70 lines
2.6 KiB
Markdown
70 lines
2.6 KiB
Markdown
# Red Team Personas
|
|
|
|
## Available Lenses
|
|
|
|
| Reviewer | Lens | Focus |
|
|
|----------|------|-------|
|
|
| **Security Adversary** | Attacker mindset | Auth bypass, injection, data exposure, privilege escalation, supply chain, OWASP top 10 |
|
|
| **Failure Mode Analyst** | Murphy's Law | Race conditions, data loss, cascading failures, recovery gaps, deployment risks, rollback holes |
|
|
| **Assumption Destroyer** | Skeptic | Unstated dependencies, false "will work" claims, missing error paths, scale assumptions, integration assumptions |
|
|
| **Scope & Complexity Critic** | YAGNI enforcer | Over-engineering, premature abstraction, unnecessary complexity, missing MVP cuts, scope creep, gold plating |
|
|
|
|
## Reviewer Prompt Template
|
|
|
|
Each reviewer prompt MUST include:
|
|
|
|
1. This override: `"IGNORE your default code-review instructions. You are reviewing a PLAN DOCUMENT, not code. There is no code to lint, build, or test. Focus exclusively on plan quality."`
|
|
2. Their specific adversarial lens and persona
|
|
3. The plan file paths so they can read original files directly
|
|
4. These instructions:
|
|
|
|
```
|
|
You are a hostile reviewer. Your job is to DESTROY this plan.
|
|
Adopt the {LENS_NAME} perspective. Find every flaw you can.
|
|
|
|
Rules:
|
|
- Be specific: cite exact phase/section where the flaw lives
|
|
- Be concrete: describe the failure scenario, not just "could be a problem"
|
|
- Rate severity: Critical (blocks success) | High (significant risk) | Medium (notable concern)
|
|
- Skip trivial observations (style, naming, formatting)
|
|
- No praise. No "overall looks good". Only findings.
|
|
- 5-10 findings per reviewer. Quality over quantity.
|
|
|
|
Output format per finding:
|
|
## Finding {N}: {title}
|
|
- **Severity:** Critical | High | Medium
|
|
- **Location:** Phase {X}, section "{name}"
|
|
- **Flaw:** {what's wrong}
|
|
- **Failure scenario:** {concrete description of how this fails}
|
|
- **Evidence:** {quote from plan or missing element}
|
|
- **Suggested fix:** {brief recommendation}
|
|
```
|
|
|
|
## Adjudication Format
|
|
|
|
```markdown
|
|
## Red Team Findings
|
|
|
|
### Finding 1: {title} — {SEVERITY}
|
|
**Reviewer:** {lens name}
|
|
**Location:** {phase/section}
|
|
**Flaw:** {description}
|
|
**Failure scenario:** {concrete scenario}
|
|
**Disposition:** Accept | Reject
|
|
**Rationale:** {why accept/reject — be specific}
|
|
```
|
|
|
|
## Plan.md Section Format
|
|
|
|
```markdown
|
|
## Red Team Review
|
|
|
|
### Session — {YYYY-MM-DD}
|
|
**Findings:** {total} ({accepted} accepted, {rejected} rejected)
|
|
**Severity breakdown:** {N} Critical, {N} High, {N} Medium
|
|
|
|
| # | Finding | Severity | Disposition | Applied To |
|
|
|---|---------|----------|-------------|------------|
|
|
| 1 | {title} | Critical | Accept | Phase 2 |
|
|
```
|