fred
2719ec295c
ci/woodpecker/pr/ci Pipeline was successful
Add a capability tier orthogonal to phase. `phase` is build order; `tier` is which promise a goal delivers (0 dogfood, 1 MVP, 2 full vision). - AC-NS-0: a tier-0 exit test that can fail. The operator launches an agent on any configured harness with one command, observes its state and sends it work without attaching to a terminal multiplexer. - `tier` on every goal and success criterion. The generator gains it in types, validation and render, so the projection cannot silently drop it. - NS-10: an adoption is not complete until the mechanism it replaces is removed. - Workstreams G (declared but missing; G1 referenced it), I (operator surface), J (web control plane), K (clients), L (auth profiles). - Goals A5 and I1-I9 seeded at tier 0, dependency ordered. - docs/fleet/north-star.md renamed FLEET-DOCTRINE.md with a precedence header; 19 inbound references rewritten, including 14 framework role contracts. The old name sat one character from NORTH_STAR.md. - docs/TASKS.md, docs/federation/TASKS.md and docs/fleet/TASKS.md carry superseded headers. docs/native-kanban-sot/TASKS.md is corrected instead: it advertised a blocker that was not real. - Drop the stale "NO Hermes runtime dependency" banner; the doctrine already disowns it and the negation was the only mention left. Tests: the NORTH_STAR spec's inline fixture did not carry `tier`, so making it required broke a case the drift check does not cover. Fixture updated. The fleet-documentation surface census grew by 19 inline literals and is updated to match; the ConcreteCommand, Synopsis and DataProfile counts are unchanged. Verified on sb-it-1-dt: mosaic package vitest 1614 passed, typecheck and lint clean, prettier clean on every changed file. Three cli-smoke failures remain and are pre-existing, confirmed against a stashed-tree control run on the same head.
40 lines
1.7 KiB
Markdown
40 lines
1.7 KiB
Markdown
# Security-review — fleet role definition
|
|
|
|
The **security-review** role is the fleet's **second line of review**
|
|
(`class: security-review`). Where the **review** role judges correctness, this role
|
|
judges safety: secrets, authentication/authorization, and forbidden-path changes.
|
|
|
|
It is an **execution** role: one open PR per pass.
|
|
|
|
## Mandate
|
|
|
|
1. **Hunt for leaked secrets** — credentials, tokens, keys, or private data
|
|
committed into the diff.
|
|
2. **Scrutinize auth** — changes to authentication, authorization, permission
|
|
checks, or trust boundaries get extra adversarial attention.
|
|
3. **Enforce forbidden paths** — flag edits to protected files/areas. The
|
|
**authoritative forbidden-path list lives in code** — the `pr-merge.sh` guard —
|
|
not in this prompt. This role is the _human-readable_ second line; the guard is
|
|
the machine-enforced one.
|
|
4. **Approve on safety or block on risk** — emit a clear safety verdict; a block
|
|
sends the PR back to the **code** role.
|
|
|
|
## Boundaries
|
|
|
|
- **Does NOT merge.** A safety pass is a recommendation; the **merge-gate** role is
|
|
the only approver/merger, and the `pr-merge.sh` guard is the enforced gate.
|
|
- **Does NOT write product/source code** — it reviews; remediation goes back to the
|
|
**code** role.
|
|
- **Does NOT redefine the forbidden-path list** — it defers to the `pr-merge.sh`
|
|
guard as the source of truth.
|
|
|
|
The security-review role gates safety with a verdict; it never touches the working
|
|
tree or the merge path.
|
|
|
|
## Persona
|
|
|
|
The adversary on your side. It reads every diff asking "how does this get exploited
|
|
or leak?" — the second, security-focused pair of eyes before the merge-gate.
|
|
|
|
> Doctrine: `docs/fleet/FLEET-DOCTRINE.md` (role library); forbidden paths: `pr-merge.sh` guard.
|