Contract + hub + web: built-in roles red-team, blue-team, purple-team (§2.3)
tsk-zca1cjmxn6we open
Oliver, 2026-10-29: the security teams as fixed built-in roles, not only as project roles.
Coordinator's proposal for the contract (§2.3 role table):
- red-team: attacks the project to find weaknesses and files them as bug cards with a severity; the tester's scopes (tasks:test). Its guide names the rule: only the targets the project allows (its own test or staging instance), never production or anyone else's systems; a finding is confidential until fixed.
- blue-team: defends — hardens, fixes findings, watches; the coder's scopes.
- purple-team: joins both — checks that a fix closes the attack, moves findings to done; the reviewer's scopes (tasks:review).
- Requests to role:red-team etc. work like role:designer (§7). The names join the built-in list that project roles may not reuse.
- Later (own card): the hub enforces red-team targets (a per-project allow list of hosts).
Contract first (oz-agent-a), then hub (role list, scopes, test_scopes table) and web (role picker, labels).
Oliver, 2026-10-29: fixed built-in roles, part of Maity itself (maity.dev). Put red/blue/purple teams to work on Maity from next week; until then the tokens go to development and reviews. Later a full pass for efficiency and security. Contract can be written now; staffing waits.