feat(#1309): add mandatory finding for agent behavior definition changes

[fullsend-ai-coder]

Add a new Platform Security rule to the code-review skill that instructs the review agent to always produce a finding when a diff modifies files that define agent behavior. This closes a governance gap where the review agent could silently approve changes to its own skill definitions, agent definitions, harness configs, or policy files without flagging them for human review.

The rule covers four file patterns: skills//SKILL.md, agents/.md, harness/.yaml, and policies/.yaml. Severity is info for additive changes and medium for modifications that relax existing checks or remove constraints.

Note: make lint could not run due to Go module cache permission errors in the sandbox (infrastructure issue, not code-related). This is a Markdown-only change with no Go code modifications.

---

Closes #1309

Post-script verification

• Branch is not main/master (agent/1309-agent-behavior-review-rule)
• Secret scan passed (gitleaks — eda1e12306a7a4393c077260bcd5acde491b8649..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

Site preview

Preview: https://31dbed02-site.fullsend-ai.workers.dev

Commit: d29ca18f5d61ef927266b1b78cf45e8cb98c69e3

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:13 PM UTC · Completed 5:22 PM UTC
Commit: 4ed6da4 · View workflow run →

[fullsend-ai-review]

Review

Findings

Low

• [logic-error] internal/scaffold/fullsend-repo/skills/code-review/SKILL.md:143 — The new "Agent behavior definition changes" rule does not specify an explicit category name for findings. The existing "Permission manifest changes" rule also omits inline categories (its categories are defined in sub-agents/security.md), so this follows the existing pattern. However, without corresponding categories in the security sub-agent definition, the pr-review routing table will fall back to the correctness dimension for re-review severity anchoring. Consider adding category directives (e.g., agent-behavior-modification) to sub-agents/security.md and the routing table.

• [logic-error] internal/scaffold/fullsend-repo/skills/code-review/SKILL.md:143 — The security sub-agent's "Own" section does not explicitly list agent behavior definition files. The sub-agent receives the Security section of SKILL.md as context (which contains the mandatory-finding directive), so it will likely follow the rule regardless. Adding agent behavior files to the sub-agent's "Own" section would improve clarity and consistency.

• [formatting-consistency] internal/scaffold/fullsend-repo/skills/code-review/SKILL.md:150 — Uses **Medium** with uppercase "M". The canonical severity list and existing rules use all lowercase (**high**, **medium**). Should be **medium** for consistency.

Info

• [agent-behavior-definition] internal/scaffold/fullsend-repo/skills/code-review/SKILL.md:143 — This diff modifies a skill definition file that controls how the review agent evaluates changes. The modification is additive: it introduces a new mandatory-finding rule for agent behavior definition files. The change expands review coverage and does not relax or weaken any existing check. This PR is self-referential — the new rule would flag this very PR, which is the correct and intended behavior.

• [design-coherence] internal/scaffold/fullsend-repo/skills/code-review/SKILL.md — The proposed rule aligns with established governance principles (no agent self-modification) documented in governance.md and security-threat-model.md.

• [scope-authorization] internal/scaffold/fullsend-repo/skills/code-review/SKILL.md — The PR correctly traces to issue code-review skill: mandatory finding when diff modifies review agent behavior files #1309. The implementation matches the issue description. Scope is appropriate and authorized.

[fullsend-ai-review]

[low] logic-error

The new rule does not specify an explicit category name for findings. Without corresponding categories in the security sub-agent definition and the pr-review routing table, re-review severity anchoring will route findings for this rule to the correctness dimension instead of security. Consider adding category directives (e.g., agent-behavior-modification) to sub-agents/security.md and the routing table.

[fullsend-ai-review]

[low] logic-error

The security sub-agent Own section does not explicitly list agent behavior definition files. Adding them would improve clarity and consistency with the mandatory-finding directive in SKILL.md.

[fullsend-ai-review]

[low] formatting-consistency

Uses Medium with uppercase M. The canonical severity list and existing rules use all lowercase. Should be medium for consistency.