chore(work): tick task in 09-ci-security-guide-and-docs

docs/work/2026-05-14-ci-security-and-supply-chain/09-ci-security-guide-and-docs/_story.md

@@ -3,7 +3,7 @@ id: 09-ci-security-guide-and-docs
 epic: 2026-05-14-ci-security-and-supply-chain
 title: CI security guide + CLAUDE.md
 type: technical-story
-status: todo
+status: in-progress
 feature: docs
 depends-on:
   [
@@ -54,5 +54,5 @@ Each prior story lands a machine-enforced layer, but no single document explains
 
 ## Tasks
 
-- [ ] Write `docs/guides/ci-security.md` with: four-pillar overview, per-pillar sections, failure-mode hierarchy table (ADR-023 §5), consumer-toggleable settings list, Socket GitHub App + gitleaks install instructions, CodeQL note for private repos, two worked examples (passing minor-bump PR; blocked major-bump PR + hard-divergence revalidation issue); one commit, all gates pass.
+- [x] Write `docs/guides/ci-security.md` with: four-pillar overview, per-pillar sections, failure-mode hierarchy table (ADR-023 §5), consumer-toggleable settings list, Socket GitHub App + gitleaks install instructions, CodeQL note for private repos, two worked examples (passing minor-bump PR; blocked major-bump PR + hard-divergence revalidation issue); one commit, all gates pass.
 - [ ] Add CI security Key Conventions bullet to `CLAUDE.md` referencing ADR-023 + `docs/guides/ci-security.md`; one commit, all gates pass.

docs/work/_state.json

@@ -1,5 +1,5 @@
 {
-  "updated_at": "2026-05-14T18:05:18.377Z",
+  "updated_at": "2026-05-14T18:14:57.902Z",
   "epics": {
     "2026-05-13-binder-wrap-helper": {
       "status": "done",
@@ -133,10 +133,10 @@
           ]
         },
         "09-ci-security-guide-and-docs": {
-          "status": "todo",
+          "status": "in-progress",
           "title": "CI security guide + CLAUDE.md",
           "ac_total": 2,
-          "ac_completed": 0,
+          "ac_completed": 1,
           "depends_on": [],
           "blocks": []
         }