Dev

.claude/skills/aces-asset-inventory-capture/SKILL.md

@@ -20,8 +20,12 @@ For Docker/Compose/container-image captures, start by copying
 `scripts/capture-container-evidence-template.sh` and
 `scripts/normalize-syft-cyclonedx.jq` into the target bundle as runnable capture
 resources, then tailor the copied script for asset-specific source paths,
-filesystem manifests, and redaction names. Keep every evidence-affecting
-normalization in the script or a referenced jq file.
+filesystem manifests, and any explicit operator/out-of-scenario withholding
+rules. Set `CAPTURE_BOUNDARY=scenario-target` only after confirming the script
+is pointed at participant-discoverable target state, and set
+`OPERATOR_SECRET_NAME_REGEX` only for material classified outside that boundary.
+Keep every evidence-affecting normalization in the script or a referenced jq
+file.
 
 ## Inputs
 
@@ -47,10 +51,10 @@ Produce a bundle that validates with the current APTL reference ledger tooling:
 - `capture-evidence.sh` or equivalent committed capture commands, derived from
   the template for Docker/Compose assets when applicable;
 - `mapping-ledger.yaml` using the current reference ledger schema;
-- `evidence/` with raw or redacted evidence files;
+- `evidence/` with source evidence files;
 - `evidence/capture-limits.txt` with one first-class limit for every skipped
   required step, declined useful-optional step, contamination boundary, or
-  redaction that changes what was captured;
+  operator/out-of-scenario withholding that changes what was captured;
 - `evidence/captured-at-utc.txt`;
 - `evidence/evidence-sha256sums.txt` covering committed evidence files.
 
@@ -117,13 +121,26 @@ No `needs_gap_triage` row may remain at review time.
    intact and separate filesystem provenance is captured or the omission is
    recorded in `capture-limits.txt`.
 
-5. Hash and redact before committing.
-
-   Follow ADR-029 redaction discipline. Do not place credentials, bearer
-   tokens, private keys, generated service secrets, cookies, session ids, or
-   operator-only values in evidence, logs, argv, tracebacks, issue comments, or
-   `mapping-ledger.yaml`. Participant-visible fixture secrets may be retained
-   only through the repo-approved secret-fixture classification.
+5. Preserve scenario-target secrets and withhold only operator material.
+
+   Follow ADR-057 as the inventory boundary. Scenario-target secrets are
+   capture facts and must not be redacted from source inventory bundles when a
+   participant or in-range agent could discover them. This includes passwords,
+   hashes, private keys, tokens, generated range secrets, service config
+   secrets, and security product state required to realize or inspect the
+   target. The Wazuh/OpenSearch Security `internal_users.yml` bcrypt hashes
+   from APTL #341 are the canonical example: preserve them unredacted in the
+   source evidence bundle because they are target configuration facts.
+
+   Operator/out-of-scenario secrets remain outside the inventory boundary.
+   Host SSH keys, cloud or CI tokens, maintainer credentials, local
+   control-plane secrets, workstation secrets, and accidental adjacent
+   environment material must not be captured as scenario facts. Exclude them
+   or record a first-class `capture-limits.txt` entry describing the withheld
+   scope. ADR-029 still governs operator-secret handling in logs, argv,
+   tracebacks, issue comments, and other non-evidence surfaces.
+   Sanitized/public exports are separate derived views; do not replace source
+   evidence with `<REDACTED>` placeholders as the default safety mechanism.
 
 6. Build the ledger fact-by-fact.
 
@@ -200,7 +217,8 @@ Before returning:
 - every evidence file is referenced from `mapping-ledger.yaml`;
 - `capture-limits.txt` records skipped methodology steps as first-class
   limits;
-- no raw secrets or operator-only values are committed;
+- scenario-target secrets are preserved as source capture facts, while
+  operator/out-of-scenario material is excluded or recorded as a capture limit;
 - `aptl aces-inventory validate <asset-dir>` passes;
 - `aptl aces-inventory gaps <asset-dir>` has no unresolved
   `needs_gap_triage`;

.claude/skills/aces-asset-inventory-capture/scripts/capture-container-evidence-template.sh

@@ -10,7 +10,8 @@ CONTAINER="${CONTAINER:-}"
 COMPOSE_FILE="${COMPOSE_FILE:-$ROOT/docker-compose.yml}"
 COMPOSE_SERVICE="${COMPOSE_SERVICE:-}"
 COMPOSE_PROFILES="${COMPOSE_PROFILES:-}"
-SECRET_NAME_REGEX="${SECRET_NAME_REGEX:-(token|secret|password|credential|cookie|session|private_key|api_key|jwt|flag_key)}"
+CAPTURE_BOUNDARY="${CAPTURE_BOUNDARY:-}"
+OPERATOR_SECRET_NAME_REGEX="${OPERATOR_SECRET_NAME_REGEX:-}"
 
