When it fires
Fires when the turn smells like risk: audit this repo, a sonar-project.properties at the root, CVE, secrets or OWASP.
You do not pick this room from a menu. You write the work and the radar lights it if the turn belongs to it.
[ ROOM / 001 ]
security001 / 011
Security
/// one of eleven · the rest off
A case
«audit the security of this repo» injects the defensive context and the model pairs an OWASP pass with a real reading of the code. Each finding arrives with severity, file:line, an attack story and a minimum fix.
That is the kind of prompt that should light it without you typing the id. If the radar is often wrong in your repo, the fix is in the pack's triggers, not in memorising /domains every morning.
The sister
Border with Compliance: Security looks at attackers, Compliance looks at duties. A Security finding cites file and line; a Compliance finding cites a GDPR article, a WCAG criterion or an SPDX id, and never invents the reference.
Sister file: Compliance. Both can be enabled at once. On a given turn only one context travels.