What (positive signal)
While implementing ADR-0020 level 3 (#2005 / PR #2103), I ran agents-plugin:review (Opus) as an adversarial security + loop-integrity pass over the workflow templates + guard/parser before requesting human review. It performed strongly.
Why it's worth noting
It surfaced 6 confirmed defects, including one that no deterministic gate could catch: gh pr list --search "head:blueprint/wo-" matches an exact branch name, not a prefix, so the level-3 daily budget count was always 0 and the budget never enforced. It also caught cargo-culted id-token: write, a dead reject-comment path ($(bash script) aborting under Actions' set -eo pipefail), and an unenforced containment assumption (branch protection required but not mandated). Each finding came with a concrete exploit/failure scenario, and it correctly returned PASS on the areas that were actually clean (the script-injection plumbing) rather than inventing findings.
Suggested follow-up (optional)
Consider promoting "run an adversarial review agent over security-sensitive changes before opening the PR" as a recommended step in the relevant workflow/dispatch skills — the two highest-value findings here were logic/security bugs invisible to CI and to a normal review pass. The two generalizable gotchas it exposed are being captured as rules in #2105.
What (positive signal)
While implementing ADR-0020 level 3 (#2005 / PR #2103), I ran
agents-plugin:review(Opus) as an adversarial security + loop-integrity pass over the workflow templates + guard/parser before requesting human review. It performed strongly.Why it's worth noting
It surfaced 6 confirmed defects, including one that no deterministic gate could catch:
gh pr list --search "head:blueprint/wo-"matches an exact branch name, not a prefix, so the level-3 daily budget count was always0and the budget never enforced. It also caught cargo-cultedid-token: write, a dead reject-comment path ($(bash script)aborting under Actions'set -eo pipefail), and an unenforced containment assumption (branch protection required but not mandated). Each finding came with a concrete exploit/failure scenario, and it correctly returned PASS on the areas that were actually clean (the script-injection plumbing) rather than inventing findings.Suggested follow-up (optional)
Consider promoting "run an adversarial review agent over security-sensitive changes before opening the PR" as a recommended step in the relevant workflow/dispatch skills — the two highest-value findings here were logic/security bugs invisible to CI and to a normal review pass. The two generalizable gotchas it exposed are being captured as rules in #2105.