{
  "schemaVersion": 1,
  "name": "security-review-writer",
  "description": "Registers one constrained tool for security-scan workers to atomically create or overwrite UTF-8 text only within the current project's ai-workspace/security-reviews directory.",
  "topic": "Constrained persistence of security-scan review artifacts within a project-local review root.",
  "scope": "Resolve absolute and relative review paths against the current project, enforce containment beneath ai-workspace/security-reviews, reject traversal, outside paths, symlink escapes, directories, and existing parents resolving outside the root, then atomically write UTF-8 text without overriding Pi's built-in write tool.",
  "nonGoals": [
    "General-purpose file writing or reading.",
    "Security scanning, review generation, or report interpretation.",
    "Writing outside ai-workspace/security-reviews.",
    "Overriding Pi built-in tools, including write.",
    "Managing permissions, encryption, credentials, or remote storage."
  ],
  "tags": [
    "security-review",
    "atomic-write",
    "path-containment",
    "worker-agent"
  ],
  "capabilities": [
    "security-review-write-atomic",
    "security-review-path-containment",
    "security-review-symlink-defense"
  ],
  "requiredExecutables": [],
  "optionalExecutables": [],
  "overrides": [],
  "benchmarkBudgets": {
    "darwin": {
      "hotPathMs": 10
    },
    "linux": {
      "hotPathMs": 10
    },
    "win32": {
      "hotPathMs": 10
    }
  }
}