docs: consolidate dual roadmaps into ROADMAP.md

.github/workflows/ci.yml

@@ -31,10 +31,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -52,10 +52,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -66,7 +66,6 @@ jobs:
 
       - name: Run mypy
         run: mypy src/redops --ignore-missing-imports
-        continue-on-error: true
 
   test:
     name: Test (Python ${{ matrix.python-version }})
@@ -78,15 +77,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Cache pip
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-${{ matrix.python-version }}-${{ hashFiles('pyproject.toml') }}
@@ -154,10 +153,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -173,18 +172,17 @@ jobs:
           REDIS_PORT: 6379
         run: |
           python -m pytest tests/integration/ -v --tb=short
-        continue-on-error: true
 
   build:
     name: Build Package
     runs-on: ubuntu-latest
     needs: [test]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -209,7 +207,7 @@ jobs:
     needs: [lint]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4

.github/workflows/codeql.yml

@@ -25,10 +25,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
         with:
           python-version: "3.12"
 

.github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           fetch-depth: 0
 
@@ -30,7 +30,7 @@ jobs:
         run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
         with:
           python-version: "3.12"
 
@@ -64,10 +64,10 @@ jobs:
     if: "!contains(github.ref, 'alpha') && !contains(github.ref, 'beta')"
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
         with:
           python-version: "3.12"
 
@@ -81,15 +81,14 @@ jobs:
         with:
           password: ${{ secrets.PYPI_API_TOKEN }}
           skip-existing: true
-        continue-on-error: true
 
   publish-docker:
     name: Publish Docker Image
     runs-on: ubuntu-latest
     needs: [release]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4

.github/workflows/secret-scan.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           fetch-depth: 0
 

.github/workflows/security.yml

@@ -21,10 +21,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
         with:
           python-version: "3.12"
 
@@ -36,21 +36,19 @@ jobs:
 
       - name: Run Safety check
         run: safety check --full-report
-        continue-on-error: true
 
       - name: Run pip-audit
         run: pip-audit
-        continue-on-error: true
 
   semgrep:
     name: Semgrep Analysis
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
         with:
           python-version: "3.12"
 
@@ -84,7 +82,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Build Docker image
         run: |
@@ -119,7 +117,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           fetch-depth: 0
 
@@ -136,10 +134,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
         with:
           python-version: "3.12"
 

.gitignore

@@ -57,3 +57,15 @@ temp/
 .env
 .env.*
 .env.local
+
+# Security: prevent secret files from being committed
+.env
+.env.local
+.envrc
+*.pem
+*.key
+id_rsa*
+id_ecdsa*
+id_ed25519*
+*.p12
+secrets.json

README.md

@@ -1,3 +1,10 @@
+> **STATUS: FROZEN as of 2026-06-22**  
+> This repository is no longer actively developed. See [AreteDriver/notes/decisions/2026-04-21-portfolio-triage.md](https://github.com/AreteDriver/notes/blob/main/decisions/2026-04-21-portfolio-triage.md) for context.  
+> Archived for reference. No new deploys or feature work.
+>
+> ---
+>
+
 # RedOPS Framework
 
 [![CI Pipeline](https://github.com/AreteDriver/RedOPS/actions/workflows/ci.yml/badge.svg)](https://github.com/AreteDriver/RedOPS/actions/workflows/ci.yml)

