegExp(k, 'i').test(text);
+    } catch {
+      return false;
+    }
+  });
+}
+
+export interface SecurityClassification {
+  declared: 'low' | 'high';
+  diff_detected: boolean;
+  effective: 'low' | 'high';
+  matched_paths: string[];
+}
+
+/**
+ * Compute effective security classification. `declared` is the task's
+ * security_class (default low). `changedFiles` (e.g. from `git diff --name-only`)
+ * are matched against path_patterns for diff-detection.
+ */
+export function computeSecurityClassification(
+  declared: 'low' | 'high',
+  changedFiles: string[],
+  cfg: SecurityPathsConfig,
+): SecurityClassification {
+  const matched = changedFiles.filter((f) => matchesSensitivePath(f, cfg));
+  const diff_detected = matched.length > 0;
+  const effective = declared === 'high' || diff_detected ? 'high' : 'low';
+  return { declared, diff_detected, effective, matched_paths: matched };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloverleaf/reference-impl",
-  "version": "0.7.4",
+  "version": "0.8.0",
   "description": "Reference implementation of the Cloverleaf methodology as Claude Code skills. Implements the Tight Loop (Implementer + Reviewer).",
   "type": "module",
   "license": "MIT",
@@ -49,7 +49,7 @@
     "prepublishOnly": "node scripts/check-standard-prepped.mjs && npm test && npm run build"
   },
   "dependencies": {
-    "@cloverleaf/standard": "^0.6.0",
+    "@cloverleaf/standard": "^0.7.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "axe-core": "^4.10.0",

package/prompts/security-reviewer.md

@@ -0,0 +1,43 @@
+# Security Reviewer
+
+You are a security-minded senior engineer reviewing a code change for vulnerabilities. You are read-only — do not modify code. Judge ONLY the diff provided.
+
+## Task
+{{task}}
+
+## Branch / base
+Branch `{{branch}}` against `{{base_branch}}`. Repo root `{{repo_root}}`.
+
+## Diff
+{{diff}}
+
+## What to judge
+
+Examine the changed code for:
+- **Injection** — SQL, command/shell, path traversal, template/SSTI. Any user/external input reaching an interpreter, query, filesystem path, or subprocess without parameterization/escaping.
+- **Broken or missing authorization** — endpoints/handlers that skip an access check; privilege boundaries crossed.
+- **Unsafe deserialization** — `pickle`, `yaml.load`, `eval`, untrusted JSON→object with prototype risks.
+- **SSRF / unsafe outbound** — server-side requests built from untrusted input.
+- **Missing input validation** — unchecked sizes, types, ranges on external input that reaches sensitive sinks.
+- **Unsafe file ops** — path joins from untrusted input, world-writable perms, temp-file races.
+- **Weak crypto / weak defaults** — MD5/SHA1 for security, hardcoded IVs, disabled TLS verification, permissive CORS.
+
+A deterministic secret scan runs separately; you do NOT need to hunt for hardcoded keys (but flag one if you see it).
+
+## Output
+
+Return ONLY a feedback envelope JSON:
+
+```json
+{ "verdict": "pass" | "bounce" | "escalate",
+  "summary": "<one-line overall assessment>",
+  "findings": [
+    { "severity": "info|warning|error|blocker",
+      "message": "<what + why it matters>",
+      "location": { "file": "<path>", "line": <n> },
+      "suggestion": "<concrete fix>",
+      "rule": "<short-id e.g. injection.sql>" }
+  ] }
+```
+
+Severity guidance: `blocker` = exploitable now / credential exposure (→ human escalation). `error` = real vulnerability the implementer must fix. `warning` = weakness worth fixing. `info` = advisory, non-blocking. Set `verdict`: `escalate` if any `blocker`; else `bounce` if any `error`/`warning`; else `pass`. Be precise — false alarms erode trust. If the diff is inert (docs/tests/config with no security surface), return `{ "verdict": "pass", "summary": "no security-relevant surface", "findings": [] }`.

