security-mcp 1.1.4 → 1.3.3

package/skills/ai-model-supply-chain-agent/SKILL.md

@@ -34,6 +34,15 @@ On every finding resolved, emit:
 }
 ```
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `supply-chain-deep`, `sbom`, and `ai` detection modules (`src/gate/checks/supply-chain-deep.ts`, `src/gate/checks/sbom.ts`, `src/gate/checks/ai.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past what single-line/single-file pattern matching can see — and APPLY the fix (Edit the loader code/config/manifest), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** a `from_pretrained` revision pinned to a mutable tag in one config, an unverified `model.onnx.data` sidecar referenced from the protobuf, and a training-data S3 bucket with a public-write ACL in IaC together form a weight-poisoning chain no single grep for `torch.load` can see; trace the path from bucket → fine-tune script → serialized artifact → inference loader.
+- **Semantic / effective-state analysis:** resolve every `revision` to a 40-char commit SHA (not a force-pushable tag), enumerate ALL files referenced by `external_data_helper` and check each against the model SBOM, and reason about `trust_remote_code=True` reached transitively via a wrapper library or YAML config rather than only direct application code.
+- **External corroboration:** use WebSearch/WebFetch for current model supply-chain CVEs and advisories (CVE-2024-3094 xz, HF malicious-pickle campaigns, picklescan disclosures) and HF discussion/issue pages for the exact model IDs in use.
+- **Apply & prove:** write the fix inline (`weights_only=True`, safetensors load, pinned SHA + SHA-256 manifest entry, dataset allowlist), re-run the `supply-chain-deep`/`sbom`/`ai` checks plus `picklescan -r` and `grep -rn trust_remote_code=True` (including `site-packages`) as a regression floor, then re-audit semantically. Emit the LEARNING SIGNAL per fix; surface any pin or allowlist that blocks a previously-floating model as an explicit reproducibility-vs-freshness trade-off with the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance
@@ -196,3 +205,106 @@ If internet permitted:
 - `requiredActions`: ordered action list
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true if finding goes beyond the SKILL.md mandate
+
+Every findings JSON MUST also include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "Unsafe torch.load endpoint accepting user-supplied model path", "exploitHint": "Supply a crafted pickle file via the model path parameter to achieve RCE" }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "SHA-1 or missing hash", "location": "Model integrity check using deprecated hash or no verification at all" }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "hf_hub_download with attacker-controlled model_id", "escalationPath": "Model download URL can be redirected to IMDSv1 endpoint to steal cloud credentials" }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["NIST 800-218A", "EU AI Act Art.13", "EO 14028 SBOM"], "releaseBlock": true }]
+  }
+}
+```
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+- **Pickle-based RCE via `torch.load` (CVE-2024-5480 / ATT&CK T1195.002):** PyTorch models distributed as `.pt`/`.pth` files use Python pickle serialization; a malicious model file can embed arbitrary Python bytecode that executes on `torch.load()` without `weights_only=True`. Real-world incident: April 2024 Hugging Face hosted multiple weaponized `.pt` files detected by `picklescan`. Test by: run `picklescan -r <model_dir>` and confirm zero unsafe globals; also run `grep -rn "torch\.load" . | grep -v "weights_only=True"`. Finding threshold: any `torch.load` call missing `weights_only=True` on a path that can receive external input is CRITICAL.
+
+- **Hugging Face `trust_remote_code=True` as a persistent backdoor (ATT&CK T1546.016 — Event-Triggered Execution):** Setting `trust_remote_code=True` in `from_pretrained()` downloads and executes arbitrary Python from the model repo's `modeling_*.py` files on every inference server restart. Supply chain incident: March 2023, the `baller423/not-a-virus` HF repo demonstrated full RCE via a poisoned `modeling_custom.py`. Test by: `grep -rn "trust_remote_code=True" . --include="*.py" --include="*.yaml" --include="*.json"` — any match is a finding; also scan installed packages: `grep -rn "trust_remote_code=True" $(python -c "import site; print(site.getsitepackages()[0])")`. Finding threshold: any occurrence not accompanied by a documented security review of the specific repo commit SHA is HIGH.
