Skip to content

Commit 10bdd8f

Browse files
Copilotpethers
Copilot
and
pethers
authored
Changes before error encountered
Agent-Logs-Url: https://github.com/Hack23/cia-compliance-manager/sessions/dc678e9a-9ea9-4abe-b7d0-b3e25fb4e575 Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>
1 parent 0c5b821 commit 10bdd8f

5 files changed

Lines changed: 212 additions & 10 deletions

File tree

‎.github/agents/code-review-agent.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,35 @@ src/components/ - common/*, charts/*, widgets/*
6565

6666
## Feedback Style
6767
Be specific, actionable, and constructive. Reference existing code when suggesting reuse. Prioritize: 🔴 Security > 🟠 Type Safety > 🟡 Reusability > 🟢 Style.
68+
69+
## Secure Development Policy Review Gates
70+
71+
Every PR review MUST verify these gates from [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md):
72+
73+
| Gate | Reviewer Check |
74+
|------|----------------|
75+
| **Threat model** | Sensitive logic has documented STRIDE analysis (PR body or `SECURITY_ARCHITECTURE.md`) |
76+
| **Input validation** | All boundaries validated + sanitized (prefer allowlists) |
77+
| **Secret hygiene** | No tokens, keys, PII in diff, logs, test fixtures, or source maps |
78+
| **Dependency hygiene** | New deps licence-compliant (Open Source Policy) and vulnerability-free |
79+
| **Tests as evidence** | 80%+ coverage, 100% on security-critical paths; negative/abuse tests present |
80+
| **ISMS mapping** | PR body cites applicable ISO 27001 / NIST CSF / CIS controls |
81+
| **Change management** | Breaking changes/migrations documented; CHANGELOG updated |
82+
83+
## Policy Cross-Reference
84+
85+
| When reviewing… | Cite this policy |
86+
|-----------------|------------------|
87+
| Any code change | [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md), [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) |
88+
| New/updated dependency | [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md), [Third Party Management](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Third_Party_Management.md) |
89+
| Crypto / key handling | [Cryptography Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Cryptography_Policy.md) |
90+
| Access / auth code | [Access Control Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Access_Control_Policy.md) |
91+
| Data handling change | [Data Classification](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Data_Classification_Policy.md), [Privacy Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Privacy_Policy.md) |
92+
| AI-assisted / generated code | [AI Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md), [OWASP LLM Security](https://github.com/Hack23/ISMS-PUBLIC/blob/main/OWASP_LLM_Security_Policy.md) |
93+
94+
## Copilot Coding Agent Review Notes
95+
96+
When a PR was produced by Copilot coding agent (via `assign_copilot_to_issue` or `create_pull_request_with_copilot`):
97+
- Verify the `custom_instructions` were honored (no `any`, 80%+ cov, policy mapping)
98+
- Check `base_ref` correctness for stacked PRs — no accidental cross-branch changes
99+
- Treat generated tests with the same rigor as human-authored tests

‎.github/agents/product-task-agent.md‎

Lines changed: 64 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
name: product-task-agent
33
description: Expert product task coordinator for CIA Compliance Manager, creating GitHub issues and optimizing quality, UX, and ISMS alignment
4-
tools: ["view", "edit", "create", "bash", "search_code", "custom-agent", "github-create_issue", "github-list_issues", "github-update_issue", "github-search_issues", "github-add_issue_comment", "playwright-browser_snapshot", "playwright-browser_take_screenshot", "playwright-browser_navigate", "playwright-browser_click", "assign_copilot_to_issue", "get_copilot_job_status"]
4+
tools: ["*"]
55
---
66

77
# Product Task Agent
@@ -97,21 +97,77 @@ TypeScript 6.0.2 · React 19.x · Vite 8 · Vitest 4.x · Cypress 15.x · Node
9797

9898
## Copilot Assignment (MCP Tool Examples)
9999

100-
These examples show how to use GitHub MCP tools to assign issues to Copilot coding agent:
100+
These examples show how to use GitHub MCP tools to assign issues to Copilot coding agent. The repo-level agent definition itself does **not** embed MCP server configuration — MCP servers are configured centrally in `.github/copilot-mcp.json`.
101101

