Skip to content

fix/persona permission audit#212

Merged
nextlevelshit merged 5 commits intomainfrom
fix/persona-permission-audit
Mar 1, 2026
Merged

fix/persona permission audit#212
nextlevelshit merged 5 commits intomainfrom
fix/persona-permission-audit

Conversation

@nextlevelshit
Copy link
Collaborator

  • fix(personas): expand analyst personas with release and PR/MR read access
  • fix(pipelines): make scope verify-report steps read-only
  • fix(personas): fix gitea-enhancer tea issue → tea issues
  • fix(personas): sync embedded commenter configs with wave.yaml
  • fix(personas): sync embedded dev persona configs (language-agnostic)

…cess

Analyst personas were restricted to issue commands only. gh-refresh
needs `gh release list`, and all analysts need PR/MR view/list for
cross-referencing during scope verification.
Analyst personas are read-only but gh/gl/gt-scope verify-report prompts
told them to post comments (gh issue comment, glab issue note, tea issues
comment). Rewrite Step 2 to match bb-scope's read-only pattern: include
a pre-rendered markdown summary in the output JSON instead.
The tea CLI uses plural subcommands (tea issues edit, tea issues view,
etc.). Both wave.yaml and the embedded default had the singular form.
Commenter personas had dangerously permissive Bash(gh/glab/tea *) with
empty deny lists. Replace with granular least-privilege permissions
matching wave.yaml: specific comment/PR/MR commands only.
Seven dev personas had stale embedded configs missing capabilities
needed at runtime (Bash, Glob, Grep, Write). Updated to use broad
Bash access with deny lists for destructive ops. Configs are
language-agnostic — language-specific customization comes later.
@nextlevelshit nextlevelshit merged commit 872e0cd into main Mar 1, 2026
1 check passed
@nextlevelshit nextlevelshit deleted the fix/persona-permission-audit branch March 1, 2026 22:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant