😏

profiles/secure-change/profile.toml

@@ -0,0 +1,97 @@
+schema_version = 8
+id = "secure-change"
+version = "8.0.0"
+display_name = "Secure Change"
+description = "A Zen-hosted Opus root frames and remediates risk while Z.AI GLM hunts candidate vulnerabilities and Go-hosted DeepSeek reproduces consequential findings."
+tags = ["security", "empirical-verification", "hybrid-provider", "featured"]
+maturity = "featured"
+root = "security_lead"
+smoke = "smoke.toml"
+
+[agents.security_lead]
+kind = "root"
+description = "Threat-framing authority, sole canonical remediator, and final coverage owner"
+model = "opencode_zen_anthropic_messages__claude_opus_5"
+reasoning = "high"
+allowed_reasoning_efforts = ["medium", "high", "xhigh", "max"]
+execution_mode = "goal"
+goal_token_budget = 600000
+max_goal_token_budget = 1000000
+stall_warning_seconds = 3600
+finalization_grace_seconds = 1800
+plan_reasoning = "high"
+permissions = "workspace-write"
+can_spawn = ["vulnerability_hunter", "finding_verifier"]
+max_active = 1
+trust = "high"
+verification = "always"
+instructions = "agents/security-lead.md"
+
+[agents.vulnerability_hunter]
+description = "Read-only vulnerability hunter for one broad scan and at most one targeted post-fix rescan"
+model = "zai_coding_responses__glm_5_3"
+reasoning = "max"
+allowed_reasoning_efforts = ["high", "max"]
+execution_mode = "goal"
+goal_token_budget = 300000
+max_goal_token_budget = 500000
+stall_warning_seconds = 1800
+finalization_grace_seconds = 1800
+permissions = "read-only"
+backends = ["mcp"]
+can_spawn = []
+max_active = 1
+allowed_task_kinds = ["security_review", "targeted_rescan"]
+trust = "adversarial_reviewer"
+verification = "root_adjudication"
+network_access = false
+web_search = "disabled"
+contract_enforcement = "strict"
+output_contract = "contracts/security.json"
+instructions = "agents/vulnerability-hunter.md"
+
+[agents.finding_verifier]
+description = "Network-disabled empirical reproducer for concrete consequential findings"
+model = "opencode_go_openai_chat__deepseek_v4_pro"
+reasoning = "high"
+allowed_reasoning_efforts = ["high", "max"]
+execution_mode = "turn"
+stall_warning_seconds = 1800
+finalization_grace_seconds = 1200
+permissions = "read-only"
+backends = ["mcp"]
+can_spawn = []
+max_active = 1
+allowed_task_kinds = ["security_verification", "reproduction", "test_analysis"]
+trust = "high"
+verification = "always"
+network_access = false
+web_search = "disabled"
+contract_enforcement = "strict"
+output_contract = "contracts/security-validation.json"
+instructions = "agents/finding-verifier.md"
+
+[agents.security_lead.controls.vulnerability_hunter]
+actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
+
+[agents.security_lead.controls.finding_verifier]
+actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
+
+[agents.vulnerability_hunter.controls.finding_verifier]
+actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
+
+[agents.finding_verifier.controls.vulnerability_hunter]
+actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
+
+[coordination]
+mode = "secure_change"
+orchestration = "mcp"
+max_active_agents = 2
+max_depth = 1
+max_children_per_agent = 2
+max_active_writers = 0
+reject_ancestor_role = true
+wait_policy = "dependency_only"
+write_conflict_policy = "reject"
+contradiction_policy = "primary_evidence"
+result_visibility = "ancestors"