mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
86 lines
2.1 KiB
Markdown
86 lines
2.1 KiB
Markdown
# Container Image Scan Policy Template
|
|
|
|
## Scan Policy Configuration
|
|
|
|
### Severity Thresholds
|
|
|
|
| Environment | Block On | Alert On | Accept |
|
|
|-------------|----------|----------|--------|
|
|
| Production | Critical, High | Medium | Low, Negligible |
|
|
| Staging | Critical | High, Medium | Low, Negligible |
|
|
| Development | None | Critical, High | Medium, Low, Negligible |
|
|
|
|
### Scan Triggers
|
|
|
|
- [ ] On image build (CI pipeline)
|
|
- [ ] On image push to registry
|
|
- [ ] Before deployment to production
|
|
- [ ] Scheduled weekly rescan of deployed images
|
|
- [ ] On new vulnerability database update
|
|
|
|
### Image Inventory
|
|
|
|
| Image | Registry | Tag Policy | Last Scanned | Status |
|
|
|-------|----------|------------|--------------|--------|
|
|
| `app/frontend` | ghcr.io | Immutable digest | YYYY-MM-DD | Pass/Fail |
|
|
| `app/backend` | ghcr.io | Immutable digest | YYYY-MM-DD | Pass/Fail |
|
|
| `app/worker` | ghcr.io | Immutable digest | YYYY-MM-DD | Pass/Fail |
|
|
|
|
## Grype Configuration Template
|
|
|
|
```yaml
|
|
# .grype.yaml - Place in repository root
|
|
check-for-app-update: false
|
|
fail-on-severity: "high"
|
|
output: "json"
|
|
scope: "squashed"
|
|
quiet: false
|
|
|
|
ignore:
|
|
# Template: Add accepted risks below
|
|
# - vulnerability: CVE-YYYY-NNNNN
|
|
# reason: "Justification for accepting this risk"
|
|
# expires: "YYYY-MM-DD" # Optional expiration for risk acceptance
|
|
|
|
db:
|
|
auto-update: true
|
|
cache-dir: "/tmp/grype-db"
|
|
max-allowed-built-age: 120h
|
|
|
|
match:
|
|
java:
|
|
using-cpes: true
|
|
python:
|
|
using-cpes: true
|
|
javascript:
|
|
using-cpes: false
|
|
stock:
|
|
using-cpes: true
|
|
```
|
|
|
|
## Risk Acceptance Form
|
|
|
|
### Vulnerability Risk Acceptance
|
|
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| CVE ID | |
|
|
| Severity | |
|
|
| Affected Package | |
|
|
| Image(s) Affected | |
|
|
| Justification | |
|
|
| Compensating Controls | |
|
|
| Approved By | |
|
|
| Approval Date | |
|
|
| Expiration Date | |
|
|
|
|
## Remediation SLA
|
|
|
|
| Severity | Remediation Timeline | Escalation |
|
|
|----------|---------------------|------------|
|
|
| Critical | 24 hours | Security Lead + Engineering VP |
|
|
| High | 7 days | Security Lead |
|
|
| Medium | 30 days | Team Lead |
|
|
| Low | 90 days | Tracked in backlog |
|
|
| Negligible | Best effort | No escalation |
|