102-
### Assign to Copilot Coding Agent
102+
### 1. Basic Assignment (REST fallback)
103+
```javascript
104+
github-update_issue({
105+
owner: "Hack23", repo: "cia-compliance-manager",
106+
issue_number: ISSUE_NUMBER,
107+
assignees: ["copilot-swe-agent[bot]"]
108+
})
109+
```
110+
111+
### 2. Advanced Assignment with `base_ref` + `custom_instructions`
103112
```javascript
104-
// MCP tool: assign_copilot_to_issue
105113
assign_copilot_to_issue({
106114
owner: "Hack23", repo: "cia-compliance-manager",
107115
issue_number: ISSUE_NUMBER,
108-
base_ref: "main",
109-
custom_instructions: "Follow .github/copilot-instructions.md. Ensure 80%+ coverage."
116+
base_ref: "main", // or "feature/<name>" for feature branch work
117+
custom_instructions: `
118+
- Follow .github/copilot-instructions.md + .github/skills/
119+
- No any types, 80%+ coverage, JSDoc for public APIs
120+
- Map changes to ISMS controls (ISO 27001, NIST CSF 2.0, CIS v8)
121+
- Reference Secure_Development_Policy.md for SDLC gates
122+
`
110123
})
111124
```
112125

113-
### Track Progress
126+
### 3. Direct PR Creation with `create_pull_request_with_copilot`
127+
```javascript
128+
create_pull_request_with_copilot({
129+
owner: "Hack23", repo: "cia-compliance-manager",
130+
title: "feat: add widget X",
131+
problem_statement: "Implement widget X per issue #NNN — include tests, JSDoc, ISMS mapping",
132+
base_ref: "main"
133+
})
134+
```
135+
136+
### 4. Stacked / Sequential PRs
137+
```javascript
138+
// Step 1: models
139+
const pr1 = create_pull_request_with_copilot({ /* base_ref: "main" */ })
140+
// Step 2: services, stacked on step 1 branch
141+
const pr2 = assign_copilot_to_issue({ /* base_ref: pr1.branch */ })
142+
// Step 3: UI, stacked on step 2
143+
const pr3 = create_pull_request_with_copilot({ /* base_ref: pr2.branch */ })
144+
```
145+
146+
### 5. Track Progress
114147
```javascript
115-
// MCP tool: get_copilot_job_status
116148
get_copilot_job_status({ owner: "Hack23", repo: "cia-compliance-manager", id: JOB_ID })
149+
// status: queued | in_progress | completed | failed → includes pull_request_url when done
117150
```
151+
152+
## Policy Alignment
153+
154+
Every issue created MUST link to relevant ISMS policies so traceability from issue → PR → control is preserved:
155+
156+
| Policy | When to Reference |
157+
|--------|-------------------|
158+
| [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) | Any change with CIA triad impact |
159+
| [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) | All code/SDLC changes |
160+
| [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) | Dependencies, licensing, community contributions |
161+
| [Vulnerability Management](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Vulnerability_Management.md) | Security fixes and SLAs |
162+
| [AI Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md) | AI/ML features or Copilot automation changes |
163+
| [Data Classification](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Data_Classification_Policy.md) | Features touching user data |
164+
165+
## Agent Handoff Matrix
166+
167+
| Issue Type | Suggested Assignee(s) |
168+
|------------|-----------------------|
169+
| Security vulnerability | `@security-compliance-agent` → `@testing-agent` → `@code-review-agent` |
170+
| New React component/widget | `@typescript-react-agent` → `@testing-agent` → `@documentation-agent` |
171+
| Documentation/architecture | `@documentation-agent` → `@code-review-agent` |
172+
| Test coverage gap | `@testing-agent` → `@code-review-agent` |
173+
| Performance regression | `@typescript-react-agent` → `@testing-agent` |

