fix(prompt): make root agent orchestrate-only and fold fixing into reporting

[devin-ai-integration]

Summary

Two prompt-level fixes flagged by a user running black-box scans with Opus/Sonnet:

1. Root agent was doing hands-on testing before delegating. system_prompt.jinja is shared by the root and all subagents and is written in the second person ("map the target", "COMPLETE full reconnaissance", "spray payloads", "Start with BASIC techniques"). The only counter-signal was one small ROOT AGENT ROLE block whose loophole ("may do lightweight triage, quick verification") the models read as license to run basic injection tests on discovered endpoints before spinning up a subagent. Crucially, is_root was never passed into the Jinja render, so the base prompt could not distinguish root from child.

• prompt.py: pass is_root into render(...).
• system_prompt.jinja: add an is_root-gated <root_agent_directive> at the top telling the root it is orchestration-only and how to read the rest of the prompt (every hands-on "you" instruction = a delegation requirement → spawn a subagent); add an is_root-gated note on MANDATORY INITIAL PHASES; close the "lightweight triage/quick verification" loophole (explicit: no scanners/fuzzers/payloads/"basic" endpoint probing — delegate anything that touches the target).
• skills/coordination/root_agent.md: same no-hands-on-testing reinforcement; clarify "analyze the target" means from scan config/scope + subagent results, not by running recon tools.

2. Fixing happened as a separate agent after reporting, wasting tokens. create_vulnerability_report already forces the reporting agent to derive the concrete patch inline (code_locations with verbatim fix_before/fix_after + fix_pr_body). The prompt nevertheless mandated a downstream "Fixing Agent" that re-reads the code and re-derives the same patch. Reworked so fixing is folded into reporting:

• WHITE-BOX chain Discovery → Validation → Reporting → Fixing (4 agents) → Discovery → Validation → Reporting-with-fix (3 agents).
• Removed the → Create "Auth Fixing Agent" step and the trailing Spawns "Auth Fixing Agent" in the workflow diagram (now STOP - no separate fixing agent).
• Replaced the "Do NOT patch/fix before reporting … only after reporting should fixing proceed" rule with "Reporting and fixing are ONE step" (report is incomplete without the inline fix; don't silently patch without a report either).
• Reworded the WHITE-BOX FIX discovered vulnerabilities … bullets to derive/apply the fix in the same agent/turn as reporting.

Notes

• Only is_root gating is behavioral for the template; child/subagent prompts are unchanged except the fix-ordering wording.
• Verified the template renders for root/child × whitebox/blackbox, is_root gating present only for root, ruff + pre-commit hooks (ruff/mypy/bandit) pass. The 2 pre-existing PLC0415 lint errors in report/state.py / telemetry/logging.py are on main already and untouched here.

Link to Devin session: https://app.devin.ai/sessions/b82ddd52d14940f18ccee6d915888fc9
Requested by: @0xallam

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Greptile Summary

This PR makes the root agent orchestration-only and folds white-box fixing into reporting. The main changes are:

• Pass is_root into system-prompt rendering.
• Add root-only delegation rules to the shared prompt and coordination skill.
• Replace the separate fixing agent with reporting that includes an inline fix.

Confidence Score: 4/5

The white-box remediation path can complete without producing, applying, or testing a fix.

• Root and child prompt gating follows the normal construction paths.
• The report tool accepts findings without the inline fix fields required by the new workflow.
• Applying and testing the patch is optional after the dedicated fixing stage is removed.

strix/agents/prompts/system_prompt.jinja and the create_vulnerability_report validation path

Important Files Changed

Filename	Overview
strix/agents/prompt.py	Passes the existing root-role flag into the Jinja template; normal root and child construction use the expected values.
strix/agents/prompts/system_prompt.jinja	Adds clear root delegation rules, but the combined reporting-and-fixing flow does not require fix data or patch application.
strix/skills/coordination/root_agent.md	Aligns the root coordination skill with the orchestration-only and reporting-with-fix instructions.

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
strix/agents/prompts/system_prompt.jinja:137
**Inline Fix Can Be Omitted**

A reporting agent can call `create_vulnerability_report` without `code_locations` or `fix_pr_body` because both fields remain optional and the tool accepts the report. With the separate fixing agent removed, that successful call ends the workflow without a machine-actionable patch or SARIF fix.

### Issue 2 of 2
strix/agents/prompts/system_prompt.jinja:138
**Confirmed Findings Remain Unpatched**

The phrase `If you also apply and verify` makes source modification and retesting optional. A reporting agent can derive an inline suggestion, file the report, and stop; because this change removes the fixing agent, the vulnerable workspace remains unchanged and the proposed fix is never validated.

_{Reviews (1): Last reviewed commit: "fix(prompt): make root agent orchestrate..." | Re-trigger Greptile}