😏

profiles/secure-change/README.md

@@ -0,0 +1,15 @@
+# Secure Change
+
+Use this profile for authorized security-sensitive changes, defensive review, and vulnerability remediation—not routine coding or offensive activity outside the operator's scope.
+
+```text
+Claude Opus 5 security lead (active root and only writer)
+├── GLM-5.3 vulnerability hunter (MCP, read-only)
+└── DeepSeek V4 Pro finding verifier (MCP, read-only, launched for concrete findings)
+```
+
+Threat modeling and audit can run in parallel while the root maps the change. Findings remain hypotheses until evidence confirms them. The root exclusively remediates and requests targeted revalidation. Worker read-only permissions, exact roles, contracts, graph, and goal/turn lifecycle are mechanical; coverage judgment and launch policy remain root responsibilities.
+
+Cost and latency are high. Provider failure creates a named coverage gap, and no result may claim complete security assurance.
+
+Hunter and verifier are persistent supervised Unix app-server workers. The root controls both, and reciprocal action grants let them steer, pause, continue, detach, or return one another to an unresolved exploitability claim without granting remediation authority. Slow analysis receives generous token budgets or clock-free turns; warning-only stalls never erase work, and suspension preserves history, traces, and partial findings.

profiles/secure-change/agents/finding-verifier.md

@@ -0,0 +1 @@
+Empirically test one concrete security finding without network access or source edits. Record exact commands and exit codes, inputs, observed artifacts, expected secure behavior, and whether the claim is confirmed, refuted, inconclusive, or blocked. A command declaration must correspond to captured tool events. Do not generalize beyond the tested evidence.

profiles/secure-change/agents/security-lead.md

@@ -0,0 +1,3 @@
+Own threat framing, canonical remediation, and final coverage. Continue inspecting trust boundaries and implementation while independent scans run. Treat GLM findings as candidate hypotheses until exact evidence and, for consequential claims, a DeepSeek reproduction support them. Reject unverifiable claims, measure false positives, and preserve negative controls. Implement the smallest robust repair yourself, then use the one permitted targeted rescan only when it can test a changed attack surface.
+
+Contracts prove structure and command-event correlation, never semantic truth. Explicitly accept or reject each result. Resolve disagreement by source, executable reproduction, artifacts, and security invariants—not voting. If an optional route is unavailable, make the loss of coverage visible rather than silently substituting a different model.

profiles/secure-change/agents/vulnerability-hunter.md

@@ -0,0 +1 @@
+Hunt for concrete vulnerabilities in the assigned scope. Trace untrusted inputs, authorization, boundaries, parser behavior, secrets, filesystem effects, and failure paths. Each finding is only a candidate: give an exact location, attack preconditions, evidence, impact, a falsification or reproduction recipe, confidence, and remediation direction. Do not claim empirical confirmation unless correlated evidence exists. Avoid generic checklist findings and do not edit files.

profiles/secure-change/contracts/security-validation.json

@@ -0,0 +1,48 @@
+{
+  "title": "Empirical security finding validation",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "finding_id": {"type": "string", "minLength": 1},
+    "verdict": {"type": "string", "enum": ["confirmed", "refuted", "inconclusive", "blocked"]},
+    "commands": {
+      "type": "array",
+      "maxItems": 30,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "command": {"type": "string", "minLength": 1},
+          "exit_code": {"type": "integer"},
+          "observation": {"type": "string", "minLength": 1}
+        },
+        "required": ["command", "exit_code", "observation"]
+      }
+    },
+    "artifacts": {
+      "type": "array",
+      "maxItems": 30,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "relative_path": {"type": "string", "minLength": 1},
+          "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
+        },
+        "required": ["relative_path", "sha256"]
+      }
+    },
+    "limitations": {"type": "array", "items": {"type": "string"}, "maxItems": 30}
+  },
+  "required": ["finding_id", "verdict", "commands", "artifacts", "limitations"],
+  "allOf": [
+    {
+      "if": {"properties": {"verdict": {"enum": ["confirmed", "refuted"]}}, "required": ["verdict"]},
+      "then": {"properties": {"commands": {"minItems": 1}}}
+    },
+    {
+      "if": {"properties": {"verdict": {"const": "blocked"}}, "required": ["verdict"]},
+      "then": {"properties": {"limitations": {"minItems": 1}}}
+    }
+  ]
+}

profiles/secure-change/contracts/security.json

@@ -0,0 +1,46 @@
+{
+  "title": "Candidate vulnerability report",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "status": {"type": "string", "enum": ["candidates", "no_findings", "blocked"]},
+    "scope": {"type": "string", "minLength": 1},
+    "findings": {
+      "type": "array",
+      "maxItems": 50,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "id": {"type": "string", "minLength": 1},
+          "severity": {"type": "string", "enum": ["critical", "high", "medium", "low", "informational"]},
+          "location": {"type": "string", "minLength": 1},
+          "preconditions": {"type": "string", "minLength": 1},
+          "evidence": {"type": "string", "minLength": 1},
+          "impact": {"type": "string", "minLength": 1},
+          "falsification_or_reproduction": {"type": "string", "minLength": 1},
+          "confidence": {"type": "string", "enum": ["low", "medium", "high"]},
+          "empirically_confirmed": {"const": false}
+        },
+        "required": ["id", "severity", "location", "preconditions", "evidence", "impact", "falsification_or_reproduction", "confidence", "empirically_confirmed"]
+      }
+    },
+    "tested_negative_controls": {"type": "array", "items": {"type": "string"}, "maxItems": 30},
+    "limitations": {"type": "array", "items": {"type": "string"}, "maxItems": 30}
+  },
+  "required": ["status", "scope", "findings", "tested_negative_controls", "limitations"],
+  "allOf": [
+    {
+      "if": {"properties": {"status": {"const": "candidates"}}, "required": ["status"]},
+      "then": {"properties": {"findings": {"minItems": 1}}}
+    },
+    {
+      "if": {"properties": {"status": {"const": "no_findings"}}, "required": ["status"]},
+      "then": {"properties": {"findings": {"maxItems": 0}, "tested_negative_controls": {"minItems": 1}}}
+    },
+    {
+      "if": {"properties": {"status": {"const": "blocked"}}, "required": ["status"]},
+      "then": {"properties": {"limitations": {"minItems": 1}}}
+    }
+  ]
+}

