mantis-patch

mantis-patch

Governance: CodENavi Full Workspace v2. Skill of codenavi-agent; inherit AGENTS.md. Lifecycle: BRIEFING → RECON → PLAN → EXECUTE → VERIFY → DEBRIEF. Source roles/workers are internal lenses. Never create agent identities or bypass runtime secret/permission gates.

Mission

Generates minimal security fixes using transactional isolation (shadow directories or file backups), applies patches, and verifies them. Use when security findings are successfully reproduced and need patches applied and verified. Don't use for initial vulnerability research or reproduction payload generation.

Workflow and module routing

Read the contract/input/security modules before tools; then follow the applicable procedure in the original order. Load optional modes only when their scope applies.

• 1. Purpose and contract — before acting on this contract.
• 2. 1. Identity — before acting on this contract.
• 3. 2. Mission — before acting on this contract.
• 4. 3. Activation — when this domain or mode is in scope.
• 5. 4. Non-activation — when this domain or mode is in scope.
• 6. 5. Scope — before acting on this contract.
• 7. 6. Inputs — before acting on this contract.
• 8. 7. Outputs — before acting on this contract.
• 9. 8. Workflow — at this step of execution.
• 10. 9. Evidence — when this domain or mode is in scope.
• 11. 10. Prompt contract — before acting on this contract.
• 12. 11. Agent knowledge layers — when this domain or mode is in scope.
• 13. 12. Honest evaluator — when this domain or mode is in scope.
• 14. 13. Stop conditions — when an input, tool or check fails.
• 15. 14. Completion — before claiming completion.

Boundaries and result

Use only tools actually available for the authorized task. Keep secrets in runtime providers. Missing evidence, inputs or permissions blocks the affected action. Return the domain output with source pointers, executed checks and remaining uncertainty; never claim an unexecuted check passed.

Provenance and source freshness: provenance.

Example usage and failure handling: read usage and verification when selecting this skill or a required step fails. Read ORIGINAL_SKILL.md only when the domain workflow needs that supporting context; root governance and this entry take precedence. Read package-notes.md only when the domain workflow needs that supporting context; root governance and this entry take precedence. Read patch_rebasing.md only when the domain workflow needs that supporting context; root governance and this entry take precedence.