‎.github/agents/security-compliance-agent.md‎

Lines changed: 64 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,69 @@ src/types/cia.ts - SecurityLevel type definitions
7979
```
8080

8181
## ISMS Policies
82+
- [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) — Overarching ISMS governance
8283
- [Secure Development](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
83-
- [Information Security](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
84+
- [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)
85+
- [Threat Modeling](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md)
86+
- [Vulnerability Management](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Vulnerability_Management.md)
87+
- [Cryptography Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Cryptography_Policy.md)
8488
- [Access Control](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Access_Control_Policy.md)
85-
- [AI Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md)
89+
- [Data Classification](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Data_Classification_Policy.md)
90+
- [Privacy Policy (GDPR)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Privacy_Policy.md)
91+
- [Incident Response](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Incident_Response_Plan.md)
92+
- [Change Management](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Change_Management.md)
93+
- [AI Policy (EU AI Act)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md)
94+
- [OWASP LLM Security](https://github.com/Hack23/ISMS-PUBLIC/blob/main/OWASP_LLM_Security_Policy.md)
95+
- [CRA Conformity Assessment](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CRA_Conformity_Assessment_Process.md)
96+
97+
## Secure SDLC Phase Gates (Secure Development Policy)
98+
99+
Every change must satisfy the gate corresponding to its lifecycle phase:
100+
101+
| Phase | Gate | Evidence |
102+
|-------|------|----------|
103+
| **Plan** | Threat model documented (STRIDE), policy mapping in issue | Issue body links policy + CIA impact |
104+
| **Design** | Architecture decision recorded, data classification assigned | Updated C4 diagrams / `docs/architecture/` |
105+
| **Build** | Static checks pass (`npm run lint`, strict TS, Knip) | CI green, `no any`, JSDoc for public APIs |
106+
| **Test** | 80%+ coverage, 100% on security-critical paths, a11y tests | Coverage report, Cypress E2E, `axe` checks |
107+
| **Review** | Peer + security review, CodeQL/Dependabot clean | PR approval, scan results |
108+
| **Release** | SBOM generated, provenance attested, CHANGELOG updated | `release.yml` artifacts, SLSA provenance |
109+
| **Operate** | Monitoring, vulnerability SLA tracking, incident ready | Dependabot, ZAP, incident runbook |
110+
111+
## Information Security Policy Mapping
112+
113+
All security review comments should cite the **specific clause** being enforced. Quick-reference mapping:
114+
115+
| Policy Clause Focus | Skill / Check |
116+
|---------------------|---------------|
117+
| Information classification & handling | `classification-framework.md`, `data-protection.md` |
118+
| Access control & least privilege | `security-by-design.md` § auth |
119+
| Cryptography & key management | Approved algorithms only, no custom crypto |
120+
| Secure development & change management | Secure SDLC gates above, PR checks |
121+
| Vulnerability & patch management | Vulnerability SLAs (Crit 24h / High 7d / Med 30d / Low 90d) |
122+
| Logging, monitoring & audit | Non-sensitive logs, no PII in errors |
123+
| Third-party / supply chain | Dependabot, FOSSA, OpenSSF Scorecard |
124+
| Incident response | Follow Incident_Response_Plan.md runbook |
125+
126+
## Copilot Coding Agent (Security Tasks)
127+
128+
For security fixes use `assign_copilot_to_issue` or `create_pull_request_with_copilot` with explicit security guardrails in `custom_instructions`:
129+
130+
```javascript
131+
assign_copilot_to_issue({
132+
owner: "Hack23", repo: "cia-compliance-manager",
133+
issue_number: ISSUE,
134+
base_ref: "main",
135+
custom_instructions: `
136+
SECURITY TASK — MUST:
137+
- Follow Secure_Development_Policy + Information_Security_Policy
138+
- Apply defense in depth; validate inputs at boundaries
139+
- 100% test coverage for modified security-critical code
140+
- Add negative/abuse tests; assert safe error messages
141+
- Update threat model in docs/architecture/SECURITY_ARCHITECTURE.md
142+
- Map fix to ISO 27001 / NIST CSF / CIS controls in PR body
143+
`
144+
})
145+
```
146+
147+