package/skills/cloverleaf-new-task/SKILL.md

@@ -35,7 +35,8 @@ The user has invoked this skill with a brief. Your job: turn the brief into a st
      "context": <see "context.rfc injection" below>,
      "acceptance_criteria": ["<criterion 1>", "<criterion 2>", "..."],
      "definition_of_done": ["<terminal statement of completion>"],
-     "risk_class": "low"
+     "risk_class": "low",
+     "security_class": "<see security_class inference below>"
    }
    ```
 
@@ -75,13 +76,18 @@ The user has invoked this skill with a brief. Your job: turn the brief into a st
 ## Rules
 
 - Do not guess at acceptance criteria. If the brief is too vague (e.g., "make it faster" with no target), ask the user a clarifying question before writing the file.
-- **`--rfc=<ID>` flag:** When the brief includes `--rfc=<RFC-ID>`, the task's `context.rfc` is populated from the on-disk RFC document (see step 4). Use this when scaffolding a standalone task linked to an RFC without a Plan parent — e.g., a hotfix-task pattern off an open RFC, as practiced by claw-crypto's CC-43/44 and CC-045..052. If `--rfc` is omitted, `context` is left empty; the task can be attached to a Plan later via Plan formation, or `context.rfc` can be edited in by hand.
+- **`--rfc=<ID>` flag:** When the brief includes `--rfc=<RFC-ID>`, the task's `context.rfc` is populated from the on-disk RFC document (see step 4). This is the canonical way to scaffold an **RFC-direct task** (no Plan parent, no `task_batch_gate`) — used for hotfixes after a Plan has delivered, or for incremental RFC progress without forming a Plan. The walker's RFC auto-advance treats RFC-direct tasks as first-class: an in-flight one blocks RFC completion; a merged one counts toward delivery. See `reference-impl/README.md` § "Plans vs RFC-direct tasks" for the full pattern docs and when to pick this over `/cloverleaf-discover`. If `--rfc` is omitted, `context` is left empty.
 - **risk_class inference:** `risk_class` determines the Delivery pipeline (`"low"` → fast lane; `"high"` → full pipeline). Rules:
   1. If the user passed `--risk=high` or `--risk=low` as a flag on the skill invocation, honor it.
   2. Otherwise, set `risk_class: "high"` when the brief OR any acceptance criterion matches (case-insensitive) any of these keywords:
      `site/`, `UI`, `page`, `component`, `style`, `visual`, `layout`, `render`, `display`, `accessibility`, `a11y`, `responsive`, `.astro`, `.css`, `.html`
   3. Also set `risk_class: "high"` for breaking APIs or cross-project work (v0.1.1 behavior, retained).
   4. Default: `risk_class: "low"`.
+- **`security_class` inference:** `security_class` (`"low"|"high"`, independent of `risk_class`) gates the Security Reviewer. Rules:
+  1. If the user passed `--security=high` or `--security=low`, honor it.
+  2. Otherwise set `"high"` when the brief, any acceptance criterion, OR any `scope.files_touched` entry matches a sensitive marker from `security-paths.json` (keyword patterns like `secret`, `credential`, `api key`, `token`, `password`, `exchange`, `sql`, `eval`, `subprocess`; or path patterns like `**/*.env*`, `**/secrets*`, `**/deploy*.sh`, `**/*.sql`, `**/auth*`). Consumers override the marker set at `.cloverleaf/config/security-paths.json`.
+  3. Default: `"low"`.
+- After writing the task, report the chosen `security_class` and why, e.g. `Security class: high → security review (matched keyword "credential"). Override with --security=low if desired.` Note: even when `low`, the orchestrator re-checks the actual diff at review time and routes to security-review if it touches sensitive paths (defense in depth).
 - After writing the task, report the chosen risk_class and how it was determined, e.g.:
   > "Risk class: `high` → full pipeline (matched keyword `component` in acceptance criterion). Override with `--risk=low` if desired."
 - Users can manually edit `risk_class` in the task JSON before running `/cloverleaf-run`.

