dagoste/squadra is a tool that orchestrates Claude, Codex, and Cursor into a single workflow. The November 6, 2026 commit 0e56ba3 changed how this repository runs its skill security scan. It strips out the scanner's own failure option `--fail-on-severity high` at the scan stage and moves the judgment that blocks HIGH and above into a new script, tools/cisco_gate.py. This commit adds 93 lines and deletes 4 lines.
The reason for the move is the scanner's cross-file rule. That rule declares a CRITICAL-level exfiltration whenever a repository that reads environment variables also uses Python sockets. After 3.14.0, the only socket use remaining in the code is local_bind_available in scripts/runtime.py, and that function merely binds a socket to port 0 on 127.0.0.1 and then closes it; it does not open a connection or send any data. The scanner policy cannot lower this rule through regrading, and because it violates the rule's own contract, a suppression does not apply either. The solution of putting a gate in front was to declare the exception once, outside that policy.
The new gate blocks only the HIGH and CRITICAL grades. The only things accepted as exceptions are the two rules (BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION, BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN), and they pass only when the evidence for that item contains exactly one network file, scripts/runtime.py. If any other network file is mixed in, that rule is blocked again. Excepted items are not erased from the scan report either but remain there as they are, and the gate splits the passing ones as 'EXCEPTED' and the blocked ones as 'BLOCKING'. This behavior is pinned by three tests added to tests/test_cisco_gate.py: single-file pass, re-blocking when another network file is present, and continued blocking for other HIGH rules and for missing evidence.
That said, this change does not fix the scanner's grades but declares an exception inside CI, so the report alone still shows two CRITICAL items remaining. What actually decides pass or fail is tools/cisco_gate.py. The exception condition is tied to a single hardcoded file path, so if the same kind of socket use enters through a different path, the rule reverts to CRITICAL as before. The scan scope is the committed repository minus tests/, and the new test file lies outside that scope. This commit only ships unit tests that verify the behavior, and includes no performance measurement or external validation results.