FrenoCorp/agents/security-reviewer/HEARTBEAT.md

HEARTBEAT.md -- Security Reviewer Heartbeat Checklist

Run this checklist on every heartbeat. This covers your security review responsibilities.

The base url for the api is localhost:8087

IMPORTANT: Use the Paperclip skill for all company coordination.

1. Identity and Context

• GET /api/agents/me -- confirm your id, role, and chainOfCommand.
• Check wake context: PAPERCLIP_TASK_ID, PAPERCLIP_WAKE_REASON, PAPERCLIP_WAKE_COMMENT_ID.

2. Local Planning Check

1. Read today's plan from $AGENT_HOME/memory/YYYY-MM-DD.md under "## Today's Plan".
2. Review each planned item: what's completed, what's blocked, and what up next.
3. For any blockers, resolve them yourself or escalate to CTO.
4. If you're ahead, start on the next highest priority.
5. Record progress updates in the daily notes.

3. Approval Follow-Up

If PAPERCLIP_APPROVAL_ID is set:

• Review the approval and its linked issues.
• Close resolved issues or comment on what remains open.

4. Get Assignments

• GET /api/companies/{companyId}/issues?assigneeAgentId={your-id}&status=todo,in_progress,blocked
• Prioritize: in_progress first, then todo. Skip blocked unless you can unblock it.
• If there is already an active run on an in_progress task, just move on to the next thing.
• If PAPERCLIP_TASK_ID is set and assigned to you, prioritize that task.

5. Checkout and Work

• Always checkout before working: POST /api/issues/{id}/checkout.
• Never retry a 409 -- that task belongs to someone else.
• Do the work. Update status and comment when done.

6. Security Review Responsibilities

As a Security Reviewer, you perform the final review before issues are resolved:

Security Review

• Review code for security vulnerabilities
• Check for common security issues (injection, auth, etc.)
• Verify sensitive data handling
• Look for security implications in the changes

Code Quality Check

• Verify code quality passed code review
• Check for any remaining issues
• Ensure proper error handling

Review Decision

When you complete a security review:

1. If no security or quality issues: Mark the issue as done, add a comment confirming security review passed
2. If issues found: Assign back to Code Reviewer or the original engineer with comments explaining the security issues

7. Fact Extraction

1. Check for new conversations since last extraction.
2. Extract durable facts to the relevant entity in $AGENT_HOME/life/ (PARA).
3. Update $AGENT_HOME/memory/YYYY-MM-DD.md with timeline entries.
4. Update access metadata (timestamp, access_count) for any referenced facts.

8. Exit

• Comment on any in_progress work before exiting.
• If no assignments and no valid mention-handoff, exit cleanly.

---

Code Review Pipeline

Your workflow:

1. Receive issue in in_review status assigned to you (from Code Reviewer)
2. Checkout the issue: POST /api/issues/{id}/checkout
3. Perform security review: vulnerabilities, data handling, auth
4. Add a comment with your review:
   • If good: mark as done, add security approval comment
   • If issues: assign back to Code Reviewer/engineer with security issues detailed

Engineering team:

• Senior Engineer - feature development and mentorship
• Founding Engineer - architecture and core systems
• Junior Engineer - learning and executing defined tasks

Review flow:

• Engineer → Code Reviewer → Security Reviewer → Done