package/skills/cloverleaf-run/SKILL.md

@@ -17,10 +17,31 @@ Do NOT `git checkout main` from a walker worktree — main is held by the primar
 MAX_REVIEWER_BOUNCES    = 3
 MAX_UI_REVIEWER_BOUNCES = 3
 MAX_QA_BOUNCES          = 3
+MAX_SECURITY_BOUNCES    = 3
 ```
 
 These counters live in-session (not persisted). Rerunning `/cloverleaf-run` resets.
 
+## Security gate (both lanes)
+
+Run this immediately after the task reaches `automated-gates` (Reviewer passed) and BEFORE the lane's next move (fast lane: merge; full pipeline: detect-ui-paths). Initialize `security_bounces = 0` at orchestrator start (alongside the other bounce counters).
+
+```bash
+cloverleaf-cli classify-security <repo_root> <TASK-ID> --branch cloverleaf/<TASK-ID>
+```
+
+Parse the JSON. If `classify-security` exits non-zero or emits unparseable output, do NOT silently skip security review (fail-open is unsafe for a security gate). Warn to the user and treat the task as `effective: "high"` — i.e. proceed into security-review anyway (fail toward more scrutiny). If `/cloverleaf-security-review` then cannot run either (e.g. branch/tooling broken), surface the failure and stop rather than merging unreviewed.
+
+If `effective == "low"` → skip the gate, proceed with the lane.
+
+If `effective == "high"`:
+- If `declared == "low"` (under-classification: `diff_detected` true), write back: load the task, set `security_class: "high"`, save it, then commit `cloverleaf: <TASK-ID> security_class → high (diff-detected)`.
+- `cloverleaf-cli advance-status <repo_root> <TASK-ID> security-review agent`; commit.
+- Inline `/cloverleaf-security-review <TASK-ID>` steps. Reload the task:
+  - `status == "automated-gates"` → security review passed; proceed with the lane.
+  - `status == "implementing"` → bounced. `security_bounces += 1`. If `security_bounces >= MAX_SECURITY_BOUNCES`, escalate (section 6). Else re-enter the implement→review loop (fast lane section 4 / full pipeline section 5.1), which re-runs the security gate on its next pass.
+  - `status == "escalated"` → the security reviewer found a blocker; stop and surface to the user (a human must review `.cloverleaf/feedback/`). This is the security reviewer's own escalation, distinct from a bounce-budget exhaustion.
+
 ## Steps
 
 1. Capture TASK-ID.
@@ -33,7 +54,7 @@ These counters live in-session (not persisted). Rerunning `/cloverleaf-run` rese
 
 ### 4. Fast Lane
 
-Initialize `reviewer_bounces = 0`.
+Initialize `reviewer_bounces = 0`, `security_bounces = 0`.
 
 Loop:
   a. Inline `/cloverleaf-implement <TASK-ID>` steps.
@@ -42,11 +63,11 @@ Loop:
   d. If `status === "implementing"`: Reviewer bounced. `reviewer_bounces += 1`. If `reviewer_bounces >= MAX_REVIEWER_BOUNCES`, escalate (section 6). Else continue loop.
   e. Else: unexpected state. Report and stop.
 
-After loop: inline `/cloverleaf-merge <TASK-ID>`.
+After loop (status `automated-gates`): run the **Security gate (both lanes)** (above). Then inline `/cloverleaf-merge <TASK-ID>`.
 
 ### 5. Full Pipeline
 
-Initialize `reviewer_bounces = 0`, `ui_reviewer_bounces = 0`, `qa_bounces = 0`.
+Initialize `reviewer_bounces = 0`, `ui_reviewer_bounces = 0`, `qa_bounces = 0`, `security_bounces = 0`.
 
 5.1. **Implementer → Documenter → Reviewer loop:**
 
@@ -58,6 +79,8 @@ Loop:
   e. If `status === "implementing"`: Reviewer bounced. `reviewer_bounces += 1`. If `reviewer_bounces >= MAX_REVIEWER_BOUNCES`, escalate. Else continue loop.
   f. Else: unexpected. Report and stop.
 
+**Security gate.** Run the **Security gate (both lanes)** (above) now, before UI-path detection. Then continue to 5.2.
+
 5.2. **UI-path detection and conditional UI Review:**
 
