Convert Gemini red-team findings into tracked controls

[labgadget015-dotcom]

Roadmap item 9/10 · Workstream: Security · Risk: High · Approval required: Yes · Target milestone: M2 — Governed intake

Objective

Turn each finding from the Gemini red-team exercise into a tracked, testable control with an owner, so findings become verified mitigations rather than a static report.

Non-goals

• Re-running the red-team exercise
• Publishing exploit detail — this repository is public

Acceptance criteria

• Input needed: the red-team findings source must be attached or linked privately — it was not found in the repository at the time of filing
• Every finding mapped to: control, owner, severity, status, and the test that proves it (findings/controls register kept private if it contains exploit detail)
• Critical/high findings have a mitigation merged or an explicit, dated risk acceptance
• Controls cross-referenced to the security baseline (7 in this series) and the approval policy (Implement approval-policy evaluation and human-gate workflow #321)
• Public issues describe the class of weakness only, never a working exploit

Dependencies

• Red-team findings document (human to provide)
• Implement approval-policy evaluation and human-gate workflow #321
• the security-baseline item (7 in this series)

Risk

High — unresolved findings are known, documented attack paths.

Test evidence required

• For each mitigated finding: a regression test or a reproducible verification step showing the attack no longer works
• Register export showing no untriaged findings

Definition of done

• 100% of findings triaged; all critical/high mitigated or formally accepted
• Register reviewed by a human and linked (privately if needed)
• Evidence URL and Correlation ID recorded on the project item