Deepen ISMS integration across agents and skills; add missing OSS governance and threat modeling skills by Copilot · Pull Request #1829 · Hack23/blacktrigram

Copilot · 2026-04-17T18:50:58Z

Repo-level agents were shallow on ISMS policy context, missed modern Copilot coding-agent features, and referenced two skills (open-source-governance, threat-modeling-enforcement) that didn't exist. 12 skills also lacked YAML frontmatter.

Agents (10 rewritten, `tools: ["*"]`, no `mcp-servers` block, all < 10 KB)

Explicit links to applicable Hack23 ISMS policies (Information Security, Secure Development §3.3/§3.4, Open Source, Vulnerability Management, Cryptography, Access Control, Incident Response, Data Classification, AI Governance, Threat Modeling, Change Management, BCP, Compliance Checklist)
task-agent — documents assign_copilot_to_issue / create_pull_request_with_copilot with base_ref, custom_instructions, custom_agent; stacked-PR chaining; get_copilot_job_status
coding-agent / frontend-specialist — OWASP Top 10, CWE Top 25, input validation at boundaries, no dangerouslySetInnerHTML with user data, CSP-friendly patterns
game-developer — fixed-timestep physics, delta clamping, seeded PRNG for deterministic combat, resource disposal
testing-agent / test-engineer — SAST/DAST/SCA gates, per-module coverage thresholds, regression test for every remediated CVE, pinned actions
security-specialist — OSSF Scorecard ≥ 8 targets, license allow-list, CRA/NIS2/GDPR/EU AI Act, incident SLAs
code-review-agent — security checklist tied to Secure Development Policy §3.3/§3.4
documentation-writer — full 12-doc C4 portfolio (current + future), ISMS evidence currency
korean-martial-arts-expert — 11 martial arts, safety framing, educational vs how-to-harm distinction

Skills (29 total)

New skills/open-source-governance/SKILL.md — license allow-list, OSSF Scorecard posture, pinned deps + pinned actions (SHA), CycloneDX SBOM, signed releases, community-respect rules; ISO 27001 A.5.19–22, NIST CSF GV.SC, CIS 2/7/16, SLSA L3, EU CRA Annex I
New skills/threat-modeling-enforcement/SKILL.md — STRIDE per trust boundary, MITRE ATT&CK mapping (web + T1195.x supply chain), attack trees in Mermaid, DFD currency rules, quarterly + post-incident cadence
Added YAML frontmatter to 12 skills (ai-governance, accessibility-wcag-patterns, code-quality-excellence, data-protection, documentation-standards, gdpr-compliance, incident-response, input-validation, risk-assessment-frameworks, secrets-management, typescript-strict-patterns, vulnerability-management)

Index docs

agents/README.md — corrected MCP description (session-level via .github/copilot-mcp.json, not per-agent frontmatter), normalized all Tool Access rows to ["*"], added ISMS policy table, removed stale MCP mermaid; kept < 30 KB
skills/README.md — added ISMS Policy Map, registered the two new skills (chore(deps-dev): bump typescript-eslint from 8.32.1 to 8.33.0 #13, Add IntroScreen and TrainingScreen components with tests #14), bumped to v2.1

Frontmatter shape used for repo-level agents

---
name: <agent-name>
description: <short domain + ISMS anchor>
tools: ["*"]
---

No mcp-servers block — MCP is session-level, uniform across agents.

…best practices Agent-Logs-Url: https://github.com/Hack23/blacktrigram/sessions/45e0cafb-538a-44ae-ba59-fecf6b6792f3 Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>

…x 12 missing frontmatters; update agents/skills README with ISMS map Agent-Logs-Url: https://github.com/Hack23/blacktrigram/sessions/45e0cafb-538a-44ae-ba59-fecf6b6792f3 Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>

github-actions · 2026-04-17T18:51:27Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

Copilot

Pull request overview

Deepens Hack23 ISMS policy integration across repository-level Copilot agents and skills, adds the previously referenced-but-missing OSS governance and threat modeling skills, and standardizes YAML frontmatter across skills for consistent metadata.

Changes:

Rewrites/expands repo agents to include explicit ISMS policy mapping, updated Copilot coding-agent workflow patterns, and standardized tools: ["*"].
Adds new skills for open-source-governance and threat-modeling-enforcement, and registers them in the skills catalog.
Adds YAML frontmatter to multiple existing skills and updates skills/agents index docs to reflect the expanded catalog.