 ```bash
@@ -88,7 +111,7 @@ Loop:
 
 - `cloverleaf-cli advance-status <repo_root> <TASK-ID> escalated agent`
 - Commit: `git add .cloverleaf/ && git commit -m "cloverleaf: <TASK-ID> escalated (bounce budget exhausted)"`.
-- Report: "✗ Escalated `<TASK-ID>`. Review `.cloverleaf/feedback/` and either refine the task or take over manually. Counters: reviewer=<N>, ui_reviewer=<N>, qa=<N>."
+- Report: "✗ Escalated `<TASK-ID>`. Review `.cloverleaf/feedback/` and either refine the task or take over manually. Counters: reviewer=<N>, ui_reviewer=<N>, qa=<N>, security=<N>."
 
 ## Rules
 

package/skills/cloverleaf-run-plan/SKILL.md

@@ -292,36 +292,29 @@ description: Autonomous DAG walker for Cloverleaf Plans. Given a PLAN-ID in stat
 
    If not every task is merged (some escalated or awaiting), do NOT advance the Plan. Print the partial-completion report from the bullets above.
 
-   **RFC auto-advance (Standard 0.6.0+).** Immediately after the Plan-advance commit lands, check whether the parent RFC can also advance to `completed`. Read the just-completed plan's `parent_rfc` (project + id), then scan all sibling plans of that RFC:
+   **RFC auto-advance (Standard 0.6.0+ + rfc-tasks 0.7.5+).** Immediately after the Plan-advance commit lands, ask `cloverleaf-cli rfc-tasks` whether the parent RFC can also advance to `completed`. The CLI considers BOTH sibling Plans AND RFC-direct (standalone) tasks under the same `parent_rfc` — an in-flight standalone task blocks the advance, a merged standalone task counts toward the at-least-one-delivered requirement.
 
    ```bash
-   PARENT_RFC_PROJECT=$(jq -r '.parent_rfc.project' <repo_root>/.cloverleaf/plans/<PLAN-ID>.json)
    PARENT_RFC_ID=$(jq -r '.parent_rfc.id' <repo_root>/.cloverleaf/plans/<PLAN-ID>.json)
-   RFC_STATUS=$(jq -r '.status' <repo_root>/.cloverleaf/rfcs/"$PARENT_RFC_ID".json)
 
-   # Count sibling Plans still in-flight (drafting, gate-pending, or approved)
-   INFLIGHT=$(jq -s --arg proj "$PARENT_RFC_PROJECT" --arg id "$PARENT_RFC_ID" \
-     '[.[] | select(.parent_rfc.project == $proj and .parent_rfc.id == $id and (.status == "drafting" or .status == "gate-pending" or .status == "approved"))] | length' \
-     <repo_root>/.cloverleaf/plans/*.json)
+   RFC_VIEW=$(cloverleaf-cli rfc-tasks <repo_root> "$PARENT_RFC_ID")
+   CAN_ADVANCE=$(echo "$RFC_VIEW" | jq -r '.summary.can_auto_advance_rfc')
 
-   # Count sibling Plans in completed (need at least one to advance)
-   COMPLETED=$(jq -s --arg proj "$PARENT_RFC_PROJECT" --arg id "$PARENT_RFC_ID" \
-     '[.[] | select(.parent_rfc.project == $proj and .parent_rfc.id == $id and .status == "completed")] | length' \
-     <repo_root>/.cloverleaf/plans/*.json)
-
-   if [ "$RFC_STATUS" = "approved" ] && [ "$INFLIGHT" = "0" ] && [ "$COMPLETED" != "0" ]; then
+   if [ "$CAN_ADVANCE" = "true" ]; then
+     DELIVERED=$(echo "$RFC_VIEW" | jq -r '"\(.summary.delivered_plans) plans, \(.summary.delivered_standalone) standalone tasks"')
      cloverleaf-cli advance-rfc <repo_root> "$PARENT_RFC_ID" completed agent
      git -C <repo_root> add .cloverleaf/rfcs/"$PARENT_RFC_ID".json .cloverleaf/events/
-     git -C <repo_root> commit -m "cloverleaf: rfc $PARENT_RFC_ID completed ($COMPLETED sibling plans completed, 0 in-flight)"
+     git -C <repo_root> commit -m "cloverleaf: rfc $PARENT_RFC_ID completed ($DELIVERED delivered, 0 in-flight)"
      echo "✓ RFC $PARENT_RFC_ID advanced approved → completed."
    fi
    ```
 
