From 9aa590c14b9789c4c68a74bed08a74fd41ec68d8 Mon Sep 17 00:00:00 2001
From: 4 Bytes Robby <robby@4bytes.de>
Date: Sun, 7 Jun 2026 13:12:53 +0200
Subject: [PATCH 1/3] docs: mark A7 gatekeeping as complete #87

---
 ROADMAP.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 844b31f..1e2aa7f 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -305,4 +305,4 @@ Per P48 — Open Source Github Review Automation: CI, linters, and tests are alr
 
 | Wave | Status | Issue |
 |------|--------|-------|
-| A7 | 🔄 In Progress | — |
+| A7 | ✅ Done | #87 |

From bcd8b975953eb63d525eebe55945e5db51b56cb5 Mon Sep 17 00:00:00 2001
From: 4 Bytes Robby <robby@4bytes.de>
Date: Sun, 7 Jun 2026 13:16:08 +0200
Subject: [PATCH 2/3] =?UTF-8?q?docs:=20check=20off=20A7=20AC=20=E2=80=94?=
 =?UTF-8?q?=20all=20gatekeeping=20criteria=20now=20met=20#87?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ROADMAP.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 1e2aa7f..e72bae2 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -296,10 +296,10 @@ Per P48 — Open Source Github Review Automation: CI, linters, and tests are alr
 - Require: conversation resolution before merge
 
 ### Acceptance Criteria (A7)
-- [ ] CI workflow runs on every PR (build + test)
-- [ ] cubic AI reviewer installed and active
-- [ ] Branch protection enforces both CI + AI review
-- [ ] No PR merges without passing gates
+- [x] CI workflow runs on every PR (build + test)
+- [x] cubic AI reviewer installed and active
+- [x] Branch protection enforces both CI + AI review
+- [x] No PR merges without passing gates
 
 ### Status
 

From d989296e133a14850a632d85b82c67aab3833991 Mon Sep 17 00:00:00 2001
From: 4 Bytes Robby <robby@4bytes.de>
Date: Sun, 7 Jun 2026 13:26:03 +0200
Subject: [PATCH 3/3] feat: add CodeQL security analysis workflow

---
 .github/workflows/codeql.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..b00e8c7
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,22 @@
+name: CodeQL
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+  push:
+    branches: [main]
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+
+      - uses: github/codeql-action/analyze@v3