name: security-fix
max_budget: 8.00

steps:
  - name: audit
    type: split
    get:
      context:
        - bash: "gosec ./... 2>&1 || true"
      prompt: |
        Analyze the security scan results.
        Produce a task for each vulnerability with the fix strategy and affected files.
    run:
      agent: claude-opus
    gate: [schema]
    hitl: before_gate
    each:
      - name: fix
        type: code
        get:
          prompt: |
            Fix this vulnerability: {task.description}
            Write a regression test proving the fix.
            Only modify: {task.files}
        run:
          agent: claude-sonnet
          guard:
            max_turns: 40
        gate: [compile, test, "touched: *_test.*"]
        retry:
          - attempt: 3
            agent: claude-opus
          - exit: 4

  - name: quality
    gate: [compile, test]