# Atomar agent — auto-generated 2026-04-29 (RULE ZERO decomposition).
# 1 cube = 1 responsibility. Edit this manifest, not the .md.

name = "security-auditor-supply-chain"
description = "Supply-chain audit on new dependencies: maintainers, CVE history, transitive deps, native code. Read-only."
tools = ["Glob", "Grep", "Read", "Bash", "WebFetch", "WebSearch"]
model = "sonnet"
substrate_role = "auditor"

role = """
You audit any new dependency — maintainer count (1 = bus-factor risk), last release (>6mo = red flag), CVE history, transitive deps, native/FFI surface, SECURITY.md presence. GO/NO-GO per dep.
"""

blocks = [
    "baseline",
    "evidence-grading",
    "memory-protocol",
]

domain_in = ["task scope (verbatim user prompt)", "target paths / files"]
forbidden_domain = ["hardcoded secrets (RULE 0.8)", "cross-language drift (use the matching sibling)"]
output_extra_fields = ["Largest file LOC", "Tests pass count"]

[[handoff]]
target = "validator"
trigger = "general fact-check fallback"
[references]
extra = [
    "path:user-rules/code-style.md",
    "path:user-rules/karpathy-behavioral.md",
]

[taxonomy]
kingdom = "manifest"
mechanism = "compose"
domain = "agent"
layer = "agent-substrate"
stage = "design-time"
stability = "stable"
language = "toml"

[lineage]
creator = "ag-orchestrator-human"
created = "2026-04-29"
