security-mcp 1.1.3 → 1.3.1

package/skills/compliance-grc/SKILL.md

@@ -146,3 +146,88 @@ Structure:
 - `releaseBlocked`: boolean
 - `releaseBlockers[]`: specific findings preventing release
 - `evidencePaths[]`: file paths of generated evidence artifacts
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{
+  "findingId": "FINDING_ID",
+  "agentName": "AGENT_NAME",
+  "resolved": true,
+  "remediationTemplate": "one-line description of what was done",
+  "falsePositive": false
+}
+```
+Call `security.record_outcome` with this payload so the routing engine learns which agent resolves each finding class most successfully. If a finding is a false positive, set `falsePositive: true` — this prevents the false-positive pattern from being routed here again.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "SQL Injection", "filesReviewed": 47, "patterns": ["queryRaw", "string concat"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["SQL Injection: queryRaw pattern searched across 47 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```

package/skills/compliance-lifecycle-tracker/SKILL.md

@@ -21,6 +21,19 @@ Track compliance posture continuously. Detect control drift (controls that exist
 Covers: §23 (ongoing compliance monitoring), §22 (security governance metrics) fully.
 Beyond SKILL.md: Continuous control monitoring (CCM), audit evidence collection automation, auditor communication templates.
 
+## BEYOND SKILL.MD
+
+Domain-specific expansions beyond the baseline mandate — each item cites a specific CVE, technique, tool, or research finding:
+
+- **CVE-2024-27322 (R lang RDS deserialization)** — compliance evidence repositories that accept uploaded artefacts (e.g., pentest reports, vendor questionnaires) may process files through pipeline tooling vulnerable to deserialization. Validate that evidence ingestion pipelines strip executable content before storage.
+- **NIST IR 8441 (Continuous Compliance Automation)** — the 2024 NIST draft defines machine-readable control assertions (OSCAL format). Compliance artefacts not expressed in OSCAL become un-diffable, making drift detection manual and error-prone. Generate OSCAL Component Definitions alongside human-readable dashboards.
+- **Technique T1078.004 (Cloud Account valid credentials abuse in audit windows)** — adversaries time access to coincide with annual access-review windows when temporary elevated permissions are granted for audit evidence collection. Flag any IAM changes made within ±7 days of an audit period close date.
+- **GDPR Article 83 — Supervisory Authority enforcement surge (2024–2025)** — enforcement actions against organisations with incomplete Records of Processing Activities (RoPAs) reached €1.2B in fines in 2024. Verify RoPA completeness as a first-class compliance control, not documentation housekeeping.
+- **PCI DSS v4.0 Requirement 6.4.3 / 11.6.1 (script integrity and change-detection, effective March 2025)** — all payment-page JavaScript must have an authorisation mechanism and integrity attribute. Compliance drift occurs silently when third-party tag managers inject new scripts outside the change-management process. Add a Content-Security-Policy `require-trusted-types-for 'script'` check to the drift detector.
+- **AI-era threat — LLM-assisted audit gaming**: Adversaries (including insiders) use LLMs to generate plausible-looking but fabricated evidence artefacts (screenshots, log exports, training completion certificates). Implement hash-chaining and tamper-evident storage (e.g., Sigstore Rekor transparency log) for all compliance evidence files; a document that cannot be independently verified is not audit-ready.
+- **Post-quantum risk to long-lived compliance records**: Compliance artefacts signed with RSA-2048 or ECDSA today (audit reports, certificates, attestations) will be forgeable once a CRQC exists. Organisations operating under HIPAA, FedRAMP, or DoD requirements have record-retention windows of 6–10 years, placing them squarely in the harvest-now-decrypt-later risk window. Begin migrating evidence signing to ML-DSA (FIPS 204) for any artefact with a retention requirement beyond 2030.
+- **EU AI Act Article 17 (Quality Management System obligation, applicable 2026)** — high-risk AI systems must maintain compliance documentation equivalent to ISO 9001 QMS, including logs of training data provenance, human-oversight records, and incident reports. This creates a new compliance lifecycle track distinct from SOC 2 / ISO 27001. Identify AI features in the product and open a parallel AI Act compliance stream in the tracker.
+
 ## LEARNING SIGNAL
 
 On every finding resolved, emit:
@@ -167,3 +180,74 @@ jobs:
 - `requiredActions`: ordered action list with framework and deadline
 - `complianceImpact`: all affected frameworks
 - `beyondSkillMd`: true if finding goes beyond the SKILL.md mandate
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "SQL Injection", "filesReviewed": 47, "patterns": ["queryRaw", "string concat"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["SQL Injection: queryRaw pattern searched across 47 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```

package/skills/credential-stuffing-specialist/SKILL.md

@@ -190,3 +190,105 @@ If internet permitted:
 - `requiredActions`: ordered action list
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true if finding goes beyond the SKILL.md mandate
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "Auth endpoint with no per-account rate limit — ready for automated spray", "exploitHint": "Use 1 password across all accounts, one request per account per 15 min — never triggers IP limits" }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "SHA-1 (HIBP k-anonymity range API — acceptable here; flag if SHA-1 used elsewhere for auth token signing)", "location": "HIBP integration module" }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "HIBP outage fallback — confirm fetch() cannot be redirected to internal metadata endpoint", "escalationPath": "If HIBP URL is configurable via env var without validation, attacker can redirect to 169.254.169.254" }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["PCI DSS Req 8.3.4", "NIST AC-7", "SOC 2 CC6.6"], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+- **AI-Generated Combo List Amplification (ATT&CK T1586.002 — Compromise Accounts: Email Accounts):** LLMs trained on breach data (RockYou2024 + LinkedIn scrapes) generate hyper-personalised candidate passwords by combining targets' names, employers, birth years, and hobby keywords — defeating entropy-based rejection rules. Test by: construct a 500-entry wordlist using the target account's publicly-visible OSINT (LinkedIn profile, social handles, known pet names) and run it against the login endpoint; any successful authentication within the first 100 guesses constitutes a finding. Finding threshold: >0 successful logins from OSINT-derived guesses not blocked by per-account rate limiting.
+
+- **Residential Proxy Botnets Evading IP Reputation (ATT&CK T1090.002 — Proxy: External Proxy; real-world: 2023 Okta credential stuffing via IPRoyal/Luminati):** Commercial residential proxy networks (Bright Data, IPRoyal) cycle through millions of legitimate ISP IPs, rendering blocklists and GeoIP controls ineffective. Each attack IP appears only once, under all per-IP rate limits. Test by: replay 100 authentication attempts against one account using 100 distinct source IPs (simulate with X-Forwarded-For headers in a controlled environment); confirm per-account counter triggers lockout at threshold regardless of source IP diversity. Finding threshold: account lockout not triggered after 10+ failures from distinct IPs.
+
+- **OAuth Token Grant Credential Stuffing Bypassing MFA Step-Up (ATT&CK T1110.004 — Credential Stuffing; CVE-2022-29244 — node-jsonwebtoken algorithm confusion):** Applications enforcing TOTP/WebAuthn on password-based login often skip step-up MFA on the OAuth `password` grant flow or on token refresh — attacker stuffs credentials directly against `/oauth/token?grant_type=password`, receiving a valid bearer token without MFA challenge. Test by: issue a direct POST to the OAuth token endpoint with stuffed credentials bypassing the UI login flow; confirm MFA enforcement applies equally to the OAuth grant endpoint. Finding threshold: successful token issuance without MFA challenge for any account with MFA enrolled.
+
+- **Supply Chain Risk in Auth Middleware Libraries (SLSA / US EO 14028; real-world: 2021 ua-parser-js npm hijack, CVE-2021-41265 next-auth CSRF bypass):** Credential stuffing controls implemented in npm-distributed auth libraries (passport.js, next-auth, express-rate-limit) are only as trustworthy as the library's build provenance; a compromised release can silently disable rate limiting or lockout logic. Test by: run `npm audit` + verify SLSA provenance attestation (`cosign verify-attestation`) for every auth dependency; diff the installed tarball hash against the registry manifest. Finding threshold: any auth dependency lacking a verifiable build provenance attestation or carrying a known CVE with CVSS >= 7.0.
+
+- **Harvest-Now-Crack-Later Against Bcrypt Hash Databases (Post-Quantum; NIST IR 8105; ATT&CK T1552.001 — Credentials In Files):** While bcrypt/Argon2id are not broken by current quantum hardware, adversaries exfiltrating password hash databases today plan to crack them once Cryptographically Relevant Quantum Computers (CRQCs) reduce bcrypt's effective work factor — particularly for hashes with cost factor < 12 or SHA-1/MD5 legacy hashes. Test by: grep the codebase and database schema for hash storage columns; verify Argon2id with memory-cost >= 65536 (64 MB) and time-cost >= 3; flag any bcrypt cost < 12, any MD5/SHA-1 password hash, and any unencrypted hash storage at rest. Finding threshold: any password hash stored with a work factor below the 2025 OWASP minimum recommendation.
+
+- **Regulatory Credential Breach Notification Gaps (GDPR Art. 33 / CCPA / NY SHIELD Act; real-world: 2023 $1.3M FTC penalty against BetterHelp for credential misuse):** Organisations detecting a credential stuffing attack that results in unauthorised access to personal data are required to notify regulators within 72 hours (GDPR) or "in the most expedient time possible" (CCPA/NY SHIELD), yet most incident-response runbooks lack automated detection-to-notification pipelines for credential-based account takeovers. Test by: trigger a simulated mass account-takeover event (>50 accounts, >5 jurisdictions) and measure time from first anomaly alert to draft regulatory notification being generated; verify the IR playbook explicitly covers credential stuffing as a notifiable breach trigger. Finding threshold: no automated ATO detection-to-notification pipeline present, or IR playbook does not classify credential stuffing ATOs as potentially notifiable events.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 credential stuffing attack cases that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Per-account rate limit bypass via username normalisation | Rate limiter keys on raw username string; attacker submits `User@example.com`, `user@example.com`, `USER@example.com` as three separate accounts — all hit the same real account | Submit the same credential set with case and Unicode variants of the username; confirm all variants share the same rate-limit bucket after normalisation |
+| 2 | Credential stuffing through password-reset flow | Rate limiting applied only to `/login`; the password-reset endpoint accepts unlimited email lookups, revealing valid accounts and enabling account enumeration at scale | Send 500 reset requests for unknown emails; confirm response timing and body are identical to known emails and that no lockout triggers |
+| 3 | OAuth / SSO silent bypass — stuffed credential bypasses MFA step-up | App enforces MFA for password-based login but skips it for OAuth flows; attacker stuffs credentials against the OAuth token exchange endpoint directly | Obtain a valid access token via password grant then replay it — confirm step-up MFA fires if new device signal is present on the OAuth flow too |
+| 4 | Residential proxy rotation below per-IP threshold — account lockout never fires | Rate limiter counts per IP, not per account; each proxy IP sees only 1–2 requests, all under limit | Replay 50 login attempts against one account from 50 distinct IPs; confirm per-account counter (not per-IP) triggers lockout at threshold |
+| 5 | HIBP check only on registration, not on breach-notification ingest | Passwords breached after account creation are never re-checked; users with newly-breached passwords remain undetected until next password change | Simulate a new breach event and confirm the system either re-checks existing passwords against the updated HIBP range set or forces a password reset via notification |
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for in the credential stuffing domain.
+
+| Threat | Est. Timeline | Relevance to Credential Stuffing | Prepare Now By |
+|--------|--------------|----------------------------------|----------------|
+| LLM-generated credential combo lists | 2025–2027 (active) | Attackers use LLMs to generate highly personalised credential guesses from OSINT (LinkedIn, social, breach data) — entropy-based password checks insufficient | Deploy zxcvbn v4+ with site-specific dictionaries; add ML anomaly scoring on login velocity patterns |
+| Cryptographically Relevant Quantum Computer (CRQC) breaks password hashing benchmarks | 2028–2032 | Bcrypt/Argon2 are compute-bound; CRQC does not directly break them, but accelerates offline cracking of stolen hash databases — harvest-now-crack-later attacks | Ensure Argon2id with memory ≥64 MB; inventory all bcrypt/MD5/SHA-1 password hashes in legacy systems for migration |
+| AI-powered residential proxy networks at commodity cost | 2025–2026 (active) | IP reputation blocklists become near-useless; attackers rotate through millions of legitimate residential IPs | Shift rate limiting entirely to account-level signals + device fingerprint; de-weight IP reputation as primary signal |
+| Passkey / FIDO2 mandatory platform requirements (Apple, Google, Microsoft) | 2025–2026 | Password-based auth will be deprecated by default on major platforms — apps that don't support passkeys will face OS-level friction | Begin passkey migration; credential stuffing is structurally eliminated for passkey-enrolled users |
+| Mandatory SBOM + build provenance for auth libraries (US EO 14028 / EU CRA) | 2025–2026 (active) | Auth dependencies (passport.js, next-auth, argon2) must have verifiable supply chain provenance | Achieve SLSA L2 for auth middleware; generate CycloneDX SBOM per release including transitive auth deps |
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in the credential stuffing domain, and what to build to close each gap.
+
+**Gaps that MUST be checked:**
+
+- **Low-and-slow distributed spray (one attempt per account, many IPs)**: Each individual request is under every rate limit threshold. No single IP triggers an alert. Need: per-account attempt counter stored in Redis (not in-process map) with a 24-hour window; alert when any account accumulates ≥5 failed attempts from ≥3 distinct IPs within the window.
+- **Username enumeration via timing side-channel**: No log event emitted; only observable as a ~5–20 ms response-time difference between "user not found" and "wrong password" code paths. Need: constant-time comparison for auth response — use `crypto.timingSafeEqual` and add artificial jitter (50–200 ms random delay) on failed auth regardless of failure reason.
+- **HIBP bypass via password mutation**: Attacker appends `!1` or `1` to a known-breached password — hash differs, HIBP returns clean. Need: zxcvbn mutation scoring alongside HIBP; reject passwords with edit-distance ≤2 from any known-breached password in the user's breach history.
+- **Account takeover via "remember me" token stuffing**: Session tokens are long-lived; attacker stuffs leaked persistent tokens from breach dumps rather than passwords. Need: persistent token rotation on each use, with binding to device fingerprint; alert on token replays from a new device or new country without step-up verification.
+- **Cross-agent chain — rate limit misconfiguration + verbose error**: Rate limiting finding from this agent + username enumeration finding from injection agent = full account enumeration at scale. Need: CISO orchestrator Phase 1 synthesis — correlate all agent findings before Phase 2 to surface compound attack chains.
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any credential stuffing attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+**Required coverage checklist:**
+
+| Attack Class | Required Grep Patterns | Minimum Files Reviewed |
+|---|---|---|
+| IP-only rate limiting | `req.ip`, `x-forwarded-for` as sole rate-limit key without `userId` or `accountId` | All auth route handlers |
+| Missing per-account lockout | `loginAttempts`, `failedAttempts`, `tooManyAttempts` absent from auth handler | All login/auth files |
+| HIBP check absent | `hibp`, `haveibeenpwned`, `pwnedpasswords` absent from password set/change flows | All password mutation endpoints |
+| Username enumeration (timing) | `timingSafeEqual` absent; response time variance between "not found" and "wrong password" | Auth comparison functions |
+| Verbose auth errors | Distinct error strings for user-not-found vs. wrong-password in response body | All auth error handlers |
+| Persistent token not rotated | `rememberMe`, `refreshToken`, `persistentToken` — check for rotation on each use | Session / token management |
+| No device fingerprint binding | Device fingerprint absent from per-account rate-limit key | Auth middleware |
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [
+      { "class": "Per-account rate limiting", "filesReviewed": 12, "patterns": ["userId.*rateLimit", "accountId.*limiter"], "result": "CLEAN" },
+      { "class": "HIBP breached password check", "filesReviewed": 5, "patterns": ["hibp", "pwnedpasswords", "haveibeenpwned"], "result": "2 findings, all fixed" }
+    ],
+    "filesReviewed": 17,
+    "negativeAssertions": ["IP-only rate limiting: req.ip without accountId searched across 12 auth files — 0 matches after fix"],
+    "uncoveredReason": {}
+  }
+}
+```

