{
  "format": "ta-amps.seed-pack.proposal.v1",
  "status": "proposal_only",
  "pack_id": "security-review",
  "title": "Security review",
  "version": "0.1.0",
  "summary": "A collection of nouns and verbs for authorized, local-only security review of code: scope check, threat model, a 16-area catalog, sandbox reproduction, tested fixes and independent review, with a worked example of the finding checks.",
  "license": "MIT",
  "store": "seedpack.security-review",
  "queue_placeholder": "conformance-seed-packs",
  "files": [
    {
      "path": "README.md",
      "sha256": "0f4eb3970107e545fe293afc2e2ad0d0c3f4bdc6984d479615e2a357241d4dcd"
    },
    {
      "path": "source.json",
      "sha256": "86e7cb1f27b39b0b0dec86fd9dd5d096dd67d81503c0402f47fff6b2089ac06e"
    },
    {
      "path": "nouns.json",
      "sha256": "e7ad79ffce6f158aea00c98587cbd986ebe2ac9e7270196dc9b7c8fc4676d5d9"
    },
    {
      "path": "verbs.json",
      "sha256": "3c8fc36c60e87991aa4065e1f09af2f8f6a9d26009ddaed719f19d9776b40bf5"
    }
  ],
  "nouns": [
    {
      "key": "security-review.v0.1.0.pack",
      "category_id": "noun.skill_pack",
      "role": "pack",
      "value_sha256": "ebc8dc4da7939984c2fabbf4f302d50e540ffc13cc62fb1037a2296d4c454d04"
    },
    {
      "key": "security-review.v0.1.0.scope-rules",
      "category_id": "noun.skill_pack",
      "role": "scope_rules",
      "value_sha256": "69cdeae7edec705f4436ce2918ba6620a2244791d034cb19bac94ed3a8719f13"
    },
    {
      "key": "security-review.v0.1.0.check-catalog",
      "category_id": "noun.benchmark_suite",
      "role": "check_catalog",
      "value_sha256": "ef7bf66b06c36ab2843c163884dfa3b98ba92074cf6f3be1ea99827c49400807"
    },
    {
      "key": "security-review.v0.1.0.severity-rubric",
      "category_id": "noun.benchmark_suite",
      "role": "severity_rubric",
      "value_sha256": "33ccfb1307e37b6491a72007ec80cfef70da599c20cafd8491c73fd0f2774041"
    },
    {
      "key": "security-review.v0.1.0.template.authorization",
      "category_id": "noun.seed_hypothesis",
      "role": "template",
      "value_sha256": "5d19e94089c413677c11edd61d575ba382081796758dc98667560b9851ea7e0e"
    },
    {
      "key": "security-review.v0.1.0.template.scope-check",
      "category_id": "noun.eval_run",
      "role": "template",
      "value_sha256": "882f1c5caf1cbfc3527725cb80981048d9b9e8f43f9ef2c381dcbcd10e98337b"
    },
    {
      "key": "security-review.v0.1.0.template.threat-model",
      "category_id": "noun.seed_hypothesis",
      "role": "template",
      "value_sha256": "9913e78a4184f7d739abfb2fe865844bacb75bdfb51de29437d04b70b8a3989c"
    },
    {
      "key": "security-review.v0.1.0.template.finding",
      "category_id": "noun.seed_hypothesis",
      "role": "template",
      "value_sha256": "edf1b85b8e8f24aadbe6c0ba682ae551910a99ad43f01b05b92518baca299cd7"
    },
    {
      "key": "security-review.v0.1.0.template.reproduction",
      "category_id": "noun.eval_run",
      "role": "template",
      "value_sha256": "2564a7dfea1b77e206ea34115ce8a53474a83adcbf66724cf416e6cca3a49030"
    },
    {
      "key": "security-review.v0.1.0.template.fix",
      "category_id": "noun.code_node",
      "role": "template",
      "value_sha256": "474827b32af3a1d429ef4ba18ede918bdfa2477ea2a571cbb7129acce86b3474"
    },
    {
      "key": "security-review.v0.1.0.template.review",
      "category_id": "noun.eval_run",
      "role": "template",
