cinch-ai-security 1.0.0__tar.gz

cinch_ai_security-1.0.0/.claude/settings.local.json

@@ -0,0 +1,11 @@
+{
+  "permissions": {
+    "allow": [
+      "mcp__lean-ctx__ctx_tree",
+      "mcp__lean-ctx__ctx_read",
+      "mcp__lean-ctx__ctx_multi_read",
+      "mcp__lean-ctx__ctx_shell",
+      "mcp__lean-ctx__ctx_search"
+    ]
+  }
+}

cinch_ai_security-1.0.0/.github/dependabot.yml

@@ -0,0 +1,29 @@
+# Dependabot keeps Cinch's dependencies and CI actions current.
+# Security-critical for a tool that itself enforces supply-chain controls.
+version: 2
+updates:
+  # Python runtime + dev dependencies.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "python"
+    commit-message:
+      prefix: "deps(pip)"
+
+  # GitHub Actions used in CI/Pages workflows.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "deps(actions)"

cinch_ai_security-1.0.0/.github/workflows/pages.yml

@@ -0,0 +1,52 @@
+name: Deploy Docs
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+# Permissions: minimal everywhere except Pages deployment.
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Allow only one concurrent Pages deployment.
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Regenerate docs data bundle
+        run: |
+          python -m pip install --upgrade pip
+          pip install pyyaml
+          python scripts/build_docs_json.py
+
+      - name: Setup Pages
+        uses: actions/configure-pages@v5
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: docs-site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

cinch_ai_security-1.0.0/.github/workflows/validate.yaml

@@ -0,0 +1,108 @@
+name: Validate
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+          cache: pip
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+          pip install bandit pip-audit
+
+      - name: Validate YAML checklists & mappings
+        run: |
+          python3 -c "
+          import yaml, glob, sys
+          errors = []
+          for f in sorted(glob.glob('checklists/*.yaml') + glob.glob('mappings/*.yaml')):
+              try:
+                  data = yaml.safe_load(open(f))
+                  items = data.get('checklist', data.get('mappings', []))
+                  print(f'  {f}: {len(items)} items OK')
+              except Exception as e:
+                  errors.append(f'{f}: {e}')
+          if errors:
+              for e in errors:
+                  print(f'ERROR: {e}')
+              sys.exit(1)
+          print('All YAML files valid.')
+          "
+
+      - name: Validate MCP server imports
+        run: |
+          python3 -c "
+          from cinch.loader import list_checklists, load_checklist, load_mapping, search_by_threat
+          from cinch.server import APP
+          checklists = list_checklists()
+          print(f'Loaded {len(checklists)} checklists')
+          for cl in checklists:
+              print(f'  {cl[\"name\"]}: {cl[\"item_count\"]} items')
+          print('MCP server imports OK')
+          "
+
+      - name: Validate checklist IDs are unique
+        run: |
+          python3 -c "
+          import yaml, glob
+          seen = {}
+          for f in sorted(glob.glob('checklists/*.yaml')):
+              data = yaml.safe_load(open(f))
+              for item in data.get('checklist', []):
+                  iid = item['id']
+                  if iid in seen:
+                      print(f'DUPLICATE: {iid} in {f} and {seen[iid]}')
+                  seen[iid] = f
+          print(f'{len(seen)} unique IDs across all checklists')
+          "
+
+      - name: Lint (ruff)
+        run: ruff check src tests
+
+      - name: Security scan (bandit)
+        run: bandit -r src -q
+
+      - name: Dependency audit (pip-audit)
+        run: pip-audit --strict
+
+      - name: Verify checklist content integrity
+        run: |
+          python3 -c "
+          from cinch.loader import list_checklists, load_checklist
+          failures = []
+          for c in list_checklists():
+              cl = load_checklist(c['name'])
+              for it in cl.items:
+                  if not it.threat or not it.control or not it.verification:
+                      failures.append(f\"{c['name']}/{it.id} has empty threat/control/verification\")
+          if failures:
+              for f in failures:
+                  print(f'ERROR: {f}')
+              raise SystemExit(1)
+          print('All checklist items have non-empty core fields.')
+          "
+
+      - name: Tests (pytest)
+        run: pytest -q
+
+      - name: Verify docs-site data bundle is in sync
+        run: |
+          python3 scripts/build_docs_json.py
+          if ! git diff --exit-code docs-site/data/full.json; then
+            echo "::error::docs-site/data/full.json is out of sync. Run 'python scripts/build_docs_json.py' and commit the result."
+            git --no-pager diff docs-site/data/full.json | head -40
+            exit 1
+          fi

