feat(delegate): parallel non-blocking security-scanner reviewer

[selta-goodparty]

What

Adds security-scanner — a second, independent Delegate reviewer that runs in parallel with pr-reviewer and never touches it. On a PR opened/ready_for_review (and on a delegate security review comment) it does an adversarial, diff-scoped security review and posts a non-blocking, comment-only review under its own security-review status context.

pr-reviewer is byte-for-byte unchanged.

Why it can't interfere with the main review

• Own Fargate task — a second dispatch() per PR, parallel, no shared state.
• Own GitHub App identity (a third App, distinct login). pr-reviewer reconciles only reviews/threads authored by its own bot login and dedups its status on context == "pr-reviewer"; a different login + the security-review context means it never sees this pass.
• Never gates merge — only ever event=COMMENT (never APPROVE / REQUEST_CHANGES), and its commit status is always success (informational, not a required check). The main bot's approval still governs mergeability, even if security suggestions are applied.

The analysis

Ported from the /security-scan skill — source→sink taint taxonomy + an adversarial disprove-it verifier — and hardened for this product:

• First-class LLM / prompt-injection lens (untrusted gov/PDF/web content into LLM tool contexts — the real surface here).
• First-class infrastructure-as-code lens (Pulumi / Dockerfiles / CI / IAM / security groups), diff-scoped.
• MITRE ATT&CK technique mapping per finding.
• Multi-step exploit chains, not just single-line bugs.
• Opus orchestrator + parallel sonnet finder/verifier subagents. Medium+ post inline with suggestion fixes; Low/info roll into a collapsed summary.

Inert until provisioned (safe to merge now)

Dispatch is gated on the SECURITY_APP_PRIVATE_KEY secret, so nothing fires until the dedicated Delegate Security App exists. To enable (see delegate/README.md):

1. Register the App (Contents:Read, Pull-requests:R&W, Statuses:R&W), install on omni.
2. Set SECURITY_APP_ID, SECURITY_INSTALLATION_ID, SECURITY_APP_PRIVATE_KEY.
3. Deploy. It auto-activates for omni (already in SECURITY_REVIEW_REPOS). Onboarding another repo = install the App + add the name.

Net-new surface

agents/security-scanner.ts (new) · an agents/index.ts import · a SECURITY_REVIEW_REPOS set + dispatch branch + delegate security review trigger in lambdas/github.ts · setupSecurityGitHubAuth in worker/github-auth.ts · a token swap in worker/entrypoint.ts · README docs.

tsc --noEmit clean; all 31 framework/lambda tests pass.

Note: this PR touches delegate/, so the bot self-reviews comment-only — a human merges.

---

Note

Medium Risk
Touches GitHub webhook dispatch and worker token routing for a new bot identity; misconfiguration could skip scans or post under the wrong App, but pr-reviewer is unchanged and dispatch is secret-gated until provisioned.

Overview
Adds security-scanner, a second Delegate agent that runs in parallel with pr-reviewer on PR opened/ready_for_review and on delegate security review comments. It performs a diff-scoped adversarial security review (taxonomy finders + disprove-it verifiers, CWE/MITRE mapping, LLM/IaC lenses) and posts comment-only reviews with a security-review status that is always success—it does not approve, request changes, or gate merge.

GitHub webhook (delegate/lambdas/github.ts): SECURITY_REVIEW_REPOS (seeded with omni), parallel dispatchSecurityScan after normal PR review dispatch, and a separate re-review path gated on SECURITY_APP_PRIVATE_KEY so the feature stays inert until provisioned.

Worker identity (github-auth.ts, entrypoint.ts): a third GitHub App mints SECURITY_GITHUB_TOKEN; security-scanner jobs exit if that token is missing so reviews never post under the delegate/reviewer identity (avoiding cross-reconciliation with pr-reviewer).

Docs: delegate/README.md documents onboarding the Delegate Security App and repo allowlisting.

^{Reviewed by Cursor Bugbot for commit cc93dcc. Configure here.}

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit cc93dcc. Configure here.}