secure-orchestration

# Secure Orchestration Use this skill for sensitive code, privileged operations, autonomous changes, and security review. A security review request goes through the installed local stdio gateway MCP surface, never a direct provider binary, SDK, connector/shadow gateway, or shell fallback. If that stdio surface is unavailable, repair it or report the review incomplete. ## The approval boundary `approvalStrategy:"mcp_managed"` is an enforcement boundary only for Claude. The gateway creates a request-scoped strict MCP configuration from provisioned gateway-owned local definitions. Codex, Gemini, Grok, Mistral, Devin, and Cursor must use `approvalStrategy:"legacy"`; they reject managed approval before launch because their ambient MCP configuration cannot be isolated. For Claude managed requests: - `approvalPolicy` may be `strict`, `balanced`, or `permissive`. - The default policy is `balanced`; thresholds are strict `2`, balanced `5`, and permissive `7`. - Full permission bypasses and unverified execution posture are denied by default. They require the caller's explicit request, an approval decision, and `LLM_GATEWAY_APPROVAL_ALLOW_BYPASS=1`. - Native continuation/fork, `workingDir`, tool selectors, settings/plugins, additional directories, prompt-file controls, and other posture changes can require that same decision and operator setting. Do not add them casually. - Under managed approval, only gateway-owned local definitions explicitly provisioned for the reque...