Pin the security policy's evidence that the core is written to the commit it was read at

[iderex]

The issue this belongs to

Closes #427

What changed

One block in SECURITY.md. The two counts that show the crate and the suite
exist name the commit they were read at, where they reproduce. The git rev-parse origin/main above them is deleted rather than pinned, because a command pinned to
a commit already says which one it is. The reading of the repository's language
keeps its output: it asks the hosting provider rather than a reference in this
tree, and nothing about it moved. What the two counts answer today is asked
separately, with no number under it, because that is a different question from the
one the paragraph is evidence for. A correction paragraph says what was wrong.

What failure it prevents

It has already happened. Three of the four commands read origin/main while their
outputs were a reading at the commit the prose names two lines above them:

git show origin/main:SECURITY.md | sed -n '74,84p'
because the file told them there was none. Read at
`5d67a074202de4d8069eee55d44812bf7fa9e201`:

    git rev-parse origin/main
    5d67a074202de4d8069eee55d44812bf7fa9e201
    git ls-tree -r --name-only origin/main | grep -c '^src/'
    10
    git ls-tree -r --name-only origin/main | grep -c '^tests/'
    6
    gh api repos/Flowfin/core --jq .language
    Rust

Against the reference those lines name:

git ls-tree -r --name-only origin/main | grep -c '^src/'
46
git ls-tree -r --name-only origin/main | grep -c '^tests/'
68

This is the document a reporter reads before deciding whether there is anything
here to report, and the paragraph exists because an earlier version of it told
them there was no code. It told them there were ten files under src/, which is
under a quarter of what is there, and that is the paragraph's own subject arriving
in its evidence: a reader who believed a stale sentence and did not open the code.

What was wrong: three outputs taken at a fixed commit standing under commands that
ask a moving reference. How it was found: by running the three lines as they were
written and comparing what they answered with what was pasted under them.

Evidence

The base this is measured against:

git rev-parse origin/main
53cd6994d93ff76982301f52908759a555fe793b

The two pinned commands in the change, run exactly as they are now written:

git ls-tree -r --name-only 5d67a074202de4d8069eee55d44812bf7fa9e201 | grep -c '^src/'
10
git ls-tree -r --name-only 5d67a074202de4d8069eee55d44812bf7fa9e201 | grep -c '^tests/'
6

The fourth command is unchanged and still answers what is pasted beside it:

gh api repos/Flowfin/core --jq .language
Rust

The two numbers named in the correction paragraph, read at the base:

git ls-tree -r --name-only 53cd6994d93ff76982301f52908759a555fe793b | grep -c '^src/'
46
git ls-tree -r --name-only 53cd6994d93ff76982301f52908759a555fe793b | grep -c '^tests/'
68

The block as it stands at this head:

git show HEAD:SECURITY.md | sed -n '74,88p'
because the file told them there was none. Read at
`5d67a074202de4d8069eee55d44812bf7fa9e201`, and each command names that commit so
that running it returns what is beside it:

    git ls-tree -r --name-only 5d67a074202de4d8069eee55d44812bf7fa9e201 | grep -c '^src/'
    10
    git ls-tree -r --name-only 5d67a074202de4d8069eee55d44812bf7fa9e201 | grep -c '^tests/'
    6
    gh api repos/Flowfin/core --jq .language
    Rust

What the two counts answer today is a different question from what this
paragraph is evidence for, and it is asked without a number beside it:

    git ls-tree -r --name-only origin/main | grep -c '^src/'

The change reaches one file and it is one commit:

git rev-parse HEAD
8c40f23bc75496c25c2e5fd6b8e1c5752edcdc44
git diff --name-only origin/main...HEAD
SECURITY.md
git rev-list --count origin/main..HEAD
1
git diff --shortstat origin/main...HEAD
 1 file changed, 25 insertions(+), 5 deletions(-)

Both gate commands at this head, reported by exit code because the build's own
last line names a profile and this body is judged by a gate that reads the word
in it:

cargo build --locked --all-targets >/dev/null 2>&1 ; echo "build exit=$?"
build exit=0
cargo test --locked >/dev/null 2>&1 ; echo "test exit=$?"
test exit=0

The two document checks that read this file, each run whole:

bash .github/doc-paths/doc-paths.sh check
Every path these documents name resolves against the tracked set.
bash .github/statements/statements.sh check
Every directive this repository excludes has a published statement saying why, and what is consequently not looked for.

The means is unchanged and no artefact is built here: this edits Markdown prose
and one indented command block in a document that already exists, so there is no
language, format, tool or runtime to choose.

What this does not cover

• The four records Four records anchor their measurements to a sha under git rev-parse origin/main, and 0269 deletes the anchor rather than a stale reading #366 holds. They anchor measurements with git rev-parse origin/main inside docs/decisions/, where 0269 decides what happens to a
  paste that stopped reproducing and where the repair is the rule question that
  issue carries. SECURITY.md is not a landed record, so nothing here turns on
  that answer and no record is touched.
• Every other reading in SECURITY.md. Only the one block whose commands
  named a moving reference is repaired. The others were re-run while this was
  found - the log of when three paths were added, the pull_request_target
  count, the std::net count, and the pair counting pub|fn two ways - and each
  still answers what is pasted beside it. Three of those also name origin/main
  and are left standing, because what they ask does not move when the mainline
  does.
• The inventory sentence itself. What the tree holds is already derived rather
  than listed in the paragraph below, and nothing here extends or re-lists it.
• A check that would refuse the next one. Nothing in this tree compares a
  pasted output against the command above it, and this adds no rule. The same
  shape can land tomorrow in any document here and no run will say so.
• No guard is added or edited. The template's section for one is deleted
  rather than filled in, because nothing here refuses anything new.
• Nothing was skipped for needing elevation, a platform nothing built for, or a
  real server. Every command above ran whole on this machine.

Who has read it

Nobody other than the author has read this change. The evidence above stands in
place of a second reading, and it is weaker than one: every command in it was run
by the same party that wrote the change.