+
+- **ONNX protobuf external data sidecar substitution (CWE-494 / NIST SP 800-218A §2.5):** ONNX models split weights into a `.onnx` descriptor and a `model.onnx.data` sidecar; integrity manifests that hash only the `.onnx` file leave the sidecar unprotected. An attacker who can write to the model artifact directory replaces the sidecar with adversarially perturbed weights that preserve the architecture but alter behavior on specific inputs (AI-assisted attack vector). Test by: parse the ONNX protobuf with `onnx.load()` and enumerate all `external_data_helper` location fields; verify each referenced file has a SHA-256 entry in the model SBOM (`models/model-manifest.json`). Finding threshold: any ONNX external data file not covered by the integrity manifest is HIGH.
+
+- **ML model weight poisoning via compromised S3/GCS training dataset bucket (ATT&CK T1195.001 — Compromise Software Supply Chain):** Fine-tuning pipelines that pull datasets from S3 buckets with permissive ACLs are vulnerable to data poisoning; an attacker with write access can inject adversarial examples that introduce a backdoor trigger. Research: "BadNL: Backdoor Attacks against NLP Models with Semantic-Preserving Improvements" (Chen et al., 2021) demonstrates <1% poisoning rate is sufficient. Test by: run `aws s3api get-bucket-acl --bucket <training-data-bucket>` and `aws s3api get-bucket-policy --bucket <training-data-bucket>`; review CloudTrail for `PutObject` events to the dataset prefix in the 30 days preceding the last training run. Finding threshold: any public write ACL or any unexpected `PutObject` from a non-CI principal is CRITICAL.
+
+- **Post-quantum harvest-now-attack-later against model signing certificates (NIST FIPS 203/204 migration gap):** Model signing certificates issued with RSA-2048 or ECDSA P-256 (current industry norm for Sigstore/cosign model provenance) are vulnerable to retroactive forgery once a cryptographically relevant quantum computer (CRQC) is available (estimated 2028–2032). Signed model artifacts stored in artifact registries today are being harvested for future forgery. Test by: enumerate all model signing certificates in the CI/CD pipeline (`cosign verify --certificate-identity ... <model_image>`); check key algorithm with `openssl x509 -in cert.pem -text | grep "Public Key Algorithm"`. Finding threshold: any model signing key using RSA or ECC rather than ML-DSA (FIPS 204) or a hybrid scheme is a MEDIUM now, escalating to CRITICAL at the CRQC horizon; flag for migration planning.
+
+- **EU AI Act Art. 13 conformity failure due to missing model supply chain documentation (Regulatory — enforcement 2026):** High-risk AI systems (Annex III categories: biometric identification, critical infrastructure, employment decisions, credit scoring) require a technical file with full supply chain provenance — model origin, training data sources, integrity verification records, and human oversight measures. Missing model SBOMs, unpinned HF revisions, and unaudited `trust_remote_code` usage each independently constitute non-conformity. Test by: classify the AI system against EU AI Act Annex III; if Tier 2 or 3, verify a conformity assessment technical file exists at `docs/ai-act-conformity/` containing model provenance records, dataset lineage, and a bias audit report. Finding threshold: any high-risk AI system lacking a complete technical file 6+ months before the EU enforcement date applicable to its risk tier is HIGH; absence of classification itself is MEDIUM.
