Rosetta weekly, Mon 27.07 – Sun 02.08

[omaiesh]

Big one this week: Rosetta now does security reviews. Starting now use /workflow commands for rosetta to fully work.

New /security-flow workflow and security skill. Eight phases, each a mandatory specialist subagent: readiness, authorize, deterministic gates, threat model, inspect and test, triage, independent review, report. The secret gate runs before any source reaches a model and returns filenames only, never values. Active testing is bounded to approved pre-production. Production active testing is prohibited, and secret hits above QA stop the run with no override. It never fixes anything either, it hands you concise inputs for a later coding session. That takes Rosetta to 13 SDLC workflows.

🛡️ Security of the repo itself, too. An external OSS review published 25.07 named our gaps. Most are closed: CodeQL scanning on every push and PR, new CI pipelines for hooks / rosetta-cli / rosetta-mcp (hooks was the one item the review called genuinely missing), 7 Dependabot alerts patched, and blanket Bash(*) grants in CI replaced with explicit read-only allowlists. All CI model calls now route through the Bifrost gateway. Our dispositions on all 98 review rows are published.

⚙️ Codex users can now directly invoke workflows. They used to ship as flat docs you could only read. Now they're real skills, same as Antigravity.

📋 Repo automation left Jira and Confluence entirely. Issues, board, and knowledge base all on GitHub now.

🚧 Guardrails tightened around higher environments. dangerous-actions now flatly states higher envs are never allowed, and risk-assessment names stage and pre-prod explicitly instead of leaving "production" to be read narrowly.

🧠 Reliability tuning: LARGE tasks now delegate everything to subagents instead of always standing up a full execution controller, subagents must process work in small batches instead of reading 30 files at once, and every workflow declares its state file by exact path.

Plugins and marketplace are on 3.1.6, rosettify and rosettify-plugins on 3.2.0.

Full details: https://github.com/griddynamics/rosetta/blob/main/CHANGELOG.md#week-mon-2707--sun-0208