From ef32c8e9ee0933ca06cbc8a7c9ce1d8cea279942 Mon Sep 17 00:00:00 2001
From: Jeffrey Montoya <montjeffrey@gmail.com>
Date: Wed, 30 Sep 2026 11:36:10 -0400
Subject: [PATCH] docs(security): refresh GateGuard evidence for the latency
 changes

---
 .../security/evidence/gateguard-fact-force-agentshield.md | 2 +-
 .../evidence/gateguard-fact-force-agentshield.sarif       | 8 ++++----
 docs/security/evidence/gateguard-fact-force.md            | 8 ++++----
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/docs/security/evidence/gateguard-fact-force-agentshield.md b/docs/security/evidence/gateguard-fact-force-agentshield.md
index 9f752d930..273eef768 100644
--- a/docs/security/evidence/gateguard-fact-force-agentshield.md
+++ b/docs/security/evidence/gateguard-fact-force-agentshield.md
@@ -42,7 +42,7 @@ Baseline comparison against `main`:
 - The gate reports one new and one resolved `info` finding. It is the same
   finding, "Hook code reads Claude transcript input" in
   `scripts/hooks/gateguard-fact-force.js`, on the same unchanged source line,
-  which moved from line 1356 to 1393. AgentShield puts the line number in the
+  which moved from line 1356 to 1418. AgentShield puts the line number in the
   finding id and the id in its baseline fingerprint, so a moved line counts
   as new. Because the gate allows no new findings, it exits `3` on this line
   shift alone.
diff --git a/docs/security/evidence/gateguard-fact-force-agentshield.sarif b/docs/security/evidence/gateguard-fact-force-agentshield.sarif
index f84f228f3..7b5050f51 100644
--- a/docs/security/evidence/gateguard-fact-force-agentshield.sarif
+++ b/docs/security/evidence/gateguard-fact-force-agentshield.sarif
@@ -144,7 +144,7 @@
               }
             },
             {
-              "id": "hooks-code-transcript-access-1393",
+              "id": "hooks-code-transcript-access-1418",
               "name": "Hook code reads Claude transcript input",
               "shortDescription": {
                 "text": "Hook code reads Claude transcript input"
@@ -341,7 +341,7 @@
       "invocations": [
         {
           "executionSuccessful": true,
-          "endTimeUtc": "2026-09-30T03:29:39.393Z",
+          "endTimeUtc": "2026-09-30T15:35:58.877Z",
           "workingDirectory": {
             "uri": "<target-path>"
           }
@@ -1144,7 +1144,7 @@
           }
         },
         {
-          "ruleId": "hooks-code-transcript-access-1393",
+          "ruleId": "hooks-code-transcript-access-1418",
           "ruleIndex": 5,
           "level": "note",
           "message": {
@@ -1157,7 +1157,7 @@
                   "uri": "scripts/hooks/gateguard-fact-force.js"
                 },
                 "region": {
-                  "startLine": 1393
+                  "startLine": 1418
                 }
               }
             }
diff --git a/docs/security/evidence/gateguard-fact-force.md b/docs/security/evidence/gateguard-fact-force.md
index 9a42cf649..440aac2c4 100644
--- a/docs/security/evidence/gateguard-fact-force.md
+++ b/docs/security/evidence/gateguard-fact-force.md
@@ -71,16 +71,16 @@ bypasses as SARIF errors. They are:
 
 | Suite | this branch | `main` |
 | --- | --- | --- |
-| `tests/hooks/gateguard-fact-force.test.js` | 1010 passed, 0 failed | 704 passed, 0 failed |
+| `tests/hooks/gateguard-fact-force.test.js` | 1018 passed, 0 failed | 704 passed, 0 failed |
 | `tests/hooks/gateguard-scenarios.test.js` | 25 passed, 0 failed | — |
 | `tests/lib/gateguard-target-class.test.js` | 30 passed, 0 failed | — |
 | `tests/lib/gateguard-readonly-shell.test.js` | 18 passed, 0 failed | — |
 | `tests/lib/gateguard-change-profile.test.js` | 47 passed, 0 failed | — |
-| `tests/lib/gateguard-code-lexer.test.js` | 11 passed, 0 failed | — |
+| `tests/lib/gateguard-code-lexer.test.js` | 15 passed, 0 failed | — |
 | `tests/lib/gateguard-file-context.test.js` | 7 passed, 0 failed | — |
 | `tests/lib/gateguard-search-filters.test.js` | 10 passed, 0 failed | — |
-| `tests/lib/gateguard-turn-scan.test.js` | 16 passed, 0 failed | — |
-| `tests/scripts/gateguard-eval.test.js` | 12 passed, 0 failed | — |
+| `tests/lib/gateguard-turn-scan.test.js` | 17 passed, 0 failed | — |
+| `tests/scripts/gateguard-eval.test.js` | 15 passed, 0 failed | — |
 
 ## Repository gates