Add direct post-deployment pentest and Linear report

[asarkar157]

Summary

• add a final create-linear-ticket stage after the SOC 2-oriented assessment
• replace the workspace/artifact/observability dependency with bounded direct Nmap, AWS posture, HTTPS/TLS, WAF-header, security-header, and protected-endpoint auth checks
• mark VictoriaMetrics, Loki, Jaeger, Grafana, and OpsVerse NOT ASSESSED in expedited mode instead of blocking
• reuse stackgen-sandbox, demo-runner, and devops-linear through dedicated least-privilege agents
• use demo_run_id, or the Aiden execution ID when absent, as the retry-safe Linear marker

Validation

• tofu fmt -check -recursive
• tofu init -input=false
• tofu validate
• initial saved plan: 8 creates, 3 in-place updates, 0 deletes, 0 replacements
• focused probe correction: 1 in-place runbook update, 0 deletes
• applied to Demo Workspace 62e29120-d230-4d4c-ba0d-3426e887d697
• live direct agents are active; post-deployment workflow is approved at version 3
• final reconciliation plan has 0 changes and 0 deletes
• end-to-end direct execution completed all seven stages without a workspace, evidence artifact, demo_run_id, or observability input
• verified only ports 80/443 open, HTTP-to-HTTPS redirect, valid TLS, correct WAF rejection on /api/public, and 401 rejection on protected /api/profile
• observability was reported NOT ASSESSED and did not block; AWS posture was also NOT ASSESSED because the runner AWS identity is not the target account
• Linear publication was proven by issue STA-35 on the first direct execution

StackGen provider v0.1.39 returned known computed-field readback errors after server-side workflow/webhook updates. Direct live discovery and the empty reconciliation plan confirm convergence.

[asarkar157]

@/tmp/pr12-security-comment.md

[asarkar157]

Security review — PASS

Validated PR #12 at e644ace314f7385240f7b0c0337494762039ee77 against the completed Security gate run. Aggregate gate: allow: true; no blocking findings.

Advisory Trivy IaC findings — infra/aws/main.tf:

• CRITICAL AWS-0104: unrestricted security-group egress. Restrict outbound CIDRs and ports to required destinations.
• HIGH AWS-0053: internet-exposed load balancer. Confirm public exposure is required; otherwise use an internal load balancer and restrictive security groups.
• HIGH AWS-0132: S3 encryption does not use a customer-managed KMS key. Configure SSE-KMS with an appropriate CMK.
• HIGH AWS-0164 (2 occurrences): subnets assign public IPs by default. Disable automatic public-IP assignment or isolate workloads in private subnets.

Gitleaks and Semgrep reported no findings. Tests, OPA policies, Trivy, and the aggregate gate completed successfully. Evidence: gitleaks, Semgrep, Trivy, aggregate gate.