docs(#1759): update stale sub-agent names across docs - #1782
Conversation
PR #1550 renamed the review sub-agents: "Intent Alignment Agent" became "Intent & Coherence", and "Injection Defense Agent" and "Platform Security Agent" were consolidated into "Security". This commit updates all documentation references to match the new naming. Changes: - docs/agents/review.md: rewrite sandbox description to reflect the orchestrator + parallel sub-agent fan-out pattern instead of the old "three review skills" model - internal/scaffold/fullsend-repo/skills/pr-review/SKILL.md: replace unsubstantiated "approved temporary exception" claim with transparent description of the ADR-0018 departure and note that a superseding ADR is needed - docs/problems/testing-agents.md: update all old sub-agent names (Intent Alignment, Injection Defense, Platform Security) to current names (Intent & Coherence, Security) including golden-set directory examples and contract headings - docs/problems/security-threat-model.md: update three stale agent name references - docs/problems/architectural-invariants.md: update "intent alignment agents" to "intent & coherence sub-agents" - docs/architecture.md: update agent registry description - docs/landscape.md: update competitive analysis references - docs/problems/code-review.md: update defense-in-depth and specialization argument references - docs/problems/agent-architecture.md: update "injection defense agent" in open questions Note: make lint could not run (Go toolchain download permission denied in sandbox). This is a docs-only change with no Go code modifications. Closes #1759
Site previewPreview: https://2ea24825-site.fullsend-ai.workers.dev Commit: |
ReviewFindingsLow
Info
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| - **Scrutiny for build definitions.** Tekton pipeline and task definitions (`.tekton/`), Dockerfiles, and build scripts define what runs during the build. Agents may legitimately need to modify these files as part of feature implementation — adding a build step, changing a base image, updating a pipeline to support a new artifact type. Blanket CODEOWNERS on all build files would force human approval on every such change, which may be appropriate for some repos but too restrictive for others. The alternative is relying on review agents to apply heightened scrutiny to build definition changes without CODEOWNERS gating — treating them as security-sensitive context for the Platform Security Agent rather than as a hard gate. | ||
| - **Scrutiny for build definitions.** Tekton pipeline and task definitions (`.tekton/`), Dockerfiles, and build scripts define what runs during the build. Agents may legitimately need to modify these files as part of feature implementation — adding a build step, changing a base image, updating a pipeline to support a new artifact type. Blanket CODEOWNERS on all build files would force human approval on every such change, which may be appropriate for some repos but too restrictive for others. The alternative is relying on review agents to apply heightened scrutiny to build definition changes without CODEOWNERS gating — treating them as security-sensitive context for the Security sub-agent rather than as a hard gate. | ||
| - **Coverage regression as a merge gate.** Not just "do tests pass" but "does meaningful coverage decrease on security-sensitive paths." A PR that weakens assertions without reducing line coverage is harder to catch, but assertion-density metrics or mutation testing scores can help. | ||
| - **Cross-PR temporal analysis.** A review capability (either in the Correctness Agent or a dedicated Test Integrity Agent) that checks whether recently-modified tests still provide meaningful coverage for the code under review. When evaluating a production change, the agent examines the git history of the relevant test files and flags recent weakening. |
There was a problem hiding this comment.
[low] logic-error
The old name Correctness Agent and Test Integrity Agent were not updated on this line. The PR updates other old names in the same file but this occurrence was missed. After merge, line 328 will read the Correctness Agent while every other reference uses the new sub-agent suffix.
Suggested fix: Change the Correctness Agent to the Correctness sub-agent and Test Integrity Agent to Test Integrity sub-agent if applicable.
| ### The defense-in-depth argument | ||
|
|
||
| A single monolithic review agent is a single point of failure. If that agent is fooled — by prompt injection, by a cleverly disguised malicious change, by a subtle logic error — all review is compromised. Multiple specialized sub-agents with different concerns create defense in depth: even if the correctness agent is fooled, the security agent might catch it. Even if the security agent misses something, the intent alignment agent might flag that the change doesn't match any authorized work. | ||
| A single monolithic review agent is a single point of failure. If that agent is fooled — by prompt injection, by a cleverly disguised malicious change, by a subtle logic error — all review is compromised. Multiple specialized sub-agents with different concerns create defense in depth: even if the correctness agent is fooled, the security agent might catch it. Even if the security sub-agent misses something, the intent & coherence sub-agent might flag that the change doesn't match any authorized work. |
There was a problem hiding this comment.
[low] logic-error
Inconsistent naming within a single sentence. The diff updates the second clause to use security sub-agent and intent and coherence sub-agent but leaves the first clause with correctness agent and security agent. The same entity is called agent in one clause and sub-agent in the next.
Suggested fix: Apply naming consistently: even if the correctness sub-agent is fooled, the security sub-agent might catch it.
| (This skill's design is an approved temporary exception to ADR-0018 | ||
| "scripted pipelines for multi-agent orchestration", pending ADR-0018 | ||
| amendment) | ||
| (This skill's design departs from ADR-0018 "scripted pipelines for |
There was a problem hiding this comment.
[info] logic-error
The updated ADR-0018 departure note references PR #123 experiments. Verify this is the actual PR number and not a placeholder.
fullsend-ai-review
Bot
added
the
ready-for-merge
1 participant
PR #1550 renamed the review sub-agents: "Intent Alignment Agent" became "Intent & Coherence", and "Injection Defense Agent" and "Platform Security Agent" were consolidated into "Security". This commit updates all documentation references to match the new naming.
Changes:
the orchestrator + parallel sub-agent fan-out pattern instead
of the old "three review skills" model
replace unsubstantiated "approved temporary exception" claim
with transparent description of the ADR-0018 departure and
note that a superseding ADR is needed
names (Intent Alignment, Injection Defense, Platform Security)
to current names (Intent & Coherence, Security) including
golden-set directory examples and contract headings
agent name references
alignment agents" to "intent & coherence sub-agents"
specialization argument references
defense agent" in open questions
Note: make lint could not run (Go toolchain download permission denied in sandbox). This is a docs-only change with no Go code modifications.
Closes #1759
Post-script verification
agent/1759-update-stale-subagent-names)027de9f0879a2099426e24831e8077030ac79837..HEAD)