post-mortem

Tool passed security scan

Risky tool definition detected

Risky tool definition detected

Tool: post-mortem/scripts/closure-integrity-audit.sh [2/2] Description: $status, evidence_mode: $evidence_mode, detail: $detail, scoped_files: $scoped_files, matched_files: $matched_files }' } classify_child() { local child="$1" local child_json="" local human_output="" local created_at="" local closed_at="" local packet_path="" local packet_mode="" local scoped_json commit_json staged_json worktree_json packet_json local -a scoped_files=() if child_json="$(bd_show_json "$child" 2>/dev/null)"; t

Tool passed security scan

Risky tool definition detected

```bash for child in $(bd children "$EPIC_ID" 2>/dev/null | grep -i 'stretch' | grep -oE '[a-z]{2}-[a-z0-9]+\.[0-9]+' | sort -u); do STATUS=$(bd show "$child" 2>/dev/null | grep -oP 'CLOSED') CLOSE_REASON=$(bd show "$child" 2>/dev/null | grep 'Close reason:') COMMITS=$(git log --oneline --all --grep="$child" 2>/dev/null | wc -l | tr -d ' ') if [ -n "$STATUS" ] && [ "$COMMITS" -eq 0 ]; then if !

Risky tool definition detected

**Preserve source:** If the evicted entry's source learning still exists in `.agents/learnings/`, it remains there. Eviction removes the entry from MEMORY.md only -- the full learning artifact is never deleted by this process. **Global eviction** (200-line backstop): When total line count would exceed 200, evict the globally lowest-scoring entry across all sections using the same sort order (citations ascending, then oldest first), regardless of which section it belongs to.

Malicious tool definition detected

# Python-specific semgrep --config "p/python" . # Go-specific semgrep --config "p/golang" . ``` ### Language-Specific Vulnerability Scanners **Python:** ```bash pip-audit -r requirements.txt --format json -o reports/pip-audit.json safety check -r requirements.txt --json > reports/safety.json ``` **Go:** ```bash govulncheck -json ./... > reports/govulncheck.json ``` **JavaScript:** ```bash npm audit --json > reports/npm-audit.json ``` --- ## Pattern-Based Detection When tools aren't available, us

Risky tool definition detected

if echo "$TITLE" | grep -qP '^(task|fix|update|todo|item|work)$'; then echo "WARN: $child has generic title '$TITLE' — possible phantom closure" fi done ``` ### Multi-Wave Regression Scan For crank epics, check if later waves reverted earlier waves' work: ```bash # Quick heuristic: count net lines added per scoped file across all wave commits # If a file has 0 net additions but was touched in multiple waves, flag it for f in $(git diff --name-only HEAD~5 2>/dev/null | sort -u); do ADDS=$(git log

Malicious tool definition detected

Risky tool definition detected

# # Exit codes: # 0 = all refs present (silent) # 1 = missing refs + --strict flag (BLOCK) # 2 = missing refs without --strict (WARN, non-blocking) # # Flags: # --strict Promote WARN to BLOCK (exit 1) on missing refs # --skip-checkpoint-policy Skip checkpoint-policy.md check # --json Output structured JSON instead of plain text set -euo pipefail SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)" REPO_ROOT="$(cd "$SKILL_DIR/../.." && pwd)" REQUIRED_REFS

Malicious tool definition detected

Tool passed security scan