@event4u/agent-config 16.5.0 → 17.0.0

package/dist/agent-src/skills/threat-modeling/data/threats.csv

@@ -1,21 +1,35 @@
-Surface Class,Threat,Source Refs,Abuse Case,Required Controls,Negative Tests,Severity
-authentication,Credential stuffing / brute force,"ATT&CK T1110, CWE-307",Attacker replays breached credential lists against login,Rate-limit per account+IP; lockout with jitter; breached-password check; MFA,Test: >N failed logins → 429/lockout; lockout not bypassable via case-variant email,HIGH
-authentication,Session fixation / insufficient invalidation,"CWE-384, ATT&CK T1563",Attacker fixes a session id pre-login or reuses one post-logout/password-change,Rotate session id on login + privilege change; invalidate all sessions on password reset,Test: session id differs pre/post login; old token rejected after reset,HIGH
-authentication,Password-reset token abuse,CWE-640,Attacker enumerates/reuses reset tokens or intercepts via referrer leak,"Single-use, short-TTL, hashed-at-rest tokens; uniform response on unknown email; no token in URL logs",Test: token unusable twice; expired token rejected; response identical for known/unknown email,HIGH
-authorization,IDOR / missing object-level check,"CWE-639, OWASP API1",Authenticated user swaps an id in the request and reads/writes another user's object,Object-level ownership check in policy (never only route middleware); deny-by-default,"Test: user A GET/PUT on B's resource id → 403/404, for EVERY verb",CRITICAL
-authorization,Privilege escalation via mass assignment,CWE-915,Attacker posts role/is_admin fields the endpoint binds blindly,Explicit allowlist DTO/fillable; server-side role assignment only via admin flow,Test: POST with role=admin → field ignored AND audit-logged,HIGH
-tenancy,Cross-tenant read via unscoped query,CWE-639,Missing tenant_id scope on a query/report/export leaks another tenant's rows,Global scope at the ORM/repository layer; tenant from session never from request; scoped test fixtures,Test: tenant A token + tenant B resource id across list/show/export/report → empty/403,CRITICAL
-tenancy,Cross-tenant write via background job,CWE-862,Queued job re-resolves tenant from payload an attacker influenced,Jobs carry tenant context sealed at dispatch; consumer re-asserts scope before write,Test: forged job payload with foreign tenant_id → rejected,HIGH
-file-upload,Malicious file / polyglot upload,"CWE-434, ATT&CK T1105",Attacker uploads webshell/polyglot accepted by extension-only check,Content-sniff + allowlist MIME; store outside webroot with random names; never execute; AV scan if executable risk,Test: .php/.svg-with-script renamed .jpg → rejected or neutralized; direct URL fetch of stored file cannot execute,HIGH
-file-upload,SSRF via user-supplied URL,"CWE-918, ATT&CK T1090",URL-fetch feature pointed at cloud metadata / internal services,Deny private/link-local ranges post-DNS-resolution; scheme allowlist; egress proxy; response-size cap,Test: http://169.254.169.254/ and DNS-rebinding host → blocked,CRITICAL
-external-integration,Webhook forgery / replay,CWE-345,Attacker posts forged or replayed events to the webhook consumer,HMAC signature verification with rotation; timestamp tolerance window; idempotency key store,Test: bad signature → 401; stale timestamp → rejected; duplicate event id processed once,HIGH
-public-endpoint,Resource exhaustion / scraping,"CWE-770, ATT&CK T1499",Unauthenticated endpoint hammered for DoS or bulk data harvest,Rate limit + cache; no expensive queries pre-auth; pagination caps; no PII in public responses,Test: response carries rate-limit headers; page size capped server-side,MEDIUM
-billing,Race condition on balance / double-spend,CWE-362,Parallel requests redeem the same credit/refund twice,DB-level constraint or SELECT FOR UPDATE / idempotency key on money mutations; ledger over mutable balance,Test: N parallel redeems of one voucher → exactly one success,CRITICAL
-billing,Price/amount tampering,CWE-602,Client-supplied price or currency trusted at checkout,Recompute amounts server-side from catalog; signed cart or server-held cart only,Test: tampered client amount → server total unchanged,CRITICAL
-secrets,Secret leakage via logs / errors / VCS,"CWE-532, ATT&CK T1552","Key appears in exception payload, debug log, or committed .env",Centralized secret manager; logger redaction list; pre-commit secret scan; scoped short-lived tokens,Test: forced exception on auth path → no credential substring in log sink,HIGH
-data-exposure,Over-broad serializer / API resource,"CWE-213, OWASP API3","Serializer returns internal fields (cost, flags, foreign tenant refs) the UI ignores but attackers read",Explicit field allowlist per resource; separate admin vs public serializers; contract test on response shape,Test: schema-diff response against documented contract → no undocumented fields,MEDIUM
-infrastructure,Unrestricted ingress to a management or database port,"CWE-1327, ATT&CK T1190",Attacker reaches SSH/RDP or a database engine straight from the internet because a security-group or firewall rule allows 0.0.0.0/0,"Deny-by-default ingress; management and database ports reachable only via bastion, VPN, or private link; CIDR scoped to known ranges; never 0.0.0.0/0 on 22/3389/3306/5432/6379/27017","Test: a rule with cidr_blocks 0.0.0.0/0 on a management or database port is rejected. Decided by: NO CHECK IN THIS REPOSITORY - nothing here parses HCL or cloud config; the deciding check is the consumer's own IaC policy scanner",CRITICAL
-infrastructure,Object storage public by default,"CWE-732, OWASP A05",Bucket or container created without a block-public-access setting so any object URL is world-readable,Block public access at account AND bucket level; explicit policy allowlist instead of a public ACL; serve objects via signed URLs or a CDN origin identity,"Test: storage created with no explicit public-access block is rejected; anonymous GET of a stored object returns 403. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own IaC policy scanner or a cloud posture tool",HIGH
-infrastructure,Missing encryption at rest or in transit,"CWE-311, CWE-319",Volume snapshot bucket or database instance created with no encryption block; endpoint accepts a plaintext connection,Encryption block mandatory on every storage and database resource; customer-managed key where the data class requires it; TLS-only bucket policy and listener; reject plaintext listeners,"Test: a storage or database resource with no encryption block is rejected; a plaintext connection to the endpoint is refused. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own IaC policy scanner",HIGH
+Surface Class,Threat,Source Refs,Abuse Case,Required Controls,Negative Tests,Severity
+authentication,Credential stuffing / brute force / password spraying,"ATT&CK T1110, CWE-307, ASVS 5.0 V6 Authentication","Attacker replays breached credential lists against login, or sprays one common password across many accounts so no single account trips its own counter; the code resend, the MFA challenge and the invite endpoint are hit the same way and are usually left unthrottled","Rate-limit per account and per source, and separately on the failure rate across accounts so spraying is visible where a per-account counter is not; lockout with jitter; breached-password check; MFA; throttle the one-time-code resend, the MFA challenge and the invite endpoint like the login itself, and never let a resend reset the failure counter; recovery stays reachable while an account is throttled, so throttling is not a denial of service against the owner; admit the verifier's cost for an unknown identity too, so response time does not say which addresses exist","Test: >N failed logins -> 429/lockout; lockout not bypassable via case-variant email, a Unicode-equivalent address, or a rotated source address; one password tried across many accounts trips the cross-account rate; a code resend does not reset the counter; response time for a known and an unknown identity is not separable. Decided by: NO CHECK IN THIS REPOSITORY - nothing here exercises a consumer's login endpoint; the deciding check is the consumer's own test suite",HIGH
+authentication,Session fixation / insufficient invalidation,"CWE-384, ATT&CK T1563",Attacker fixes a session id pre-login or reuses one post-logout/password-change,Rotate session id on login + privilege change; invalidate all sessions on password reset,Test: session id differs pre/post login; old token rejected after reset,HIGH
+authentication,Password-reset token abuse,CWE-640,Attacker enumerates/reuses reset tokens or intercepts via referrer leak,"Single-use, short-TTL, hashed-at-rest tokens; uniform response on unknown email; no token in URL logs",Test: token unusable twice; expired token rejected; response identical for known/unknown email,HIGH
+authentication,Account enumeration through an observable difference,"CWE-204, CWE-203, CWE-208, ASVS 5.0 V6 Authentication","The login, reset, sign-up or verification response says whether an email address is already registered: a different message, status code, redirect target or cookie, or an early return before the verifier runs, tells the attacker which account exists","One response shape for known and unknown identities at every identity entry point; the verifier path runs for an unknown identity too; sign-up for an address that already exists returns the same response as a new one and mails the owner a notice instead; a deliberately disclosing flow is a written project decision recorded with the flow, never a default and never a defect when it is written down","Test: a known and an unknown identity produce the same status, body category, redirect and cookies on login, reset request, sign-up and verification resend; sign-up for a registered address emits a notice to the owner and no distinguishing response. Decided by: NO CHECK IN THIS REPOSITORY - nothing here runs a consumer's identity flow; the deciding check is the consumer's own test suite, written as the equivalence case test-case-discovery names",HIGH
+authentication,Unverified email ownership granting privilege,"CWE-287, CWE-640, ASVS 5.0 V6 Authentication","An address nobody proved they control reaches a privileged state: sign-up grants access before verification, a mail scanner's GET on the verification or magic link consumes it before the person sees it, or two concurrent requests both spend a verification token that was never single-use","No privilege before proven ownership; the link's GET is safe and the state change needs an explicit confirmation a scanner will not perform; the token is single-use, short-lived and consumed atomically under concurrency; a resend invalidates the previous token; changing the address returns the account to the unverified state",Test: an account whose address is unverified cannot reach the privileged action; a plain GET on the verification link does not consume it; two concurrent consumptions of one token yield exactly one success; a resend makes the previous token unusable. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own test suite,HIGH
+authentication,Password acceptance weakened by composition and handling rules,"CWE-521, ASVS 5.0 V6 Authentication","Composition rules, forced periodic rotation, a low maximum length, a blocked paste or a missing breached-and-common screen push people towards predictable passwords the attacker already holds","Accept the length and character range the authority sets, without composition rules and without scheduled rotation; rotate on evidence of compromise only; allow paste and password managers; screen against a breached-and-common list; normalise Unicode before the check; every value defers to ASVS 5.0 V6 Authentication and NIST SP 800-63B, never to this corpus",Test: a long passphrase and a pasted password are accepted; a password on the breached list is refused with a reason the person can act on; no scheduled expiry forces a change. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own test suite against the authority named in Required Controls,MEDIUM
+authentication,Fast or home-made password storage,"CWE-916, CWE-759, ASVS 5.0 V6 Authentication, ASVS 5.0 V11 Cryptography","Passwords stored under a general-purpose hash, salted or not, or under a hand-rolled salt scheme, so a stolen table is cracked at speed; or an over-long input is silently truncated at the algorithm's own limit; or the pepper sits in the repository or in the same store as the hash","A password hashing function the authority names, with its parameters taken from the authority and never from this corpus; never a general-purpose hash - MD5, SHA-1 and every SHA-2 included, salted or not - and never an invented salt scheme; the salt is per-password and generated by the library; rehash on a successful login once the parameters have moved; refuse or pre-digest an input past the algorithm's own length limit rather than truncating it; a pepper, where one is used, lives outside the credential store with a rotation plan and is never a literal in the tree - its absence is not a finding","Test: the stored value is produced by the platform's password hashing API and checked through its verify primitive, never by comparing digests; an input past the algorithm's limit is refused or pre-digested, never silently cut; a login under outdated parameters rewrites the stored value. Decided by: PARTIAL CHECK IN THIS REPOSITORY - ai-code-blindspots carries a password-scoped fast-hash grep that catches the authoring-time shape; the deciding check is the consumer's own test suite and static analysis",CRITICAL
+authentication,Unsafe secret comparison and home-made credential primitives,"CWE-208, CWE-338, ASVS 5.0 V11 Cryptography","A token, one-time code, signature or MAC compared with the language's ordinary equality leaks its prefix through timing; or the project mints its own token or one-time code from a non-cryptographic source an attacker can predict from a seed","Compare every secret with the platform's constant-time primitive and respect that primitive's length precondition; draw every token, one-time code and salt from the platform's cryptographically secure random source; never invent a credential primitive where the library ships one","Test: no equality operator compares a token, one-time code, signature or MAC anywhere on the identity path; codes drawn repeatedly show no sequence reproducible from a seed. Decided by: PARTIAL CHECK IN THIS REPOSITORY - ai-code-blindspots carries a raw-secret-equality grep that catches the authoring-time shape; the deciding check is the consumer's own test suite and static analysis",HIGH
