Skip to content

Commit 6cf4f6b

Browse files
stackbilt-adminCodebeastclaude
authored
feat(security,ecosystem): outbound disclosure policy + OSS repo manifest (#15)
Adds the missing "outbound" side of the security policy — rules for when Stackbilt itself (operators and internal agents) files findings against its own public repositories. The existing policy covered inbound reports only; this closes the gap. What's new: 1. security.md — new "Outbound Disclosure" section: - Severity/channel routing matrix for public vs private repos - Neutral-filer rule (no internal agent branding on public issues) - Reference framing rules (cite RFCs/OWASP, not internal docs) - Scrub list of identifier classes that must not appear publicly - Cross-repo chain rule (never describe private-chain findings publicly) - Approval gate for agent-filed public issues - Disclosure audit log requirement - Policy Authoring Rule: the policy itself must pass its own scrub filter during revisions (includes a case study of the near-miss that produced this section) - Primary reporting email flipped to admin@stackbilt.dev - GHSA added as per-repo preferred channel 2. ecosystem.md — two new sections: - Open Source Libraries table listing 14 OSS repos under Stackbilt-dev with one-line purposes and repo links - OSS Core / Commercial Extension pattern documentation with aegis-oss as the concrete example; commercial extensions described abstractly without naming - Service Map AEGIS row updated to point at aegis-oss (removes the "Internal cognitive agent" phrasing that contradicted the new OSS libraries section) 3. public/ecosystem/repo-visibility.json — new machine-readable manifest: - Public allowlist only (16 repos) with ecosystem_role, disclosure channel, and fallback channel per entry - default_policy stanza: anything not listed is private, must not be referenced publicly - Routing matrix for severity -> channel decisions - Reference framing allowlist / prohibition list - agent_consumers section documenting pre-flight lookup behavior - Contains NO private repo names. Private-name scrub lists are generated dynamically by agents at session start via the authenticated GitHub API, never persisted to a public-visible location. 4. public/ecosystem/SECURITY.md.template — canonical per-repo SECURITY.md template. Placeholder {{REPO_NAME}} replaced at rollout time. Points at admin@stackbilt.dev and the canonical policy URL. Known pre-existing scrub gaps in ecosystem.md that are NOT addressed in this PR and will be tracked in a follow-up issue: - Service Map line 29: tarotscript-worker service binding identifier - Service Map line 30: img-forge-gateway service binding identifier - Authentication section lines 123, 129: edge-auth named by private repo name These were present before this PR and are editorial decisions about how the deployed auth and service-binding architecture is described. Fixing them requires broader rewriting of those sections and is out of scope for this policy introduction. Co-authored-by: Codebeast <codebeast@stackbilt.dev> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 1c629af commit 6cf4f6b

4 files changed

Lines changed: 378 additions & 4 deletions

File tree

‎public/ecosystem/SECURITY.md.template‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Security
2+
3+
For the full Stackbilt security policy, see https://docs.stackbilt.dev/security/.
4+
5+
## Reporting a Vulnerability
6+
7+
**Do not open a public GitHub issue for security vulnerabilities.**
8+
9+
### How to report
10+
11+
- **Primary channel:** email `admin@stackbilt.dev` with "SECURITY:" in the subject line
12+
- **GitHub Security Advisory:** https://github.com/Stackbilt-dev/{{REPO_NAME}}/security/advisories/new
13+
- Include: vulnerability description, reproduction steps, potential impact, and any suggested mitigation
14+
15+
### Response targets
16+
17+
| Severity | Acknowledgement | Fix target |
18+
|---|---|---|
19+
| Critical — active exploitation, data exposure | 24 hours | 7 days |
20+
| High — exploitable with effort | 48 hours | 14 days |
21+
| Medium / Low | 5 business days | Next release cycle |
22+
23+
These are targets, not contractual SLAs. Stackbilt is a solo-founder operation and response times reflect that reality honestly. Critical issues affecting user data are prioritized above everything else.
24+
25+
### Scope
26+
27+
This policy covers all software published in this repository. For the full policy covering the entire Stackbilt-dev organization, see the [canonical security policy](https://docs.stackbilt.dev/security/).
28+
29+
### Out of scope
30+
31+
- Denial of service against free-tier services (Cloudflare handles DDoS)
32+
- Rate limiting bypass on non-authenticated endpoints (unless it enables data access)
33+
- Missing security headers on non-production deployments
34+
- Vulnerabilities in third-party dependencies where this repo is not the upstream maintainer
35+
36+
### Disclosure
37+
38+
- Stackbilt practices **coordinated disclosure** with a minimum 90-day window (30 days for critical).
39+
- Reporters are credited in release notes unless anonymity is requested.
40+
- Good-faith security research within this policy will not face legal action.
41+
42+
### Contact
43+
44+
- **Primary:** admin@stackbilt.dev
45+
- **Canonical policy:** https://docs.stackbilt.dev/security/

