98 lines
3.5 KiB
TOML
98 lines
3.5 KiB
TOML
schema_version = 8
|
|
id = "secure-change"
|
|
version = "8.0.0"
|
|
display_name = "Secure Change"
|
|
description = "A Zen-hosted Opus root frames and remediates risk while Z.AI GLM hunts candidate vulnerabilities and Go-hosted DeepSeek reproduces consequential findings."
|
|
tags = ["security", "empirical-verification", "hybrid-provider", "featured"]
|
|
maturity = "featured"
|
|
root = "security_lead"
|
|
smoke = "smoke.toml"
|
|
|
|
[agents.security_lead]
|
|
kind = "root"
|
|
description = "Threat-framing authority, sole canonical remediator, and final coverage owner"
|
|
model = "opencode_zen_anthropic_messages__claude_opus_5"
|
|
reasoning = "high"
|
|
allowed_reasoning_efforts = ["medium", "high", "xhigh", "max"]
|
|
execution_mode = "goal"
|
|
goal_token_budget = 600000
|
|
max_goal_token_budget = 1000000
|
|
stall_warning_seconds = 3600
|
|
finalization_grace_seconds = 1800
|
|
plan_reasoning = "high"
|
|
permissions = "workspace-write"
|
|
can_spawn = ["vulnerability_hunter", "finding_verifier"]
|
|
max_active = 1
|
|
trust = "high"
|
|
verification = "always"
|
|
instructions = "agents/security-lead.md"
|
|
|
|
[agents.vulnerability_hunter]
|
|
description = "Read-only vulnerability hunter for one broad scan and at most one targeted post-fix rescan"
|
|
model = "zai_coding_responses__glm_5_3"
|
|
reasoning = "max"
|
|
allowed_reasoning_efforts = ["high", "max"]
|
|
execution_mode = "goal"
|
|
goal_token_budget = 300000
|
|
max_goal_token_budget = 500000
|
|
stall_warning_seconds = 1800
|
|
finalization_grace_seconds = 1800
|
|
permissions = "read-only"
|
|
backends = ["mcp"]
|
|
can_spawn = []
|
|
max_active = 1
|
|
allowed_task_kinds = ["security_review", "targeted_rescan"]
|
|
trust = "adversarial_reviewer"
|
|
verification = "root_adjudication"
|
|
network_access = false
|
|
web_search = "disabled"
|
|
contract_enforcement = "strict"
|
|
output_contract = "contracts/security.json"
|
|
instructions = "agents/vulnerability-hunter.md"
|
|
|
|
[agents.finding_verifier]
|
|
description = "Network-disabled empirical reproducer for concrete consequential findings"
|
|
model = "opencode_go_openai_chat__deepseek_v4_pro"
|
|
reasoning = "high"
|
|
allowed_reasoning_efforts = ["high", "max"]
|
|
execution_mode = "turn"
|
|
stall_warning_seconds = 1800
|
|
finalization_grace_seconds = 1200
|
|
permissions = "read-only"
|
|
backends = ["mcp"]
|
|
can_spawn = []
|
|
max_active = 1
|
|
allowed_task_kinds = ["security_verification", "reproduction", "test_analysis"]
|
|
trust = "high"
|
|
verification = "always"
|
|
network_access = false
|
|
web_search = "disabled"
|
|
contract_enforcement = "strict"
|
|
output_contract = "contracts/security-validation.json"
|
|
instructions = "agents/finding-verifier.md"
|
|
|
|
[agents.security_lead.controls.vulnerability_hunter]
|
|
actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
|
|
|
|
[agents.security_lead.controls.finding_verifier]
|
|
actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
|
|
|
|
[agents.vulnerability_hunter.controls.finding_verifier]
|
|
actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
|
|
|
|
[agents.finding_verifier.controls.vulnerability_hunter]
|
|
actions = ["inspect", "trace", "steer", "interrupt", "pause", "continue", "detach", "stop", "finalize", "compact", "respond", "set_effort", "fork"]
|
|
|
|
[coordination]
|
|
mode = "secure_change"
|
|
orchestration = "mcp"
|
|
max_active_agents = 2
|
|
max_depth = 1
|
|
max_children_per_agent = 2
|
|
max_active_writers = 0
|
|
reject_ancestor_role = true
|
|
wait_policy = "dependency_only"
|
|
write_conflict_policy = "reject"
|
|
contradiction_policy = "primary_evidence"
|
|
result_visibility = "ancestors"
|