docs: add nosec disposition and invariant pointer

[devin-ai-integration]

Pull Request Description

Summary

Adds the requested hygiene gate work before any # nosec removals:

• Records the complete # nosec audit in nosec_disposition.md with one row per occurrence found in scope, plus the single additional test-suite occurrence needed for the acceptance criterion.
• Keeps all existing # nosec suppressions intact pending disposition review.
• Makes root INVARIANTS.md canonical and replaces .github/INVARIANTS.md with a 3-line pointer.
• Updates the consistency check and tests so CI fails if .github/INVARIANTS.md becomes a divergent duplicate again.
• Adds the missing v* tag trigger to acvp_validation.yml, matching security.yml release-tag behavior.
• Added no-code rerun commits after macOS POST timing samples failed on unrelated FIPS self-test code; no functional code changed in those rerun commits. Recent main (25296298536) and PR ci: Bump github/codeql-action from 4.35.2 to 4.35.4 #293 (75341760035) show the same macOS 3.10 job can pass on this code path.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Security fix (addresses a security vulnerability)
• Performance improvement (improves performance without changing functionality)
• Documentation update (changes to documentation only)
• Code refactoring (improves code quality without changing functionality)
• Test enhancement (adds or improves tests)
• Dependency update (updates dependencies)

Related Issues

Relates to v3.1.0 nosec hygiene audit.

Motivation and Context

Why is this change required?

The v3.1.0 hygiene pass requires a reviewed # nosec disposition table before suppressions are removed, and the duplicated invariants documents had identical content that could drift silently.

What problem does it solve?

This creates the review artifact for subsequent per-file remediation PRs and preserves a single canonical invariants document while retaining the .github/INVARIANTS.md path as a pointer.

Cryptographic Impact

Security Impact Assessment

• No cryptographic security impact
• Adds new cryptographic primitive (requires extensive review)
• Modifies existing cryptographic operation (requires security analysis)
• Changes key management approach
• Affects multiple security layers
• Performance optimization only (no security changes)

Standards Compliance

• NIST FIPS 202 (SHA-3)
• NIST FIPS 204 (Dilithium)
• NIST SP 800-108 (Key Derivation)
• RFC 2104 (HMAC)
• RFC 5869 (HKDF)
• RFC 8032 (Ed25519)
• RFC 3161 (Timestamps)
• No standards affected

Academic References

N/A — no cryptographic construction changed.

Security Analysis

Classical Security: No primitive, key-management, KAT, or constant-time implementation changes.

Quantum Security: No PQC implementation changes.

Security Impact: Maintains current posture; adds audit documentation and CI guardrails.

Implementation Details

Changes Made

1. Added nosec_disposition.md covering every # nosec found in ama_cryptography/, tools/, benchmarks/, examples/, plus the repo-wide test fixture occurrence.
2. Replaced .github/INVARIANTS.md with a 3-line pointer to root INVARIANTS.md.
3. Updated tools/check_version_consistency.py and tests to enforce the pointer and root canonical document.
4. Added tags: ['v*'] to acvp_validation.yml so future release tags trigger ACVP validation.

Technical Approach

Keep this PR limited to review artifacts, docs pointer cleanup, and CI guardrails. No public API, C source, constant-time function, KAT vector, or build-system floor was changed.

Breaking Changes

Breaking Changes:

• None
• Yes (describe below)

Migration Path:
N/A.

Testing

Test Coverage

• Unit tests added/updated
• Integration tests added/updated
• Test coverage maintained or improved
• All tests pass locally

Testing Performed

Environment:

• Python version(s): local venv default
• Operating System: Ubuntu
• PQC backend: [ ] Native C library [x] None for targeted docs/tool tests

Test Cases:

1. python tools/check_version_consistency.py
2. pytest tests/test_version_consistency.py tests/test_invariant_upgrades.py -q

Known Test Vectors

• Tested against official NIST test vectors
• Tested against IETF RFC test vectors
• No official test vectors available

Code Quality

Code Quality Checks

• Code follows PEP 8 style guidelines
• All functions have type hints
• All functions have comprehensive docstrings
• No security warnings from linters (Bandit, etc.)
• Black formatting applied (black .)
• Ruff linting passed (ruff check .)
• Type checking passed (mypy ama_cryptography/)

Documentation Updates

• README.md updated
• SECURITY.md updated (if security affected)
• IMPLEMENTATION_GUIDE.md updated (if deployment affected)
• CHANGELOG.md updated
• Inline code comments added for complex logic
• Docstrings include academic citations (if applicable)

Backwards Compatibility

Compatibility Assessment

• Fully backwards compatible
• Backwards compatible with deprecation warnings
• Breaking changes with migration path
• Major version bump required

Deprecation Notices

Deprecated Features:

• None

Deprecation Timeline:

• N/A

Performance Impact

Performance Analysis

Benchmarks:
N/A.

Impact:

• No performance impact
• Performance improvement
• Slight performance degradation
• Significant performance impact

Release Notes

No version bump. Source remains v3.1.0.

Link to Devin session: https://app.devin.ai/sessions/380c3bcb95034d1f83fb66062f20e8cf
Requested by: @Steel-SecAdv-LLC

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

Closing as superseded by merged PR #301. The nosec disposition, INVARIANTS pointer, ACVP tag trigger, and related guardrails are already present on main via #301.