Reviewed changes

Copilot reviewed 26 out of 26 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/skills/vulnerability-management/SKILL.md	Adds YAML frontmatter metadata for vulnerability management skill.
.github/skills/typescript-strict-patterns/SKILL.md	Adds YAML frontmatter metadata for strict TypeScript enforcement skill.
.github/skills/threat-modeling-enforcement/SKILL.md	Introduces new threat modeling skill (STRIDE/MITRE/attack trees) and required artifacts.
.github/skills/secrets-management/SKILL.md	Adds YAML frontmatter metadata for secrets handling skill.
.github/skills/risk-assessment-frameworks/SKILL.md	Adds YAML frontmatter metadata for risk assessment skill.
.github/skills/open-source-governance/SKILL.md	Introduces new OSS governance skill (licenses, Scorecard, SBOM/SLSA, pinned actions/deps).
.github/skills/input-validation/SKILL.md	Adds YAML frontmatter metadata for boundary input validation skill.
.github/skills/incident-response/SKILL.md	Adds YAML frontmatter metadata for incident response skill.
.github/skills/gdpr-compliance/SKILL.md	Adds YAML frontmatter metadata for GDPR/NIS2/CRA-oriented compliance skill.
.github/skills/documentation-standards/SKILL.md	Adds YAML frontmatter metadata for documentation standards skill.
.github/skills/data-protection/SKILL.md	Adds YAML frontmatter metadata for data protection skill.
.github/skills/code-quality-excellence/SKILL.md	Adds YAML frontmatter metadata for code quality skill.
.github/skills/ai-governance/SKILL.md	Adds YAML frontmatter metadata for AI governance skill.
.github/skills/accessibility-wcag-patterns/SKILL.md	Adds YAML frontmatter metadata for WCAG accessibility skill.
.github/skills/README.md	Updates skill catalog: adds ISMS policy map, registers new skills, version bump.
.github/agents/testing-agent.md	Enhances testing agent guidance with ISMS-linked security testing patterns and updated stack references.
.github/agents/test-engineer.md	Expands CI/testing gate strategy (SAST/SCA/licensing/Scorecard) and coverage threshold guidance.
.github/agents/task-agent.md	Updates orchestration agent to document modern Copilot coding-agent workflows and adds ISMS policy map.
.github/agents/security-specialist.md	Expands supply-chain + application security guidance with ISMS policy stewardship and EU alignment.
.github/agents/korean-martial-arts-expert.md	Broadens martial arts scope and adds governance/safety framing and authenticity standards.
.github/agents/game-developer.md	Updates game-dev agent with deterministic loop/physics guidance, observability, and ISMS references.
.github/agents/frontend-specialist.md	Strengthens secure UI boundary rules, WCAG guidance, and ISMS references for frontend work.
.github/agents/documentation-writer.md	Expands documentation portfolio expectations (C4 current/future) and ISMS traceability requirements.
.github/agents/coding-agent.md	Updates coding agent with explicit ISMS alignment, secure coding standards, and updated project structure guidance.
.github/agents/code-review-agent.md	Expands review checklist to include ISMS policy references and supply-chain/security/a11y gates.
.github/agents/README.md	Updates agent catalog to reflect 29 skills, ISMS policy integration, and session-level MCP configuration guidance.

Copilot · 2026-04-17T18:56:57Z

+const FIXED_STEP = 1 / 60;
+const MAX_DELTA = 1 / 30;      // clamp to prevent spiral-of-death
+let accumulator = 0;

-```
 useFrame((state, delta) => {
-  const dt = Math.min(delta, 0.05); // clamp to prevent spiral-of-death
+  const dt = Math.min(delta, MAX_DELTA);
  accumulator += dt;
  while (accumulator >= FIXED_STEP) {
-    physicsStep(FIXED_STEP);        // deterministic physics
+    physicsStep(FIXED_STEP);   // deterministic physics
    accumulator -= FIXED_STEP;
  }
-  interpolateRender(accumulator / FIXED_STEP); // smooth visual
+  interpolateRender(accumulator / FIXED_STEP);


The fixed-timestep useFrame example uses a plain let accumulator = 0; in the snippet. In a React component this value can reset on re-render and can also be confusing about lifetime/ownership. Consider modeling accumulator as a ref (and similarly any step state) so the example is copy-paste safe and matches React+R3F patterns for persistent mutable state.