+authentication,Password reset beyond the token,"CWE-640, CWE-362, ASVS 5.0 V6 Authentication, ASVS 5.0 V7 Session Management","The reset link is built from an attacker-controlled Host header, or leaks through the Referrer of a third-party asset on the reset page; or the reset signs the person straight in, leaves the other sessions alive, satisfies the second factor, or is spent twice by concurrent requests","Build the link from server configuration, never from a request header; no third-party asset and no secret in the query string on the reset page; the reset ends every other session and the remembered-device state; it does not sign the person in and does not satisfy the second factor; single use enforced atomically under concurrency; the owner is notified on the channel that was already verified",Test: a forged Host header does not change the link's origin; the reset page loads no third-party asset; after a reset the pre-reset session token is rejected and a second factor is still demanded; two concurrent uses of one token yield exactly one success. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own test suite,HIGH
+authentication,Identity or credential change without fresh re-authentication or notice,"CWE-620, CWE-778, ASVS 5.0 V6 Authentication, ASVS 5.0 V16 Security Logging and Error Handling","A hijacked session can change the account's email address, phone number, password, MFA factor, passkey, recovery codes or a linked identity without proving the person is still present, and nobody is told: the channel that was already verified gets no notice, and a sign-in from an unrecognised device is silent","Every identity mutation demands fresh re-authentication at the assurance the factor being changed already carries; the previously verified address or number is notified and the change is reversible for a window the project states; a sign-in from an unrecognised device notifies the owner; each event is logged with actor, time and outcome, and never with the secret","Test: each identity mutation refuses without a fresh re-authentication, and a lower-assurance factor does not satisfy it; the previously verified channel receives the notice; the log line for each event carries no credential substring. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own test suite",HIGH
+authentication,MFA enforced only in the interface or undercut by its recovery path,"CWE-308, ASVS 5.0 V6 Authentication",The second factor is a screen the client can skip because the server already issued a full session; or the recovery path is weaker than the factor it replaces; or the TOTP seed sits in the credential store in plaintext and the backup codes are stored unhashed or stay valid after use,"The server issues no privileged session until the factor is verified - the challenge is a state the server holds, not a screen the client renders; recovery is at least as strong as the factor it replaces, and is itself throttled and notified; the shared seed is encrypted at rest under a key held outside the credential store; backup codes are hashed like passwords and are single-use; enrolling or removing a factor is an identity mutation under its own row",Test: a request that skips the challenge step reaches no privileged action; a backup code fails on its second use; the stored seed is not readable from the credential store alone. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own test suite,HIGH
+authentication,Persistent login and incomplete logout,"CWE-613, CWE-539, ASVS 5.0 V7 Session Management","A remember-me token lifted from a device reaches a sensitive action without a fresh login; or logout clears the client and leaves the server session, the remembered-device record and the federated session alive","A remembered session carries a lower assurance and never satisfies a sensitive action on its own; the remember-me token is per-device, rotated on use, and revocable from a session list the owner can see; logout invalidates the server-side state, the remember-me record and the cookie, and offers to end the federated session too; every session ends on a credential change","Test: a remembered session is re-challenged at a sensitive action; after logout the previous token is rejected server-side, not merely absent from the client; revoking a device from the session list rejects that device's token. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own test suite",MEDIUM
+authentication,Authentication token in script-readable browser storage,CWE-922,"A session, access or refresh token is written to localStorage, sessionStorage, IndexedDB or another store page script can read, so any injected script reads it and replays it from the attacker's own device for as long as the token lives","Carry the session in a cookie marked HttpOnly, Secure and SameSite, which page script cannot read; never persist a session, access or refresh token in Web Storage or IndexedDB; where an architecture requires a script-held bearer token, keep it in memory only, short-lived and narrowly scoped, and treat that as shortening the exposure rather than preventing theft during a script compromise; a cookie-borne session still needs the login and state-changing CSRF controls of its own rows","Test: after sign-in and after the federated callback, no session, access or refresh token value is present in localStorage, sessionStorage or IndexedDB, whether written with setItem or by property assignment; the session cookie carries HttpOnly, Secure and SameSite. Decided by: check_account_surface reports the setItem and property-assignment writes lexically; the deciding check is the consumer's own browser test suite",HIGH
+authentication,Federated sign-in account takeover,"CWE-287, CWE-352, ASVS 5.0 V10 OAuth and OIDC","A provider sign-in is linked on email equality, so any identity provider that lets an attacker assert someone else's mailbox takes the local login over; or an email claim the provider never verified is trusted; or the authorization response is never bound to the request that began it, or arrives from a different issuer than the one the flow asked","Identity is issuer plus subject, never the address alone; an unverified email claim links nothing and grants nothing; bind the response to the request with a state and a nonce checked server-side against the session that started the flow; pin the issuer and the audience per provider and refuse a response from any other; linking a provider onto an existing local account is an identity mutation under its own row",Test: a provider response carrying a known address but a different issuer or subject creates no link; an unverified email claim grants nothing; a response with a missing or replayed state is refused; a token minted for another audience is refused. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own test suite,CRITICAL
+authentication,Self-contained token validation bypass,"CWE-347, ASVS 5.0 V9 Self-contained Tokens","The verifier accepts an unsigned algorithm, takes the verification key from the token's own header, skips the issuer audience or expiry check, or accepts an ID token where an access token was required","Pin the accepted algorithms and the key source server-side; never read a key or a key location out of the token; check issuer, audience, expiry and not-before on every request; keep ID tokens and access tokens distinct and refuse the wrong kind; call the library's verify entry point rather than decoding the payload and inspecting claims by hand",Test: a token declaring no signature algorithm is refused; a token signed with a key named in its own header is refused; an expired token and a token for another audience are refused; an ID token presented as an access token is refused. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own test suite,CRITICAL
