openwork/warden.toml at dev · ModaOperandi/openwork · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
version = 1

# Warden gates clearance on blocking findings from three skills:
# diff-security-review and confidentiality-review (all findings block) and
# desktop-den-sync-review (only high findings block; medium findings are
# advisory). The clearance itself is granted by
# .github/workflows/warden-clearance.yml.

[defaults]
reportOn = "low"
ignorePaths = [
  "**/node_modules/**",
  "**/pnpm-lock.yaml",
  "**/dist/**",
  "**/*.min.js",
]

[defaults.agent]
model = "openai/gpt-5.6-luna"

# Auxiliary verifies/merges findings and gates what survives to the report;
# keep it on the same strong model so weak verification can't cause a false
# clearance.
[defaults.auxiliary]
model = "openai/gpt-5.6-luna"

[[skills]]
name = "diff-security-review"

[[skills.triggers]]
type = "pull_request"
actions = ["opened", "synchronize", "reopened"]
draft = false

# Lets developers run `warden` locally on uncommitted changes before pushing.
[[skills.triggers]]
type = "local"

# Public repo: customer/prospect/partner identities must never land in the
# tree (see AGENTS.md, Confidentiality).
[[skills]]
name = "confidentiality-review"

[[skills.triggers]]
type = "pull_request"
actions = ["opened", "synchronize", "reopened"]
draft = false

[[skills.triggers]]
type = "local"

[[skills]]
name = "spec-provenance-review"
paths = ["evals/specs/**", "evals/worlds/**"]

[[skills.triggers]]
type = "pull_request"
actions = ["opened", "synchronize", "reopened"]
draft = false

[[skills.triggers]]
type = "local"

[[skills]]
name = "desktop-den-sync-review"
paths = [
  "apps/app/**",
  "apps/desktop/**",
  "ee/apps/den-api/**",
  "packages/types/**",
]

[[skills.triggers]]
type = "pull_request"
actions = ["opened", "synchronize", "reopened"]
draft = false

[[skills.triggers]]
type = "local"