Jon Chery
2c08c778a9
REQ-221: skills/ directory with 9 Atelier-derived skill files mapped to the BA.A citizen-developer catalog: api, security, data, testing, observability, errors, devops, infrastructure-as-code, compliance. Each names the Atelier source path, distills first-principles to the citizen-dev-relevant subset, links to agent-checklist triggers, maps to BA.A 5-skill catalog. REQ-222: docs/skills.md index (9-skill table, Atelier provenance, 8 core principles C1-C8, consumption instructions, reference-only domains, excluded domains). PROJECT.md BA.A decision extended with the Atelier-derived skill catalog reference. ---ci--- project: acdl phase: 4 milestone: v1.18 status: execute requirements: covered: [REQ-221, REQ-222] partial: [] ---/ci---
2.0 KiB
Skill: Security
Atelier source:
domains/security/(first-principles + authentication, authorization, input-validation, secrets, supply-chain) Core principles: C1 Correctness (security is correctness) BA.A mapping: cross-cutting (all 5 skills) Consumer: read this before any production submission.
First Principles (citizen-developer-relevant subset)
- No secrets in code, logs, URLs, or error messages. Secrets live in the platform's secret store (SSM SecureString, Secrets Manager), not your application repo.
- Input is validated at the boundary. Every external input (HTTP body, query, header, file) is validated against a schema before processing.
- Output is encoded for its context. HTML escaping, URL encoding, SQL parameterization — context-appropriate, not a blanket escape.
- Crypto uses vetted libraries. No MD5/SHA1 for security. Use bcrypt/argon2 for passwords, AES-GCM for encryption.
- Authorization is checked, not assumed. Every request verifies the caller's authority to perform the action.
Agent-Checklist Triggers (§ Security)
- No secrets in code, logs, URLs, or error messages
- Input is validated at the boundary
- Output is encoded for its context
- Crypto uses vetted libraries (no MD5/SHA1 for security)
- Authorization is checked, not assumed
How Nova Uses This
The submission-readiness gate checks policyPreconditions (e.g.,
public-ingress: false, encryption_enabled: true). The security skill
tells you what the platform enforces and what your application must
enforce on its own surface. The platform enforces infrastructure-level
security (IAM scoping, ABAC, encryption-at-rest, policy-as-code via
Checkov); you enforce application-level security (input validation, output
encoding, auth checks). The Atelier MCP server (mcp/atelier/server.py,
P5) can validate your code against these principles agenticly — beyond
what deterministic scanners like Wiz/Checkmarx/Mend catch.