key         = "security_hardening"
title       = "Security Hardening"
blurb       = "Scan the repo for vulnerabilities, research patches, then apply + verify."
requires_repo = true

[[phases]]
kind      = "security_scan"
order_idx = 0
[phases.config]
# Slice 8 wires these tools as an MCP bundle. Each finding becomes
# a mission_task with external_id = CVE/RUSTSEC/gitleaks fingerprint.
tools = ["cargo_audit", "gitleaks", "trivy_fs", "semgrep"]

[[phases]]
kind      = "research"
order_idx = 1
[phases.config]
produces          = ["md", "pdf"]
default_topology  = "hub_spoke"
# The research phase reads the security_scan phase's findings from
# mission_tasks and produces a patch strategy per finding.
input_from_phase  = "security_scan"

[[phases]]
kind      = "coding"
order_idx = 2
[phases.config]
loop            = "until_all_findings_closed"
# Security requires reviewer approval on top of green tests.
commit_policy   = "on_reviewer_approval"
mcp_bundles     = ["clawmates_door", "clawmates_skills", "gitea_forge", "security_scan"]

default_team_template = "rust_sdlc"