Repository navigation
feat(catalog): seven security roles - #229
Merged
Merged
Conversation
Technical writer, reliability engineer, release engineer, codebase guide, AI instruction writer, prototype builder, localization engineer and code cleanup engineer, with their text in the three languages. All work on the owner's own code with the Manual mode's approvals: none changes a live system, publishes, or handles keys by itself. The catalog is now 94 roles.
Threat modeler, incident responder, secrets auditor, privacy engineer, compliance checklist assistant, AI-written code auditor and cloud setup reviewer, with their text in the three languages. All work defensively on the owner's own things: none attacks, scans, signs in to an account or repeats the value of a secret, and none calls anything compliant or certified. The catalog is now 101 roles.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Seven roles in a new Security category (G4): threat modeler, incident responder, secrets auditor, privacy engineer, compliance checklist assistant, AI-written code auditor and cloud setup reviewer. The catalog goes from 94 to 101 roles, with the text in English, Portuguese and Spanish. The security reviewer stays under Code. Five of the seven run at
higheffort.All of them are defensive and work only on the owner's own things, with the owner's approval. None attacks, scans, sends traffic, writes attack code against a live system, signs in to an account, uses a secret it found, or asks for a password, key or token in the chat. The sheets say to write
<redacted>instead of any secret value, even inside a code block. The privacy and compliance ones say they are not a lawyer or an auditor, never call anything compliant or certified, and turn laws into questions for a professional. The incident responder tells the owner to save evidence before fixing and never retaliates or probes whoever did it.New
securitycategory: enum inbotloft-core, the chief's tool schema, the Agency filter chip and the regeneratedprotocol.gen.ts.Stacked on #228 (engineering roles); merge that one first.
Checks
cargo fmt,clippy -D warnings,catalog_lint, catalog and chief tests passpnpm checkpasses (556 tests)Manual (needs the real Claude Code)
Create the secrets auditor, the incident responder and the cloud setup reviewer in a crew and give each a typical task on a throwaway repo or export containing a fake key; see that the auditor reports the place and kind but never the value, the responder gives containment steps before looking for causes, and the cloud reviewer asks for exports instead of access.