+authentication,Login cross-site request forgery,"CWE-352, ASVS 5.0 V6 Authentication","An attacker makes the victim's browser log in to an account the attacker controls, so the victim's later activity accrues to it; the federated callback is the same shape when its state is not bound to the session",The login form and the federated callback carry a per-request anti-forgery token bound to the pre-login session; the session identifier rotates on login; the post-login landing performs no action on a cross-site request,Test: a cross-site POST to the login endpoint without the bound token is refused; the session identifier differs before and after login. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own test suite,MEDIUM
+authentication,Signup abuse and disposable addresses as a policy choice,"CWE-799, ASVS 5.0 V2 Validation and Business Logic","Automated sign-up drains invites, trial credit, outbound mail reputation or a free tier; the reflex is a disposable-domain blocklist that also shuts out privacy-conscious people and quietly becomes a third-party call on the registration path","State the product's posture first - allow, warn, challenge or block - because the right answer differs between a consumer product and a paid B2B one; this is a policy row and names no list: any blocklist or reputation feed is a consumer dependency the consumer owns and ages; never a synchronous third-party call per registration request - decide asynchronously and degrade to allow when the dependency is unreachable; throttle and cost the sign-up path itself; verification before privilege carries most of the weight a blocklist is reached for","Test: registration completes with the reputation dependency unreachable; the posture is written down with the flow and the implemented outcome matches it; a scripted burst of sign-ups from one source is throttled. Decided by: NO CHECK IN THIS REPOSITORY - this is a product policy, not a defect class; the deciding check is the consumer's own written posture and test suite",MEDIUM
+authorization,IDOR / missing object-level check,"CWE-639, OWASP API1",Authenticated user swaps an id in the request and reads/writes another user's object,Object-level ownership check in policy (never only route middleware); deny-by-default,"Test: user A GET/PUT on B's resource id → 403/404, for EVERY verb",CRITICAL
+authorization,Privilege escalation via mass assignment,CWE-915,Attacker posts role/is_admin fields the endpoint binds blindly,Explicit allowlist DTO/fillable; server-side role assignment only via admin flow,Test: POST with role=admin → field ignored AND audit-logged,HIGH
+tenancy,Cross-tenant read via unscoped query,CWE-639,Missing tenant_id scope on a query/report/export leaks another tenant's rows,Global scope at the ORM/repository layer; tenant from session never from request; scoped test fixtures,Test: tenant A token + tenant B resource id across list/show/export/report → empty/403,CRITICAL
+tenancy,Cross-tenant write via background job,CWE-862,Queued job re-resolves tenant from payload an attacker influenced,Jobs carry tenant context sealed at dispatch; consumer re-asserts scope before write,Test: forged job payload with foreign tenant_id → rejected,HIGH
+file-upload,Malicious file / polyglot upload,"CWE-434, ATT&CK T1105",Attacker uploads webshell/polyglot accepted by extension-only check,Content-sniff + allowlist MIME; store outside webroot with random names; never execute; AV scan if executable risk,Test: .php/.svg-with-script renamed .jpg → rejected or neutralized; direct URL fetch of stored file cannot execute,HIGH
+file-upload,SSRF via user-supplied URL,"CWE-918, ATT&CK T1090",URL-fetch feature pointed at cloud metadata / internal services,Deny private/link-local ranges post-DNS-resolution; scheme allowlist; egress proxy; response-size cap,Test: http://169.254.169.254/ and DNS-rebinding host → blocked,CRITICAL
+external-integration,Webhook forgery / replay,CWE-345,Attacker posts forged or replayed events to the webhook consumer,HMAC signature verification with rotation; timestamp tolerance window; idempotency key store,Test: bad signature → 401; stale timestamp → rejected; duplicate event id processed once,HIGH
+public-endpoint,Resource exhaustion / scraping,"CWE-770, ATT&CK T1499",Unauthenticated endpoint hammered for DoS or bulk data harvest,Rate limit + cache; no expensive queries pre-auth; pagination caps; no PII in public responses,Test: response carries rate-limit headers; page size capped server-side,MEDIUM
+billing,Race condition on balance / double-spend,CWE-362,Parallel requests redeem the same credit/refund twice,DB-level constraint or SELECT FOR UPDATE / idempotency key on money mutations; ledger over mutable balance,Test: N parallel redeems of one voucher → exactly one success,CRITICAL
+billing,Price/amount tampering,CWE-602,Client-supplied price or currency trusted at checkout,Recompute amounts server-side from catalog; signed cart or server-held cart only,Test: tampered client amount → server total unchanged,CRITICAL
+secrets,Secret leakage via logs / errors / VCS,"CWE-532, ATT&CK T1552","Key appears in exception payload, debug log, or committed .env",Centralized secret manager; logger redaction list; pre-commit secret scan; scoped short-lived tokens,Test: forced exception on auth path → no credential substring in log sink,HIGH
+data-exposure,Over-broad serializer / API resource,"CWE-213, OWASP API3","Serializer returns internal fields (cost, flags, foreign tenant refs) the UI ignores but attackers read",Explicit field allowlist per resource; separate admin vs public serializers; contract test on response shape,Test: schema-diff response against documented contract → no undocumented fields,MEDIUM
+infrastructure,Unrestricted ingress to a management or database port,"CWE-1327, ATT&CK T1190",Attacker reaches SSH/RDP or a database engine straight from the internet because a security-group or firewall rule allows 0.0.0.0/0,"Deny-by-default ingress; management and database ports reachable only via bastion, VPN, or private link; CIDR scoped to known ranges; never 0.0.0.0/0 on 22/3389/3306/5432/6379/27017",Test: a rule with cidr_blocks 0.0.0.0/0 on a management or database port is rejected. Decided by: NO CHECK IN THIS REPOSITORY - nothing here parses HCL or cloud config; the deciding check is the consumer's own IaC policy scanner,CRITICAL
+infrastructure,Object storage public by default,"CWE-732, OWASP A05",Bucket or container created without a block-public-access setting so any object URL is world-readable,Block public access at account AND bucket level; explicit policy allowlist instead of a public ACL; serve objects via signed URLs or a CDN origin identity,Test: storage created with no explicit public-access block is rejected; anonymous GET of a stored object returns 403. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own IaC policy scanner or a cloud posture tool,HIGH
