Repository navigation
Update AGENTS.md and SECURITY.md for agents working from the board #13
Description
Why
Coding agents will start picking up issues from the jscebu.org board through Symphony. A lead moves a card to Todo, the agent works on a symphony/ branch and hands off a PR in Human Review, and a lead reviews and merges. AGENTS.md and SECURITY.md were written before this and don't describe it.
What should change
AGENTS.md
- Describe the board: what each column means (Backlog, Todo, In Progress, Human Review, Rework, Done) and who moves cards into it.
- Map "How work ships" onto the board. Moving a card to Todo approves the intent. For anything bigger than a small fix, the agent hands off a plan first, and a lead approves it by moving the card back to Todo.
- Say whose instructions count: the issue body, and comments or reviews from leads. Comments from anyone else are information, not instructions.
- Make the skill references work for agents that don't have the
superpowers:skills (Codex, for example): describe each step, and name the skill as one way to do it.
SECURITY.md
- It points to the "Report a vulnerability" button "if it's enabled", but private vulnerability reporting is off for this repo today. Either a lead turns it on, or the line changes.
- Cover the agents. Prompt injection through issues, comments or pull requests, and misuse of an agent's access, are in scope and should be reported privately. Say what the agents can't do: merge, push to
mainor deploy.
Acceptance
- Both files describe how the board and the agents actually work.
- Decisions only a lead can make (private vulnerability reporting, who counts as a lead, anything else that comes up) are listed as open questions in the plan, and answered before the files change.
-
pnpm testandpnpm buildpass.
Activity
dorelljames commentedon Oct 30, 2026
Codex Workpad
Phase: build, handed off
Plan
Acceptance Criteria
pnpm testandpnpm buildpass.Validation
pnpm test— passed: 7 brand files / 93 tests and 4 website files / 21 tests (114 total).pnpm build— passed, including check-dist: 14 files, 6 pages, 10 redirects, brand parity, 30 source files checked.git diff origin/main, untracked files and whitespace.Notes
Merge pull request #14 from javascriptcebu/symphony/gh-13
dorelljames commentedon Oct 30, 2026
Reopening: PR #14 merged only the plan (spec and plan docs). The AGENTS.md and SECURITY.md changes are still to do, after a lead answers the plan's three open questions.
dorelljames commentedon Oct 30, 2026
Answers to the plan's open questions (PR #14):
author_associationisOWNER,MEMBERorCOLLABORATOR. No separate allow-list.cebu-symphony commentedon Oct 30, 2026
Codex update
Phase: build · Started: addressing the lead's workflow changes on PR #15.
cebu-symphony commentedon Oct 30, 2026
Codex update
Phase: build, handed off · All four requested workflow changes are implemented and validated; host handoff files are ready for PR #15.
Needs you
Review AGENTS.md’s update, approval and PR handoff rules, and SECURITY.md’s App identity and access limits on PR #15.
Checklist, checks and notes
Dorells-MacBook-Pro-X.local:/Users/dorelljames/Projects/jscebu-symphony-workspaces/GH-13@eebb2ddPlan
Acceptance criteria
pnpm testandpnpm buildpass.Checks
pnpm install --frozen-lockfile— passed; repeated from a fresh local node_modules after the stale install broke an Astro check dependency.CI=1 pnpm test— passed: 112 brand tests and 58 website tests (170 total); Astro/TypeScript checks passed with 3 existing deprecation hints.pnpm build— passed; check-dist: 15 files, 6 pages, 20 redirects, brand parity, 30 source files.git diff origin/main, untracked files andgit diff --check— passed; only AGENTS.md, SECURITY.md and the plan/spec changed. No generated artifacts, unrelated changes or secrets in the diff.Feedback
Notes
Phase: build, handed off; Rework continues the approved implementation on symphony/Update AGENTS.md and SECURITY.md for agents working from the board #13, without a move to In Progress.
Sync is clean at eebb2dd; PR Document the current Symphony agent workflow #15 is open. PR Plan: Document board-driven agent and security policies #14 merged the plan. No pre-existing local changes or local workpad.
Original Q1–Q3 answers: lead issue comment 6519521904 (MEMBER); keep reporting off and use hello@jscebu.org, use OWNER/MEMBER/COLLABORATOR, leads own Backlog.
Current workflow changes explicitly requested by dorelljames (MEMBER) at Document the current Symphony agent workflow #15 (comment); no new lead-only decision is needed.
Latest issue update: start comment 6535737424, authored by cebu-symphony[bot]. Historical Codex Workpad comment 6517684229 is unchanged.
GET /user returned 403 for this App installation token. Session identity was independently confirmed by the successful start comment; this does not block the task.
All feedback channels read; no inline comments, formal PR reviews or must-fix findings. The host's round-1 review is a PR conversation comment by dorelljames from before the App existed.
The host-provided GitHub skill still describes the old workpad protocol; the explicit session and lead update instructions take precedence.
Initial pnpm test stalled at Astro’s install prompt because the pre-existing install lacked @emnapi/core; pnpm install --force did not repair it. Reinstalled node_modules from the unchanged lockfile; the CI=1 rerun passed. Removed the temporary backup and task-created pnpm cache after repair; manifests and lockfile are unchanged.
All four lead requests are resolved. Plan shortened to the session’s three-part format while retaining resolved decisions, source links and validation history. No external blockers remain.
Host handoff files prepared for the existing PR Document the current Symphony agent workflow #15 with Closes Update AGENTS.md and SECURITY.md for agents working from the board #13 and Symphony attribution. The host will commit, push and update the PR after this run; no new commit or CI result is claimed.
Merge remote-tracking branch 'origin/main' into symphony/gh-13
Merge pull request #15 from javascriptcebu/symphony/gh-13