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in the AI model supply chain domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Pickle payload smuggled inside a `safetensors` wrapper | Scanners check file extension and format header; a safetensors file whose metadata JSON embeds a base64-encoded pickle blob for a custom "callback" key goes undetected | Write a synthetic safetensors file with a poisoned `__metadata__` value that triggers deserialization in a downstream consumer that parses metadata naively |
+| 2 | Model revision SHA pinned to a tag rather than a commit SHA | Tag `v1.0` on Hugging Face can be force-pushed (tags are mutable); scanners see a hash and assume immutability | Verify the `revision` parameter resolves to a 40-character commit SHA (not a branch or tag name) by calling the HF API; confirm it matches `git rev-parse HEAD` on the upstream repo |
+| 3 | Backdoor triggered only by a specific trigger phrase, not by general inputs | Black-box accuracy tests pass because the backdoor activates on a rare, crafted input; no observable difference in benign evaluation | Run targeted behavioural probes using known backdoor trigger patterns (e.g., specific Unicode sequences, rare tokens); compare output distribution against a clean reference model |
+| 4 | Fine-tuning data poisoning via a shared, writable S3/GCS bucket | Scanner checks model file integrity but not training data integrity; the poisoning happens upstream before model serialization | Verify the training data source bucket policy blocks public write; check CloudTrail/GCS audit logs for unexpected PUT operations to the dataset prefix in the 30 days before the training run |
+| 5 | ONNX external data file (`model.onnx` + `model.onnx.data`) substitution | Scanners hash-check `model.onnx` but miss the external weights sidecar file; attacker replaces `model.onnx.data` with adversarially perturbed weights | Ensure the integrity manifest covers ALL files referenced by `external_data_helper`; grep for `location` fields in the ONNX protobuf and confirm each referenced file has an entry in the model SBOM |
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that AI model supply chain defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to AI Model Supply Chain | Prepare Now By |
+|--------|--------------|-------------------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) breaking RSA/ECDSA model signatures | 2028–2032 | Model signing certificates issued today (RSA-2048, ECDSA P-256) will be retrospectively forgeable; harvest-now-attack-later applies to stored signed model artifacts | Migrate model signing to ML-KEM / ML-DSA (FIPS 203/204); inventory all long-lived model signing keys |
+| AI-assisted automated backdoor insertion at scale | 2025–2027 (active) | LLM-powered tools can generate subtly poisoned fine-tuning datasets and propose PRs to open-source model repos that pass human review | Enforce automated backdoor detection (e.g., Neural Cleanse, STRIP) as a CI gate before any fine-tuned model reaches staging |
+| EU AI Act Art. 13 + 17 mandatory conformity assessments for high-risk AI | 2026 (enforcement) | High-risk AI systems require technical documentation, supply chain provenance records, and bias audits — non-compliance blocks EU market access | Classify all AI features against AI Act Annex III risk tiers now; begin conformity assessment prep for any Tier 2/3 systems |
+| Mandatory SBOM + SLSA provenance for AI artifacts (US EO 14028, EU CRA) | 2025–2026 (active) | Software Bills of Materials and SLSA Level 2+ build provenance are becoming legally required for AI model artifacts used in government and critical infrastructure contracts | Generate CycloneDX SBOM per model release; achieve SLSA L2 minimum for training pipelines (hermetic builds, signed provenance) |
+| Hugging Face ecosystem at scale as a malware distribution vector | 2025–2027 | HF hosts >500k models; automated malware campaigns are already depositing weaponised pickle files; the volume makes manual vetting impossible | Implement organisation-level HF allowlists; block `from_pretrained` from any repo not on the approved list; scan all downloads with `picklescan` in CI |
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in the AI model supply chain domain, and what to build to close each gap.
+
+**Gaps that MUST be checked:**
+
+- **Silent model weight substitution post-download**: Standard file integrity checks run at download time; if a compromised model is swapped in the local model cache between download and load, no alert fires. Need: hash re-verification at load time (not just at download time), with the expected hash stored outside the cache directory (e.g., in a secrets manager or read-only config).
+
+- **Behavioural drift from fine-tuning data poisoning**: Model weights pass hash checks (the poisoned model is internally consistent); the attack is only observable as anomalous output on trigger inputs. Standard monitoring logs requests and responses but doesn't maintain a baseline distribution. Need: a shadow evaluation harness that runs a fixed probe set against every newly trained model and compares output distributions against the approved baseline; flag any model where KL-divergence on the probe set exceeds threshold.
+
+- **`trust_remote_code=True` execution via transitive dependency**: The flag is set in a config file or a wrapper library, not in application code directly — grep on application code misses it. Need: extend grep patterns to `**/*.yaml`, `**/*.json`, `**/*.toml` model config files and all installed package source under `site-packages` for the string `trust_remote_code`.
