[twistedmelonman]

What changes

Code Security is not bought, by decision (Andrew, 2026-10-21). Semgrep CE, through the reusable semgrep-scan.yml workflow in smartwatermelon/github-workflows, is the substitute. The digest's CodeQL section now shows which private repos without Code Security have a Semgrep caller.

standards.sh

For a repo in the no-code-security state, the survey reads .github/workflows/semgrep-scan.yml through the contents API and records codeql.substitute:

• semgrep: the file decodes, and a job-level or step-level uses: line points at smartwatermelon/github-workflows/.github/workflows/semgrep-scan.yml@. A commented-out reference does not count.
• none: an HTTP 404 with a 404 body. Also none: the file exists but does not call the reusable workflow. In that case substituteDetail says so. The brief named three states and did not cover this case. I put it in the "no Semgrep caller" list and kept it visible, never in the covered list.
• unreadable: any other failure (403, 5xx, a non-file response, an encoding other than base64, a decode failure), with its reason. A failed read is never none.

render.sh

The no-Code-Security list splits into three sub-lists under "Without paid Code Security":

• "Covered by Semgrep (CodeQL substitute)"
• "No code scanning: paid Code Security not bought, no Semgrep caller"
• "Semgrep coverage unreadable"

A record without a substitute field (from an older survey) or with an unknown value goes to the unreadable list, never to the covered list. The summary line counts each bucket. The "open cost decision" sentence is replaced. "No gaps" still requires zero repos without Code Security, so Semgrep coverage alone never prints "No gaps".

Tests

• The gh stub in test-standards.sh gains a .404.json convention that matches real gh output (captured 2026-10-21), plus unset -f gh as in dev-env#215.
• New fixtures cover semgrep, none (404), none (commented-out caller), unreadable (403), and unreadable (encoding none).
• fixtures/codeql-semgrep.ndjson adds render cases for all three states, a record with no substitute field, and a record with an unknown value.
• Known-bad proof: every new assertion fails against the origin/main scripts. Three mutations are each caught: a failed read treated as none, a plain substring match instead of a uses: line, and a missing field rendered as covered.

docs/STATUS.md records the decision and the Semgrep pilot on nightowlstudiollc/reliquarist. Its check fails on new findings but is not required. Code Security also leaves the "Open decisions" line.

Advances #166