profiles/secure-change/profile.toml

@@ -0,0 +1,97 @@
+schema_version = 8
+id = "secure-change"
+version = "8.0.0"
+display_name = "Secure Change"
+description = "A Zen-hosted Opus root frames and remediates risk while Z.AI GLM hunts candidate vulnerabilities and Go-hosted DeepSeek reproduces consequential findings."
+tags = ["security", "empirical-verification", "hybrid-provider", "featured"]
+maturity = "featured"
+root = "security_lead"
+smoke = "smoke.toml"
+
+[agents.security_lead]
+kind = "root"
+description = "Threat-framing authority, sole canonical remediator, and final coverage owner"
+model = "opencode_zen_anthropic_messages__claude_opus_5"
+reasoning = "high"
+allowed_reasoning_efforts = ["medium", "high", "xhigh", "max"]
+execution_mode = "goal"
+goal_token_budget = 600000
+max_goal_token_budget = 1000000
+stall_warning_seconds = 3600
+finalization_grace_seconds = 1800
+plan_reasoning = "high"
+permissions = "workspace-write"
+can_spawn = ["vulnerability_hunter", "finding_verifier"]
+max_active = 1
+trust = "high"
+verification = "always"
+instructions = "agents/security-lead.md"
+
+[agents.vulnerability_hunter]
+description = "Read-only vulnerability hunter for one broad scan and at most one targeted post-fix rescan"
+model = "zai_coding_responses__glm_5_3"
+reasoning = "max"
+allowed_reasoning_efforts = ["high", "max"]
+execution_mode = "goal"
+goal_token_budget = 300000
+max_goal_token_budget = 500000
+stall_warning_seconds = 1800
+finalization_grace_seconds = 1800
+permissions = "read-only"
+backends = ["mcp"]
+can_spawn = []
+max_active = 1
+allowed_task_kinds = ["security_review", "targeted_rescan"]
+trust = "adversarial_reviewer"
+verification = "root_adjudication"
+network_access = false
+web_search = "disabled"
+contract_enforcement = "strict"
+output_contract = "contracts/security.json"
+instructions = "agents/vulnerability-hunter.md"
+
+[agents.finding_verifier]
+description = "Network-disabled empirical reproducer for concrete consequential findings"
+model = "opencode_go_openai_chat__deepseek_v4_pro"
+reasoning = "high"
+allowed_reasoning_efforts = ["high", "max"]
+execution_mode = "turn"
+stall_warning_seconds = 1800
+finalization_grace_seconds = 1200
+permissions = "read-only"
+backends = ["mcp"]
+can_spawn = []
+max_active = 1
+allowed_task_kinds = ["security_verification", "reproduction", "test_analysis"]
+trust = "high"
+verification = "always"
+network_access = false
+web_search = "disabled"
+contract_enforcement = "strict"
+output_contract = "contracts/security-validation.json"
+instructions = "agents/finding-verifier.md"
+
+[agents.security_lead.controls.vulnerability_hunter]
+actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
+
+[agents.security_lead.controls.finding_verifier]
+actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
+
+[agents.vulnerability_hunter.controls.finding_verifier]
+actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
+
+[agents.finding_verifier.controls.vulnerability_hunter]
+actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
+
+[coordination]
+mode = "secure_change"
+orchestration = "mcp"
+max_active_agents = 2
+max_depth = 1
+max_children_per_agent = 2
+max_active_writers = 0
+reject_ancestor_role = true
+wait_policy = "dependency_only"
+write_conflict_policy = "reject"
+contradiction_policy = "primary_evidence"
+result_visibility = "ancestors"

profiles/secure-change/smoke.toml

@@ -0,0 +1,24 @@
+schema_version = 8
+
+[[tasks]]
+agent = "security_lead"
+task_kind = "analysis"
+task = "Inspect the runtime security boundaries read-only and explain how candidate findings become empirically accepted or rejected."
+mode = "read-only"
+wall_timeout_seconds = 600
+
+[[tasks]]
+agent = "vulnerability_hunter"
+task_kind = "security_review"
+task = "Audit one narrow input-validation boundary in libexec read-only. Return only the candidate vulnerability JSON and include a tested negative control when reporting no findings."
+backend = "mcp"
+mode = "read-only"
+wall_timeout_seconds = 900
+
+[[tasks]]
+agent = "finding_verifier"
+task_kind = "security_verification"
+task = "Empirically test whether profile schema v1 is rejected by the current compiler without editing files or using the network. Return only the validation JSON with captured command evidence."
+backend = "mcp"
+mode = "read-only"
+wall_timeout_seconds = 900