Omar SobhandClaude Opus 4.7
565f6cae65
Two things land together:
1. Ships the 5 workflow recipes as TOML files under
templates/workflows/*.toml:
- research_only (hub_spoke research → MD + PDF)
- research_and_code (research → coding loop until INT-XX drained)
- security_hardening (scan → research patches → coding with
reviewer approval + full MCP bundle)
- refactor (single-pass coding with dep audit
preamble + before/after benchmarks)
- benchmark (author + baseline benchmarks per stack)
Each declares phases[], per-phase config, default_team_template.
Loaded read-only into an in-memory registry (workflow_registry)
via OnceLock — no DB row per recipe.
2. Ships the mission-launch orchestrator that closes the loop from
Slice 3.5d's mechanics. When a mission transitions draft→running,
`mission_orchestrator::on_launch`:
- Reads mission.team_template_id (skips if unset)
- Loads the team template detail (roles + skills bindings)
- Builds a topology graph from role slots via cm_topology::build
- Inserts the teams row + stamps template_id/version/risk_profile/mcp_bundles
- For each role: agent insert, model binding, runtime provision
(opt-in via RuntimeProvisioner::from_env), brain_seed::ingest
(Slice 3.5d), agent_template_link::upsert (Slice 3.5d),
team_members bind, audit trail
- UPDATE missions SET team_id = ...
Wired into routes::missions::set_status when prior.status='draft'
and new='running'. Failures log + are non-fatal (mission still
flips to running so the user can inspect + retry).
With this, Slice 3.5d's brain-seed + link machinery actually gets
populated, and the MCP skills server's template-defaults-merge path
(Slice 3.5b/d) starts serving real bindings to real agents.
Follow-ups (Slice 5-8):
- Task-card parser watches run events for TASK/COMPLETED markers
→ mission_tasks rows
- PDF renderer worker turns MD artifacts into PDFs
- Before/after benchmark runner honors phases[].config.benchmark
- Security scan MCP bundle exposes cargo-audit/gitleaks/trivy/semgrep
- Level-up endpoints diff learned-vs-seeded via agent_template_link
Co-Authored-By: Claude Opus 4.7 <[email protected]>
35 lines
1.1 KiB
TOML
35 lines
1.1 KiB
TOML
key = "security_hardening"
|
|
title = "Security Hardening"
|
|
blurb = "Scan the repo for vulnerabilities, research patches, then apply + verify."
|
|
requires_repo = true
|
|
|
|
[[phases]]
|
|
kind = "security_scan"
|
|
order_idx = 0
|
|
[phases.config]
|
|
# Slice 8 wires these tools as an MCP bundle. Each finding becomes
|
|
# a mission_task with external_id = CVE/RUSTSEC/gitleaks fingerprint.
|
|
tools = ["cargo_audit", "gitleaks", "trivy_fs", "semgrep"]
|
|
|
|
[[phases]]
|
|
kind = "research"
|
|
order_idx = 1
|
|
[phases.config]
|
|
produces = ["md", "pdf"]
|
|
default_topology = "hub_spoke"
|
|
# The research phase reads the security_scan phase's findings from
|
|
# mission_tasks and produces a patch strategy per finding.
|
|
input_from_phase = "security_scan"
|
|
|
|
[[phases]]
|
|
kind = "coding"
|
|
order_idx = 2
|
|
[phases.config]
|
|
loop = "until_all_findings_closed"
|
|
task_preamble = "workspace_repo_v1"
|
|
# Security requires reviewer approval on top of green tests.
|
|
commit_policy = "on_reviewer_approval"
|
|
mcp_bundles = ["clawmates_door", "clawmates_skills", "gitea_forge", "security_scan"]
|
|
|
|
default_team_template = "rust_sdlc"
|