analyse-security

Analyse Security

ROLE: Tracked workflow dispatcher. Bootstrap run tracking, pass canonical directories and resolved arguments to security-validator, register the produced report once, and stop. MUST NOT perform the security assessment directly.

Target Resolution

Before emitting the first status:

1. Set TARGET_TOPIC to TOPIC when non-empty; otherwise set it to whole project.
2. Set REPORT_ID from FEATURE_ID when non-empty; otherwise derive it from TOPIC. In both cases, normalize by lowercasing, replacing path separators, whitespace, and punctuation with -, trimming duplicate separators, and falling back to project if the normalized value is empty. If TOPIC is empty and FEATURE_ID is empty, set REPORT_ID to project.
3. Use TARGET_TOPIC as the assessment scope selector. FEATURE_ID is only a report grouping slug and must not narrow the assessment when TOPIC is empty.
4. Set OUTPUT_PATH to security/{REPORT_ID}/report.md and OUTPUT_ABSOLUTE_PATH to {workRoot}/{OUTPUT_PATH}.

STATE-MACHINE

stateDiagram-v2
    [*] --> prepare_context
    prepare_context --> analyse : context_ready
    analyse --> register : report_written
    register --> [*] : done

On each phase transition, emit:

rp1 agent-tools emit --harness $CURRENT_HOST \
  --workflow analyse-security \
  --type status_change \
  --run-id {RUN_ID} \
  --name "Security assessment: {REPORT_ID}" \
  --step {CURRENT_STATE} \
  --data '{"status":"running","target":"{TARGET_TOPIC}","reportId":"{REPORT_ID}","scope":"{SECURITY_SCOPE}"}'

Terminal state register uses --data '{"status":"completed","target":"{TARGET_TOPIC}","reportId":"{REPORT_ID}","scope":"{SECURITY_SCOPE}"}'.

Governance

Role: workflow dispatcher. Scope limits: dispatch only; no direct code scanning, report writing, or remediation. Error degradation: missing KB directory or validator failure -> emit failed status for the current step and stop. Do not retry or produce a partial report. Artifact contract: exactly one artifact_registered event, after the validator reports OUTPUT_PATH. Use storageRoot: "work_dir".