Adds an opt-in `security` role to `micro loop` and wires it into go-micro's own
loop. On a schedule it dispatches the agent to audit the codebase for real,
exploitable vulnerabilities and file them.
Security gets a deliberately more conservative policy than the other roles,
encoded in .github/loop/prompts/security.md:
- NEVER auto-merges a security change (fixes stay human-reviewed).
- NEVER publishes exploit detail / PoC in a public issue — novel exploitable
findings get a concise `security` + `needs-human` issue (class, location,
impact) routed to private disclosure; only known/public dep CVEs get a
bump PR (no auto-merge).
- Weekly by default (`--security-cron`, 0 6 * * 1); tunable.
The go-micro prompt targets its real attack surface: MCP/A2A gateways, x402
payments, JWT/wrapper auth, provider BaseURL SSRF + key leakage, the agent
tool loop (prompt injection / guardrail bypass), TLS defaults, the loop's own
PAT, and dependency CVEs via govulncheck.
Note: an agent review is not a gate. The deterministic companion — govulncheck
as a required CI check — is a recommended follow-up so known-vulnerable deps
can't merge at all.
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
Co-authored-by: Claude <noreply@anthropic.com>
* ai/minimax: complete provider surface (matrix, conformance, changelog)
Follow-up after merging the MiniMax provider (#3769), mirroring the Ollama
completeness pass (#3637):
- Add the `minimax` row to the AI provider capability matrix and blank-import
ai/minimax in provider_capabilities_test.go so the matrix stays enforced
against the registry.
- Add minimax to the stream-conformance allowlist (+ import) so its streaming
is actually exercised against the OpenAI-compatible SSE contract, not just
registered. It passes via the shared ai/internal/openaiapi path.
- Record the provider in CHANGELOG [Unreleased].
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
* ai: update capabilities_test provider assertions for minimax
Adding the minimax blank-import to the shared ai_test binary (for stream
conformance) also registers it for TestRegisteredProviders / TestCapabilityRows
/ TestCapabilityMatrix in capabilities_test.go, which pin the exact provider
set. Update those assertions to include minimax. (Fixes the Unit Tests failure
my scoped `-run TestStreamProviders` check missed — go compiles all _test.go in
a package into one binary.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
---------
Co-authored-by: Claude <noreply@anthropic.com>
Backstop for the gate: previously loop-triage only fired on Harness (E2E)
failures, so a red lint or test on master (e.g. the misspell that slipped past
because golangci-lint isn't a required check) produced no fix issue. Now triage
watches all the gate workflows.
- micro loop: `--ci-workflow` accepts a comma-separated list of workflow names,
rendered into the triage workflow_run trigger as a YAML array; the issue names
the actual failed workflow via github.event.workflow_run.name. (generic CLI)
- go-micro: regenerate loop-triage.yml to watch "Harness (E2E)", "Lint",
"Run Tests"; generalize the triage prompt beyond the harness (a lint/test
failure on master is a real regression to fix, not a flake to ignore).
- Docs: update CONTINUOUS_IMPROVEMENT.md triage description.
Note: this is defense-in-depth. The primary fix is making golangci-lint a
required status check so red lint can't merge in the first place — that stays
with the human (branch protection).
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
Co-authored-by: Claude <noreply@anthropic.com>
Asim Aslam