‎public/ecosystem/repo-visibility.json‎

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
{
2+
"$schema": "https://docs.stackbilt.dev/ecosystem/repo-visibility.schema.json",
3+
"version": "1.0.0",
4+
"updated": "2026-04-10",
5+
"canonical_url": "https://docs.stackbilt.dev/ecosystem/repo-visibility.json",
6+
"purpose": "Authoritative public-facing manifest of Stackbilt-dev open source repositories. Lists only repos that are safe to reference publicly. Consumed by internal automation to route findings and by external researchers to confirm which repos are in scope for public discussion.",
7+
8+
"default_policy": {
9+
"description": "Any Stackbilt-dev repository not listed in the `repos` array below is to be treated as private. Private repositories must not be referenced by name in any public artifact — blog posts, GitHub issues, PR descriptions, commit messages, conference talks, or social media posts. This includes repositories that may become public in the future but have not yet been added to this manifest.",
10+
"unlisted_repo_handling": "treat_as_private",
11+
"new_repo_onboarding": "Public repositories graduate into this manifest via a PR on Stackbilt-dev/docs updating this file. Opening a repo to public visibility on GitHub does not automatically add it here — the manifest is the canonical source of truth for `safe_to_reference_publicly`, not GitHub's own visibility flag."
12+
},
13+
14+
"disclosure_channels": {
15+
"ghsa": "GitHub Security Advisory on the target repository. Preferred for critical and high-severity security findings — coordinated disclosure with the repo maintainer, tracked in the repo's security tab.",
16+
"email": "admin@stackbilt.dev — the canonical Stackbilt security address. Use as fallback when GHSA is not appropriate or for findings spanning multiple repositories.",
17+
"public_issue": "Public GitHub issue on the target repository. Appropriate only for non-security findings: low-severity hardening, documentation gaps, test coverage, refactors, and performance work."
18+
},
19+
20+
"routing_matrix": {
21+
"description": "Severity → channel routing for findings against repos in this manifest. See https://docs.stackbilt.dev/security/ § Outbound Disclosure for the full policy.",
22+
"critical": "ghsa",
23+
"high_exploitable": "ghsa",
24+
"medium_exploitable": "ghsa",
25+
"medium_hardening": "public_issue",
26+
"low": "public_issue",
27+
"docs": "public_issue",
28+
"test_gap": "public_issue"
29+
},
30+
31+
"reference_framing_rules": {
32+
"description": "When drafting public artifacts about these repos, cite only sources that are already publicly published.",
33+
"allowed_citations": [
34+
"Published RFCs (RFC 6749, RFC 7636, RFC 7519, etc.)",
35+
"OWASP guidance and Top 10 entries",
36+
"Cloudflare Workers documentation at developers.cloudflare.com",
37+
"Published npm packages on npmjs.com",
38+
"Commits, issues, and PRs in repositories listed in this manifest",
39+
"Publicly-dated blog posts at blog.stackbilder.com"
40+
],
41+
"prohibited_citations": [
42+
"Commits, issues, or PRs in Stackbilt-dev repositories not listed in this manifest",
43+
"Internal policy documents, agent memory stores, CLAUDE.md files",
44+
"Internal incident descriptions or postmortems not publicly published",
45+
"Sibling private service names or binding identifiers",
46+
"Non-public pricing, customer names, or commercial configuration"
47+
]
48+
},
49+
50+
"repos": [
51+
{
52+
"name": "charter",
53+
"public_name": "Charter CLI",
54+
"disclosure_channel": "ghsa",
55+
"fallback_channel": "admin@stackbilt.dev",
56+
"ecosystem_role": "OSS governance runtime, ADF context compiler, CLI gateway (Apache-2.0)",
57+
"npm_package": "@stackbilt/cli",
58+
"docs_url": "https://docs.stackbilt.dev/platform/#charter"
59+
},
60+
{
61+
"name": "docs",
62+
"public_name": "Stackbilt Documentation",
63+
"disclosure_channel": "ghsa",
64+
"fallback_channel": "admin@stackbilt.dev",
65+
"ecosystem_role": "docs.stackbilt.dev — public documentation site",
66+
"docs_url": "https://docs.stackbilt.dev/"
67+
},
68+
{
69+
"name": ".github",
70+
"public_name": "Stackbilt-dev Organization Profile",
71+
"disclosure_channel": "public_issue",
72+
"fallback_channel": "admin@stackbilt.dev",
73+
"ecosystem_role": "GitHub organization profile and shared templates"
74+
},
75+
{
76+
"name": "stackbilt-mcp-gateway",
77+
"public_name": "Stackbilt MCP Gateway",
78+
"disclosure_channel": "ghsa",
79+
"fallback_channel": "admin@stackbilt.dev",
80+
"ecosystem_role": "OAuth-authenticated MCP gateway routing to Stackbilt platform services",
81+
"docs_url": "https://docs.stackbilt.dev/mcp/"
82+
},
83+
{
84+
"name": "cc-taskrunner",
85+
"public_name": "cc-taskrunner",
86+
"disclosure_channel": "ghsa",
87+
"fallback_channel": "admin@stackbilt.dev",
