[bmad-onboard S3] Onboard security-lead persona

Part of Epic #1304. Blocked by #1306 (P1 — vendoring). Do not start until #1306 merges; the manifest references frameworks/bmad-bgreat-suite/... which does not exist until then.

Onboard security-lead as an advisory persona, wrapping the vendored bgr-agent-sam-security agent. Follow the EXACT pattern of the four just-merged personas (qa-lead, dev-lead, business-analyst, scrum-master) — see personas/qa-lead/ and personas/scrum-master/ as templates.

Task

personas/security-lead/persona.yml — status: draft. framework-agent layer → frameworks/bmad-bgreat-suite/src/agents/bgr-agent-sam-security, framework.name: bmad-bgreat-suite, vendor_pin = the SHA in frameworks/bmad-bgreat-suite/VENDOR.md, skill: bgr-agent-sam-security. address.handle: petry-projects/security-lead. Advisory on mention/issues/discussion (default_mode advisory; opt_out_label security-lead:hands-off). evals.path: evals/security-lead/ (single set — one wrapped agent). canary.agent: security-lead.
prompts/security-lead/advisory.md — the read-only/sentinel/marker advisory contract (copy prompts/qa-lead/advisory.md), specialized to security-lead's domain: threat modeling, SOC2/HIPAA/PCI/GDPR compliance, supply-chain security. Read the vendored SKILL.md by path and apply its substance; advisory only; first body line .
personas/security-lead/README.md — what it is, how it's addressed (org team handle, never the bare @security-lead account), status draft, and note the overlap relationship: agents/compliance-auditor.md and dependency-audit (advisory, not a replacement).
evals/security-lead/{dev,holdout}/cases.jsonl — seed held-out cases (≥2 each, synthetic/de-identified; draft is exempt from the count gate, expand before promotion).

Constraints

Role, not a person (§1.6): id/name are security-lead / the role title, NEVER the upstream person-name. Reference the upstream agent only by framework.skill.
Advisory-only: no write surfaces (§3 advisory-by-default).
fails closed: any script you add must never report success when the thing it claims did not happen (feat: implement issue #737 — [Phase 1] Instrument auto-rebase: agentic-conflict-resolution rate + fan-out CI-run volume report #755) — though this story is manifest/prompt/eval content, not scripts.
Do NOT create the org team (that is the epic's session step T) and do NOT register in canary-rings (draft doesn't need it).

Acceptance criteria

validate-personas.py passes with the new manifest (5→6 personas).
validate-cases.py passes over the new seed evals.
markdownlint clean on the README.
The advisory prompt carries the marker rule and the no-literal-handle rule verbatim from the qa-lead template.

Blocked by: #1306. Epic: #1304.

Thanks for the well-structured issue and for tying it clearly to the epic and blocker! This looks straightforward to implement once #1306 merges — could you confirm whether prompts/qa-lead/advisory.md should be treated as the canonical template verbatim (with only domain-specific sections swapped), or whether any structural changes to the advisory format are expected before this story is picked up?

Dev-Lead Implementation Plan

Issue: #1309 — [bmad-onboard S3] Onboard security-lead persona

Scope

Onboard security-lead as an advisory-only persona (status: draft) wrapping the vendored bgr-agent-sam-security agent, following the exact pattern of qa-lead/scrum-master.

Implementation Checklist

personas/security-lead/persona.yml — framework-agent layer → frameworks/bmad-bgreat-suite/src/agents/bgr-agent-sam-security, framework.name: bmad-bgreat-suite, vendor_pin: ae8914e84b87, skill: bgr-agent-sam-security; address.handle: petry-projects/security-lead; advisory on mention/issues/discussion; evals.path: evals/security-lead/; canary.agent: security-lead
prompts/security-lead/advisory.md — copy of prompts/qa-lead/advisory.md specialized to threat modeling / SOC2-HIPAA-PCI-GDPR compliance / supply-chain; marker ; marker rule + no-literal-handle rule verbatim
personas/security-lead/README.md — what it is, addressing (org team handle, never bare @security-lead), status draft, overlap note re: agents/compliance-auditor.md + dependency-audit (advisory, not a replacement)
evals/security-lead/{dev,holdout}/cases.jsonl — ≥2 synthetic/de-identified cases each

Tests to Write

N/A — pure manifest/prompt/eval content. Validation is provided by existing validators (validate-personas.py, validate-cases.py, markdownlint). Phase 2 TDD exception noted per CLAUDE.md.