package/skills/crypto-pki-specialist/SKILL.md

@@ -134,3 +134,90 @@ Write `.mcp/agent-runs/{agentRunId}/crypto-findings.json`
 Every finding includes: algorithm/primitive affected, CWE, CVSSv4, ATT&CK technique,
 proof of exploitability, fixed code written inline.
 Post-quantum readiness score included in summary.
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{
+  "findingId": "FINDING_ID",
+  "agentName": "AGENT_NAME",
+  "resolved": true,
+  "remediationTemplate": "one-line description of what was done",
+  "falsePositive": false
+}
+```
+Call `security.record_outcome` with this payload so the routing engine learns which agent resolves each finding class most successfully. If a finding is a false positive, set `falsePositive: true` — this prevents the false-positive pattern from being routed here again.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "SQL Injection", "filesReviewed": 47, "patterns": ["queryRaw", "string concat"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["SQL Injection: queryRaw pattern searched across 47 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```

package/skills/csa-ccm-mapper/SKILL.md

@@ -21,6 +21,19 @@ Map all cloud infrastructure controls to CSA CCM v4 domains. Identify which cont
 Covers: §23 (cloud compliance via CSA CCM), §11 (cloud security controls) fully.
 Beyond SKILL.md: CSA STAR Level 1 (self-assessment), CSA CAIQ submission preparation.
 
+## BEYOND SKILL.MD
+
+Domain-specific threats, CVEs, and research findings that extend beyond the baseline CCM checklist:
+
+- **CVE-2024-21626 (runc container escape)** — A compromised container can break out to the host via leaked file descriptors. CSA CCM IVS-09 (workload segmentation) and AIS-01 (malware scanning) must explicitly cover container runtime hardening, not just image scanning. Verify `runc` version ≥ 1.1.12 in all container runtimes.
+- **CVE-2023-44487 (HTTP/2 Rapid Reset DDoS)** — Cloud-hosted APIs and load balancers exposed over HTTP/2 are vulnerable to low-volume, high-impact request floods. BCR-01 (BCP) must model volumetric DDoS against cloud-native ingress; LOG-08 alerting must detect request-rate anomalies at the CDN/LB layer.
+- **Confused Deputy via AWS IAM cross-account trust** — Misconfigured `sts:AssumeRole` policies with wildcard principals allow lateral movement across AWS accounts without compromising credentials. STA-04 (supply chain risk) and IAM-09 (service account least privilege) are the CCM controls; audit all cross-account role trust policies with `aws iam simulate-principal-policy`.
+- **Shadow SaaS / unsanctioned cloud storage exfiltration** — Attackers with valid SSO tokens upload sensitive data to personal cloud drives (Dropbox, personal GCS buckets). DSP-01 (data classification) and DSP-07 (data lifecycle) must include CASB or egress DLP controls; CSA CCM DCS-09 is the anchor control.
+- **AI-era threat — LLM-assisted cloud misconfiguration discovery (2025–active)** — Attackers use LLMs to parse public Terraform modules and IaC repositories, automatically identifying misconfigured S3 bucket policies, overly permissive firewall rules, and exposed metadata endpoints. TVM-02 (vulnerability scanning) must include IaC static analysis (Checkov, tfsec) on every PR — reactive scanning is no longer adequate.
+- **Post-quantum harvest-now-decrypt-later against cloud KMS-protected data** — Cloud KMS keys encrypting long-lived regulated data (PII, PHI, PCI) are targeted for offline decryption once CRQCs are available (~2028–2032). CEK-01 and CEK-09 must now include a quantum readiness column: inventory all RSA/ECC key usages and flag data with retention horizons beyond 2030 for migration to ML-KEM (FIPS 203) or AWS KMS post-quantum preview algorithms.
+- **Terraform state file exposure in shared CI/CD backends** — Plaintext `terraform.tfstate` files stored in insufficiently protected S3 buckets or GitLab artifact stores expose all resource IDs, secrets interpolated at plan time, and IAM role ARNs. GRC-03 (third-party risk) and CEK-02 (data at rest encryption) both apply; the concrete check is S3 server-side encryption + bucket policy denying public access + KMS key policy restricting CI role access.
+- **OIDC federation token hijacking via GitHub Actions misconfiguration** — Repositories using `id-token: write` permissions with overly broad audience claims allow any workflow (including forks via pull_request_target) to obtain short-lived cloud credentials. IAM-09 (service account management) and STA-05 (third-party security reviews) must cover OIDC federation trust policy review — specifically, `sub` claim constraints must be pinned to specific repo + branch combinations, not just the organisation.
+
 ## LEARNING SIGNAL
 
