feat(template): wire molecule-hitl + molecule-security-scan into roles (#266, #275) - #277
Merged
Merged
Conversation
#266, #275) Closes #266 and #275. Per-role install matrix matching the per-tick #266 triage comment. ## Added plugins | Role | Plugin | Rationale | |---|---|---| | Backend Engineer | molecule-hitl | Scope includes destructive DB migrations + runtime config changes — @requires_approval stops unattended agents from shipping prod schema mutations. | | DevOps Engineer | molecule-hitl | Scope covers fly deploys + registry pushes + CI pipeline mutations — @requires_approval before destructive infra ops. | | Security Auditor | molecule-hitl | Gates public issue filing for critical findings; prevents false-positive spam of the tracker. | | Security Auditor | molecule-security-scan | Primary consumer of gosec/bandit/CVE scanning via builtin_tools/security_scan.py. Security Auditor system prompt already expects to run these tools; this wires them. | ## Per-PR #71 semantics Each workspace's `plugins:` UNIONs with `defaults.plugins` — these additions don't drop any existing plugin. Security Auditor's list went from 3 → 5; Backend + DevOps Engineer now have a role-specific list layered on top of defaults. ## NOT adding (yet) Dev Lead / Research Lead / Technical Researcher / QA Engineer / UIUX Designer / PM / Documentation Specialist — none have destructive ops scope in the role description. If you want belt-and-suspenders HITL coverage I can extend this PR; leaving narrow for now. ## Test plan - [x] YAML parses cleanly (python3 -c 'import yaml; yaml.safe_load(...)') - [x] Three edited roles' plugins lists verified by walk-script - [ ] Next org re-import activates the plugins on each workspace container - [ ] Agents invoke request_approval / security_scan from their system prompts after re-import Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This was referenced Apr 15, 2026
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #266 and #275.
Install matrix
Security Auditor's `plugins:` list goes from 3 → 5. Backend + DevOps Engineer get their first role-specific `plugins:` block, layered on top of defaults per the PR #71 UNION merge semantics.
Verification
```
$ python3 -c 'import yaml; yaml.safe_load(open("org-templates/molecule-dev/org.yaml"))'
(no error)
Backend Engineer: ['molecule-hitl']
DevOps Engineer: ['molecule-hitl']
Security Auditor: ['molecule-skill-code-review', 'molecule-skill-cross-vendor-review', 'molecule-skill-llm-judge', 'molecule-security-scan', 'molecule-hitl']
```
NOT in this PR
Dev Lead / Research Lead / Technical Researcher / QA Engineer / UIUX Designer / PM / Documentation Specialist — none have destructive ops scope. Leaving narrow to avoid HITL-prompt fatigue on read-only roles.
Test plan
🤖 Generated with Claude Code