-   Auto-advance rules in plain language:
-   - Skip entirely if the RFC's `status` is not `approved` (already terminal, already abandoned, or somehow still pre-approval — leave it).
-   - Skip if any sibling Plan is still in-flight (`drafting`, `gate-pending`, or `approved`) — more work is pending on this RFC.
-   - Skip if no sibling Plan is `completed` (all `rejected`) — the RFC's decomposition was uniformly rejected; operator must decide whether to abandon or re-decompose.
-   - Otherwise advance the RFC to `completed`. Idempotent: the status guard makes re-runs safe.
+   Skip conditions encoded in `can_auto_advance_rfc`:
+   - RFC is not at `approved` (already terminal, abandoned, or somehow still pre-approval).
+   - Any sibling Plan is in-flight (`drafting`, `gate-pending`, or `approved`) OR any standalone task is in a non-terminal state.
+   - No Plan reached `completed` AND no standalone task reached `merged` — the RFC has nothing delivered (e.g. all child Plans were rejected); operator must decide whether to abandon or re-decompose.
+
+   Idempotent: the `rfc.status === "approved"` guard inside `can_auto_advance_rfc` makes re-runs of `/cloverleaf-run-plan` against a fully-merged plan safe.
 
    ## Next steps (release publishing)
 
@@ -399,3 +392,7 @@ The concrete policy JSON is the same one used during the CLV-16..CLV-20 dogfood
 ## Notes
 
 **Vocab dependency.** The walker reads `notification_contract.vocabulary` from the `start_session` response advisorily — if the expected tokens (`DONE`, `NEEDS-INPUT`) are absent it warns to stderr but continues. The authoritative source of truth for which tokens Session B will emit is the SDK's `--driven-tokens` flag passed when claw-drive spawns the session. A mismatch between the contract and the actual flag signals a version skew between the claw-drive server and the reference-impl skill; upgrade both components together to keep them in sync.
+
+**RFC-direct task participation in RFC auto-advance.** Tasks with no `parent` field but with `context.rfc` set (created via `/cloverleaf-new-task --rfc=<RFC-ID>`) are *first-class* participants in the `can_auto_advance_rfc` check. They block the advance when in-flight; they count toward delivery when merged. See `cloverleaf-cli rfc-tasks <repo_root> <RFC-ID>` for the categorized view this dispatch reads from, or `reference-impl/README.md` § "Plans vs RFC-direct tasks" for the user-facing pattern docs.
+
+**Security-review escalations.** When a task's effective `security_class` is high, `/cloverleaf-run` routes it through `security-review` off the automated-gates hub. A `blocker` finding (e.g. a leaked credential) advances the task to `escalated`, which surfaces through the walker's existing escalation path — expect and surface these like any other escalation; do not auto-retry a security blocker.

