mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
5.1 KiB
5.1 KiB
SDP Deployment Workflows
Workflow 1: SDP Connection Establishment
┌────────────┐ ┌──────────────┐ ┌────────────┐
│ IH (Client) │ │ SDP Controller│ │ AH (Gateway)│
└──────┬─────┘ └──────┬───────┘ └──────┬─────┘
│ │ │
│ 1. Authenticate │ │
│──────────────────>│ │
│ │ │
│ 2. Validate ID, │ │
│ device, policy │ │
│ │ │
│ 3. Auth response │ │
│<──────────────────│ │
│ (SPA key, AH IP) │ │
│ │ 4. Notify AH to │
│ │ expect IH │
│ │────────────────────>│
│ │ │
│ 5. Send SPA packet│ │
│─────────────────────────────────────────>│
│ │ │
│ │ 6. Validate SPA │
│ │ Open port │
│ │ │
│ 7. mTLS handshake │ │
│<════════════════════════════════════════>│
│ │ │
│ 8. Application │ │
│ traffic flows │ │
│<═══════════════════════════════════════=>│
Workflow 2: SDP Deployment Lifecycle
Phase 1: Planning (Weeks 1-2)
├── Inventory protected applications
├── Map user-to-application access requirements
├── Design PKI infrastructure for mTLS
├── Select SDP solution (open-source or commercial)
└── Plan network architecture changes
Phase 2: Controller Setup (Weeks 3-4)
├── Deploy SDP controller with HA
├── Integrate with IdP (SAML/OIDC)
├── Configure PKI and certificate templates
├── Define application catalog and policies
└── Test controller authentication flow
Phase 3: Gateway Deployment (Weeks 5-6)
├── Deploy gateways in each app environment
├── Configure default-drop firewall rules
├── Enable SPA listeners
├── Register applications with controller
└── Verify gateway invisibility (port scan test)
Phase 4: Client Rollout (Weeks 7-10)
├── Package SDP client with certificates
├── Deploy to pilot user group
├── Validate end-to-end connectivity
├── Expand to all user groups
└── Decommission legacy VPN access
Phase 5: Operations (Ongoing)
├── Monitor SDP controller and gateway health
├── Rotate certificates on schedule
├── Review and update access policies
├── Conduct quarterly penetration tests
└── Update SDP components for security patches
Workflow 3: SPA Validation
Incoming Packet to Gateway
│
v
┌─────────────────────┐
│ Is it a SPA packet? │
│ (Check magic bytes) │
└───┬──────────┬──────┘
│ │
YES NO
│ │
v v
┌──────────┐ ┌──────────┐
│ Decrypt │ │ DROP │
│ SPA data │ │ silently │
└────┬─────┘ └──────────┘
v
┌─────────────────────┐
│ Validate timestamp │
│ (within 60s window) │
└───┬──────────┬──────┘
VALID EXPIRED
│ │
v v
┌──────────┐ ┌──────────┐
│ Check │ │ DROP + │
│ HMAC │ │ Log │
└────┬─────┘ └──────────┘
v
┌─────────────────────┐
│ Verify replay │
│ (check sequence DB) │
└───┬──────────┬──────┘
NEW REPLAY
│ │
v v
┌──────────┐ ┌──────────┐
│ Open port │ │ DROP + │
│ for src IP│ │ Alert │
│ (30s TTL) │ └──────────┘
└──────────┘