yak(sobelow-in-the-lens-pass-vr40): sobelow in the Lens pass

app/Makefile

@@ -3,7 +3,7 @@
 MISE_BIN ?= mise
 MISE_EXEC = $(MISE_BIN) exec --
 
-.PHONY: check precommit deps assets compile test test.coverage coverage crap format format.check credo verify
+.PHONY: check precommit deps assets compile test test.coverage sobelow coverage crap format format.check credo verify
 
 # Run all static analysis checks (no database required). `format.check` only
 # reports: a gate that rewrites the files it judges can never fail. Fix
@@ -159,6 +159,10 @@ credo:
 # VERIFY_SENSORS — that variable is the single source of truth for what this
 # target reports as wired.
 #   - sobelow    (yak: sobelow in the Lens pass)
+#                  WIRED below (sobelow, ~1s). Fails loudly on findings and
+#                  when the task is missing — no fallback of any kind.
+#                  Per-finding skips exist only in .sobelow-skips, each with a
+#                  written rationale (pinned by scripts/check-lens-sensors.sh).
 #   - coverage   (yak: coverage floors + framework-glue exclusions policy)
 #                  WIRED below (test.coverage + coverage).
 #   - crap       (yak: CRAP scores with ex_crap (both apps))
@@ -171,7 +175,17 @@ credo:
 #
 # The suite runs FIRST, because it is what produces the coverage export the
 # sensors read; sensors still run cheapest-first among themselves.
-VERIFY_SENSORS := coverage crap
+VERIFY_SENSORS := sobelow coverage crap
+
+# Sobelow security scan. `--exit` is load-bearing: without it sobelow prints
+# findings and exits 0 (verified 2026-10-28, sobelow 0.17.0: 3 findings -> 0,
+# `--exit` -> 1; it defaults to the `low` confidence threshold). `--skip`
+# applies only the individually rationalised entries in .sobelow-skips.
+# There is deliberately no guard or fallback: if the dep is absent, `mix
+# sobelow` is a hard Mix error ("The task could not be found") and the
+# verify loop's `|| exit 1` fails the pass.
+sobelow:
+	$(MISE_EXEC) mix sobelow --skip --exit
 
 verify:
 	@echo "==> verify(app): suite (coverage exported), then sensors [$(VERIFY_SENSORS)]"