Jon Chery
2c08c778a9
REQ-221: skills/ directory with 9 Atelier-derived skill files mapped to the BA.A citizen-developer catalog: api, security, data, testing, observability, errors, devops, infrastructure-as-code, compliance. Each names the Atelier source path, distills first-principles to the citizen-dev-relevant subset, links to agent-checklist triggers, maps to BA.A 5-skill catalog. REQ-222: docs/skills.md index (9-skill table, Atelier provenance, 8 core principles C1-C8, consumption instructions, reference-only domains, excluded domains). PROJECT.md BA.A decision extended with the Atelier-derived skill catalog reference. ---ci--- project: acdl phase: 4 milestone: v1.18 status: execute requirements: covered: [REQ-221, REQ-222] partial: [] ---/ci---
42 lines
2.0 KiB
Markdown
42 lines
2.0 KiB
Markdown
# Skill: Security
|
|
|
|
> **Atelier source:** `domains/security/` (first-principles +
|
|
> authentication, authorization, input-validation, secrets, supply-chain)
|
|
> **Core principles:** C1 Correctness (security is correctness)
|
|
> **BA.A mapping:** cross-cutting (all 5 skills)
|
|
> **Consumer:** read this before any production submission.
|
|
|
|
## First Principles (citizen-developer-relevant subset)
|
|
|
|
- **No secrets in code, logs, URLs, or error messages.** Secrets live in
|
|
the platform's secret store (SSM SecureString, Secrets Manager), not
|
|
your application repo.
|
|
- **Input is validated at the boundary.** Every external input (HTTP
|
|
body, query, header, file) is validated against a schema before
|
|
processing.
|
|
- **Output is encoded for its context.** HTML escaping, URL encoding,
|
|
SQL parameterization — context-appropriate, not a blanket escape.
|
|
- **Crypto uses vetted libraries.** No MD5/SHA1 for security. Use
|
|
bcrypt/argon2 for passwords, AES-GCM for encryption.
|
|
- **Authorization is checked, not assumed.** Every request verifies the
|
|
caller's authority to perform the action.
|
|
|
|
## Agent-Checklist Triggers (§ Security)
|
|
|
|
- No secrets in code, logs, URLs, or error messages
|
|
- Input is validated at the boundary
|
|
- Output is encoded for its context
|
|
- Crypto uses vetted libraries (no MD5/SHA1 for security)
|
|
- Authorization is checked, not assumed
|
|
|
|
## How Nova Uses This
|
|
|
|
The submission-readiness gate checks `policyPreconditions` (e.g.,
|
|
`public-ingress: false`, `encryption_enabled: true`). The security skill
|
|
tells you what the platform enforces and what your application must
|
|
enforce on its own surface. The platform enforces infrastructure-level
|
|
security (IAM scoping, ABAC, encryption-at-rest, policy-as-code via
|
|
Checkov); you enforce application-level security (input validation, output
|
|
encoding, auth checks). The Atelier MCP server (`mcp/atelier/server.py`,
|
|
P5) can validate your code against these principles agenticly — beyond
|
|
what deterministic scanners like Wiz/Checkmarx/Mend catch. |