From 9a73113895c73462ce1d08eb06556f6627ebdcee Mon Sep 17 00:00:00 2001
From: tps-flint <flint@tps.dev>
Date: Wed, 2 Sep 2026 05:17:21 -0700
Subject: [PATCH 1/2] chore(security): pin Socket.dev policy in-repo (Refs
 ops-3pdm)

---
 socket.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 socket.yml

diff --git a/socket.yml b/socket.yml
new file mode 100644
index 0000000..2e9a642
--- /dev/null
+++ b/socket.yml
@@ -0,0 +1,18 @@
+# Socket.dev policy — OUR trust anchor, not Socket's default.
+# Same rules as tpsdev-ai/cli (the first repo to pin one). Supply-chain risk,
+# vulnerabilities and anomalies are errors; quality signals only warn.
+# Pinned 2026-09-02 (ops-3pdm). Change it here, in review — never in the dashboard alone.
+version: 2
+projectIgnorePaths:
+  - "node_modules"
+  - "test"
+  - "docs"
+issueRules:
+  supplyChainRisk:
+    deferTo: error
+  vulnerabilities:
+    deferTo: error
+  quality:
+    deferTo: warn
+  anomalies:
+    deferTo: error

From ea3cbfef2c8f922185cceab0f3d8cb297d92bfd7 Mon Sep 17 00:00:00 2001
From: tps-flint <flint@tps.dev>
Date: Wed, 2 Sep 2026 05:25:04 -0700
Subject: [PATCH 2/2] =?UTF-8?q?chore(security):=20socket.yml=20=E2=80=94?=
 =?UTF-8?q?=20bind=20only=20what=20a=20repo=20file=20can=20(githubApp=20fl?=
 =?UTF-8?q?ags,=20ignore=20paths);=20drop=20the=20no-op=20deferTo=20block?=
 =?UTF-8?q?=20(Refs=20ops-3pdm)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 socket.yml | 35 +++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/socket.yml b/socket.yml
index 2e9a642..17eb040 100644
--- a/socket.yml
+++ b/socket.yml
@@ -1,18 +1,21 @@
-# Socket.dev policy — OUR trust anchor, not Socket's default.
-# Same rules as tpsdev-ai/cli (the first repo to pin one). Supply-chain risk,
-# vulnerabilities and anomalies are errors; quality signals only warn.
-# Pinned 2026-09-02 (ops-3pdm). Change it here, in review — never in the dashboard alone.
+# Socket.dev repo config (socket.yml v2; schema = @socketsecurity/config 3.0.1).
+#
+# WHAT THIS FILE BINDS: which Socket GitHub App surfaces run on this repo (the
+# "Socket Security: Pull Request Alerts" and "Project Report" checks, the PR
+# dependency table), the paths Socket ignores, and that no user is exempt.
+#
+# WHAT IT CANNOT BIND: the ACTION per alert type (block / warn / monitor / ignore).
+# That lives in the org Security Policy in the Socket dashboard, scoped by repo
+# label, and is enforced here by the branch ruleset requiring the
+# "Socket Security: Pull Request Alerts" check. A `deferTo:` block in this file is
+# SILENTLY DROPPED by the parser (verified 2026-09-02 with readSocketConfig, ops-3pdm)
+# — do not add one. `issueRules` here only takes booleans keyed by alert type.
 version: 2
 projectIgnorePaths:
-  - "node_modules"
-  - "test"
-  - "docs"
-issueRules:
-  supplyChainRisk:
-    deferTo: error
-  vulnerabilities:
-    deferTo: error
-  quality:
-    deferTo: warn
-  anomalies:
-    deferTo: error
+  - node_modules
+githubApp:
+  enabled: true
+  projectReportsEnabled: true
+  pullRequestAlertsEnabled: true
+  dependencyOverviewEnabled: true
+  ignoreUsers: []