 On every finding resolved, emit:
@@ -176,3 +189,74 @@ If internet permitted:
 - `requiredActions`: ordered action list with CCM, ISO, SOC2, PCI cross-references
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true if finding goes beyond the SKILL.md mandate
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10x more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3x their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "SQL Injection", "filesReviewed": 47, "patterns": ["queryRaw", "string concat"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["SQL Injection: queryRaw pattern searched across 47 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```

package/skills/csf2-governance-mapper/SKILL.md

@@ -157,3 +157,87 @@ Generate `docs/security/csf2-gap-analysis.md`:
 - `requiredActions`: ordered action list
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true if finding goes beyond the SKILL.md mandate
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+## BEYOND SKILL.MD
+
+Domain-specific expansions for csf2-governance-mapper covering threats, research, and edge cases beyond the core mandate:
+
+- **CVE-2024-3094 (XZ Utils supply chain backdoor)**: A CSF 2.0 GV.SC (Supply Chain Risk Management) failure case — a trusted maintainer inserted a backdoor over 2 years. Governance programs must mandate cryptographic build provenance (SLSA L2+) and binary reproducibility checks, not just vendor assessments. Current SBOM tooling (Syft, FOSSA) would not have detected this without runtime behavioural analysis.
+- **MITRE ATT&CK T1195.002 — Compromise Software Supply Chain**: Attackers increasingly target the CI/CD pipeline itself (e.g., 3CX, SolarWinds). CSF 2.0 GV.SC and ID.RA must explicitly model pipeline compromise as a threat scenario; pipeline hardening (ephemeral runners, OIDC token scoping, artifact signing) must appear in the governance roadmap.
+- **AI-model governance gaps (OWASP LLM Top 10, 2025)**: Organisations deploying LLMs lack CSF-aligned controls for LLM01 (Prompt Injection) and LLM06 (Sensitive Information Disclosure). GV.RM must include AI risk appetite statements; DE.AE must cover adversarial prompt detection. EU AI Act Article 9 requires documented risk management systems for high-risk AI — directly maps to GV.RM and GV.OV.
+- **Post-quantum cryptography governance gap (NIST FIPS 203/204/205, 2024)**: RSA and ECDSA keys created today are vulnerable to harvest-now-decrypt-later attacks. CSF 2.0 PR.DS (Data Security) and GV.RM must include a quantum-migration roadmap. CISA's PQC migration guidance (2024) recommends inventory completion by 2025 and migration completion by 2035; boards must receive annual status updates.
+- **CVE-2021-44228 (Log4Shell) governance lesson**: The failure was not technical — it was governance. No organisation had a complete software inventory (ID.AM) or a documented response SLA for critical CVEs (RS.MA). Gap analysis must verify that asset inventory includes transitive dependencies and that the IR plan includes a "critical CVE response" playbook with defined RTO.
+- **Vendor concentration risk and single-points-of-failure**: The CrowdStrike Falcon sensor outage (July 2024) affected 8.5 million Windows systems globally — a GV.SC and RC.RP failure at ecosystem scale. Governance programs must assess vendor-induced SPOF and require multi-vendor resilience or manual fallback procedures for Tier-1 dependencies.
+- **AI-assisted governance evasion**: Adversaries now use LLMs to generate plausible-looking but non-compliant policy documents that pass human review. GV.PO controls must include automated policy-to-control traceability (mapping written policy clauses to implemented technical controls), not just policy existence checks. Tools: Drata, Vanta, Tugboat Logic with automated evidence collection.
+- **Regulatory fragmentation risk (EU CRA + US EO 14028 + DORA + NIS2)**: Organisations operating across jurisdictions face overlapping and sometimes conflicting mandatory security reporting and SBOM requirements. CSF 2.0 GV.OC must include a regulatory landscape map; GV.PO must maintain a cross-framework control matrix to avoid duplicated effort and identify true gaps vs. coverage overlap.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "SQL Injection", "filesReviewed": 47, "patterns": ["queryRaw", "string concat"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["SQL Injection: queryRaw pattern searched across 47 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```