+infrastructure,Missing encryption at rest or in transit,"CWE-311, CWE-319",Volume snapshot bucket or database instance created with no encryption block; endpoint accepts a plaintext connection,Encryption block mandatory on every storage and database resource; customer-managed key where the data class requires it; TLS-only bucket policy and listener; reject plaintext listeners,Test: a storage or database resource with no encryption block is rejected; a plaintext connection to the endpoint is refused. Decided by: NO CHECK IN THIS REPOSITORY - the deciding check is the consumer's own IaC policy scanner,HIGH
 infrastructure,Wildcard IAM action or resource,"CWE-269, ATT&CK T1078.004",A role policy grants Action * or Resource * so one compromised workload credential reaches every service and object in the account,Enumerate actions and resource ARNs; one role per workload; permission boundary or service control policy on privileged roles; no wildcard outside a named reviewed exception,"Test: a policy document containing Action ""*"" or Resource ""*"" is rejected or carries a named exception. Decided by: NO CHECK IN THIS REPOSITORY - nothing here parses IAM policy documents; the deciding check is the consumer's own IaC policy scanner",CRITICAL
-infrastructure,Credential in an IaC or vars file instead of a secret manager,"CWE-798, ATT&CK T1552.001",Password token or key written as a literal into a .tf .tfvars or .yaml file and committed,Secret-manager reference or runtime-injected env var; never a literal in IaC or vars files; treat the state file as sensitive and store it encrypted with restricted access,"Test: a literal credential in a tracked IaC or vars file fails the build. Decided by: check_secret_leak (src/scripts/check_secret_leak.ts) inside THIS repository - it has no extension allowlist so .tf and .yaml are in scope; for a CONSUMER the deciding check is the gitleaks workflow the package ships as a template that the consumer must copy",HIGH
+infrastructure,Credential in an IaC or vars file instead of a secret manager,"CWE-798, ATT&CK T1552.001",Password token or key written as a literal into a .tf .tfvars or .yaml file and committed,Secret-manager reference or runtime-injected env var; never a literal in IaC or vars files; treat the state file as sensitive and store it encrypted with restricted access,Test: a literal credential in a tracked IaC or vars file fails the build. Decided by: check_secret_leak (src/scripts/check_secret_leak.ts) inside THIS repository - it has no extension allowlist so .tf and .yaml are in scope; for a CONSUMER the deciding check is the gitleaks workflow the package ships as a template that the consumer must copy,HIGH

package/dist/agent-src/skills/type-design/SKILL.md

@@ -0,0 +1,196 @@
+---
+model_tier: high
+name: type-design
+description: "Build an original font from lettering or a brief — measured spec, code-built outlines, gated build, rendered proof. Use to turn a wordmark into a font."
+domain: product
+personas:
+  - design-director
+workspaces:
+  - engineering
+packs:
+  - frontend-design
+trust:
+  level: experimental
+install:
+  removable: true
+scope:
+  write: []
+  verification_reason: "execution declares no handler, so this skill runs nothing of its own — every write is the calling agent's, under the rules that govern it. No command can prove a scope the skill never executes."
+execution:
+  type: manual
+---
+
+# type-design
+
+Design an original font as a **constructed system**: measure parameters, let
+code build every outline from measured parts, set spacing before kerning, and
+build through gates that measure outlines, metrics, coverage and fidelity — with
+a rendered proof the agent looked at. The model perceives, decides and judges;
+code writes every coordinate.
+
+The skill bundles no script and no font. It runs a pinned peer-side toolchain in
+the consumer's environment ([`references/toolchain.md`](references/toolchain.md)).
+
+## When to use
+
+- "Turn this wordmark into a font", "the rest of the alphabet in this lettering".
+- "Design an original display face for our brand" from a written brief.
+- A logo or a lettering image exists and the person wants a typeable family.
+
+## When NOT to use
+
+- Choosing or pairing existing fonts, or building a type scale →
+  `typography-system`.
+- Making a logo or a single mark → `logo-generation`; tracing one icon or mark
+  → `svg-authoring`; an icon font from an existing set → `iconography`.
+- Reproducing a typeface someone else published — license it instead (§ Rights gate).
+
+## The honest limit
+
+A coherent **display or brand family** — one weight, Latin, shared stems,
+overshoot and spacing — is in reach. **Text-grade optical refinement** (hinting,
+optical compensation at small sizes, a multi-weight interpolated family) is a
+type designer's work. Say so before the first build, and never label a result
+beyond what the gates showed (§ Maturity).
+
+## Rights gate — before any trace
+
+1. **Own or commissioned lettering** proceeds.
+2. **Lettering set in an existing typeface** — name the typeface and recommend
+   licensing it instead of reconstructing it. Proceed only on a stated decision
+   that the result is a different design.
+3. **A third party's mark** stops until its owner's rights are stated.
+4. **An origin the agent cannot establish** is treated as not owned, and asked
+   about. Never assume a lettering image is the person's own.
+
+Record the class (`own`, `commissioned`, `typeface-named`, `third-party`,
+`unknown`) in the spec's source block.
+
+## License — asked, never stamped
+
+Ask which license the new font carries. Record the answer in `font-spec.yaml`
+and in the font's name table (license description and URL). With no answer the
+license is `unknown`, written as such in both places. **Never** choose one on
+the person's behalf: a default license is a commitment made for someone else.
+
+## No freehand outlines
+
+The model never writes path data for a glyph by hand and never ships a freehand
+SVG glyph. To change a shape, change a spec parameter or a construction rule and
+let code rebuild. A glyph that cannot be expressed through the spec is a sign the
+spec is missing a parameter — add it.
+
+## Procedure
+
+0. **Toolchain** — install the pinned set from
+   [`references/toolchain.md`](references/toolchain.md) into an isolated
+   environment in the consumer tree. Missing and not installable → stop and say
+   which tool; never substitute a hand-written approximation.
+1. **Spec first** — write `font-spec.yaml` per
+   [`references/font-spec.md`](references/font-spec.md): units per em, vertical
+   metrics, stems, contrast, stress angle, overshoot, aperture, terminals,
+   spacing, the coverage tier, license and source blocks.
+2. **Path A — from lettering** (raster or SVG, including a wordmark just made by
+   `logo-generation` or `image-generation`):
+   1. **Ingest** — parse the SVG, or threshold and deskew the raster.
+   2. **Segment** — code splits the letters; the model labels a numbered
+      **contact sheet** of the segments, never the raw image by eye.
+   3. **Trace** with the fill rule declared and counters wound opposite to their
+      outer contour (`svg-authoring` § Trace to measure, construct to deliver).
+   4. **Measure** the spec from the traced letters, then **normalise** the
+      present letters to it, and extend per step 4.