88+
"ecosystem_role": "Autonomous task queue for Claude Code with safety hooks, branch isolation, and PR creation"
89+
},
90+
{
91+
"name": "mindspring",
92+
"public_name": "Mindspring",
93+
"disclosure_channel": "ghsa",
94+
"fallback_channel": "admin@stackbilt.dev",
95+
"ecosystem_role": "Semantic search for AI conversation exports (ChatGPT/Claude)"
96+
},
97+
{
98+
"name": "aegis-oss",
99+
"public_name": "AEGIS",
100+
"disclosure_channel": "ghsa",
101+
"fallback_channel": "admin@stackbilt.dev",
102+
"ecosystem_role": "Persistent AI agent framework for Cloudflare Workers — multi-tier memory, autonomous goals, dreaming cycles, MCP native",
103+
"has_commercial_extension": true,
104+
"public_reference_note": "When discussing AEGIS in any public context, always reference aegis-oss. The commercial platform builds additional integrations on top of this OSS framework; those integrations are implementation details and are not publicly named."
105+
},
106+
{
107+
"name": "n8n-transpiler",
108+
"public_name": "n8n-transpiler",
109+
"disclosure_channel": "ghsa",
110+
"fallback_channel": "admin@stackbilt.dev",
111+
"ecosystem_role": "n8n workflow JSON → Cloudflare Workers transpiler"
112+
},
113+
{
114+
"name": "social-sentinel",
115+
"public_name": "Social Sentinel",
116+
"disclosure_channel": "ghsa",
117+
"fallback_channel": "admin@stackbilt.dev",
118+
"ecosystem_role": "Privacy-first social sentiment monitoring with PII redaction and Workers AI sentiment analysis",
119+
"has_commercial_extension": true,
120+
"public_reference_note": "When discussing Social Sentinel in any public context, always reference social-sentinel. Commercial extensions are implementation details and are not publicly named."
121+
},
122+
{
123+
"name": "equity-scenario-sim",
124+
"public_name": "Equity Scenario Sim",
125+
"disclosure_channel": "ghsa",
126+
"fallback_channel": "admin@stackbilt.dev",
127+
"ecosystem_role": "Cap table simulator for partnership negotiations — deal structures, vesting, exit payouts"
128+
},
129+
{
130+
"name": "ai-playbook",
131+
"public_name": "AI Playbook",
132+
"disclosure_channel": "ghsa",
133+
"fallback_channel": "admin@stackbilt.dev",
134+
"ecosystem_role": "AI interaction frameworks, philosophical archetypes, and context engineering patterns"
135+
},
136+
{
137+
"name": "llm-providers",
138+
"public_name": "llm-providers",
139+
"disclosure_channel": "ghsa",
140+
"fallback_channel": "admin@stackbilt.dev",
141+
"ecosystem_role": "Multi-LLM failover with circuit breakers, cost tracking, and intelligent retry"
142+
},
143+
{
144+
"name": "audit-chain",
145+
"public_name": "audit-chain",
146+
"disclosure_channel": "ghsa",
147+
"fallback_channel": "admin@stackbilt.dev",
148+
"ecosystem_role": "Tamper-evident audit trail for Cloudflare Workers — SHA-256 hash chaining with R2 immutability and D1 indexing"
149+
},
150+
{
151+
"name": "worker-observability",
152+
"public_name": "worker-observability",
153+
"disclosure_channel": "ghsa",
154+
"fallback_channel": "admin@stackbilt.dev",
155+
"ecosystem_role": "Edge-native observability for Cloudflare Workers — health checks, structured logging, metrics, tracing, SLI/SLO monitoring"
156+
},
157+
{
158+
"name": "feature-flags",
159+
"public_name": "feature-flags",
160+
"disclosure_channel": "ghsa",
161+
"fallback_channel": "admin@stackbilt.dev",
162+
"ecosystem_role": "Edge-native feature flags for Cloudflare Workers — KV-backed, per-tenant, canary rollouts, A/B conditions, Hono middleware"
163+
},
164+
{
165+
"name": "contracts",
166+
"public_name": "Stackbilt Contracts",
167+
"disclosure_channel": "ghsa",
168+
"fallback_channel": "admin@stackbilt.dev",
169+
"ecosystem_role": "Contract Ontology Layer — ODD-driven code generation from TypeScript+Zod contracts"
170+
}
171+
],
172+
173+
"agent_consumers": {
174+
"description": "Internal agents that consume this manifest at pre-flight before filing any issue, PR, or security advisory against a Stackbilt-dev repository. See https://docs.stackbilt.dev/security/ § Outbound Disclosure for agent responsibilities.",
175+
"lookup_behavior": "Agents fetch this manifest at session start, cache for the session, and check the target repo's name against the `repos` array before any filing action. A target repo not in the array is treated as private per `default_policy.unlisted_repo_handling`.",
176+
"scrub_list_generation": "Agents generate their private-repo scrub list dynamically at session start by calling `gh api orgs/Stackbilt-dev/repos --paginate` with authenticated credentials and extracting the names of private repositories. The scrub list is held in memory only, never persisted, and never published. This manifest does not contain the scrub list directly — it contains only the positive (public) allowlist."
177+
}
178+
}

