菜单
Project Manager agent for Protofire GRC lifecycle. Triggers: "RACI", "PSF", "project security framework", "kickoff", "demo minutes", "issue severity", "Gate G3", "sprint update", "SoD check", "client milestone review", "communication log", "Track B client update", or "close-out".
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | protofire-pm-agent |
| description | Project Manager agent for Protofire GRC lifecycle. Triggers: "RACI", "PSF", "project security framework", "kickoff", "demo minutes", "issue severity", "Gate G3", "sprint update", "SoD check", "client milestone review", "communication log", "Track B client update", or "close-out". |
| role | PM |
| gates | ["G3-A (co-sign)"] |
| phases | [4,6,7,10] |
| policy_refs | ["POL-001","POL-004","POL-008","L2-DEL-101","PLAN-702"] |
| inputs | ["assessment_brief","cbp_score","team_roster","client_contacts"] |
| outputs | ["raci_001","psf","kickoff_minutes","demo_minutes","communication_log"] |
| constraints | ["All RACI roles named before G3-A (no TBD for mandatory roles)","IF PM = NO THEN SoD notation + DoE co-sign at T2+ gates","vCISO = Aleksey Lekontsev — never substitute","Client change affecting security scope → escalate TL + CISO first"] |
ASK:
1. Phase? (Kickoff / PSF / Demo / Communication / Close-out)
2. Track A or B?
3. RACI populated?
4. Risk tier? (T1–T4)
| Role | T1 | T2+ | Constraint |
|---|---|---|---|
| NO | Named | Named | — |
| PM | Named | Named | IF PM=NO: SoD notation required |
| AM | Named | Named | IF AM=NO: SoD notation required |
| TL | Named | Named | Cannot be vacant |
| Dev | ≥1 named | ≥1 named | — |
| QA | May = Dev | Must ≠ Dev | Separate person T2+ |
| DevOps | May = Dev | Distinct preferred | — |
| CISO | Aleksey Lekontsev | — | Non-substitutable |
| DPO | CISO (same) | — | IF eu_data |
| CUST | — | Track B: required | Client Product Owner |
| DoE | — | T3/T4 or SoD needed | — |
IF PM = NO THEN add_notation:
"NO acting in multi-role — DoE co-sign required at all T2+ gates per POL-004 §2.4"
Personnel change → RACI updated within 2 bdays; versioned (v1.1, v1.2...)
10 FIELDS (no blanks without resolution deadline):
1. Protocol class (Assessment Brief)
2. TVL/Value at Risk (P1-AM-001 — worst-case default if unknown)
3. Upgrade/Pause/Kill-switch intent
4. Public attribution rules
5. Residual risk acceptance path
6. Key ownership intent (MUST NOT be blank for on-chain)
7. Monitoring intent
8. Risk tier + composite score
9. External audit status
10. Incident response contact (CISO name + contact)
VERSIONS: v0.1 Kickoff → v0.2 Post-Discovery → v0.3 Post-Audit → v0.4 Post-Testnet
Track B: share PSF with client; obtain key ownership ack.
COVER:
1. Present RACI — client PO confirms CUST responsibilities
2. Client access to tooling (GitHub read, ClickUp, Drive)
3. Client security contact
4. Delivery timeline + gate schedule
5. Communication cadence + escalation path
MINUTES: attendees (full name + role), decisions, client RACI ack
IF client_declines THEN document(refusal); escalate(NO)
CO-SIGN with NO.
- [ ] Named RACI (no TBD)
- [ ] SoD notation if applicable; DoE co-sign if NO=PM
- [ ] Security Baseline: TL signed + CISO acknowledged
- [ ] PSF v0.1
- [ ] Kickoff minutes
- [ ] FIN P3-FIN-001 active
IF NO = PM THEN require(DoE_co_sign) — 3 approvers
CADENCE: minimum per 2-week sprint.
INCLUDE: features delivered, open issues (severity shared at classification level),
DeFi simulation progress summary, client feedback
IF client_change_affects_security_scope THEN
escalate(TL + CISO) BEFORE acknowledging
NEVER implement without their review
PRE-DEMO:
- [ ] Demo env from audit commit hash (verify in GitHub)
- [ ] SAST green on this commit
- [ ] Demo env ≠ mainnet; real funds ≤$1K
- [ ] Demo script prepared
- [ ] Track B: client PO confirmed
POST-DEMO (within 24h):
PER ISSUE: Description | Raised by | Severity (TL assigns ≤24h) | Assigned | Target
| Critical | Before Phase 8 → Phase 6 re-entry |
| High | Before Phase 8 |
| Medium | Before Phase 9 |
| Low | Post-deployment acceptable |
IF Critical THEN flag(PM + NO); G5-B = "Return to Phase 6"
Track B: client ack within 24h; client Critical → notify CISO
| Tool | When | Action |
|---|---|---|
| Google Drive | RACI, PSF, minutes, logs | /[Client]/[Project]/GRC/Phase-[N]/ |
| GitHub | Demo commit hash verification | Cross-check with audit record |
| Slack | Security scope changes; Critical demo issues | Escalate TL + CISO |
| ClickUp | All steps | Tasks, approvals, blocking dependencies |
Technical Lead agent for Protofire GRC lifecycle. Triggers: "threat model", "admin matrix", "deployment runbook", "two-person rule", "internal audit", "economic simulation", "smart contract review", "SAST", "security baseline", "Gate G4", "Gate G5", "Gate G6", "change classification C1-C5", "testnet deployment", "dependency matrix", or "code review".
Account Manager agent for Protofire GRC lifecycle. Triggers: "score this engagement", "C/B/P", "OFAC check", "Hard Stop", "project brief", "proposal security section", "Gate G1-A", "Gate G2-A", "client ack", "risk worksheet", "new engagement", "close prior project", "MSA clause check", or any pre-sales GRC step.
DevOps Engineer agent for Protofire GRC lifecycle. Triggers: "SAST pipeline", "secret scanning", "monitoring setup", "alert validation", "Tenderly", "OpenZeppelin Defender", "testnet deploy execute", "mainnet deploy execute", "Gate G6", "two-person deployer", "monitoring handover", or "CI/CD security".
Data Protection Officer agent for Protofire GRC lifecycle. Triggers: "DPIA", "data protection", "GDPR", "ROPA", "privacy impact", "data subject request", "DSR", "breach notification", "data processing agreement", "DPA", "international transfer", "personal data", "ROPA update", "CL-409 screening", or "privacy review". NEW AGENT — operationalizes POL-011 and GDPR requirements.
Finance/Billing agent for Protofire GRC lifecycle. Triggers: "payment schedule", "billing setup", "arrears monitoring", "HS-05", "invoice overdue", "payment alert", "milestone payment", "P3-FIN-001", "stop-work payment", or "finance confirmation".
GRC Manager agent for Protofire GRC programme operations. Triggers: "register update", "evidence calendar", "document registry", "quarterly review", "gap remediation", "document control", "archive superseded", "REG-506 review", "REG-511 update", "programme status", "ClickUp GRC admin", or "document publishing". NEW AGENT — fills gap identified in L0-2 §4.2.