 TRIVY_IMAGE="${TRIVY_IMAGE:-aquasec/trivy@sha256:be1190afcb28352bfddc4ddeb71470835d16462af68d310f9f4bca710961a41e}"
 SYFT_IMAGE="${SYFT_IMAGE:-anchore/syft@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6}"
@@ -26,12 +27,25 @@ require() {
   }
 }
 
+require_capture_boundary() {
+  if [[ "$CAPTURE_BOUNDARY" != "scenario-target" ]]; then
+    printf '%s\n' \
+      "Set CAPTURE_BOUNDARY=scenario-target after confirming this capture is scoped to participant-discoverable target state." \
+      "Use OPERATOR_SECRET_NAME_REGEX only for operator/out-of-scenario material that must be withheld." >&2
+    exit 2
+  fi
+}
+
 record_limit() {
   printf -- '- %s\n' "$*" >> "$OUT/capture-limits.txt"
 }
 
 redact_text_stream() {
-  awk -v secret_re="$SECRET_NAME_REGEX" '
+  if [[ -z "$OPERATOR_SECRET_NAME_REGEX" ]]; then
+    cat
+    return
+  fi
+  awk -v secret_re="$OPERATOR_SECRET_NAME_REGEX" '
     {
       for (i = 1; i <= NF; i++) {
         token = $i
@@ -57,7 +71,7 @@ redact_text_stream() {
 
 redact_env_jq='
   def redact_env($secret_re):
-    if contains("=") then
+    if (($secret_re | length) > 0) and contains("=") then
       capture("^(?<name>[^=]+)=(?<value>.*)$") as $m
       | if ($m.name | test($secret_re; "i")) then
           "\($m.name)=<REDACTED-\($m.name | gsub("_"; "-"))>"
@@ -69,29 +83,41 @@ redact_env_jq='
     end;
 
   def redact_sensitive_keys($secret_re):
-    walk(
-      if type == "object" then
-        with_entries(
-          if (.key | test($secret_re; "i")) then
-            .value = "<REDACTED>"
-          else
-            .
-          end
-        )
-      else
-        .
-      end
-    );
+    if ($secret_re | length) == 0 then
+      .
+    else
+      walk(
+        if type == "object" then
+          with_entries(
+            if (.key | test($secret_re; "i")) then
+              .value = "<REDACTED>"
+            else
+              .
+            end
+          )
+        else
+          .
+        end
+      )
+    end;
 '
 
 require docker
 require jq
 require sha256sum
+require_capture_boundary
 
 mkdir -p "$OUT"
 : > "$OUT/capture-limits.txt"
 date -u +"%Y-%m-%dT%H:%M:%SZ" > "$OUT/captured-at-utc.txt"
 
+# With CAPTURE_BOUNDARY=scenario-target, this template preserves scenario-target values by default.
+# Configure OPERATOR_SECRET_NAME_REGEX only after classifying a value as
+# operator/out-of-scenario material rather than target evidence.
+if [[ -n "$OPERATOR_SECRET_NAME_REGEX" ]]; then
+  record_limit "Operator/out-of-scenario values matching OPERATOR_SECRET_NAME_REGEX were withheld by the capture template; ledger must describe the boundary and evidence impact"
+fi
+
 docker version --format json | jq . > "$OUT/docker-version.json"
 if compose_version="$(docker compose version --format json 2>/dev/null)"; then
   printf '%s\n' "$compose_version" | jq . > "$OUT/docker-compose-version.json"
@@ -106,7 +132,7 @@ if [[ -n "$COMPOSE_SERVICE" && -f "$COMPOSE_FILE" ]]; then
     docker compose -f "$COMPOSE_FILE" config --format json
   fi | jq \
     --arg service "$COMPOSE_SERVICE" \
-    --arg secret_re "$SECRET_NAME_REGEX" '
+    --arg secret_re "$OPERATOR_SECRET_NAME_REGEX" '
       if ((.services // {}) | has($service) | not) then
         error("compose service not found: " + $service)
       else
@@ -115,7 +141,7 @@ if [[ -n "$COMPOSE_SERVICE" && -f "$COMPOSE_FILE" ]]; then
       | .environment = (
           (.environment // {})
           | with_entries(
-              if (.key | test($secret_re; "i")) then
+              if (($secret_re | length) > 0 and (.key | test($secret_re; "i"))) then
                 .value = ("<REDACTED-" + (.key | gsub("_"; "-")) + ">")
               else
                 .
@@ -129,7 +155,7 @@ fi
 
 if [[ -n "$CONTAINER" ]]; then
   docker inspect "$CONTAINER" \
-    | jq --arg secret_re "$SECRET_NAME_REGEX" \
+    | jq --arg secret_re "$OPERATOR_SECRET_NAME_REGEX" \
         "$redact_env_jq
         .[].Config.Env |= ((. // []) | map(redact_env(\$secret_re)))
         | redact_sensitive_keys(\$secret_re)" \
@@ -162,7 +188,7 @@ else
 fi
 
 docker image inspect "$IMAGE" \
-  | jq --arg secret_re "$SECRET_NAME_REGEX" "$redact_env_jq redact_sensitive_keys(\$secret_re)" \
+  | jq --arg secret_re "$OPERATOR_SECRET_NAME_REGEX" "$redact_env_jq redact_sensitive_keys(\$secret_re)" \
   > "$OUT/docker-inspect.image.json"
 docker history --no-trunc "$IMAGE" | redact_text_stream > "$OUT/docker-history.image.txt"
 

