C/C++ Security Review

Resolve four parameters, make one Workflow call, return the report. The workflow owns concurrency, retries and result collection.

Use for: native C/C++ userspace, memory safety, integer overflow, races, type confusion, Linux/macOS daemons, Windows services.

Not for: kernel drivers or modules; managed languages (Java, C#, Python, Go, Rust); embedded or bare-metal code with no libc.

Phase 0, Parameters

Parse any free text on the invocation line (flamenco only, high severity only, use haiku) and pre-fill what it implies. Then make one AskUserQuestion call for whatever is still unresolved. Never silently default a required parameter.

Parameter	Values	Inferring it from the invocation
threat_model	REMOTE / LOCAL_UNPRIVILEGED / BOTH	"remote", "network", "attacker" → REMOTE; "local", "unprivileged" → LOCAL_UNPRIVILEGED; otherwise ask
worker_model	haiku / sonnet / opus / inherit	An explicit model name. Otherwise ask. inherit uses the session model
severity_filter	all / medium / high	"all", "every", "noisy" → all; "medium and above" → medium; "high only" → high; otherwise ask
scope_subpath	repo-relative directory, optional	"X only", "just audit X/" → the matching subdirectory, fuzzy-matched against top-level dirs. Absent → .. Ambiguous → ask

Two scopes stay separate for the whole run:

• finding_scope_root = scope_subpath (default .), a finding must live inside it, and it is the tree the unit list is generated from.
• context_roots = ., read freely to establish callers, build flags and reachability. Narrow it to finding_scope_root only if the user explicitly forbids wider reading, and say that reachability confidence drops when you do.

Phase 1, Resolve paths