docs: move security contract to CLAUDE.md

Add a Security contract section to CLAUDE.md so it's a standing
invariant Claude always sees, not text buried in TODO.md. Fix
dangling SECURITY.md links in ADR-0001/0003/0004 (that file never
existed) to point at CLAUDE.md instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: dfa1

CLAUDE.md

@@ -184,6 +184,15 @@ if (cap == n) {                                  // fast path: zero modulos, vec
 Profile with JFR (`-prof stack:lines=10`); `idiv`/`sdiv`/arithmetic helpers as the hot frame is
 almost always this.
 
+## Security contract
+
+The reader memory-maps and parses untrusted binary input. Every malformed input must throw
+`VortexException`, never `ArrayIndexOutOfBoundsException`, `NegativeArraySizeException`,
+`OutOfMemoryError`, `StackOverflowError`, a raw FlatBuffer runtime exception, or a Protobuf parser
+exception. See [TODO.md §Security](TODO.md) for the current gap list (per-encoding adversarial
+tests, resource caps, fuzz infra) and [ADR 0003](adr/0003-vortex-exception-sanitization.md) /
+[ADR 0004](adr/0004-resource-caps-read-options.md) for the design.
+
 ## Reference implementation
 
 When stuck on encode/decode behavior, consult **in this order**:

TODO.md

@@ -15,10 +15,8 @@
 
 ## Security
 
-**Contract:** the reader memory-maps and parses untrusted binary input. Every malformed input must
-throw `VortexException`, never `ArrayIndexOutOfBoundsException`, `NegativeArraySizeException`,
-`OutOfMemoryError`, `StackOverflowError`, a raw FlatBuffer runtime exception, or a Protobuf
-parser exception. Each entry below is either a known gap, a contract audit, or supporting infra.
+See [CLAUDE.md §Security contract](CLAUDE.md) for the invariant. Each entry below is either a
+known gap, a contract audit, or supporting infra.
 
 ### Per-encoding adversarial tests
 

adr/0001-split-read-and-write-runtimes.md

@@ -264,8 +264,8 @@ of CI / integration-test fallout, plus reviewer time. Not a weekend.
 ### Positive
 
 - **Public API never exposes raw `MemorySegment`** for the read path.
-  `VortexHandle.slice` disappears from the public surface. The SECURITY.md
-  contract is enforced architecturally, not by audit-trail convention.
+  `VortexHandle.slice` disappears from the public surface. The CLAUDE.md
+  §Security contract is enforced architecturally, not by audit-trail convention.
 - **PR #27's 33 `unwrapForSubParser` sites collapse to a handful** —
   only the decoders that genuinely call a sub-parser
   (`ProtoReader`-bound decoders: Constant, Pco, Sparse, plus Zstd's
@@ -353,6 +353,6 @@ of CI / integration-test fallout, plus reviewer time. Not a weekend.
 
 - [PR #27 — `sec(parser): BoundedSegment + audit trail for untrusted asSlice`](https://github.com/dfa1/vortex-java/pull/27)
 - [Phase 1–4 commits — BoundedSegment introduction and migration](https://github.com/dfa1/vortex-java/pull/27/commits)
-- [SECURITY.md — the contract this work hardens](../SECURITY.md)
+- [CLAUDE.md §Security contract](../CLAUDE.md)
 - [CLAUDE.md — current "three touch-points" rule for adding an encoding](../CLAUDE.md)
 - [TODO.md — parser hardening backlog](../TODO.md)

adr/0003-vortex-exception-sanitization.md

@@ -5,7 +5,7 @@
 - **Deciders:** project maintainer
 - **Related:** [ADR 0001 — Split read and write runtimes](0001-split-read-and-write-runtimes.md),
   [ADR 0004 — Resource caps and `ReadOptions`](0004-resource-caps-read-options.md),
-  [SECURITY.md](../SECURITY.md)
+  [CLAUDE.md §Security contract](../CLAUDE.md)
 
 ## Context
 
@@ -45,7 +45,7 @@ no sanitization contract.
 
 Message sanitization governs *what a `VortexException` says*. A separate,
 orthogonal gap governs *whether a `VortexException` is thrown at all*. The
-reader's contract (SECURITY.md) is: any malformed input throws
+reader's contract (CLAUDE.md §Security contract) is: any malformed input throws
 `VortexException`, never a raw JDK exception. But ~21 `MemorySegment.asSlice`
 call sites take offsets/lengths straight from untrusted layout/footer
 metadata and pass them to the JDK unguarded:
@@ -415,7 +415,7 @@ programmatically inspect exception types, this decision can be revisited.
 
 ## References
 
-- [SECURITY.md — injection threat model](../SECURITY.md)
+- [CLAUDE.md §Security contract](../CLAUDE.md)
 - [PR #27 — `BoundedSegment` + audit trail for untrusted `asSlice`](https://github.com/dfa1/vortex-java/pull/27)
 - [ADR 0001 — Split read and write runtimes](0001-split-read-and-write-runtimes.md)
-- [TODO.md §"Error messages — structural sanitization"](../TODO.md)
+- [TODO.md §"`VortexException` message sanitization"](../TODO.md)

adr/0004-resource-caps-read-options.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted — implementation pending
 - **Date:** 2026-06-13
 - **Deciders:** project maintainer
-- **Related:** [SECURITY.md](../SECURITY.md), [TODO.md §Resource caps](../TODO.md)
+- **Related:** [CLAUDE.md §Security contract](../CLAUDE.md), [TODO.md §Resource caps](../TODO.md)
 
 ## Context
 
@@ -170,6 +170,6 @@ a user-facing query limit, not a security cap.
 
 ## References
 
-- [SECURITY.md — zip-bomb and depth-bomb mitigations](../SECURITY.md)
+- [CLAUDE.md §Security contract](../CLAUDE.md)
 - [TODO.md §Resource caps](../TODO.md)
 - [ADR 0003 — VortexException sanitization](0003-vortex-exception-sanitization.md)