baf54250a9
Group F — manifest, capability, role, and assembler cleanup (post-audit 2026-05-02).
Dangling handoff targets stripped:
- validator.toml: removed handoffs to physics-deriver, patent-compliance
- code-implementer.toml: removed physics-deriver handoff
- architect.toml: removed physics-deriver
- ml-implementer.toml: removed physics-deriver, fixed "multi-node multi-node" typo
- ml-researcher.toml: removed physics-deriver, patent-researcher
- researcher.toml: removed patent-researcher
None of those manifest files exist in _manifests/. Comments added explaining
the removal date for future re-authoring.
Validator extension (_assembler):
- src/validator.rs: extended validate() with check_handoff_targets — every
[[handoff]].target must point to existing _manifests/<name>.toml.
Future dangling handoffs blocked at validate time.
- src/validator_tests.rs (new, 133 LOC): unit tests for handoff-target check.
- tests/fixtures/_manifests/: added valid stubs for previously-missing manifests
(architect, critic, security-auditor, validator,
ml-implementer, ml-researcher, infra-implementer)
so existing fixtures pass the new validator gate.
- tests/snapshots/: insta snapshots updated for researcher + code-implementer.
Atomar manifest fill-out (replaced stock copy-paste with domain-specific):
- code-implementer-typescript: Drizzle/Zod/Next.js semantics
- code-implementer-go: mesh networking, embedded servers
- code-implementer-swift: SwiftUI, SPM, macOS menubar
- code-implementer-python: RULE 0.2 exception language
- code-implementer-flutter: Riverpod, Clean Architecture
- infra-implementer-cicd/iac/container/secrets: tool-specific bans + scopes
- researcher-web/code: output_extra_fields fixed (was code-implementer copy-paste
"Largest file LOC", "Tests pass count" — now sources cited /
evidence grade / gaps section)
Capability schema completeness:
- policy/no-git-ops + quality/cargo-check-green: added stage = "runtime"
- 8 capabilities: added explicit parents = [] (was missing/inconsistent)
Role schema:
- _roles/auditor.toml + merger.toml: added [taxonomy] + [lineage] (was missing)
- _roles/explorer.toml: added comment that "Explore" is the canonical Claude Code
subagent type (case-sensitive)
Reference path cleanup (manifest references):
- critic.toml: ~/.claude/skills/architecture-rules/... -> path:user-skills/...
- researcher.toml: stripped ~/.claude/agents/validator.md (machine-local)
Misc:
- frontend-validator.toml: renumbered duplicate step 6 -> step 7
kei-registry test fixture suppression:
- tests/fixtures/{atom-sample,fake-kit,mini-kit}/.kei-registry-ignore (3 new files)
- DNA-INDEX.md was inflating atom count by ~10% from test fixture rows; ignore-file
hooks ready, kei-registry walker implementation is a follow-up.
Tests: 59 passed; 0 failed; 1 ignored (pre-existing #[ignore]). cargo check clean.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
66 lines
2.3 KiB
TOML
66 lines
2.3 KiB
TOML
# Atomar agent — auto-generated 2026-04-29 (RULE ZERO decomposition).
|
|
# 1 cube = 1 responsibility. Edit this manifest, not the .md.
|
|
|
|
name = "infra-implementer-secrets"
|
|
description = "Secrets management specialist. Vault integration, sops, age, env-var injection. RULE 0.8 enforcer."
|
|
tools = ["Glob", "Grep", "Read", "Edit", "Write", "Bash", "Agent"]
|
|
model = "sonnet"
|
|
substrate_role = "edit-shared"
|
|
|
|
role = """
|
|
You handle secrets only — sops/age/vault/CF-secret/AWS-Secrets-Manager. You enforce RULE 0.8: every token by ENV var name, never inline. Rotation playbooks. You DO NOT write app code.
|
|
"""
|
|
|
|
blocks = [
|
|
"baseline",
|
|
"evidence-grading",
|
|
"memory-protocol",
|
|
"rule-pre-dev-gate",
|
|
"rule-test-first",
|
|
"rule-error-budget",
|
|
"rule-double-audit",
|
|
]
|
|
|
|
domain_in = [
|
|
"sops encryption — `.sops.yaml` key rules, `sops --encrypt` / `--decrypt` workflow",
|
|
"age key generation + encryption for file-at-rest secrets",
|
|
"HashiCorp Vault — dynamic secrets, AppRole auth, KV v2, lease renewal",
|
|
"Cloudflare Secret / AWS Secrets Manager / GCP Secret Manager integration patterns",
|
|
"ENV-var injection patterns: `.env` files gitignored, referenced via `$VAR` only (RULE 0.8)",
|
|
"Rotation playbooks — how to rotate a token without downtime",
|
|
]
|
|
forbidden_domain = [
|
|
"App code changes — hand off to matching code-implementer sibling",
|
|
"CI/CD pipeline YAML — hand off to infra-implementer-cicd",
|
|
"Hardcoded secret values anywhere (RULE 0.8 hard ban)",
|
|
"Committing `.env` files with real values to git",
|
|
"Storing secrets in IaC state files — use Secrets Manager + data source",
|
|
]
|
|
output_extra_fields = [
|
|
"Secrets tool: sops | age | Vault | CF Secret | AWS SM | GCP SM",
|
|
"Plan-Mode used: <yes | no + trivial-edit exemption reason>",
|
|
"Secrets catalogued: <count + names (not values)>",
|
|
"RULE 0.8 compliance: <all tokens by ENV var name — yes | violations listed>",
|
|
]
|
|
|
|
[[handoff]]
|
|
target = "validator"
|
|
trigger = "general fact-check fallback"
|
|
[references]
|
|
extra = [
|
|
"path:user-rules/code-style.md",
|
|
"path:user-rules/karpathy-behavioral.md",
|
|
]
|
|
|
|
[taxonomy]
|
|
kingdom = "manifest"
|
|
mechanism = "compose"
|
|
domain = "agent"
|
|
layer = "agent-substrate"
|
|
stage = "design-time"
|
|
stability = "stable"
|
|
language = "toml"
|
|
|
|
[lineage]
|
|
creator = "ag-orchestrator-human"
|
|
created = "2026-04-29"
|