cinch_ai_security-1.0.0/.github-pages-config

@@ -0,0 +1,10 @@
+source: docs-site/
+destination: docs/
+includes:
+  - "docs-site/**"
+  - "checklists/*.yaml"
+  - "mappings/*.yaml"
+  - "protocols/*.md"
+  - "skills/*/SKILL.md"
+  - "templates/*.md"
+  - "docs/*.md"

cinch_ai_security-1.0.0/.gitignore

@@ -0,0 +1,26 @@
+# Python
+__pycache__/
+*.pyc
+*.egg-info/
+dist/
+build/
+*.egg
+
+# Node
+node_modules/
+
+# Environment
+.env
+.venv/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+__pycache__/
+*.pyc

cinch_ai_security-1.0.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,21 @@
+# Code of Conduct
+
+We pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity, education, socio-economic status, nationality, race, religion, or sexual orientation.
+
+## Our Standards
+
+**Positive behavior includes:**
+- Demonstrating empathy and kindness
+- Being respectful of differing opinions
+- Giving and accepting constructive feedback
+- Citing sources and being precise in technical claims
+- Focusing on what is best for the community
+
+**Unacceptable behavior includes:**
+- Harassment, personal attacks, or derogatory comments
+- Publishing others' private information without permission
+- Other conduct that would be inappropriate in a professional setting
+
+## Attribution
+
+Adapted from the [Contributor Covenant](https://www.contributor-covenant.org/) v2.1.

cinch_ai_security-1.0.0/CONTRIBUTING.md

@@ -0,0 +1,60 @@
+# Contributing to Cinch
+
+Thank you for contributing. Every claim must cite a source. Every control must map to a threat.
+
+## Principles
+
+1. **Every claim must cite a source.** Checklist items, protocol steps, and mappings must reference a specific framework, standard, research paper, or published best practice.
+2. **Enforceable over aspirational.** Prefer controls that can be verified by a checklist, test, or audit over vague guidance.
+3. **Threat-to-control mapping.** Every control must map to one or more threats. If you add a control, identify the threat it mitigates.
+4. **Architecture-level, not model-level.** Focus on environment, infrastructure, and process — not model alignment or prompt engineering alone.
+
+## How to contribute
+
+### Add or modify a checklist item
+
+1. Edit the relevant YAML file in `checklists/`
+2. Every item must include: `id`, `category`, `threat`, `control`, `severity`, `verification`, `sources`
+3. Validate: `python3 -c "import yaml; yaml.safe_load(open('checklists/YOUR_FILE.yaml'))"`
+
+### Add a protocol
+
+1. Create or edit a Markdown file in `protocols/`
+2. Follow the structure: Purpose → Scope → Prerequisites → Steps → Verification → Rollback
+3. Reference checklist items by ID
+
+### Add a skill
+
+1. Create a directory under `skills/` with a `SKILL.md` file
+2. Follow the Hermes Agent SKILL.md format (YAML frontmatter + markdown body)
+3. Include trigger conditions, numbered steps, pitfalls, and verification
+
+### Add a mapping
+
+1. Edit or create the relevant YAML file in `mappings/`
+2. Each mapping entry must include: `framework`, `control_id`, `framework_control_name`, `checklist_ids`, `description`
+
+### Add a cross-harness config
+
+1. Create or edit the config file in `cross-harness/`
+2. Follow the existing format for the target agent (Claude, OpenClaw, NanoClaw)
+3. Include all relevant CUSTODY pillars and checklist items
+
+## Formatting
+
+- YAML files: 2-space indent, keys in snake_case
+- Markdown files: ATX headers, 80-char soft wrap
+- File names: kebab-case (e.g., `agent-containment.yaml`)
+- Checklist IDs: uppercase prefix + number (e.g., `AC-001`, `HE-006`, `RT-015`)
+
+## Pull request checklist
+
+- [ ] All YAML files validate
+- [ ] Every new item cites at least one source
+- [ ] Every new control maps to a threat
+- [ ] No duplicate IDs within a file
+- [ ] Commit message follows conventional commits format
+
+## Code of Conduct
+
+See [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md). Be respectful. Be precise. Cite your sources.