package/skills/cloverleaf-security-review/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: cloverleaf-security-review
+description: Run the Security Reviewer agent on a task in the `security-review` state. Hybrid two-pass (deterministic secret scan + LLM vulnerability judgment); emits a feedback envelope; advances to automated-gates (pass), implementing (bounce), or escalated (blocker). Usage — /cloverleaf-security-review <TASK-ID>.
+---
+
+# Cloverleaf — security review
+
+## Steps
+
+0. Pre-flight: stay on the current branch (do NOT checkout main in walker worktrees). Clean stale temp:
+   ```bash
+   rm -f /tmp/cloverleaf-fb-s.json
+   ```
+
+1. Capture the TASK-ID argument.
+
+2. Load the task: `cloverleaf-cli load-task <repo_root> <TASK-ID>`. Verify `status === "security-review"`. If not, report the current status and stop.
+
+3. Confirm the branch `cloverleaf/<TASK-ID>` exists: `git rev-parse --verify cloverleaf/<TASK-ID>`. If missing, report the discrepancy and stop. Compute the diff for the subagent (do NOT check out): `git diff main..cloverleaf/<TASK-ID>`.
+
+4. **Pass A — deterministic secret scan:**
+   ```bash
+   cloverleaf-cli secret-scan <repo_root> --branch cloverleaf/<TASK-ID>
+   ```
+   Capture the `findings[]` array (each has `severity` of `error`/`blocker`, plus `rule`, `message`, `location`).
+
+5. **Pass B — LLM judgment:** dispatch a subagent via the Task tool:
+   - `subagent_type`: `general-purpose`
+   - `model`: `sonnet`
+   - Prompt: contents of `$(cloverleaf-cli plugin-root)/prompts/security-reviewer.md` with substitutions for `{{task}}`, `{{branch}}`, `{{base_branch}}`, `{{repo_root}}`, `{{diff}}`.
+   Parse the subagent's feedback envelope (`verdict` + `findings[]`).
+
+6. **Merge + derive verdict.** Concatenate Pass A findings + Pass B findings into one `findings[]`. Derive the final verdict from the max severity across ALL findings:
+   - any `blocker` → `verdict: "escalate"`
+   - else any `error` or `warning` → `verdict: "bounce"`
+   - else (only `info`, or none) → `verdict: "pass"`
+
+7. **Branch on verdict:**
+
+   **Pass:**
+   ```bash
+   cloverleaf-cli advance-status <repo_root> <TASK-ID> automated-gates agent
+   git -C <repo_root> add .cloverleaf/ && git -C <repo_root> commit -m "cloverleaf: <TASK-ID> security review passed → automated-gates"
+   ```
+   Report: "✓ Security review passed. State → automated-gates."
+
+   **Bounce:**
+   ```bash
+   echo '<merged-envelope-json>' > /tmp/cloverleaf-fb-s.json
+   cloverleaf-cli write-feedback <repo_root> <TASK-ID> /tmp/cloverleaf-fb-s.json
+   git -C <repo_root> add .cloverleaf/feedback/ && git -C <repo_root> commit -m "cloverleaf: <TASK-ID> security review feedback"
+   cloverleaf-cli advance-status <repo_root> <TASK-ID> implementing agent
+   git -C <repo_root> add .cloverleaf/ && git -C <repo_root> commit -m "cloverleaf: <TASK-ID> security review bounced → implementing"
+   ```
+   Report: "✗ Security review bounced. Findings: <summarize by severity>. State → implementing."
+
+   **Escalate (blocker found):**
+   ```bash
+   echo '<merged-envelope-json>' > /tmp/cloverleaf-fb-s.json
+   cloverleaf-cli write-feedback <repo_root> <TASK-ID> /tmp/cloverleaf-fb-s.json
+   git -C <repo_root> add .cloverleaf/feedback/ && git -C <repo_root> commit -m "cloverleaf: <TASK-ID> security review feedback"
+   cloverleaf-cli advance-status <repo_root> <TASK-ID> escalated agent
+   git -C <repo_root> add .cloverleaf/ && git -C <repo_root> commit -m "cloverleaf: <TASK-ID> security review escalated (blocker finding)"
+   ```
+   Report: "⚠ Security review found a BLOCKER. State → escalated. A human must review `.cloverleaf/feedback/` before this can proceed."
+
+## Rules
+
+- Never push. Read-only on source — the security reviewer does not modify code.
+- A `blocker` (e.g. a leaked credential) ALWAYS escalates to a human; never let the bounce loop silently "fix" it.
+- On illegal state transition, report and stop without partial commits.