+   5. A wordmark's one-off tweaks become **alternates or ligatures**, never the
+      default forms. A **signature letter** the brief names is a **locked
+      glyph**; its drift fails the fidelity gate.
+   6. A source below 600 px cap height (or an SVG under 1,000 units) is reported
+      as **low confidence** and cannot reach `validated-static` on fidelity —
+      a stated default, not a measured one; the benchmark is what can move it.
+3. **Path B — from a brief**: brief → spec with numbers → build `n o H O` →
+   render the proof sheet → the person asking **approves the four control
+   glyphs** before anything else is built. A rejection changes the spec, and
+   the four are rebuilt.
+4. **Construction order** — `n o H O` first, then the **derivation chains**:
+   n → h m u r · o → c e b d p q · H → E F I L T · O → C D G Q. Then the
+   diagonals (A K M N V W X Y k v w x y), then the free shapes (a g s S f t z and
+   the figures), then composites for diacritics through anchors — the German set
+   (ä ö ü Ä Ö Ü ß ẞ „ “ ‚ ‘) included when the tier asks for it.
+5. **Spacing before kerning** — sidebearings from edge classes first, kerning
+   classes only afterwards ([`references/gates.md`](references/gates.md) § 4).
+6. **Build and gate** — UFO source → compiled `ttf` and `woff2`. Run every gate
+   in [`references/gates.md`](references/gates.md); each prints a threshold and
+   a failure message to act on.
+7. **Rendered proof** — generate a proof SVG whose specimens are `<text>`
+   elements set in the new family (waterfall 12 to 72 px, `HHOHH nnonn`, every
+   letter between n and n and between o and o, the kerning strings, the wordmark
+   text), the built `woff2` in its own `@font-face`; witness the SVG itself
+   (an `.html` target reports no text — gates § 5):
+   ```bash
+   agent-config ui:render proof/proof.svg --profile asset
+   ```
+   The new family must read `loaded`. Open the PNG and state what you saw.
+8. **Fidelity (path A)** — the wordmark text set in the new font against the
+   source by silhouette IoU (gates § 6); produce the diff overlay and look at it.
+9. **Fallback** — emit the metric-matched fallback `@font-face` (gates § 7).
+10. **Repair budget** — a failing gate gets at most **three** repair rounds.
+    After that the QA report names the gate and the label stays below
+    `validated-static`.
+
+## Outputs — in the consumer tree
+
+UFO source, `font-spec.yaml`, built `woff2` and `ttf`, the proof page with its
+PNG, and the QA report — at the location `design-system-capture` conventions
+give the project's design-system assets, **never inside the package**. Record
+the family there as a custom family with its source and license.
+
+### Maturity — exactly one label
+
+| Label | Means |
+|---|---|
+| `concept` | spec and control glyphs exist; the tier is not covered |
+| `prototype` | the tier is covered and the font builds; at least one gate is open |
+| `validated-static` | every gate in `references/gates.md` that applies to the path is green (gate 6 applies to path A only), the witness read `loaded`, and the proof was looked at |
+
+Never a claim the run cannot show.
+
+## Output format
+
+1. **QA report** — coverage tier, maturity label, the license (or `unknown`),
+   the rights class, and each gate with its measured value, threshold and
+   result.
+2. **Witness reading** — the face state the asset profile reported for the new
+   family, the PNG path, and one sentence on what the agent saw in it.
+3. **Fidelity (path A)** — per-glyph and per-word IoU, the locked glyph's IoU,
+   the registration they were measured against, and the overlay path.
+4. **Files** — every output path, read back from disk, with byte size.
+
+## Gotcha
+
+- **A plausible font is not a system.** Glyphs that each look fine and share no
+  stems, overshoot or spacing pass a glance and fail the consistency gate —
+  run it, do not eyeball it.
+- **Same-direction counters paint solid.** Under `fill-rule: nonzero`, the default, an
+  `o` whose inner contour winds like its outer one fills its counter.
+- **Kerning cannot rescue spacing.** Kerning pairs on unspaced glyphs grow
+  without bound and still look uneven; set sidebearings first.
+- **The witness reads the face, not the look.** A fallback face that resembles
+  the new one reads `error` there — trust the state, not the screenshot.
+
+## Do NOT
+
+- Do NOT trace lettering whose rights class is `unknown`, or `third-party` until
+  the owner's rights are stated and it is recorded as `commissioned`.
+- Do NOT write or ship glyph path data by hand.
+- Do NOT stamp a license the person did not give.
+- Do NOT claim a coverage tier the font does not cover, or `validated-static`
+  with a gate open.
+- Do NOT write outputs into the package, or add a font binary to it.
+
+## See also
+
+Named rather than linked: some of these neighbours ship in other packs.
+
+- `typography-system` — choosing and pairing fonts; consumes a custom family.
+- `svg-authoring` — trace-to-measure and the counter rule this skill reuses.
+- `logo-generation`, `brand-identity` — where a wordmark is born and handed here.
+- `design-system-capture` — where the finished family is recorded.
+- `supply-chain-intake` — the gate every toolchain pin passed.

package/dist/agent-src/skills/type-design/references/font-spec.md

@@ -0,0 +1,90 @@
+# `font-spec.yaml` — the parameters every outline is built from
+
+The spec is the only place a shape decision lives. Code reads it and builds the
+outlines; the model changes it and lets code rebuild. A value the run measured
+carries `measured: true` and the glyphs it came from; a value the brief set
+carries `measured: false`.
+
+```yaml
+family: "Acme Display"
+style: "Regular"
+units_per_em: 1000
+
+vertical:                    # font units, baseline = 0
+  baseline: 0
+  x_height: 520
+  cap_height: 700
+  ascender: 760
+  descender: -220
+
+stems:                       # font units, measured by ray-cast (gates § 3)
+  lowercase_vertical: 92     # n h m u l i
+  lowercase_horizontal: 80   # e bar, t crossbar
+  capital_vertical: 100      # H I L
+  capital_horizontal: 86     # H bar, E arms
+
+contrast: 0.86               # thinnest / thickest stroke on o and O
+stress_angle: 0              # degrees from vertical; negative leans left
+overshoot:                   # share of x-height / cap height, 0.01–0.03
+  round: 0.015
+  pointed: 0.010
+aperture: 0.42               # opening of c e s a, share of the bowl width
+terminal: "flat"             # flat | angled | round | ball
+serif: "none"                # none | slab | bracketed | hairline
+
+spacing:                     # sidebearings in font units, per edge class
+  straight: 62
+  round: 38
+  diagonal: 8
+
+coverage: "latin-basic"      # wordmark | latin-basic | latin-de
+
+license:
+  id: "unknown"              # the answer the person gave, or unknown
+  url: ""
+  name_table: true           # written into the name table at build
+
+source:
+  path: "brand/wordmark.png" # path A; omitted for path B
+  rights: "own"              # own | commissioned | typeface-named | third-party | unknown
+  digest: "sha256:…"         # of the source file, so a later run knows it is the same image
+  resolution_confidence: "ok"   # ok | low
+  locked_glyphs: ["g"]       # signature letters; drift fails gates § 6
+```
+
+## Fields
+
+- **`units_per_em`** — 1000 unless the build target asks for 2048.