Copilot · 2026-04-17T18:56:57Z

+
 ### 🏗️ Architecture & Documentation

 #### 13. [c4-architecture-documentation](./c4-architecture-documentation/SKILL.md)


The skill catalog numbering is now duplicated: after adding items "#### 13" and "#### 14" in the Security & Compliance section, the Architecture & Documentation section still starts at "#### 13" / "#### 14". This makes cross-references ambiguous and will drift further as new skills are added. Consider renumbering subsequent sections to keep a single monotonic sequence across the whole catalog (or remove the numeric prefixes entirely and rely on headings/anchors).

Suggested change

#### 13. [c4-architecture-documentation](./c4-architecture-documentation/SKILL.md)

#### 15. [c4-architecture-documentation](./c4-architecture-documentation/SKILL.md)

github-actions · 2026-04-17T19:03:05Z

📸 Automated UI Screenshots

📋 Screenshots Captured (8)

#	Screenshot
1	`01-splash-screen.png` - 01 splash screen.png
2	`02-intro-screen-menu.png` - 02 intro screen menu.png
3	`03-intro-screen-archetype-selector.png` - 03 intro screen archetype selector.png
4	`04-controls-screen.png` - 04 controls screen.png
5	`05-philosophy-screen.png` - 05 philosophy screen.png
6	`06-training-screen.png` - 06 training screen.png
7	`07-combat-screen-practice.png` - 07 combat screen practice.png
8	`08-combat-screen-versus.png` - 08 combat screen versus.png

📦 Download Screenshots

📥 Download all screenshots from workflow artifacts

Screenshots are preserved as workflow artifacts for 30 days.

🤖 Generated by Playwright automation

Copilot AI and others added 2 commits April 17, 2026 18:41

Enhance 10 repo-level agents with ISMS policy integration and modern …

ae53fc5

…best practices Agent-Logs-Url: https://github.com/Hack23/blacktrigram/sessions/45e0cafb-538a-44ae-ba59-fecf6b6792f3 Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>

Copilot AI assigned Copilot and pethers Apr 17, 2026

Copilot created this pull request from a session on behalf of pethers April 17, 2026 18:51 View session

github-actions bot added documentation Documentation updates infrastructure CI/CD and build infrastructure labels Apr 17, 2026

pethers marked this pull request as ready for review April 17, 2026 18:51

pethers self-requested a review as a code owner April 17, 2026 18:51

Copilot AI review requested due to automatic review settings April 17, 2026 18:51

pethers merged commit 2562af8 into main Apr 17, 2026
7 checks passed

pethers deleted the copilot/improve-agent-capabilities-documentation branch April 17, 2026 18:52

Copilot started reviewing on behalf of pethers April 17, 2026 18:53 View session

Copilot AI reviewed Apr 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deepen ISMS integration across agents and skills; add missing OSS governance and threat modeling skills#1829

Deepen ISMS integration across agents and skills; add missing OSS governance and threat modeling skills#1829
pethers merged 2 commits intomainfrom
copilot/improve-agent-capabilities-documentation

Copilot AI commented Apr 17, 2026

Uh oh!

github-actions bot commented Apr 17, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 17, 2026

Uh oh!

Copilot AI Apr 17, 2026

Uh oh!

github-actions bot commented Apr 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		### 🏗️ Architecture & Documentation

		#### 13. [c4-architecture-documentation](./c4-architecture-documentation/SKILL.md)

	#### 13. [c4-architecture-documentation](./c4-architecture-documentation/SKILL.md)
	#### 15. [c4-architecture-documentation](./c4-architecture-documentation/SKILL.md)

Conversation

Copilot AI commented Apr 17, 2026

Agents (10 rewritten, tools: ["*"], no mcp-servers block, all < 10 KB)

Skills (29 total)

Index docs

Frontmatter shape used for repo-level agents

Uh oh!

github-actions bot commented Apr 17, 2026

Dependency Review

Scanned Files

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Apr 17, 2026

📸 Automated UI Screenshots

📋 Screenshots Captured (8)

📦 Download Screenshots

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Agents (10 rewritten, `tools: ["*"]`, no `mcp-servers` block, all < 10 KB)