+
+- **Training pipeline data source tampering via CI/CD injection**: The dataset hash is correct at the start of the training job, but a compromised CI step downloads a replacement dataset mid-pipeline before the training script runs. Standard pipeline logs don't record file hashes at each step. Need: hash the dataset immediately before passing it to the training script (not in a separate pre-check step); emit the hash as a structured log event that feeds into SIEM.
+
+- **Cross-agent chain: unsafe model load + SSRF = cloud credential theft**: A SSRF finding from the network agent and a `torch.load` finding from this agent, individually Medium severity, combine into a CRITICAL chain (attacker supplies a URL to a pickle that, when loaded, makes a request to IMDSv1). Neither agent alone flags this as critical. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings on the same service before Phase 2 begins.
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item below, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+**Mandatory attack classes for AI model supply chain:**
+
+1. Unsafe deserialization — `torch.load` without `weights_only=True`, `pickle.load`, `joblib.load` on untrusted input
+2. `trust_remote_code=True` — in Python source, YAML configs, JSON configs, and installed package wrappers
+3. Missing model hash verification — model downloaded or loaded without SHA-256 check against a trusted manifest
+4. Unpinned model revision — `from_pretrained` using a branch name or tag instead of a commit SHA
+5. Fine-tuning data source integrity — training data ingested without hash verification or source allowlist
+6. Model SBOM completeness — every model artifact (including ONNX external data files) covered by the manifest
+7. HF token least privilege — write-scoped tokens used where read-only suffices; tokens present in env files committed to repo
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [
+      { "class": "Unsafe deserialization", "filesReviewed": 23, "patterns": ["torch\\.load", "pickle\\.load", "joblib\\.load"], "result": "CLEAN" },
+      { "class": "trust_remote_code=True", "filesReviewed": 47, "patterns": ["trust_remote_code=True"], "result": "2 findings, both fixed" }
+    ],
+    "filesReviewed": 47,
+    "negativeAssertions": [
+      "Unsafe deserialization: torch.load pattern searched across 23 .py files — 0 unsafe calls found",
+      "trust_remote_code: searched 47 .py/.yaml/.json files — 2 instances found and removed"
+    ],
+    "uncoveredReason": {}
+  }
+}
+```

package/skills/algorithm-implementation-reviewer/SKILL.md

@@ -34,6 +34,15 @@ Any use of the following in any context, even non-security uses:
 - `RSA PKCS#1 v1.5` padding — PKCS#1 oracle attacks; use OAEP; CWE-780
 - `Math.random()` for any security-sensitive value — not cryptographically random; CWE-338
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `crypto` detection module (`src/gate/checks/crypto.ts`) is your deterministic floor, not your ceiling. Treat its finding IDs as the minimum, then reason past what single-line/single-file pattern matching can see — and APPLY the fix (Edit the crypto code), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** an AES-GCM nonce that looks random at the call site but is derived from a counter persisted in another module (or absent in a serverless deployment) reuses under the same key — catastrophic GCM nonce reuse that grepping the `randomBytes(12)` line in isolation never reveals; trace the key+nonce pair from generation through every encrypt call.
+- **Semantic / effective-state analysis:** distinguish a security-sensitive `Math.random()` from a cosmetic one by following the value to its sink (session token vs animation seed); verify a comparison is *effectively* constant-time end-to-end (not just that `timingSafeEqual` appears somewhere); confirm Argon2 parameters are compile/deploy-time constants and not runtime-injectable to a near-zero cost factor.
+- **External corroboration:** use WebSearch/WebFetch for current crypto CVEs and advisories (CVE-2022-21449 Psychic Signatures, Bleichenbacher/python-jose oracles, library-specific JWT alg-confusion CVEs) and NIST FIPS 203/204 ML-KEM/ML-DSA migration guidance.
