Skip to content

feat: adversarial subagents, PRD design fixes, and cross-file alignment - #14

Merged
jonathan-vella merged 3 commits into
mainfrom
feature/product-docs
Feb 25, 2026
Merged

jonathan-vella merged 3 commits into
mainfrom
feature/product-docs

Conversation

@jonathan-vella

Copy link
Copy Markdown
Owner

Summary

Adversarial Subagents (3 new agents)

  • infra-challenger-subagent — migrated from 10-challenger.agent.md; reviews Azure infra artifacts for governance gaps, WAF blind spots, AVM usage
  • app-security-challenger-subagent — new; challenges auth bypass, IDOR, injection, XSS, data exposure
  • app-logic-challenger-subagent — new; challenges business rules, API contract drift, edge cases, test gaps
  • Adversarial gates wired into Phase E of hackops execution plan
  • All parent agent references updated (conductor, requirements, architect, planner)
  • AGENTS.md restructured with Adversarial Subagents + Other Subagents sections

PRD Design Fixes (6 decisions)

Decision Change
Scoring model Hackers submit evidence; Coaches enter rubric scores during review
Event codes Drop SHA-256 hashing — store as plaintext, rate-limit /api/join (5/min/IP)
Tiebreaker Tied scores → earliest last-approval timestamp wins
Team balance Balanced distribution with ceil(teamSize/2) minimum per team
Resubmission Unlimited evidence resubmits (scores only set by Coach on review)
Coach queue Hackathon-scoped — hackathonId filter required

Cross-file Alignment (15 replacements across 7 files)

All stale SHA-256, eventCodeHash, 0000-9999, and "Hacker submits scores" references updated in: README, plan-hackOps, plan-hackOpsExecution, doc-prd-generator, doc-data-model-generator, doc-api-contract-generator, docs/prd.md

Fixes

  • MD029 markdownlint errors in hackops-user-guide.md
  • MD013 line-length in doc-prd-generator.prompt.md

Checklist

  • All lefthook pre-commit checks pass (0 errors)
  • No deprecated references
  • Version sync verified
  • Conventional commits

- Move 10-challenger.agent.md to _subagents/infra-challenger-subagent
- Add app-security-challenger-subagent (auth bypass, IDOR, injection, XSS)
- Add app-logic-challenger-subagent (business rules, contract drift, edge cases)
- Wire adversarial gates into Phase E of hackops execution plan
- Update all parent agent references (conductor, requirements, architect, planner)
- Restructure AGENTS.md with Adversarial Subagents + Other Subagents sections
- Fix MD029 markdownlint errors in hackops-user-guide.md
- Coach scores: Hackers submit evidence; Coaches enter rubric scores during review
- Event codes: drop SHA-256 hashing; store as plaintext + rate limit join (5/min/IP)
- Tiebreaker: earliest last-approval timestamp wins on tied scores
- Team balance: balanced distribution with ceil(teamSize/2) minimum per team
- Coach queue: hackathon-scoped (hackathonId filter required)
- Propagate changes across README, plan-hackOps, execution plan,
  doc-prd-generator, doc-data-model-generator, doc-api-contract-generator
@jonathan-vella
jonathan-vella merged commit bc966bd into main Feb 25, 2026
3 checks passed
@jonathan-vella
jonathan-vella deleted the feature/product-docs branch February 25, 2026 22:19
@jonathan-vella jonathan-vella mentioned this pull request Feb 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant