{
  "markdown": "# spec-objects-security\n\n> Filament Module: tier-2 security and identity ObjectTypes (threats, controls, auth flows, secrets, policies)\n\n`spec-objects-security` is an **Agent-IX Filament module**: a `manifest.yaml` plus per-kind authoring **skeletons** (and frontmatter schemas) that teach the spec tooling a vocabulary of object kinds. It is not a standalone app — it is loaded by [`quire-cli`](https://github.com/agent-ix/quire-cli) and [`quoin`](https://github.com/agent-ix/quoin) to author and validate Markdown spec artifacts.\n\n## Installing quire-cli\n\n`@agent-ix` packages are published to public npm. Install the CLI globally:\n\n```bash\nnpm install -g @agent-ix/quire-cli\n```\n\nSee https://github.com/agent-ix/quire-cli#install for details.\n\n## Install this module via npm\n\nThis module is also published as a config-only npm package: `@agent-ix/spec-objects-security`.\nThe package root **is** the Filament module (`manifest.yaml` + schemas/skeletons),\nso it works directly as a `--module` target or via quoin's `package:` source.\n\n```bash\nnpm install @agent-ix/spec-objects-security\n```\n\n```bash\n# quoin — resolve the module from npm by name\nquoin plugin install package:@agent-ix/spec-objects-security\n\n# or point any tool at the installed package root\nquire validate spec/**/*.md --module node_modules/@agent-ix/spec-objects-security\n```\n\n## Object types provided\n\nThis module adds the following object kinds (frontmatter `type:` value in parentheses). All kinds are tier-2 embedded ObjectTypes — they require `id`, `title` and `type` in frontmatter plus the kind-specific contract below.\n\n| Object | `type:` | Description |\n|--------|---------|-------------|\n| Auth flow | `auth_flow` | An authentication/login flow, with a `Flow` section carrying a mermaid diagram of the sequence (e.g. OIDC authorization code flow). |\n| Permission | `permission` | A single grantable permission, naming the protected `resource` kind and the `verb` (action) it grants on it. |\n| Scope | `scope` | An OAuth/authorization scope, with a `Grants` section listing the permissions the scope confers. |\n| Role | `role` | A named role, with a `Permissions` section listing the permissions bound to it. |\n| Secret | `secret` | A managed secret (e.g. client secret), with a `Rotation` section describing how and how often it rotates. |\n| Encryption key | `encryption_key` | An encryption key, with frontmatter `algorithm` (cipher) and optional `rotation` cadence. |\n| Session config | `session_config` | A session configuration, with a `Settings` section enumerating the effective session parameters (cookies, timeouts, limits). |\n| Data classification | `data_classification` | A data sensitivity class, with a `Handling` section stating the handling requirements for that class. |\n| Trust boundary | `trust_boundary` | A trust boundary between security zones, with a `Boundary` section carrying a mermaid diagram of the zones. |\n| Audit event | `audit_event` | An emitted audit/log event, with an `Event Schema` section carrying a JSON code block of its payload schema. |\n| CSRF token | `csrf_token` | A CSRF-protection token, with frontmatter `rotation_window` (how often a fresh token is issued). |\n| CORS policy | `cors_policy` | A browser cross-origin policy, with an `Origins` section enumerating the allowed origins and their rules. |\n| Password policy | `password_policy` | A password policy, with a `Rules` section enumerating the enforced password rules. |\n| MFA method | `mfa_method` | A multi-factor authentication method, with frontmatter `kind` (method kind) and optional `factor` (auth factor class). |\n| JWT claim | `jwt_claim` | A JWT/token claim, with a `Schema` section carrying a JSON code block of the claim's JSON Schema. |\n| Threat | `threat` | A threat, with frontmatter `stride_category` (STRIDE class) and `vector` (the attack vector). |\n| Control | `control` | A security control, with a `Mappings` section mapping it to the threats, risks and standards it addresses. |\n| Risk | `risk` | A risk-register entry, with frontmatter `likelihood` and `impact` qualitative ratings driving its score. |\n| Vulnerability | `vulnerability` | A vulnerability, with frontmatter `severity` and optional `cve_id` linking the public advisory. |\n| Asset | `asset` | A protected asset, with a `Description` section describing the asset and why it matters. |\n| Attack surface | `attack_surface` | An attack surface, with an `Entry Points` section enumerating the externally reachable entry points. |\n| Policy | `policy` | A normative security policy, with a `Policy` section stating the policy text. |\n| Audit finding | `audit_finding` | A security-audit finding, with a `Recommendation` section stating the remediation recommendation. |\n\n## How this module is used\n\n### With quoin (recommended)\n\n[`quoin`](https://github.com/agent-ix/quoin) is the spec-domain authoring CLI. Install the module as a plugin, then author and validate:\n\n```bash\nquoin plugin install path:../spec-objects-security\nquoin catalog list                      # list the kinds this module adds\nquoin write . --types threat,control    # scaffold artifacts of these kinds\nquoin review                            # validate authored files\n```\n\n### With quire-cli directly\n\nPoint `quire` at this module (the package directory holds `manifest.yaml` and `skeletons/`):\n\n```bash\nquire schema threat --module ./spec_objects_security                 # a kind's extraction contract\nquire validate spec/**/*.md --module ./spec_objects_security         # structural validation\nquire extract <DOC> --module ./spec_objects_security                 # extract structured data\n```\n\nSee the [quire-cli usage docs](https://github.com/agent-ix/quire-cli#usage-instructions) for all commands.\n\n## Development\n\nThis module is a flat-layout Python package (`spec_objects_security`, Python 3.13+) managed with [Poetry](https://python-poetry.org/) and built/published via GitHub Actions to Google Artifact Registry (PyPI-compatible).\n\n```bash\nmake install          # install dependencies in the Poetry venv\nmake test             # run pytest\nmake lint             # ruff + black --check\nmake format           # auto-format (ruff --fix + black)\nmake build            # build wheel + sdist under dist/\nmake local-publish    # publish to the local pypi.ix registry\nmake update-lock      # update poetry.lock\nmake use-local p=<name> / make use-upstream p=<name>   # swap a dep source\n```\n\n**CI:** GitHub Actions runs on `push`, `pull_request`, and `v*.*.*` tags — it tests, lints, builds with `poetry build`, and on tags publishes via `twine upload -r internal-pypi`. Versioning is dynamic from the Git tag. Required CI config: `GCP_SERVICE_ACCOUNT_KEY` (secret) plus `GCP_REGION`, `GCP_PROJECT_NAME`, `GCP_PYPI` (variables).\n\n## License\n\nAGPL-3.0-or-later — see [LICENSE](./LICENSE).\n",
  "bytes": 6822,
  "sha": "e8ae37cce42c03e068033e7218c33fa7ad9795246ea2428734031a1844918ea4",
  "repo_slug": "agent-ix/spec-objects-security",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/okf_agent_ix_spec_objects_security_spec_inde_45993233/readme"
}