‎src/content/docs/ecosystem.md‎

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ Charter is the open-source CLI. Stackbilder and img-forge are commercial service
2929
| **TarotScript** | `tarotscript-worker` (service binding) | Deterministic scaffold engine — intent classification, scaffold-cast spreads, grimoire persistence |
3030
| **img-forge** | `img-forge-gateway` (service binding) | AI image generation API, async job queue, R2 image storage |
3131
| **Auth** | `auth.stackbilt.dev` | Centralized auth — OAuth (GitHub/Google), session management, API keys, quota, billing |
32-
| **AEGIS** | `aegis.stackbilt.dev` | Internal cognitive agent — memory, goals, task pipeline |
32+
| **AEGIS** | `aegis.stackbilt.dev` | Persistent AI agent framework — see [aegis-oss](https://github.com/Stackbilt-dev/aegis-oss) |
3333
| **Docs** | `docs.stackbilder.com` | Documentation (this site) |
3434
| **Blog** | `blog.stackbilder.com` | Blog and changelog |
3535

@@ -140,6 +140,42 @@ Flat tiers. No credits, no tokens, no per-action charges.
140140

141141
Every plan includes full governance output. See [stackbilder.com/pricing](https://stackbilder.com/pricing).
142142

143+
## Open Source Libraries
144+
145+
Beyond Charter and the commercial services, Stackbilt maintains a set of edge-native open source libraries. They are standalone, composable, and deliberately scoped — each solves one problem Cloudflare Workers developers hit repeatedly.
146+
147+
| Library | Repo | Purpose |
148+
|---|---|---|
149+
| **Charter CLI** | [Stackbilt-dev/charter](https://github.com/Stackbilt-dev/charter) | Governance runtime, ADF context compiler, CLI gateway (Apache-2.0) |
150+
| **Stackbilt MCP Gateway** | [Stackbilt-dev/stackbilt-mcp-gateway](https://github.com/Stackbilt-dev/stackbilt-mcp-gateway) | OAuth-authenticated MCP gateway routing to Stackbilt platform services |
151+
| **AEGIS (OSS framework)** | [Stackbilt-dev/aegis-oss](https://github.com/Stackbilt-dev/aegis-oss) | Persistent AI agent framework for Workers — multi-tier memory, goals, dreaming cycles, MCP native |
152+
| **llm-providers** | [Stackbilt-dev/llm-providers](https://github.com/Stackbilt-dev/llm-providers) | Multi-LLM failover with circuit breakers, cost tracking, intelligent retry |
153+
| **worker-observability** | [Stackbilt-dev/worker-observability](https://github.com/Stackbilt-dev/worker-observability) | Edge-native observability — health checks, structured logging, metrics, tracing, SLI/SLO monitoring |
154+
| **audit-chain** | [Stackbilt-dev/audit-chain](https://github.com/Stackbilt-dev/audit-chain) | Tamper-evident audit trail via SHA-256 hash chaining with R2 immutability and D1 indexing |
155+
| **feature-flags** | [Stackbilt-dev/feature-flags](https://github.com/Stackbilt-dev/feature-flags) | KV-backed feature flags — per-tenant, canary rollouts, A/B conditions, Hono middleware |
156+
| **contracts** | [Stackbilt-dev/contracts](https://github.com/Stackbilt-dev/contracts) | Stackbilt Contract Ontology Layer — ODD-driven code generation from TypeScript+Zod contracts |
157+
| **cc-taskrunner** | [Stackbilt-dev/cc-taskrunner](https://github.com/Stackbilt-dev/cc-taskrunner) | Autonomous task queue for Claude Code with safety hooks, branch isolation, PR creation |
