Omar SobhandClaude Opus 5
285d0c82f2
Tier 0 of the prompt-ablation pass -- subtraction only, none of this
reached a model.
- cm-brain: drop ClawBrain::export_markdown (zero callers).
- workflows: drop the `task_preamble` keys. No Rust code ever read them --
WorkflowPhase.config is an opaque serde_json::Value -- so the comment
calling the preamble "the belt, the skill the suspenders" described a belt
that was never implemented. (`commit_policy` is unread for the same reason;
left in place as documentation pending a decision.)
- mcp_door: derive the unknown-tool error from EXPOSED_TOOLS. The literal had
drifted to naming one of the three tools the door exposes.
- Dashboard.tsx: drop TEAM_TEMPLATES/COMPANY_TEMPLATES, defined and never
referenced, and disconnected from the real templates/teams/*.toml.
The substantive one: GET /api/claws/{id}/compartments returned hardcoded
strings for tools/capabilities/safety, identical for every claw. Every card
read "Network: none" and "Shell . blocked" regardless of the claw's real
risk_profile -- which is the actual capability boundary, so the card was
most wrong exactly where it mattered, on a coding_readwrite claw that does
have shell. Now derived from the claw's effective risk_profile (its team's
setting, else the same role-derived default the provisioner applies), with
the allowlists mirroring [risk_profiles.*] in the runtime config.
Note: cm-topology/src/heuristics.rs was slated for deletion here as unused.
It is not -- routes/topology.rs:43 serves it and p0_endpoints.rs:302 asserts
it. Left alone.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
34 lines
1.1 KiB
TOML
34 lines
1.1 KiB
TOML
key = "security_hardening"
|
|
title = "Security Hardening"
|
|
blurb = "Scan the repo for vulnerabilities, research patches, then apply + verify."
|
|
requires_repo = true
|
|
|
|
[[phases]]
|
|
kind = "security_scan"
|
|
order_idx = 0
|
|
[phases.config]
|
|
# Slice 8 wires these tools as an MCP bundle. Each finding becomes
|
|
# a mission_task with external_id = CVE/RUSTSEC/gitleaks fingerprint.
|
|
tools = ["cargo_audit", "gitleaks", "trivy_fs", "semgrep"]
|
|
|
|
[[phases]]
|
|
kind = "research"
|
|
order_idx = 1
|
|
[phases.config]
|
|
produces = ["md", "pdf"]
|
|
default_topology = "hub_spoke"
|
|
# The research phase reads the security_scan phase's findings from
|
|
# mission_tasks and produces a patch strategy per finding.
|
|
input_from_phase = "security_scan"
|
|
|
|
[[phases]]
|
|
kind = "coding"
|
|
order_idx = 2
|
|
[phases.config]
|
|
loop = "until_all_findings_closed"
|
|
# Security requires reviewer approval on top of green tests.
|
|
commit_policy = "on_reviewer_approval"
|
|
mcp_bundles = ["clawmates_door", "clawmates_skills", "gitea_forge", "security_scan"]
|
|
|
|
default_team_template = "rust_sdlc"
|