ROADMAP.md

@@ -14,6 +14,22 @@
 
 ---
 
+## Priority 0 — Gate (blocks any offensive Active Chain release)
+
+> Folded in from the qwen-audited roadmap (2026-05-30). The Active Chain — wireless
+> evil-twin + deauth, subnet recon, CVE check, and an autonomous Ollama agent under
+> `modules/active/` + `modules/ai/` — is coded, tested, and committed, but **unreleased
+> and undocumented**. It must not ship until this gate clears. Authorization is a review,
+> not a code flag.
+
+- [ ] **Legal-boundary review** — `docs/legal-boundaries.md` + SECURITY.md: jurisdiction, authorized-use definition, explicit will/won't-do list for deauth + evil-twin.
+- [ ] **Authorization mechanism** — scope assertion + recorded operator consent that every `modules/active/` module checks before executing (not just a flag). Add a test asserting each active module refuses to run absent an authorized-target assertion.
+- [ ] **Misuse threat model** — model RedOPS pointed at an unauthorized network; document the technical controls that make casual misuse hard.
+- [ ] **Tested egress enforcement** — a test that attempts cloud egress during an active-chain run and asserts it is blocked (local Ollama only). Enforced, not asserted.
+- [ ] **Operator runbook + smoke test** — mock authorized-engagement walkthrough; full-chain smoke test on lab hardware (Alfa AWUS036NHA + Kali) before tagging the release.
+
+---
+
 ## Priority 1 — Critical (Do Now)
 
 ### Security and Reliability

SECURITY.md

@@ -12,7 +12,8 @@
 If you discover a security vulnerability, please report it responsibly:
 
 1. **Do not** open a public issue
-2. Email **jamesyng79@gmail.com** with:
+2. Use GitHub **Private Vulnerability Reporting** (enabled on this repository)
+   or email **security@redops.dev** with:
    - Description of the vulnerability
    - Steps to reproduce
    - Potential impact
@@ -31,15 +32,39 @@ This project uses:
 
 RedOPS is an offensive security tool intended for **authorized security testing only**. The tool itself is designed to find vulnerabilities in target systems — security reports should focus on vulnerabilities in RedOPS's own code, not in its intended functionality.
 
+## Active Chain Authorization Requirements
+
+The **Active Chain** (`modules/active/`) — wireless deauthentication, evil-twin
+access points, ARP scanning, port scanning, and autonomous vulnerability chaining
+— is **gated** by the following requirements:
+
+1. **Recorded operator consent** is mandatory. Every active module calls
+   `assert_active_authorized(ctx)`, which raises `ActiveAuthorizationError`
+   if no valid authorization exists.
+2. **Explicit target assertion** is required. The operator must name the exact
+   target(s) they claim to own or have permission to test.
+3. **Egress blocking** is enforced. `block_external_egress()` prevents cloud API
+   calls during active chain execution, ensuring local-only operation.
+4. **Legal review** is required before any release containing active modules.
+   See `docs/legal-boundaries.md` for jurisdiction analysis and authorized-use
+   definition.
+5. **Operator runbook** must be followed. See `docs/operator-runbook.md` for
+   step-by-step authorized engagement procedures.
+
+Vulnerabilities in the authorization or egress enforcement mechanisms are
+**critical** and in scope for this security policy.
+
 ## Scope
 
 The following are in scope for security reports:
 - Code injection in RedOPS itself
 - Credential exposure or mishandling
 - Authentication bypasses in the web interface
 - Dependency vulnerabilities with known exploits
+- Bypass of `assert_active_authorized()` or `block_external_egress()`
+- Injection or mutation of audit log entries
 
 Out of scope:
 - Functionality that is working as designed (scanning, recon, etc.)
-- Denial of service
+- Denial of service against the target (by design for active modules)
 - Social engineering

config/pipelines/active_chain.json

@@ -8,6 +8,18 @@
     "warning": "Authorized home lab use only"
   },
   "steps": [
+    {
+      "name": "Record Authorization",
+      "module": "active.authorization.record_authorization_from_params",
+      "params": {
+        "operator": "{{operator}}",
+        "target_assertion": "{{target}}",
+        "consent_text": "I am authorized to perform active security testing on the stated target. This is my own network, a designated lab environment, or a system for which I have explicit written permission.",
+        "duration_hours": 4
+      },
+      "enabled": true,
+      "continue_on_error": false
+    },
     {
       "name": "Validate Scope",
       "module": "compliance.scope_guard.validate_scope",