{"format": "ta-amps.seed-pack.nouns.v1", "pack_id": "security-review", "status": "proposal_only", "records": [
{"store": "seedpack.security-review", "key": "security-review.v0.1.0.pack", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.skill_pack", "pack:security-review", "role:pack", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.skill_pack", "role": "pack", "pack": "security-review", "pack_version": "0.1.0", "title": "A collection of nouns and verbs for authorized, local-only security review of code", "lets_workers": "Review code you own or are authorized to review for security problems, reproduce them only in a local sandbox, propose tested fixes and have another worker check the findings, all privately.", "flow": [{"verb": "security-review.check-scope", "when": "First, always; nothing else runs without a passing scope check."}, {"verb": "security-review.threat-model", "when": "After the scope check."}, {"verb": "security-review.review-code", "when": "Per priority area; areas can run as separate attempts."}, {"verb": "security-review.reproduce-locally", "when": "For findings worth confirming, in a sandbox only."}, {"verb": "security-review.propose-fix", "when": "For confirmed findings; a patch and a test, never pushed."}, {"verb": "security-review.review-findings", "when": "Last, by a different worker."}], "rules": ["Review only code the requester owns or is explicitly authorized to review, from a local copy. Never scan, probe, exploit or load-test any running system, including the requester's own production.", "Findings go only to the requester. Disclosure to anyone else is the owner's separate decision.", "Report where a secret is, never its value. Never try a found credential."], "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": [{"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.scope-rules", "target_category": "noun.skill_pack", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.check-catalog", "target_category": "noun.benchmark_suite", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.severity-rubric", "target_category": "noun.benchmark_suite", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.template.authorization", "target_category": "noun.seed_hypothesis", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.template.scope-check", "target_category": "noun.eval_run", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.template.threat-model", "target_category": "noun.seed_hypothesis", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.template.finding", "target_category": "noun.seed_hypothesis", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.template.reproduction", "target_category": "noun.eval_run", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.template.fix", "target_category": "noun.code_node", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.template.review", "target_category": "noun.eval_run", "note": ""}]}},
{"store": "seedpack.security-review", "key": "security-review.v0.1.0.scope-rules", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.skill_pack", "pack:security-review", "role:scope_rules", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.skill_pack", "role": "scope_rules", "pack": "security-review", "pack_version": "0.1.0", "title": "Scope rules for security review", "category_reason": "A reusable set of guardrails every verb in this pack must follow.", "rules": ["Review only code the requester owns or is explicitly authorized to review, from a local copy. Never scan, probe, exploit or load-test any running system, including the requester's own production.", "Findings go only to the requester. Disclosure to anyone else is the owner's separate decision.", "Report where a secret is, never its value. Never try a found credential.", "The authorization noun names the requester, the target, the exact commit, the allowed activities and an expiry; an expired or missing authorization means blocked.", "Sandboxes have no credentials and no network beyond local services the sandbox itself starts.", "Never weaken a security control to make a reproduction or a test pass."], "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.security-review", "key": "security-review.v0.1.0.check-catalog", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.benchmark_suite", "pack:security-review", "role:check_catalog", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.benchmark_suite", "role": "check_catalog", "pack": "security-review", "pack_version": "0.1.0", "title": "Security check catalog: 16 areas", "category_reason": "A fixed catalog of review areas that every review is measured against.", "areas": [{"id": "object-authorization", "asks": "Every read or write of a private resource checks the caller's right to that exact resource on the server."}, {"id": "authentication-sessions", "asks": "Credentials, tokens and sessions are created, stored, expired and revoked safely."}, {"id": "injection", "asks": "Untrusted input never reaches a SQL query, shell command, template or interpreter without parameterization or strict validation."}, {"id": "path-traversal", "asks": "User-controlled paths cannot escape their intended directory."}, {"id": "server-side-requests", "asks": "User-controlled URLs cannot make the server reach internal or unintended destinations."}, {"id": "unsafe-deserialization", "asks": "Untrusted bytes are never deserialized into executable objects."}, {"id": "output-encoding", "asks": "Untrusted text is encoded for its output context, so it cannot run as script in a browser."}, {"id": "cross-site-requests", "asks": "State-changing browser requests need proof they came from the site itself."}, {"id": "secrets-handling", "asks": "Secrets are not in code, logs, errors, client bundles or CI output."}, {"id": "dependency-advisories", "asks": "Known advisories are checked against reachable code paths, with the tool and database date."}, {"id": "ci-supply-chain", "asks": "CI never runs untrusted code with secrets or write tokens, and third-party actions are pinned."}, {"id": "cryptography", "asks": "Passwords use a slow salted hash, randomness comes from a secure source and no custom cryptography is used."}, {"id": "abuse-and-cost", "asks": "Expensive operations have rate limits and quotas so one caller cannot exhaust capacity or budget."}, {"id": "uploads", "asks": "Uploaded files have type, size and storage limits and are never executed or served unsafely."}, {"id": "sensitive-logging", "asks": "Logs omit personal data and credentials, and log retention is bounded."}, {"id": "agent-tool-boundaries", "asks": "Model and tool outputs, retrieved documents and task text are treated as data: they cannot widen a tool's permissions, choose destinations or become commands without checks."}], "note": "agent-tool-boundaries covers systems where models or agents call tools; skip it otherwise.", "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.security-review", "key": "security-review.v0.1.0.severity-rubric", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.benchmark_suite", "pack:security-review", "role:severity_rubric", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.benchmark_suite", "role": "severity_rubric", "pack": "security-review", "pack_version": "0.1.0", "title": "Severity rubric and deterministic finding checks", "category_reason": "A scoring rubric with deterministic checks and golden fixtures with recorded expected results.", "fixture_kind": "finding_checks", "severity_levels": {"critical": "Remote, unauthenticated compromise of data or systems, or exposure of credentials with broad access.", "high": "Unauthorized access to other users' data or actions with modest preconditions.", "medium": "Limited impact, or significant preconditions such as an existing account with special rights.", "low": "Defense in depth: hard to exploit or small impact.", "informational": "A risky pattern with no demonstrated impact."}, "confidence_rule": "High needs a local reproduction; reasoning from code alone is at most medium.", "finding_schema": {"type": "object", "additionalProperties": false, "required": ["area", "title", "severity", "confidence", "location", "explanation", "reproduction", "fix", "status"], "properties": {"area": {"type": "string", "enum": ["object-authorization", "authentication-sessions", "injection", "path-traversal", "server-side-requests", "unsafe-deserialization", "output-encoding", "cross-site-requests", "secrets-handling", "dependency-advisories", "ci-supply-chain", "cryptography", "abuse-and-cost", "uploads", "sensitive-logging", "agent-tool-boundaries"]}, "title": {"type": "string", "minLength": 1, "maxLength": 200}, "severity": {"type": "string", "enum": ["critical", "high", "medium", "low", "informational"]}, "confidence": {"type": "string", "enum": ["high", "medium", "low"]}, "location": {"type": "string", "minLength": 1, "maxLength": 300}, "explanation": {"type": "string", "minLength": 1, "maxLength": 1200}, "reproduction": {"type": "string", "minLength": 1, "maxLength": 1500}, "fix": {"type": "string", "minLength": 1, "maxLength": 800}, "status": {"type": "string", "enum": ["reproduced_locally", "reasoned_not_reproduced", "not_reproducible"]}}}, "deterministic_checks": [{"id": "area-known", "rule": {"rule": "enum", "path": "area", "values": ["object-authorization", "authentication-sessions", "injection", "path-traversal", "server-side-requests", "unsafe-deserialization", "output-encoding", "cross-site-requests", "secrets-handling", "dependency-advisories", "ci-supply-chain", "cryptography", "abuse-and-cost", "uploads", "sensitive-logging", "agent-tool-boundaries"]}, "why": "Findings map to the catalog."}, {"id": "severity-known", "rule": {"rule": "enum", "path": "severity", "values": ["critical", "high", "medium", "low", "informational"]}, "why": "Severity uses the rubric's levels."}, {"id": "located", "rule": {"rule": "present", "path": "location"}, "why": "Every finding points at code."}, {"id": "fix-present", "rule": {"rule": "present", "path": "fix"}, "why": "Every finding proposes a fix."}, {"id": "local-only", "rule": {"rule": "hosts_local_only", "path": "reproduction"}, "why": "Reproductions target only local sandboxes: every host named must be localhost, a loopback address or .invalid."}, {"id": "no-secret-values", "rule": {"rule": "pattern_absent", "path": "$", "pattern": "(?i:\\b(?:api[_-]?key|secret|token|password|passwd|pwd|access[_-]?key|client[_-]?secret)\\b[\"']?\\s*[:=]\\s*[\"']?[A-Za-z0-9_\\-/+=.]{8,})|(?i:\\bbearer\\s+[A-Za-z0-9_\\-.=+/]{12,})|\\b[A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|API_KEY)[A-Z0-9_]*\\s*=\\s*[^\\s\"']{8,}"}, "why": "Report where a secret is, never its value."}], "golden_fixtures": [{"id": "good-reproduced", "finding": {"area": "object-authorization", "title": "Any signed-in user can read another user's invoice", "severity": "high", "confidence": "high", "location": "app/routes/invoices.py:41-58", "explanation": "The handler loads the invoice by id and returns it without comparing its owner with the caller.", "reproduction": "In a local sandbox build with two synthetic users, user B requested user A's invoice at http://localhost:8000/invoices/1 and received it.", "fix": "Compare invoice.owner_id with the caller's id before returning; add a test that user B is refused.", "status": "reproduced_locally"}, "label": "known_good"}, {"id": "good-reasoned", "finding": {"area": "agent-tool-boundaries", "title": "Retrieved page text can choose the fetch tool's next destination", "severity": "medium", "confidence": "medium", "location": "agent/tools/fetch.py:12-30", "explanation": "The fetch tool follows a URL extracted from the previous page's text with no allowlist.", "reproduction": "Not run: reasoning from code only. A local fixture page containing a link to http://127.0.0.1:9/ would show whether the tool follows it.", "fix": "Restrict destinations to the task's declared allowlist and treat page text as data.", "status": "reasoned_not_reproduced"}, "label": "known_good"}, {"id": "bad-live-target", "finding": {"area": "object-authorization", "title": "Invoice exposure confirmed on the live site", "severity": "high", "confidence": "high", "location": "app/routes/invoices.py:41-58", "explanation": "The handler loads the invoice by id and returns it without comparing its owner with the caller.", "reproduction": "Requested https://billing.example.com/invoices/1 as a second user and received it.", "fix": "Compare invoice.owner_id with the caller's id before returning; add a test that user B is refused.", "status": "reproduced_locally"}, "label": "known_bad"}, {"id": "bad-secret-value", "finding": {"area": "secrets-handling", "title": "Deploy key committed", "severity": "high", "confidence": "high", "location": "deploy/config.env:3", "explanation": "The file contains password = hunter2hunter2hunter2 for the database.", "reproduction": "Read the file at the pinned commit.", "fix": "Remove it and rotate the credential.", "status": "reproduced_locally"}, "label": "known_bad"}, {"id": "bad-no-location", "finding": {"area": "object-authorization", "title": "Some route probably lacks checks", "severity": "high", "confidence": "high", "location": "", "explanation": "The handler loads the invoice by id and returns it without comparing its owner with the caller.", "reproduction": "In a local sandbox build with two synthetic users, user B requested user A's invoice at http://localhost:8000/invoices/1 and received it.", "fix": "Compare invoice.owner_id with the caller's id before returning; add a test that user B is refused.", "status": "reproduced_locally"}, "label": "known_bad"}, {"id": "bad-userinfo-host", "finding": {"area": "object-authorization", "title": "Any signed-in user can read another user's invoice", "severity": "high", "confidence": "high", "location": "app/routes/invoices.py:41-58", "explanation": "The handler loads the invoice by id and returns it without comparing its owner with the caller.", "reproduction": "Requested http://localhost@203.0.113.9/invoices/1 as a second user.", "fix": "Compare invoice.owner_id with the caller's id before returning; add a test that user B is refused.", "status": "reproduced_locally"}, "label": "known_bad"}, {"id": "bad-lookalike-host", "finding": {"area": "object-authorization", "title": "Any signed-in user can read another user's invoice", "severity": "high", "confidence": "high", "location": "app/routes/invoices.py:41-58", "explanation": "The handler loads the invoice by id and returns it without comparing its owner with the caller.", "reproduction": "Requested http://localhost.attacker.example/invoices/1 as a second user.", "fix": "Compare invoice.owner_id with the caller's id before returning; add a test that user B is refused.", "status": "reproduced_locally"}, "label": "known_bad"}, {"id": "bad-wildcard-dns", "finding": {"area": "object-authorization", "title": "Any signed-in user can read another user's invoice", "severity": "high", "confidence": "high", "location": "app/routes/invoices.py:41-58", "explanation": "The handler loads the invoice by id and returns it without comparing its owner with the caller.", "reproduction": "Requested http://127.0.0.1.nip.io:8000/invoices/1 as a second user.", "fix": "Compare invoice.owner_id with the caller's id before returning; add a test that user B is refused.", "status": "reproduced_locally"}, "label": "known_bad"}, {"id": "bad-bare-address", "finding": {"area": "object-authorization", "title": "Any signed-in user can read another user's invoice", "severity": "high", "confidence": "high", "location": "app/routes/invoices.py:41-58", "explanation": "The handler loads the invoice by id and returns it without comparing its owner with the caller.", "reproduction": "Sent the request to 198.51.100.7:8080 from a second account.", "fix": "Compare invoice.owner_id with the caller's id before returning; add a test that user B is refused.", "status": "reproduced_locally"}, "label": "known_bad"}, {"id": "bad-bare-domain", "finding": {"area": "object-authorization", "title": "Any signed-in user can read another user's invoice", "severity": "high", "confidence": "high", "location": "app/routes/invoices.py:41-58", "explanation": "The handler loads the invoice by id and returns it without comparing its owner with the caller.", "reproduction": "Requested billing.example.com/invoices/1 from a second account.", "fix": "Compare invoice.owner_id with the caller's id before returning; add a test that user B is refused.", "status": "reproduced_locally"}, "label": "known_bad"}, {"id": "bad-quoted-secret", "finding": {"area": "secrets-handling", "title": "Deploy key committed", "severity": "high", "confidence": "high", "location": "deploy/config.env:3", "explanation": "The file sets \"password\": \"hunter2hunter2\" for the database.", "reproduction": "Read the file at the pinned commit.", "fix": "Remove it and rotate the credential.", "status": "reproduced_locally"}, "label": "known_bad"}], "expected": {"good-reproduced": {"verdict": "pass", "failed_checks": []}, "good-reasoned": {"verdict": "pass", "failed_checks": []}, "bad-live-target": {"verdict": "fail", "failed_checks": ["local-only"]}, "bad-secret-value": {"verdict": "fail", "failed_checks": ["no-secret-values"]}, "bad-no-location": {"verdict": "fail", "failed_checks": ["located"]}, "bad-userinfo-host": {"verdict": "fail", "failed_checks": ["local-only"]}, "bad-lookalike-host": {"verdict": "fail", "failed_checks": ["local-only"]}, "bad-wildcard-dns": {"verdict": "fail", "failed_checks": ["local-only"]}, "bad-bare-address": {"verdict": "fail", "failed_checks": ["local-only"]}, "bad-bare-domain": {"verdict": "fail", "failed_checks": ["local-only"]}, "bad-quoted-secret": {"verdict": "fail", "failed_checks": ["no-secret-values"]}}, "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": [{"relation": "requires_noun", "target_id": "seedpack.security-review/security-review.v0.1.0.template.finding", "target_category": "noun.seed_hypothesis", "note": ""}]}},
{"store": "seedpack.security-review", "key": "security-review.v0.1.0.template.authorization", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.seed_hypothesis", "pack:security-review", "role:template", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.seed_hypothesis", "role": "template", "pack": "security-review", "pack_version": "0.1.0", "title": "Template: who authorized this review, for which target and commit, which activities, and until when", "category_reason": "The stated scope is a claim the scope check verifies before any review work.", "describes": "who authorized this review, for which target and commit, which activities, and until when", "schema": {"type": "object", "additionalProperties": false, "required": ["requester", "target", "commit", "basis", "allowed_activities", "expires_at"], "properties": {"requester": {"type": "string", "minLength": 1, "maxLength": 200}, "target": {"type": "string", "minLength": 1, "maxLength": 300}, "commit": {"type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[0-9a-f]{40}([0-9a-f]{24})?$"}, "basis": {"type": "string", "enum": ["owner", "written_authorization"]}, "evidence": {"type": "string", "minLength": 0, "maxLength": 400}, "allowed_activities": {"type": "array", "minItems": 1, "maxItems": 3, "items": {"type": "string", "enum": ["read_code", "run_tests_in_sandbox", "reproduce_in_sandbox"]}}, "expires_at": {"type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}", "maxLength": 40}}}, "rules": ["basis is owner or written_authorization with evidence.", "Expired means blocked."], "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.security-review", "key": "security-review.v0.1.0.template.scope-check", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.eval_run", "pack:security-review", "role:template", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.eval_run", "role": "template", "pack": "security-review", "pack_version": "0.1.0", "title": "Template: the result of checking a review's authorization against the snapshot", "category_reason": "A scope check is a deterministic verification run.", "describes": "the result of checking a review's authorization against the snapshot", "schema": {"type": "object", "additionalProperties": false, "required": ["authorization_ref", "snapshot_ref", "checks", "verdict"], "properties": {"authorization_ref": {"type": "string", "minLength": 1, "maxLength": 300}, "snapshot_ref": {"type": "string", "minLength": 1, "maxLength": 300}, "checks": {"type": "array", "minItems": 3, "maxItems": 3, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "enum": ["fields-match", "not-expired", "activities-listed"]}, "result": {"type": "string", "enum": ["pass", "fail"]}, "note": {"type": "string", "minLength": 0, "maxLength": 300}}}}, "verdict": {"type": "string", "enum": ["confirmed", "blocked"]}}}, "rules": ["verdict is confirmed only when all three checks pass."], "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.security-review", "key": "security-review.v0.1.0.template.threat-model", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.seed_hypothesis", "pack:security-review", "role:template", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.seed_hypothesis", "role": "template", "pack": "security-review", "pack_version": "0.1.0", "title": "Template: assets, entry points, trust boundaries, likely attackers and the areas to review first", "category_reason": "A threat model is a set of hypotheses about how the system could be attacked.", "describes": "assets, entry points, trust boundaries, likely attackers and the areas to review first", "schema": {"type": "object", "additionalProperties": false, "required": ["assets", "entry_points", "trust_boundaries", "attackers", "priority_areas"], "properties": {"assets": {"type": "array", "minItems": 1, "maxItems": 20, "items": {"type": "string", "minLength": 1, "maxLength": 200}}, "entry_points": {"type": "array", "minItems": 1, "maxItems": 40, "items": {"type": "object", "additionalProperties": false, "required": ["name", "location"], "properties": {"name": {"type": "string", "minLength": 1, "maxLength": 120}, "location": {"type": "string", "minLength": 1, "maxLength": 300}}}}, "trust_boundaries": {"type": "array", "minItems": 1, "maxItems": 20, "items": {"type": "string", "minLength": 1, "maxLength": 200}}, "attackers": {"type": "array", "minItems": 1, "maxItems": 10, "items": {"type": "string", "minLength": 1, "maxLength": 200}}, "priority_areas": {"type": "array", "minItems": 1, "maxItems": 16, "items": {"type": "string", "enum": ["object-authorization", "authentication-sessions", "injection", "path-traversal", "server-side-requests", "unsafe-deserialization", "output-encoding", "cross-site-requests", "secrets-handling", "dependency-advisories", "ci-supply-chain", "cryptography", "abuse-and-cost", "uploads", "sensitive-logging", "agent-tool-boundaries"]}}}}, "rules": ["Every entry point cites its location in code."], "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.security-review", "key": "security-review.v0.1.0.template.finding", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.seed_hypothesis", "pack:security-review", "role:template", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.seed_hypothesis", "role": "template", "pack": "security-review", "pack_version": "0.1.0", "title": "Template: one security finding: area, severity, confidence, location, local reproduction and fix", "category_reason": "A finding is a hypothesis about a weakness, confirmed or not by reproduction.", "describes": "one security finding: area, severity, confidence, location, local reproduction and fix", "schema": {"type": "object", "additionalProperties": false, "required": ["area", "title", "severity", "confidence", "location", "explanation", "reproduction", "fix", "status"], "properties": {"area": {"type": "string", "enum": ["object-authorization", "authentication-sessions", "injection", "path-traversal", "server-side-requests", "unsafe-deserialization", "output-encoding", "cross-site-requests", "secrets-handling", "dependency-advisories", "ci-supply-chain", "cryptography", "abuse-and-cost", "uploads", "sensitive-logging", "agent-tool-boundaries"]}, "title": {"type": "string", "minLength": 1, "maxLength": 200}, "severity": {"type": "string", "enum": ["critical", "high", "medium", "low", "informational"]}, "confidence": {"type": "string", "enum": ["high", "medium", "low"]}, "location": {"type": "string", "minLength": 1, "maxLength": 300}, "explanation": {"type": "string", "minLength": 1, "maxLength": 1200}, "reproduction": {"type": "string", "minLength": 1, "maxLength": 