mantis-meta-agent

Meta-Agent Orchestrator (/mantis-meta-agent)

System Goal

Autonomous Campaign Manager. Supervises the continuous review loop, ensures resilience, and monitors long-running security pipelines.

Command Definition

• Command: /mantis-meta-agent
• Description: Acts as the persistent supervisor, launching and monitoring the automated review campaign.
• Parameters:
  • --sync: OPT-IN boundary sync + snapshot pinning. When present (or when the user explicitly instructs a sync for this pass), synchronize the target with its upstream at the START of the pass (Block C) and pin an immutable per-pass snapshot (Block D). When ABSENT (the default), do NOT sync and do NOT pin: leave active_snapshot/snapshot_history unwritten, leave snapshot_pinned unset, and run the pass against the live tree exactly as today (single static snapshot; --target_root semantics unchanged).
  • --snapshot_keep=<N>: retention for pinned snapshots under <state_root>/.mantis_snapshots/ (Block D step 6 GC). DEFAULT 2 (this pass + previous), safe because correctness never re-reads an older snapshot; raise it for patch/PoC rebasing against a finding's discovery snapshot.
  • --state_root=<absolute path>: directory that contains workspace/ and .mantis_snapshots/. DEFAULT: the absolute path of the current working directory at meta-agent launch (i.e., the parent of workspace/). If state_root resolves inside CODE_ROOT (the colocated case — the default when launching from inside the target repo), Step 3 (PIN) MUST (a) HALT and yield to the user with a message to pass --state_root outside CODE_ROOT — this is the DEFAULT and the only safe behavior without explicit opt-in. Auto-relocate (option b) is opt-in ONLY via an explicit --auto_relocate_state flag (or an equivalent user instruction to auto-relocate for this pass); without it, never move user state. When the user has explicitly opted in, auto-relocate by moving workspace/ and .mantis_snapshots/ to a sibling directory outside CODE_ROOT and updating state_root for the remainder of the pass. This is the "colocated state" transition that mantis-pipeline-adapter Scenario 1 requires. The relocation is a MOVE (not copy-then-delete) and is skipped if workspace/.workspace_edit.lock is held (INV-5: no user data loss). The MOVE MUST be atomic on the same filesystem: move into a fresh temp dir under the sibling's parent, then rename(2) to the final sibling path; refuse and HALT if the sibling already exists or the temp dir cannot be created (never clobber an existing directory). If rename(2) fails, leave the source untouched and HALT — do NOT fall back to copy-then-delete.
  • --auto_relocate_state: OPT-IN flag. When state_root resolves inside CODE_ROOT (colocated state — the default when launching from inside the target repo), the default behavior is to HALT and yield to the user. Passing this flag (or giving an equivalent user instruction) authorizes the atomic-MOVE auto-relocate path described under --state_root above. Without it, never move user state.