Standard 1.4: Add proportionate security and evidence rule

[artyomboyko]

Summary

• Add Agent Handoff Standard 1.4 with a strict threshold for blocking or scope-expanding security and evidence work.
• Require a verified High or Critical current-scope risk supported by reproducible evidence or a directly applicable authoritative source.
• Limit suspected High or Critical risks to short, time-boxed investigation until confirmed.
• Keep Low, Medium, unrated, and unverified risks non-blocking.
• Preserve exact acceptance criteria and verified mandatory requirements as independent blockers only when cited.
• Preserve the existing security baseline while prioritizing the smallest useful end-to-end scenario.
• Keep the 10–15% security-and-evidence share as a non-binding planning heuristic.
• Synchronize protocols, adoption guidance, release metadata, public pages, handoff, and the structural checker.

Why

The previous wording used a concrete and credible current-scope risk as the threshold. That was still broad enough for hypothetical or Medium-risk hardening to become blocking. Standard 1.4 now requires verified High or Critical severity before security or evidence work may block acceptance or expand scope.

Related issue

Closes #14

Agent handoff

• Agent: Codex
• Agent ID: clear-oak-7d2a
• Run ID: 20260724-issue-14-7d2a
• Work claim exists: yes
• Final result comment exists: yes
• Handoff
• Final reviewed threshold commit: 8ec71d942d6f6f27e7da95ab2e5f2a4257350a83
• Final HEAD: 3c040f6b86e1b44736b22b5d1009dcdbdddf7aa4

Commits and CI

• Initial core commit: 9637257a94cfa4443b419f5e22ed0c56e1d7934f
• Initial handoff commit: cc92f1e3a3698026a2c37c0ac8e7ec7d4ef579aa
• Verified High/Critical threshold finalized through: 8ec71d942d6f6f27e7da95ab2e5f2a4257350a83
• Handoff synchronization: 835775bfb4ebe6c92fe9cb5a69ce570705e0a41a
• Final index/HEAD: 3c040f6b86e1b44736b22b5d1009dcdbdddf7aa4
• Final CI 30125143556: passed

Change type

• Bug fix
• Standard change
• Documentation
• Template change
• Refactoring
• Research
• Other

Checks

• Related Issue or PR is linked.
• Required files exist.
• Relative Markdown and HTML links work.
• YAML and front matter are valid.
• Required final result comment exists.
• Agent Handoff checker passed.
• Security and evidence work did not block acceptance or expand scope without a verified High/Critical current-scope risk or an exactly cited mandatory requirement; other items remain non-blocking.
• Mandatory containerization decision is not applicable; no container files changed.
• Compose validation is not applicable; no Compose configuration changed.
• GUI testing rules were not changed.
• Canonical English-only validation passed.
• GitHub Actions passed on the final HEAD.

State updates

• ai/PROJECT_STATE.md updated.
• ai/DECISIONS.md updated.
• Handoff file updated.
• ai/handoffs/INDEX.md updated.

Scope boundaries

• No application or production code.
• No change to SECURITY.md.
• No mandatory threat model for every PR.
• No automated risk scoring.
• No hard percentage limit.
• No new approval gates.
• No weakening of the existing security baseline.
• No merge in this task.

Risks

• Blocking: none.
• Investigation: none.
• Follow-up hardening: none required for this standard change.
• Accepted: none.
• Owner review and merge remain pending.

Next steps

1. Review this Draft Pull Request.
2. If accepted, authorize a separate Ready-for-review and merge action.
3. Keep Issue Change: Add proportionate security and evidence rule #14 open until merge.