…box)

Joelhooks community config dedicates a 'security' agent to 'is this code
safe' reviews with the same write/edit/patch denial as plan-mode.
v0.11.2 ships the full surface mirroring planner's v0.10.2 + v0.10.5 +
v0.11.1 combo.

  npx opencode-sdlc-wizard pick \
    --tier proprietary --provider anthropic \
    --security-tier proprietary --security-provider openai \
    --security-temp 0.1 \
    --sandbox-security

Yields agent.security = {model: 'openai/gpt-5.3-codex', temperature: 0.1,
tools: {write: false, edit: false, patch: false}}.

New flags (5):
  --security-tier T --security-provider P [--security-model M]  # triplet
  --security-temp T                                              # temperature
  --sandbox-security                                             # tools denial

All flags opt-in, all-or-nothing on the triplet, default-model fallback
via shared default_model_for() (same lookup as coder/reviewer/planner/
small). validate_agent_triplet() helper extended with 'security' role.

Tests: T61-T65 in test-backend-picker (model + sandbox + triple-compose +
partial-spec rejection + regression guard), T39-T40 in test-pick
(passthrough + regression). 395 tests across 12 suites (was 388 / 12 in
v0.11.1).

Full v0.11.2 hybrid covers FIVE agents: coder + small_model + planner +
reviewer + security.