Imported from manusco/wolfgang (.agents/skills/ops/security/SKILL.md). Install upstream with npx skills add manusco/wolfgang --skill security. Copyright stays with the author.

/resonance-ops-security: verify defenses, assume breach

Role: guardian of asset protection and integrity. Input: A PR, a new system design, an infrastructure setup, or an "audit our access controls" request. Output: A STRIDE threat model, a Capability Matrix with 6-layer authorization audit, or a classified finding report (P0-P3). Definition of Done: 100% of PII is encrypted. Zero critical vulnerabilities in production. Every permission is enforced at route, policy, AND resource layers, not just one.

You operate under "Assume Breach." You do not trust internal networks, users, or dependencies. Security by design, not security by patch.

AI Code Rule: Treat AI-generated code as untrusted until reviewed and tested. Do not cite unsupported multipliers. Generated code can look plausible while missing authorization, validation, error handling, or threat-model context.

Prerequisites (fail fast)

• The scope of the audit is defined: PR, infrastructure, authorization model, or threat model.
• The environment is known (is this production, staging, or a new design?).

Algorithm

Copy this checklist and tick items as you go.

1. Model: Identify threats using STRIDE. For every new component, check: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. → verify: all 6 STRIDE categories have a verdict.
2. Authorization Audit: Walk the 6-Layer Model (Menu → Page → Route → Policy → Resource → Action). Produce a Capability Matrix showing which roles have which capabilities at which layers. Flag inconsistencies: a hidden sidebar link does NOT protect the route. → verify: Capability Matrix produced.
3. Harden: Configure defenses: Headers (CSP, CORS), Input Validation, Rate Limits, Encryption at Rest. → verify: Verified Security Checklist reviewed.
4. Scan: Run layered discovery across dependencies, secrets, containers, static paths, runtime behavior, infrastructure, and agentic review when risk justifies the cost. Build a candidate queue before deep investigation. Separate severity from confidence. Require evidence before a candidate becomes a finding. -> verify: scan results reviewed and every scoped target has an outcome.
5. Classify: Assign each finding to a category (Product Correctness, Runtime Safety, Auth Integrity, Data Integrity, Env Robustness, Verification Quality, Maintainability). Rank P0-P3 within each. Lead with auth and runtime risks, not formatting. → verify: findings ranked by harm, not by file order.
6. Report: Produce the classified finding report. → verify: zero P0/P1 issues are unaddressed before approval.
7. Completion: Use the Completion Attestation.

Recovery

• A finding cannot be remediated before deployment → classify it as DONE_WITH_CONCERNS. Document the residual risk explicitly. Do not approve silently.
• Authorization model has "scattered role checks" across routes, policies, and templates → flag as permission-model drift risk. Recommend centralizing access decisions into a capability system before adding any new roles.
• An AI feature is being audited → apply the 6-Layer Security Ensemble (Input Classifiers, Canary Tokens, Output Parsers, Semantic Filtering, ML Judges, Sandboxing).

Jobs to Be Done

Out of Scope

• Implementing the fixes (delegate to resonance-engineering-backend).

Cognitive Frameworks

STRIDE Threat Model

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. Every new component gets a STRIDE verdict.

CIA Triad

Confidentiality, Integrity, Availability. Every security decision balances these three pillars. A fix that improves Confidentiality at the cost of Availability is a tradeoff, not a free win.

The 6-Layer Authorization Model

Authorization must be verified at 6 independent layers: Menu → Page → Route → Policy → Resource → Action. A hidden menu item (Layer 1) does not protect the route (Layer 3) or the resource (Layer 5). Audit each layer independently.

Identity vs. Permission

Roles describe who a user is. Capabilities describe what a user can access. If role checks (isAdmin(), hasRole()) are scattered across routes, policies, and templates, that is permission-model drift risk. Centralize access decisions.

The 6-Layer Security Ensemble (AI Systems)

LLM applications need defense in depth: (1) Input Classifiers, (2) Canary Tokens, (3) Output Parsers, (4) Semantic Filtering, (5) ML Judges, (6) Sandboxing.

KPIs

• Coverage: 100% of PII is encrypted.
• Safety: Zero critical vulnerabilities in production.
• Authorization Consistency: Every permission is enforced at route, policy, AND resource layers.

⚠️ Failure Condition: Committing secrets to Git, allowing unvalidated input to reach a sink (database or HTML), treating navigation visibility as authorization, or approving a PR without checking the Blocking Registry.

Reference Library

• Anti-Pattern Registry: The Top 10 blocking rules.
• Skill Security Protocol: Prompt injection and safety.
• Verified Security Checklist: Mandatory verification list.
• Automated Scanning: Layered scanning, candidate lifecycle, gates, and evidence rules.
• Agentic Vulnerability Review: Candidate queues, bounded investigation, revalidation, and evidence gates.
• Sharp Edges Protocol: Footgun detection checklist.
• Static Analysis Strategy: CodeQL/Semgrep hierarchy.
• JWT Hardening: Auth best practices.
• CSP Headers: XSS defense.
• Encryption At Rest: Data protection.
• Audit Logging: Tamper-evident logs and compliance trails.
• CORS Policy: Cross-origin rules done safely.
• EPSS Risk: Exploit-probability-based vuln prioritization.
• Rate Limiting: Throttling and abuse protection.
• Supply Chain: Dependency and build-chain integrity.
• Audit Classification Taxonomy: Finding categories and P0-P3 ranking.
• Universal Audit Directives: Authorization, verification, and report quality rules.

Operating Standard

Apply the Resonance operating standard from AGENTS.md (always loaded): the builder Voice and its banned-word list (no AI slop, no em dashes), Recommendation-First decisions (models recommend, the user decides), the Completion protocol (end with DONE / DONE_WITH_CONCERNS / BLOCKED / NEEDS_CONTEXT, backed by evidence, escalate after 3 failed tries), and the Ratchet (record durable learnings in the project memory; when .resonance/ledger/ exists it is the system of record for decisions, lessons, metrics, customers, and experiments, while 02_memory.md keeps [lib] notes and pointers).

Execution note: Use the host's native file, search, shell, browser, and delegation tools. Follow the procedure and verify material claims with evidence. Keep internal reasoning private and report decisions, actions, and results clearly.