Security policy identifies Mneme as Dioptron

[forkwright]

Finding

Mneme's public security policy says “Dioptron is in the design phase.” The identity-bearing vulnerability-reporting surface was copied without substituting the repository's product name.

Evidence

SECURITY.md:9-12 names Dioptron. Pinax carried the identical copied sentence and now tracks that instance in forkwright/pinax#2, confirming a scaffold substitution defect rather than an isolated typo.

Why this matters

Security reporters use this document to determine scope and trust that they have reached the intended project. A wrong product name makes the scope ambiguous and demonstrates that public policy artifacts can pass the repository's gate without being instance-correct.

Desired correction

Correct the Mneme instance and make project identity a required scaffold parameter from which SECURITY.md is generated or validated. Add a repo-identity gate that rejects unrelated fleet product names in identity-bearing files, and repair the canonical scaffold so future repositories cannot reproduce the defect.

[forkwright]

Instance fix in #5 (gated and stamped locally).

Checked the blast radius rather than assuming it: pulled SECURITY.md from every repo in fleet-repos.toml and searched each for a fleet product name other than its own. Four hits — pinax→dioptron and mneme→dioptron are real (byte-identical copies of dioptron's file); heurema→kanon and theatron→kanon are legitimate references to kanon as tooling, not identity claims. So this class is exactly the two repos already tracked, and nothing else inherited it.

The prevention half both issues ask for — a gate rejecting unrelated fleet product names in identity-bearing files — is filed as forkwright/kanon#2704, with the discriminator that matters: subject position, not substring presence. A bare "any foreign name" match would fire on heurema and theatron and be wrong, and #2704 records the fixture needed to prove the rule can be silent on those while firing on this text.

Leaving this open until both #5 and the kanon rule land.

[forkwright]

Instance fix merged (#5). Verified on main: SECURITY.md now names this repo. Leaving open only for the prevention half, forkwright/kanon#2704.

[forkwright]

Already fixed — closing with the verification.

SECURITY.md on current main reads:

Scope

Mneme is in the design phase. No implementation code has landed.

grep -n Dioptron SECURITY.md returns nothing. Landed as docs(security): name Mneme in its own security policy (#5).

The scaffold half of the desired correction — making project identity a required scaffold parameter, and adding a repo-identity gate that rejects unrelated fleet product names in identity-bearing files — is a change to kanon's scaffold, not to this repo, so it is not closed by this. Worth noting that the reason the copy survived is now addressed from a different direction: #6 points this repo's gate at kanon lint . instead of a two-file sample, so identity-bearing files are at least inside the checked set. A rule that actually knows fleet product names would still be the stronger fix, and belongs in basanos.