mirror of
https://github.com/merlinhu1/codex-game-studio.git
synced 2026-08-25 07:54:34 +02:00
7e8846a7fb
* feat: add deterministic model tier routing Define Sol, Terra, and Luna policies with fixed fallbacks, explicit surface assignments, runtime precedence, and Luna escalation. Validate generated metadata and expose tier overrides across role, task, and orchestration commands. * fix: infer model tiers from surface models * fix: rebalance prompt model routing * fix: decouple prompt effort routing --------- Co-authored-by: MerlinH <merlinh221@gmail.com>
2.3 KiB
2.3 KiB
model, model_reasoning_effort, primary-agent, linked-skills, phase, risk, argument-hint, source-reference, source-hash, output-artifacts
| model | model_reasoning_effort | primary-agent | linked-skills | phase | risk | argument-hint | source-reference | source-hash | output-artifacts | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| gpt-5.6-sol | high | security-engineer |
|
review | high | Provide a security audit request with the objective or decision, target files/assets/milestone, scope constraints, owner or handoff needs, and required verification evidence. | .codex/workflows/security-audit.md | 9c3da9ef0ffb2084e33e3f720e10457c7cbaf2609174e48540db7abaff197737 |
|
Security Audit Workflow
Purpose
Review security, secrets, dependencies, online surfaces, abuse cases, and mitigation priorities for the project or feature.
Inputs
- AGENTS.md
- .codex/studio.json
- .codex/workflows/security-audit.md
Role
Security Engineer (security-engineer) owns this workflow.
Taxonomy
Category: qa-testing CCGS adaptation coverage:
- security review
- abuse-case inspection
CLI aliases:
- security-audit
Outputs
- Security review
- Threat notes
- Mitigation checklist
Validation
- Threats are tied to project surfaces
- Secrets and dependencies are considered
- Mitigations are actionable
Phase Gates
- Confirm project state, owner role, write policy, and selected context.
- Name acceptance criteria before implementation or review work.
- Do not advance to handoff until evidence is recorded or a blocker is explicit.
Required Artifacts
- Summary of the workflow result.
- Files, assets, tasks, or docs changed or proposed.
- Verification evidence and unresolved risks.
Context Contract
- Load AGENTS.md, .codex/studio.json, this workflow, the primary agent, linked skills, and only task-relevant project files.
- Avoid broad context unless the user explicitly approves it.
Output Contract
- Decision or change summary.
- Step-by-step work performed or planned.
- Evidence, blockers, warnings, and next owner.
Stop Conditions
- Required project state, approval, target files, or verification path is missing.
- The task crosses into another role without an explicit handoff.
- The workflow would require generated prompt mirrors or hidden automation.
Handoff
Report changed files, validation evidence, residual risks, and the next owner only when ownership changes.