      "value_sha256": "f93046fc13a3b0a7880bea4727fb9d1a800a88606cf4f3fb110c12a1706aa297"
    }
  ],
  "verbs": [
    {
      "template_id": "security-review.check-scope",
      "kind": "verb.verify_gate",
      "claimant": "agent",
      "idempotency_key": "seedpack:security-review:check-scope:817b4f454b2bc8999f83f2788f88ed1f382c071a67a42c6947a9c6feafe577f1",
      "report_shape_sha256": "ed81f61016fae6fad48fd3ff60c3ae35417c1c6127bce12500a377eb165d0749"
    },
    {
      "template_id": "security-review.threat-model",
      "kind": "verb.situate",
      "claimant": "agent",
      "idempotency_key": "seedpack:security-review:threat-model:4664903e6ca0af5cc1ddc86cde8db4e65e32db6e6544caae1f2cd5937add57e6",
      "report_shape_sha256": "d9d533431f460a1025b00017e6998299ebb4a6030184399a5878020c6f1e6e95"
    },
    {
      "template_id": "security-review.review-code",
      "kind": "verb.solve_draft",
      "claimant": "agent",
      "idempotency_key": "seedpack:security-review:review-code:1802b5b76e1a135a44ce740994a81a0f5a3cd09ac0de65a0018f65441aa1c2e4",
      "report_shape_sha256": "b6b46a8b701e13b497e42538b53ec03efb23bf73808c5ae618ee11519aabec02"
    },
    {
      "template_id": "security-review.reproduce-locally",
      "kind": "verb.verify_gate",
      "claimant": "agent",
      "idempotency_key": "seedpack:security-review:reproduce-locally:92a935efc7074e60264bdbdf82ef65d9230869533999f6669f699ec85caa05ad",
      "report_shape_sha256": "93c2cf5828dd9d7406b7affd50bb5a6e4161a4fbde31104ed33f6f90ab8d752e"
    },
    {
      "template_id": "security-review.propose-fix",
      "kind": "verb.solve_draft",
      "claimant": "agent",
      "idempotency_key": "seedpack:security-review:propose-fix:6bdd845c67c82d60f57f1f41280a7a7a8a27e63df4bb706f23dbc915ab023b70",
      "report_shape_sha256": "f83f49d28863c330fa831ef8de050cb94b338af96271d11ae75d0668d01be9ee"
    },
    {
      "template_id": "security-review.review-findings",
      "kind": "verb.verify_gate",
      "claimant": "agent",
      "idempotency_key": "seedpack:security-review:review-findings:426cd0dde086f7ccbb43325527945202dfd0e5f853ec058bcbe3bea1048703d3",
      "report_shape_sha256": "689dfd66c6508de355dca807089df7a663555636cf1f60df9c0a1e5a1b868c34"
    }
  ],
  "dependencies": [],
  "boundaries": [
    "Review only code the requester owns or is explicitly authorized to review, from a local copy. Never scan, probe, exploit or load-test any running system, including the requester's own production.",
    "Findings go only to the requester. Disclosure to anyone else is the owner's separate decision.",
    "Report where a secret is, never its value. Never try a found credential.",
    "Importing the pack writes nothing and enqueues nothing."
  ],
  "override_policy": {
    "automatic_merge": false,
    "on_conflict": "stop_and_clarify"
  },
  "importer": null,
  "importer_reason": "No manifest endpoint or generic importer exists. Reading or exporting this pack writes no records, enqueues no verbs and activates nothing.",
  "activation": {
    "automatic": false,
    "steps": [
      "An owner assigns the namespace, store and queue.",
      "Each noun is written create-only with existing grants and read back; its value SHA-256 must match the pin.",
      "A verb template is filled with exact pins and enqueued explicitly by an authorized requester."
    ]
  },
  "evaluation": {
    "result": null,
    "reason": "Offline shape, category and digest validation only. No worker has run these verbs."
  }
}