158+
| **Social Sentinel** | [Stackbilt-dev/social-sentinel](https://github.com/Stackbilt-dev/social-sentinel) | Privacy-first social sentiment monitoring — PII redaction, Workers AI sentiment analysis |
159+
| **Mindspring** | [Stackbilt-dev/mindspring](https://github.com/Stackbilt-dev/mindspring) | Semantic search for AI conversation exports — upload, embed, search, RAG chat |
160+
| **n8n-transpiler** | [Stackbilt-dev/n8n-transpiler](https://github.com/Stackbilt-dev/n8n-transpiler) | n8n automation JSON → deployable Workers transpiler |
161+
| **equity-scenario-sim** | [Stackbilt-dev/equity-scenario-sim](https://github.com/Stackbilt-dev/equity-scenario-sim) | Cap table simulator for partnership negotiations |
162+
| **ai-playbook** | [Stackbilt-dev/ai-playbook](https://github.com/Stackbilt-dev/ai-playbook) | AI interaction frameworks, philosophical archetypes, context engineering patterns |
163+
164+
All libraries live under the [`Stackbilt-dev`](https://github.com/Stackbilt-dev) GitHub organization. Contributions welcome — see each repo's `CONTRIBUTING.md` and `SECURITY.md`.
165+
166+
## OSS Core ↔ Commercial Extension Pattern
167+
168+
Some capabilities in the Stackbilt ecosystem ship as a public OSS core with a commercial productization built on top. The OSS core is the canonical, publicly-named reference implementation — that's what gets documented, discussed, contributed to, and written about. Commercial extensions are implementation details: they are not publicly named, not separately documented, and not referenced in public artifacts.
169+
170+
A concrete example: [`aegis-oss`](https://github.com/Stackbilt-dev/aegis-oss) is the full persistent AI agent framework for Cloudflare Workers — multi-tier memory, autonomous goals, dreaming cycles, MCP native. It is the canonical AEGIS and is fully open source under its repository license. The commercial Stackbilt platform builds additional integrations and productization on top of that core. When referring to "AEGIS" in any public context — blog posts, GitHub issues, conference talks, external documentation, social media — the reference is to `aegis-oss`. Commercial extensions exist but are not separately named, advertised, or linked publicly.
171+
172+
This convention serves two purposes:
173+
174+
1. **OSS clarity.** Contributors, users, and researchers engage with one canonical repo per capability. There is no ambiguity about "which version are we talking about."
175+
2. **Moat protection.** Commercial productization is kept out of public discussion, which prevents feature leaks and competitive mapping of the commercial surface.
176+
177+
Internal contributors — including autonomous agents filing issues or drafting documentation — must follow the same convention. Public artifacts reference the OSS core only. See [Outbound Disclosure](/security/#outbound-disclosure--filing-against-stackbilt-dev-public-repositories) for the full authoring rules.
178+
143179
## Multi-Stack Roadmap
144180

145181
Cloudflare Workers is the currently supported stack. Coming soon:

0 commit comments

Comments
 (0)