1500}, "fix": {"type": "string", "minLength": 1, "maxLength": 800}, "status": {"type": "string", "enum": ["reproduced_locally", "reasoned_not_reproduced", "not_reproducible"]}}}, "rules": ["Must pass every deterministic check in the severity rubric.", "Reproductions target local sandboxes only."], "example": {"area": "object-authorization", "title": "Any signed-in user can read another user's invoice", "severity": "high", "confidence": "high", "location": "app/routes/invoices.py:41-58", "explanation": "The handler loads the invoice by id and returns it without comparing its owner with the caller.", "reproduction": "In a local sandbox build with two synthetic users, user B requested user A's invoice at http://localhost:8000/invoices/1 and received it.", "fix": "Compare invoice.owner_id with the caller's id before returning; add a test that user B is refused.", "status": "reproduced_locally"}, "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.security-review", "key": "security-review.v0.1.0.template.reproduction", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.eval_run", "pack:security-review", "role:template", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.eval_run", "role": "template", "pack": "security-review", "pack_version": "0.1.0", "title": "Template: a local sandbox reproduction of one finding", "category_reason": "A reproduction is a recorded run with artifact digests.", "describes": "a local sandbox reproduction of one finding", "schema": {"type": "object", "additionalProperties": false, "required": ["finding_ref", "environment", "steps", "result", "artifacts_sha256"], "properties": {"finding_ref": {"type": "string", "minLength": 1, "maxLength": 300}, "environment": {"type": "string", "minLength": 1, "maxLength": 400}, "steps": {"type": "array", "minItems": 1, "maxItems": 20, "items": {"type": "string", "minLength": 1, "maxLength": 300}}, "result": {"type": "string", "enum": ["reproduced", "not_reproduced", "inconclusive"]}, "artifacts_sha256": {"type": "array", "minItems": 0, "maxItems": 10, "items": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "rules": ["The environment names the sandbox and confirms it had no credentials."], "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.security-review", "key": "security-review.v0.1.0.template.fix", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.code_node", "pack:security-review", "role:template", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.code_node", "role": "template", "pack": "security-review", "pack_version": "0.1.0", "title": "Template: a proposed patch with its tests, stored by digest and never pushed", "category_reason": "A fix is a code artifact pinned by digest with its test evidence.", "describes": "a proposed patch with its tests, stored by digest and never pushed", "schema": {"type": "object", "additionalProperties": false, "required": ["finding_ref", "patch_sha256", "files", "tests_added", "tests_passed"], "properties": {"finding_ref": {"type": "string", "minLength": 1, "maxLength": 300}, "patch_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}, "files": {"type": "array", "minItems": 1, "maxItems": 30, "items": {"type": "string", "minLength": 1, "maxLength": 300}}, "tests_added": {"type": "array", "minItems": 1, "maxItems": 10, "items": {"type": "string", "minLength": 1, "maxLength": 300}}, "tests_passed": {"type": "boolean"}, "notes": {"type": "string", "minLength": 0, "maxLength": 600}}}, "rules": ["tests_passed comes from an actual run.", "The patch is not pushed, merged or opened as a pull request by this pack."], "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.security-review", "key": "security-review.v0.1.0.template.review", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.eval_run", "pack:security-review", "role:template", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.eval_run", "role": "template", "pack": "security-review", "pack_version": "0.1.0", "title": "Template: an independent review of the findings", "category_reason": "A review is a verification run over the findings.", "describes": "an independent review of the findings", "schema": {"type": "object", "additionalProperties": false, "required": ["checked", "verdict", "reasons"], "properties": {"checked": {"type": "array", "minItems": 1, "maxItems": 60, "items": {"type": "object", "additionalProperties": false, "required": ["finding_ref", "result"], "properties": {"finding_ref": {"type": "string", "minLength": 1, "maxLength": 300}, "result": {"type": "string", "enum": ["upheld", "downgraded", "rejected"]}, "note": {"type": "string", "minLength": 0, "maxLength": 400}}}}, "verdict": {"type": "string", "enum": ["accept", "revise", "reject"]}, "reasons": {"type": "array", "minItems": 1, "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 300}}}}, "rules": ["The reviewer did not write the findings."], "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}}
]}