Track with `get_copilot_job_status`. For stacked security remediation use `base_ref: "copilot/issue-<NNN>"` to build on a prior PR's branch.

‎.github/agents/testing-agent.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,3 +86,34 @@ npx cypress run # E2E tests
8686
- Use `describe` blocks for logical grouping
8787
- One assertion concept per test (multiple `expect` OK if related)
8888
- No network calls in unit tests — mock all external dependencies
89+
90+
## Policy Alignment (Test Evidence)
91+
92+
Tests provide **audit evidence** for ISMS controls. Map test suites to policies:
93+
94+
| Policy / Control | Test Obligation |
95+
|------------------|-----------------|
96+
| [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) | Every security-critical function has negative/abuse tests (100% cov) |
97+
| [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) | CIA-triad assertions: confidentiality (no leaks), integrity (no mutation), availability (graceful fallback) |
98+
| [Vulnerability Management](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Vulnerability_Management.md) | Regression tests for every fixed CVE / security alert |
99+
| [Privacy Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Privacy_Policy.md) | Error-path tests asserting no PII / secrets in messages or logs |
100+
| [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) | SBOM & license checks enforced in CI, not skipped |
101+
102+
## Abuse / Negative Test Patterns (SHOULD)
103+
- Oversized inputs (DoS surface)
104+
- Malformed UTF-8 / unicode edge cases
105+
- XSS vectors in any user-visible string field
106+
- Unexpected `null` / `undefined` at every boundary
107+
- Parallel / out-of-order state transitions
108+
109+
## Accessibility Testing (WCAG 2.1 AA)
110+
- Cypress + `cypress-axe` for E2E a11y assertions on every critical flow
111+
- Component-level: assert semantic roles, labels, keyboard focus ordering
112+
- Verify `aria-live` regions announce updates for dynamic widgets
113+
114+
## Copilot Coding Agent (Test Tasks)
115+
When delegating test-writing via `assign_copilot_to_issue`, include in `custom_instructions`:
116+
- “Follow `.github/skills/testing-excellence.md`, AAA pattern, colocated tests”
117+
- “Achieve ≥ 80% (100% on security-critical paths); no skipped tests”
118+
- “Add negative/abuse tests for every new validator or boundary”
119+
Use `get_copilot_job_status` to confirm coverage target met before merge.

‎.github/agents/typescript-react-agent.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,4 +65,25 @@ npm run lint # ESLint 10.x flat config
6565
npm run build # Vite production build (includes TypeScript strict checks)
6666
npm run build:lib # Library build (vite.config.lib.ts + tsconfig.lib.json)
6767
npm run knip # Dead code detection
68+
npm run test # Vitest (run before commit)
6869
```
70+
71+
## Policy Alignment (SDLC)
72+
73+
Every implementation task MUST honor:
74+
- [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) — threat model sensitive code, validate inputs, no secrets in source
75+
- [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) — map feature to CIA impact, apply least privilege
76+
- [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) — check license/provenance before adding deps; prefer existing in-tree utilities
77+
- [Data Classification](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Data_Classification_Policy.md) — classify new data structures (Public / Internal / Confidential / Restricted)
78+
- [AI Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md) — when using AI-assisted code, keep humans in the loop and review generated code
79+
80+
## Security Hotspots in React Code
81+
- ❌ No `eval`, `new Function`, `dangerouslySetInnerHTML` with unsanitized content, or `innerHTML`
82+
- ❌ No secrets, tokens, or PII in client-side code, source maps, or logs
83+
- ✅ Sanitize anything rendered from external data; encode before DOM insertion
84+
- ✅ Validate props with TypeScript + runtime guards from `src/utils/typeGuards.ts`
85+
- ✅ Use Content Security Policy directives already configured in `vite.config.ts`
86+
87+
## Copilot Coding Agent Handoff
88+
89+
When coordinated by `@product-task-agent` via `assign_copilot_to_issue` / `create_pull_request_with_copilot`, honor the `base_ref` given (for stacked PRs) and the `custom_instructions`. Emit progress so `get_copilot_job_status` returns meaningful state. Use existing `src/` conventions — do not scaffold parallel structures.

0 commit comments

Comments
 (0)