reporook-securitylisted

# RepoRook Security Use RepoRook as the deterministic evidence layer. Use the host's reasoning for contextual validation and remediation. Never merge those trust levels silently. ## Run the scan and policy gate 1. If the user asks to configure RepoRook and no configuration exists, run `reporook init .`, show what it detected, and review the generated fail-closed scanner requirements. Do not replace an existing configuration without explicit approval for `--force`. 2. Prefer the RepoRook MCP tools when available. Otherwise run the already-installed `reporook scan .` binary. If `reporook` or `reporook-mcp` is missing, stop and tell the user; never download, install, update, or bootstrap executable software on their behalf. 3. For a pull request or local change, use `scan_changes` or `reporook scan . --changed <base> --head <head>`. 4. Read `coverage_status` and every scanner status before interpreting findings. 5. Treat exit `2` or failed coverage as a security-gate failure. If coverage is partial, say which checks did not run. Never describe an incomplete scan as clean or safe. 6. Never print, copy, or place a detected secret in a prompt, report, patch, test, or log. 7. Read `policy.summary` and each finding's policy disposition. Prioritize only `actionable` findings. Keep baseline, suppressed, and below-threshold findings visible as audit evidence without treating them as permission to edit. 8. Treat `containerImages` and `gitHistory` as explicit scope. Never add an image,