name: audit-security
description: Full security audit. Reads every project file one by one for security review
max_steps: 15
initial_step: plan

loop_monitors:
  - cycle:
      - supervise
      - review
    threshold: 3
    judge:
      persona: supervisor
      instruction: |
        The supervise → review cycle for the security audit has repeated {cycle_count} times.
        Review the audit report and judge:
        - Whether the audit scope has expanded since the previous cycle (new files audited)
        - Whether remaining unaudited files can be completed in a reasonable number of cycles
      rules:
        - condition: Audit quality and scope are sufficient
          next: COMPLETE
        - condition: Scope is expanding and progress continues
          next: review
        - condition: Scope is stalled with no prospect of improvement
          next: ABORT

steps:
  - name: plan
    tags:
      - plan
    persona: planner
    policy: contract-change
    instruction: audit-security-plan
    edit: false
    output_contracts:
      report:
        - name: 01-plan.md
          format: plan
    rules:
      - condition: Project structure understood
        next: audit

  - name: audit
    tags:
      - review
    persona: security-reviewer
    policy:
      - contract-change
      - review
    knowledge:
      - security
      - security-web
      - security-api
      - security-local
      - security-data
      - security-dependencies
    instruction: audit-security-team-leader
    edit: false
    team_leader:
      max_parts: 3
      part_persona: security-reviewer
      part_edit: false
    output_contracts:
      report:
        - name: 02-audit-security.md
          format: audit-security
    rules:
      - condition: Audit complete
        next: supervise

  - name: supervise
    tags:
      - review
      - supervise
    persona: supervisor
    policy: contract-change
    knowledge:
      - security
      - security-web
      - security-api
      - security-local
      - security-data
      - security-dependencies
    instruction: audit-security-supervise
    edit: false
    rules:
      - condition: All files audited with sufficient quality
        next: COMPLETE
      - condition: Unaudited files exist or audit is insufficient
        next: review

  - name: review
    tags:
      - review
    persona: security-reviewer
    policy:
      - contract-change
      - review
    knowledge:
      - security
      - security-web
      - security-api
      - security-local
      - security-data
      - security-dependencies
    instruction: audit-security-review
    edit: false
    output_contracts:
      report:
        - name: 02-audit-security.md
          format: audit-security
    rules:
      - condition: Re-audit complete
        next: supervise