.codex

@@ -33,3 +33,11 @@ such as `GOV-918`.
 - For Claude Code, use
   `.claude/skills/aces-asset-inventory-capture/SKILL.md`. This server also
   links it at `~/.claude/skills/aces-asset-inventory-capture`.
+- For Codex, use `.codex-skills/aces-gap-remediation-implement/SKILL.md`
+  when remediating ACES/APTL gaps found by the asset-inventory methodology.
+  This server also links it at
+  `~/.codex/skills/aces-gap-remediation-implement`.
+- For Claude Code, use
+  `.claude/skills/aces-gap-remediation-implement/SKILL.md` for the same
+  overlay. This server also links it at
+  `~/.claude/skills/aces-gap-remediation-implement`.

.codex-skills/aces-asset-inventory-capture/SKILL.md

@@ -20,8 +20,12 @@ For Docker/Compose/container-image captures, start by copying
 `scripts/capture-container-evidence-template.sh` and
 `scripts/normalize-syft-cyclonedx.jq` into the target bundle as runnable capture
 resources, then tailor the copied script for asset-specific source paths,
-filesystem manifests, and redaction names. Keep every evidence-affecting
-normalization in the script or a referenced jq file.
+filesystem manifests, and any explicit operator/out-of-scenario withholding
+rules. Set `CAPTURE_BOUNDARY=scenario-target` only after confirming the script
+is pointed at participant-discoverable target state, and set
+`OPERATOR_SECRET_NAME_REGEX` only for material classified outside that boundary.
+Keep every evidence-affecting normalization in the script or a referenced jq
+file.
 
 ## Inputs
 
@@ -47,10 +51,10 @@ Produce a bundle that validates with the current APTL reference ledger tooling:
 - `capture-evidence.sh` or equivalent committed capture commands, derived from
   the template for Docker/Compose assets when applicable;
 - `mapping-ledger.yaml` using the current reference ledger schema;
-- `evidence/` with raw or redacted evidence files;
+- `evidence/` with source evidence files;
 - `evidence/capture-limits.txt` with one first-class limit for every skipped
   required step, declined useful-optional step, contamination boundary, or
-  redaction that changes what was captured;
+  operator/out-of-scenario withholding that changes what was captured;
 - `evidence/captured-at-utc.txt`;
 - `evidence/evidence-sha256sums.txt` covering committed evidence files.
 
@@ -117,13 +121,26 @@ No `needs_gap_triage` row may remain at review time.
    intact and separate filesystem provenance is captured or the omission is
    recorded in `capture-limits.txt`.
 
-5. Hash and redact before committing.
-
-   Follow ADR-029 redaction discipline. Do not place credentials, bearer
-   tokens, private keys, generated service secrets, cookies, session ids, or
-   operator-only values in evidence, logs, argv, tracebacks, issue comments, or
-   `mapping-ledger.yaml`. Participant-visible fixture secrets may be retained
-   only through the repo-approved secret-fixture classification.
+5. Preserve scenario-target secrets and withhold only operator material.
+
+   Follow ADR-057 as the inventory boundary. Scenario-target secrets are
+   capture facts and must not be redacted from source inventory bundles when a
+   participant or in-range agent could discover them. This includes passwords,
+   hashes, private keys, tokens, generated range secrets, service config
+   secrets, and security product state required to realize or inspect the
+   target. The Wazuh/OpenSearch Security `internal_users.yml` bcrypt hashes
+   from APTL #341 are the canonical example: preserve them unredacted in the
+   source evidence bundle because they are target configuration facts.
+
+   Operator/out-of-scenario secrets remain outside the inventory boundary.
+   Host SSH keys, cloud or CI tokens, maintainer credentials, local
+   control-plane secrets, workstation secrets, and accidental adjacent
+   environment material must not be captured as scenario facts. Exclude them
+   or record a first-class `capture-limits.txt` entry describing the withheld
+   scope. ADR-029 still governs operator-secret handling in logs, argv,
+   tracebacks, issue comments, and other non-evidence surfaces.
+   Sanitized/public exports are separate derived views; do not replace source
+   evidence with `<REDACTED>` placeholders as the default safety mechanism.
 
 6. Build the ledger fact-by-fact.
 
@@ -200,7 +217,8 @@ Before returning:
 - every evidence file is referenced from `mapping-ledger.yaml`;
 - `capture-limits.txt` records skipped methodology steps as first-class
   limits;
-- no raw secrets or operator-only values are committed;
+- scenario-target secrets are preserved as source capture facts, while
+  operator/out-of-scenario material is excluded or recorded as a capture limit;
 - `aptl aces-inventory validate <asset-dir>` passes;
 - `aptl aces-inventory gaps <asset-dir>` has no unresolved
   `needs_gap_triage`;