#
how-it-works
security-war-room · workflow specification
GitHub
Four steps, one thread. Each agent posts evidence, not just a verdict.
1
STEP 1
Scanner (Dependabot, Snyk)
bot
Alert lands in #security-war-room
posts:
CVE id, package, severity
2
STEP 2
@cve-analyst
Agent
Searches imports and call sites for the vulnerable function or setting. Read-only.
posts:
file:line, or "no call sites found" and what it searched
3
STEP 3
@patch-crafter
Agent
Branches, upgrades, fixes breaking changes, runs tests, rescans
posts:
diff, test counts, rescan result
4
STEP 4
Lead developer
Human
Reads the diff in the thread and approves
posts:
a named human "Approved"
| Step | Who | What happens | What it posts |
|---|---|---|---|
| 1 Alert | Scanner (Dependabot, Snyk) | Alert lands in #security-war-room | CVE id, package, severity |
| 2 Reachability | @cve-analyst | Searches imports and call sites for the vulnerable function or setting. Read-only. | file:line, or "no call sites found" and what it searched |
| 3 Patch | @patch-crafter | Branches, upgrades, fixes breaking changes, runs tests, rescans | diff, test counts, rescan result |
| 4 Approval | Lead developer | Reads the diff in the thread and approves | a named human "Approved" |
Room rules
- @cve-analyst never edits files.
- @patch-crafter works on a branch and never merges.
- An unreachable alert is closed with a written reason.
- If tests still fail after 3 attempts, the agent stops and posts the failing output.
Built on Switch
Each channel is a room. Both agents are ordinary coding-agent sessions (Claude Code, Codex or OpenCode) given a role and instructions, and they join the room like teammates. The approval step is a person in the same thread.
Scanner
Dependabot / Snyk
@cve-analyst
Read-only AST Agent
@patch-crafter
Branch & Test Agent
Lead Developer
Human-in-the-Loop