+- **`vertical`** — baseline, x-height, cap height, ascender, descender. The
+  vertical metrics tables are derived from these (gates § 2), never set apart
+  from them.
+- **`stems`** — lowercase and capitals, vertical and horizontal. Every straight
+  stroke a construction rule draws takes its width from here.
+- **`contrast`** and **`stress angle`** — the ratio of thin to thick on the
+  round letters and the axis it rotates around. A monoline face is `1.0` at
+  stress angle `0`.
+- **`overshoot`** — how far round and pointed letters cross the baseline and the
+  x-height or cap height, as a share of that height.
+- **`aperture`**, **`terminal`**, **`serif`** — the open letters' opening, how
+  strokes end, and what sits at their ends.
+- **`spacing`** — sidebearings per edge class, set on H, n, O and o before any
+  other glyph (gates § 4).
+- **`license`** — never filled by default (`SKILL.md` § License).
+- **`source`** — path A only: the file, its rights class from the rights gate,
+  its digest, whether its resolution is enough for fidelity, and the locked
+  glyphs.
+
+## Coverage tiers
+
+Defined by this skill, not copied from an external glyph-set definition. The
+tier is written into the spec and into the QA report, and nothing claims a tier
+it does not cover.
+
+| Tier | Glyphs |
+|---|---|
+| `wordmark` | the letters present in the source, plus their alternates and ligatures, plus `space` and `.notdef` |
+| `latin-basic` | A–Z, a–z, 0–9, `space`, `.notdef`, and `. , : ; ! ? ' " ‘ ’ “ ” - – — ( ) / & @ # % *` |
+| `latin-de` | `latin-basic` plus ä ö ü Ä Ö Ü, both forms of sharp s (ß and ẞ), and the German quotation marks „ “ ‚ ‘ |
+
+The coverage gate (gates § 1) lists every glyph the tier names and fails on any
+that is absent.

package/dist/agent-src/skills/type-design/references/gates.md

@@ -0,0 +1,113 @@
+# Gates — every one a peer-side command with a threshold
+
+<!-- reference-toc:start (generated by generate_reference_toc — do not edit) -->
+**Contents**
+
+- [1. Outline hygiene and coverage](#1-outline-hygiene-and-coverage)
+- [2. Vertical metrics](#2-vertical-metrics)
+- [3. System consistency](#3-system-consistency)
+- [4. Spacing before kerning](#4-spacing-before-kerning)
+- [5. Rendered proof](#5-rendered-proof)
+- [6. Source fidelity — path A](#6-source-fidelity--path-a)
+- [7. Metric-matched fallback](#7-metric-matched-fallback)
+<!-- reference-toc:end -->
+
+Each gate runs in the toolchain environment (`toolchain.md`) against the built
+UFO and the compiled `ttf`, prints its measured value beside its threshold, and
+on failure prints a message naming the glyph and what to change in the spec.
+A gate the run did not execute is reported as `not run`, never as passed.
+
+The thresholds below are stated defaults (own analysis). The reconstruction
+benchmark is what may move them; nothing else does.
+
+## 1. Outline hygiene and coverage
+
+- **Every contour closed.** An open contour fails with the glyph and the point
+  index.
+- **Counters per glyph** equal an expected table: o 1, e 1, a 1, b d p q 1,
+  A 1, D O P Q 1, R 1, B 2, 8 2, 0 1, 4 1 (closed form) or 0 (open form, as the
+  spec says), 6 1, 9 1, g 1 or 2 (single- or
+  double-storey, as the spec says). A filled or a doubled counter fails.
+- **Points at extrema** on every curve, within 1 unit.
+- **No contour under the size threshold** — an area below 0.05 % of the em
+  square is a stray fragment and fails.
+- **Direction correct for the outline format** — outer contours clockwise in
+  TrueType (`glyf`) output and counter-clockwise in CFF output, counters wound
+  opposite to their outer contour in both.
+- **Fill rule declared before overlap removal** — overlap removal runs on a
+  glyph only after its fill rule and contour directions are settled; running it
+  first is how a counter disappears.
+- **Coverage** — every glyph the spec's tier names exists and is non-empty
+  (`space` excepted). A missing glyph fails with the tier and the name.
+
+## 2. Vertical metrics
+
+- `OS/2` typo ascender, descender and line gap agree with `hhea` ascender,
+  descender and line gap.
+- Both line gaps are `0`.
+- `USE_TYPO_METRICS` (`OS/2.fsSelection` bit 7) is set.
+- `usWinAscent` and `usWinDescent` cover the family's extremes: the highest and
+  lowest point of any glyph, diacritics included. A clipped extreme fails with
+  the glyph.
+
+## 3. System consistency
+
+- **Stems by ray-cast at half x-height** — a horizontal ray at `x_height / 2`
+  across n h m u l i; every vertical stem it crosses is within **3 %** of the
+  spec's `lowercase_vertical`. Capitals the same at half cap height across
+  H I L E F T against `capital_vertical`.
+- **Overshoot** — o O e c s reach **1 to 3 %** beyond baseline and x-height or
+  cap height, and within 0.5 % of the spec's `overshoot.round`; pointed apexes
+  (A V W v w) within 0.5 % of `overshoot.pointed`.
+- **Ink area per glyph group** — the filled share of each glyph's advance box,
+  grouped (straight lowercase, round lowercase, capitals, figures), within
+  **±12 %** of its group's median. An outlier fails with the glyph.