Test Command

python3 personas/validate-personas.py personas && python3 evals/validate-cases.py evals/security-lead && npx markdownlint-cli2 personas/security-lead/README.md && bash .dev-lead/scripts/dev-lead-lint.sh

Dev-Lead: Implementation Complete

Plan Execution

personas/security-lead/persona.yml — status draft; framework-agent layer → frameworks/bmad-bgreat-suite/src/agents/bgr-agent-sam-security; framework.name: bmad-bgreat-suite, vendor_pin: ae8914e84b87 (matches VENDOR.md), skill: bgr-agent-sam-security; address.handle: petry-projects/security-lead; advisory on mention/issues/discussion with opt_out_label: security-lead:hands-off; evals.path: evals/security-lead/; canary.agent: security-lead
prompts/security-lead/advisory.md — copied from qa-lead template and specialized to threat modeling / SOC2·HIPAA·PCI·GDPR compliance / supply-chain; reads vendored SKILL.md by path; advisory-only; body marker ; marker rule + no-literal-handle rule carried verbatim
personas/security-lead/README.md — what it is, addressing via org team handle (never the bare @security-lead account), status draft, and the overlap note (advisory, not a replacement for agents/compliance-auditor.md or dependency-audit.yml)
evals/security-lead/{dev,holdout}/cases.jsonl — 3 dev + 4 holdout synthetic/de-identified cases (draft is exempt from the count gate; expand before promotion)

Test Results

$ python3 personas/validate-personas.py personas
OK: 6 persona manifest(s) valid, invariants hold.        # 5 -> 6 personas

$ python3 evals/validate-cases.py
OK: 10 skill(s), 82 case(s) across dev+holdout, no cross-split id overlap.

$ npx markdownlint-cli2 personas/security-lead/README.md
Summary: 0 issues in 0 files

$ bash .dev-lead/scripts/dev-lead-lint.sh
  [lint] all checks passed

Files Changed

personas/security-lead/persona.yml: new advisory persona manifest (draft)
prompts/security-lead/advisory.md: read-only/sentinel/marker advisory contract
personas/security-lead/README.md: persona docs incl. addressing + overlap note
evals/security-lead/dev/cases.jsonl, evals/security-lead/holdout/cases.jsonl: seed held-out cases

Notes

Phase 2 (TDD) exception: this story is pure manifest/prompt/eval content with no scripts — validation is provided by the repo's existing validators (validate-personas.py, validate-cases.py, markdownlint, dev-lead-lint.sh), all green above.
The marker rule and no-literal-handle rule are byte-identical to the qa-lead template (verified via diff).
Deliberately not done (per issue constraints): no org team created, no canary-rings.json registration (draft does not need it), no write surfaces, no scripts.

feat: implement issue #1309 — [bmad-onboard S3] Onboard security-lead…

Navigation Menu

Repository navigation

[bmad-onboard S3] Onboard security-lead persona #1309

Task

Constraints

Acceptance criteria

Dev-Lead Implementation Plan

Scope

Implementation Checklist

Tests to Write

Test Command

Dev-Lead: Implementation Complete

Plan Execution

Test Results

Files Changed

Notes

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[bmad-onboard S3] Onboard security-lead persona #1309

Description

Task

Constraints

Acceptance criteria

Activity

github-actions commented on Jul 18, 2026

don-petry commented on Jul 18, 2026

Dev-Lead Implementation Plan

Scope

Implementation Checklist

Tests to Write

Test Command

don-petry commented on Jul 18, 2026

Dev-Lead: Implementation Complete

Plan Execution

Test Results

Files Changed

Notes

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions