diff --git a/Agents.md b/Agents.md index ef36c12..2e777a4 100644 --- a/Agents.md +++ b/Agents.md @@ -850,15 +850,22 @@ Coyote comes packaged with some useful built-in agents: worktree-based parallel task execution. * `coder`: An agent to assist you with all your coding tasks * `code-reviewer`: A [CodeRabbit](https://coderabbit.ai)-style code reviewer that spawns per-file reviewers using the - teammate messaging pattern + teammate messaging pattern and synthesizes their findings into a severity-tagged report. Includes an optional + operational-history lane (via the `incident-prior-art` skill): git archaeology on guards the diff deletes or + weakens, plus, when the `prior_art_agent` variable names an incident-historian agent, a sweep of your incident + record for past outages the change risks reintroducing. * `demo`: An example agent to use for reference when learning to create your own agents * `deep-research`: A graph-based agent designed to perform deep web research * `explore`: An agent designed to help you explore and understand your codebase -* `file-reviewer`: An agent designed to perform code-review on a single file (used by the `code-reviewer` agent) +* `file-reviewer`: An agent designed to perform code-review on a single file (used by the `code-reviewer` agent). + Reviews with the `code-review` and `ai-slop-remover` skills, and additionally loads the `transactional-integrity` + skill when the diff touches state-changing code (e.g. DB writes, transactions, queue/webhook/job handlers, retries, or + external side effects, etc.) to catch atomicity gaps, read-modify-write races, non-idempotent handlers of at-least-once + inputs, and dual-writes with no reconciliation. * `gatekeeper`: A plan self-containedness gate (via the `plan-gatekeeping` skill). Audits a plan against - the "sealed container" standard — every question a context-free implementer will hit is either answered + the "sealed container" standard, meaning every question a context-free implementer will hit is either answered inline or delegated via a VERIFIED pointer to the exact code/docs that answer it (where infra code goes, - what DB tech, which layout to mirror, exact test commands) — and returns a blocking + what DB tech, which layout to mirror, exact test commands), and returns a blocking `PLAN_GATE: SEALED`/`LEAKY` verdict with the missing questions. The pre-implementation context counterpart to `plan-review` (executability) and `adversary` (post-implementation conformance). Designed to be delegated to by `architect`. @@ -868,11 +875,18 @@ Coyote comes packaged with some useful built-in agents: * `oracle`: An agent for high-level architecture, design decisions, complex debugging, and reviewing implementation plans before execution (via the `plan-review` skill, returning a `PLAN_REVIEW: OKAY`/`REJECT` verdict) * `report-writer`: An agent to polish research findings into clear, citation-preserving final reports +* `security-reviewer`: A security analyst for code changes (via the `security-review` skill). Traces untrusted data + from sources to dangerous sinks (injection, committed secrets, authn/authz gaps, path traversal, SSRF, unsafe + deserialization, supply chain), then returns a posture-gated `SECURITY_REVIEW: PASS`/`FAIL` verdict. The + `security_posture` variable (`prototype`/`standard`/`hardened`) sets the blocking threshold so POCs aren't held to + production strictness, while Critical findings (leaked credentials, host-endangering code) block in every posture. + Designed to be delegated to by `sisyphus` alongside `code-reviewer` and `adversary`. * `sisyphus`: A powerhouse orchestrator agent for writing complex code and acting as a natural language interface for your codebase (similar to ClaudeCode, Gemini CLI, Codex, or OpenCode). Uses sub-agent spawning to delegate to - `explore`, `librarian`, `coder`, `oracle`, `code-reviewer`, `adversary`, and `step-runner`. On non-trivial work it - runs two complementary independent review passes — `code-reviewer` for code quality and `adversary` for plan - conformance. Also supports plan-driven workflows: authoring phased implementation plans (via the `plan-authoring` + `explore`, `librarian`, `coder`, `oracle`, `code-reviewer`, `adversary`, `security-reviewer`, and `step-runner`. On + non-trivial work it runs three complementary independent review passes: `code-reviewer` for code quality, + `adversary` for plan conformance, and `security-reviewer` for exploitability when the change touches attack + surface. Also supports plan-driven workflows: authoring phased implementation plans (via the `plan-authoring` skill), having `oracle` review them, and executing them one reviewed step at a time. * `sql`: A universal SQL agent that enables you to talk to any relational database in natural language * `step-runner`: A graph-based agent that executes ONE step of a phased implementation plan (a `plans/` repo authored diff --git a/Skills.md b/Skills.md index 95ab044..c14fb4a 100644 --- a/Skills.md +++ b/Skills.md @@ -11,7 +11,8 @@ their declared MCP servers get acquired automatically. Common uses: -- **Methodology overlays** ("how to do git surgery", "how to review code"). +- **Methodology overlays** ("how to do git surgery", "how to review code", "how to review state-changing code for + transactional integrity"; see the bundled `transactional-integrity` skill). - **Toolkit unlocks** that grant a small bundle of tools or MCP servers without changing the active role. - **One-shot helpers** that auto-unload after the model finishes a task (see [auto_unload](#auto-unload)).