+
+## 4. Spacing before kerning
+
+- **Sidebearings from edge classes first** — straight, round and diagonal edges
+  take the spec's `spacing` values. Set them on H, n, O and o, check `HHOHH`
+  and `nnonn` in the proof, and only then propagate to the derived glyphs.
+- **Kerning classes from edge groups only afterwards** — a kerning class is an
+  edge group, never a single glyph, except for a named exception pair.
+- **Collision check** — render the kerning strings (`AVATAR`, `To`, `Ty`, `LT`,
+  `P.`, `r,`, `f)` and their German counterparts for `latin-de`) and fail on any
+  two glyphs whose outlines intersect.
+- **Features built** — `kern`, `mark` (diacritic anchors), `liga` (where the
+  spec defines ligatures) and, where figures exist, `tnum`.
+- **Shaping confirms the features apply** — shape the kerning strings, an
+  accented word and a ligature through the shaping binding and fail when the
+  shaped advances or glyph ids equal the unshaped ones.
+
+## 5. Rendered proof
+
+The witness reading, not a gate script: `ui:render --profile asset` over the
+proof SVG reads `loaded` for the new family (`SKILL.md` step 7). `error`,
+`unloaded`, `timeout` or `synthesised` fails, and so does a reading with no text
+in it — the shape an HTML target produces. The agent has looked at the PNG.
+
+## 6. Source fidelity — path A
+
+Applies to path A only. On path B the QA report reads `not applicable` for this
+gate, which is neither `not run` nor passed.
+
+The wordmark text set in the new font, aligned to the source by baseline and
+cap height, compared by **silhouette IoU** with the method `svg-authoring` uses
+for a raster-to-vector conversion (saturated regions, registration recorded as
+`x,y,w,h` in the source's pixel frame, scorer and sample resolution named).
+
+- per glyph **≥ 0.90**
+- per word **≥ 0.85**
+- a **locked signature glyph ≥ 0.95**
+
+Produce the diff overlay (source and render in two colours, overlap neutral) and
+look at it. A source flagged `resolution_confidence: low` reports these numbers
+but cannot pass this gate.
+
+## 7. Metric-matched fallback
+
+Emit the fallback `@font-face` for the new family over a named local system face,
+with `size-adjust`, `ascent-override`, `descent-override` and
+`line-gap-override` derived from the built font's own tables — the derivation is
+the one in `docs/guidelines/design-asset-discipline.md` (the swapped-face
+bullet). That is what catalogue tell T12 asks a swapped webfont to carry.

package/dist/agent-src/skills/type-design/references/toolchain.md

@@ -0,0 +1,66 @@
+# Toolchain — pinned, peer-side, never bundled
+
+The package ships no Python and no font tooling. The type-design build runs in
+an isolated environment **in the consumer's tree**, from the exact versions
+below. A version moves only by a pull request that repeats the intake below for
+the new version — never floating, never `latest`.
+
+| Role | Package | Pin | License |
+|---|---|---|---|
+| outline library, compiler back end | `fonttools` | `fonttools==4.66.1` | MIT |
+| path booleans (overlap removal) | `skia-pathops` | `skia-pathops==0.9.2` | BSD-3-Clause |
+| UFO source library | `ufoLib2` | `ufoLib2==0.18.1` | Apache-2.0 |
+| font compiler | `fontmake` | `fontmake==3.12.1` | Apache-2.0 |
+| shaping binding (feature checks) | `uharfbuzz` | `uharfbuzz==0.56.2` | Apache-2.0 |
+| raster tracer | `vtracer` | `vtracer==0.6.15` | MIT |
+
+Write the pins to `.type-design/pins.txt` in the consumer tree:
+
+```text
+fonttools==4.66.1
+skia-pathops==0.9.2
+ufoLib2==0.18.1
+fontmake==3.12.1
+uharfbuzz==0.56.2
+vtracer==0.6.15
+```
+
+Create a virtual environment under `.type-design/`, install that file into it
+with the environment's own package installer, and freeze the resolved set to
+`.type-design/pins.lock`.
+
+Commit the lock file with the font sources: `fontmake` resolves further packages
+(`ufo2ft`, `glyphsLib`, `fontMath`), and the lock records which ones built this
+font. The raster tracer is MIT-licensed on purpose: a copyleft tracer is not the
+default builder.
+
+## Intake record — 2026-10-18
+
+Taken through `supply-chain-intake` against the live registry on 2026-10-18.
+The figures below are as that run reported them; the raw registry and OSV
+responses were not stored, so re-query the registry before relying on one.
+
+| Pin | Exists | Published | Downloads, last month | Known vulnerabilities |
+|---|---|---|---|---|
+| `fonttools==4.66.1` | yes | 2026-09-29 | 189,260,520 | none |
+| `skia-pathops==0.9.2` | yes | 2026-02-16 | 325,892 | none |
+| `ufoLib2==0.18.1` | yes | 2025-07-10 | 79,359 | none |
+| `fontmake==3.12.1` | yes | 2026-06-02 | 23,711 | none |
+| `uharfbuzz==0.56.2` | yes | 2026-09-21 | 1,509,780 | none |
+| `vtracer==0.6.15` | yes | 2026-03-23 | 477,912 | none |
+
+- **Existence and publish date** — the registry's JSON API for each package
+  and version; none is yanked.
+- **Age** — each pin is the newest release at least two weeks old on the intake
+  date. A newer release existed for `fonttools`, `ufoLib2`, `fontmake` and
+  `uharfbuzz` and was passed over for being days old.
+- **Compatibility** — `fontmake==3.12.1` requires `ufoLib2>=0.18.1` and
+  `fonttools>=4.59.2`; `ufoLib2==0.18.1` requires `fonttools>=4.58.0`. All six
+  need Python 3.11 or newer because `fonttools` does.
+- **Vulnerabilities** — the OSV database returned no advisory for any of the six
+  pinned versions. Run `pip-audit` over the frozen lock before the first build;
+  the intake covered the six named packages, not what they resolve.
+- **Typo-adjacency** — each registry entry declares its source repository
+  (`fonttools/fonttools`, `fonttools/skia-pathops`, `fonttools/ufoLib2`,
+  `googlei18n/fontmake`, `trufont/uharfbuzz`, and visioncortex for `vtracer`);
+  `potracer` and `pypotrace` were considered for tracing and rejected as GPL.