+- **Apply & prove:** write the corrected primitive inline (unconditional `randomBytes(12)` per-encryption nonce, OAEP over PKCS#1 v1.5, `timingSafeEqual`, Argon2id at memoryCost ≥ 64MB/timeCost ≥ 3, HKDF for key separation), re-run the `crypto` checks plus `semgrep` crypto rules as a regression floor, then re-audit semantically. Emit the LEARNING SIGNAL per fix; surface any algorithm swap that changes wire format or stored-hash format as an explicit migration trade-off with the secure default.
+
 ## EXECUTION
 
 1. **Grep for banned patterns across all source files:**
@@ -83,3 +92,101 @@ Any use of the following in any context, even non-security uses:
 - Working exploit demonstrating exploitability (timing oracle PoC, collision PoC, etc.)
 - Fixed implementation written inline
 - CWE, CVSSv4
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+## BEYOND SKILL.MD
+
+Domain-specific knowledge beyond standard algorithm review that this agent must apply:
+
+- **CVE-2022-21449 "Psychic Signatures" (Java ECDSA)**: Java 15–18 ECDSA signature verification accepted `r=0, s=0` as valid for any message. Any Java service validating JWTs or signed tokens pre-patch must be retested; the fix is upgrading JDK and adding explicit `r`/`s` range checks.
+- **CVE-2023-29197 / AES-GCM nonce reuse at scale**: Serverless and multi-instance deployments that generate GCM nonces from a counter without distributed state coordination inevitably reuse nonces; nonce collision under GCM allows full plaintext and key recovery. Require `crypto.randomBytes(12)` unconditionally; never counter-based nonces in stateless environments.
+- **Harvest-now-decrypt-later (HNDL) against long-lived RSA/ECDH sessions**: Nation-state adversaries are capturing TLS handshakes and encrypted archives today for decryption once a CRQC arrives (estimated 2028–2032). Any data with a secrecy horizon beyond 5 years is already at risk. Mandate ML-KEM (FIPS 203) hybrid key encapsulation for all new key agreement.
+- **LLM-assisted differential cryptanalysis (2025-active)**: LLM-powered tools (e.g., CryptoPals-GPT derivatives) can suggest distinguisher attacks against reduced-round ciphers and weak PRNG seeds far faster than human review. Assume any custom cipher or non-standard PRNG has been systematically attacked; ban custom ciphers entirely.
+- **Bleichenbacher-style oracle resurrection via JSON parsing (CVE-2023-46234 / python-jose)**: RSA PKCS#1 v1.5 decryption errors that differ based on padding validity re-enable adaptive chosen-ciphertext attacks even when the original padding oracle path is patched. Mandate OAEP and constant-time error paths throughout the entire stack.
+- **ML-KEM / CRYSTALS-Kyber parameter confusion**: Early adopters using `kyber512` (NIST security level 1) for long-lived secrets are underprotected; NIST mandates `kyber768` (level 3) minimum for general use and `kyber1024` for data encrypted beyond 2035. Flag any ML-KEM instantiation below level 3.
+- **Side-channel leakage through speculative execution in crypto code (Spectre v2, Retbleed)**: VM-co-located adversaries can extract AES round keys or ECDSA nonces from cache-timing and branch-predictor side channels. Require constant-time implementations (`libsodium`, `noble-curves`) and document hardware-level mitigation requirements for HSM deployments.
+- **Argon2id parameter downgrade via configuration injection**: Applications that read Argon2 parameters from a database or environment variable allow attackers with write access to reduce cost factors to near-zero, converting stored hashes to brute-forceable form at login time. Parameters must be compile-time or deploy-time constants, never runtime-configurable without signed attestation.
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{
+  "findingId": "FINDING_ID",
+  "agentName": "algorithm-implementation-reviewer",
+  "resolved": true,
+  "remediationTemplate": "one-line description of what was done",
+  "falsePositive": false
+}
+```
+Call `security.record_outcome` with this payload so the routing engine learns which agent resolves each finding class most successfully. If a finding is a false positive, set `falsePositive: true` — this prevents the false-positive pattern from being routed here again.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "SQL Injection", "filesReviewed": 47, "patterns": ["queryRaw", "string concat"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["SQL Injection: queryRaw pattern searched across 47 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```