Derive what the root holds, rather than listing it in the security policy [#332]

[iderex]

The issue this belongs to

Closes #332

What changed

The inventory under "What this repository is" no longer lists the root file by file. It names the kinds a reporter needs - the crate, the suite, the decision records and the index that lists them, the gate-parity document, the workflows and the shell scripts they run, the templates beside them, and the register under security/ - and hands the reader the command that returns what the root itself holds.

The paragraph directly under it, which already says of itself that the inventory is a list and that a list drifts, gains the account of this instance rather than having it written over.

What failure it prevents

A failure that has already happened. The inventory named one licence while two texts stand, named neither the code of conduct nor the register under security/, and never named CONTRIBUTING.md:

git ls-tree --name-only origin/main | grep -v -E '^(src|tests|docs|\.github)$'
.editorconfig
.gitattributes
.gitignore
CODE_OF_CONDUCT.md
CONTRIBUTING.md
Cargo.lock
Cargo.toml
DCO
LICENSE-APACHE
LICENSE-MIT
NOTICE.md
README.md
SECURITY.md
rust-toolchain.toml
rustfmt.toml
security

Three of those arrived after the inventory was written, and none of the three opened it:

git log origin/main --format='%h %ad %s' --date=short -1 -S'a README, two issue templates' -- SECURITY.md
c6d3694 2026-08-26 Make the security policy read the tree it describes (#200) (#203)

git log origin/main --diff-filter=A --format='%h %ad' --date=short \
  -- LICENSE-APACHE CODE_OF_CONDUCT.md security/statements.json
89b9102 2026-09-05
a9dfdca 2026-09-04
2939128 2026-09-02

CONTRIBUTING.md is the other case and it is not drift. It was in the tree before that sentence was written and the sentence never named it, so nothing made that omission arrive; the derived line repairs it by construction.

What it cost is the purpose of the paragraph, whose own first line tells a reporter to read the tree before deciding what to look for. An item missing from it is a surface a reporter does not know is there. The register under security/ is the one that matters most for that: it is where a scanner exclusion and a dismissed finding are stated publicly rather than suppressed quietly, so a wrong entry in it is a class nothing looks at with nothing saying so, and the list gave no sign a register of that kind exists.

It was found by reading the inventory against the tree while working the board, not by anything reporting it.

Evidence

Read at the commit being pushed, d6bb826.

The two checks on this board that read this file, or the register it now names:

bash .github/doc-paths/doc-paths.sh check | tail -1
Every path these documents name resolves against the tracked set.

bash .github/doc-paths/doc-paths.sh check | grep 'named path(s)'
ok    78 document(s), 363 named path(s) resolved, 0 excused as examples

bash .github/statements/statements.sh check | tail -1
Every directive this repository excludes has a published statement saying why, and what is consequently not looked for.

The paths this change touches, against the Scope: line #332 declares:

git diff --name-only origin/main...HEAD
SECURITY.md

The means is Markdown prose in a file that is already Markdown prose, and no artefact is built here. The change edits one paragraph and adds one below it, in the form this document already uses for its earlier corrections; it adds no language, no runtime and no dependency, and the path check that already reads every name this document writes is what judges it.

What this does not cover

• No mechanism. Nothing compares this file's description of the tree against the tree. .github/doc-paths/doc-paths.sh refuses a name a document writes that resolves to no file, which is the opposite direction: it never asks whether a file went unnamed. A derived line stops this paragraph going stale in this particular way and refuses nothing.
• The rest of SECURITY.md. I read this paragraph and the two derivations under it against the tree, and audited the remainder of the file no further. The security policy understates the pull-request-triggered permission surface in three places #324 closed on this file earlier today on a different paragraph.
• .editorconfig, .gitignore and rustfmt.toml. The derived command returns them and the sentence names no one of them. Whether a security policy's map owes a formatter setting and an ignore list is a judgement about what a reporter needs, and the change makes it unnecessary to take rather than taking it.
• The past-tense correction blocks already in this file. They record what was read and when, they were right when they were written, and moving them would rewrite what happened rather than repair what is claimed.
• No guard added, and the suite was not run. This change adds and edits no check, no test and no guard, so no bite is owed and none is shown. It touches no source, so cargo build --locked --all-targets and cargo test --locked were not run at this commit; the two check runs above are the whole of what was measured here.

Who has read it

Nobody other than the author. There is one person on this account and no second reader was available, so the evidence above stands in place of a review rather than the question being left open.