| name | security-strategy-author |
| description | Authors the annual information-security strategy. Threat landscape, current posture vs NIST CSF 2.0, CIS Controls IG1/IG2/IG3 maturity, prioritized initiatives, budget envelope, security OKRs, board narrative. Per NIST CSF 2.0 + ISO/IEC 27001:2022 + CIS Controls v8 + Verizon DBIR + MITRE ATT&CK. Author a SECURITY_STRATEGY markdown from source artefact(s). Generates a versioned security-strategy@1 file under output_dir, with per-claim authority markers and provenance to the source. Chains naturally into security-strategy-audit by default. Refuses to author when upstream artefact is in non-pass state. Use when user asks to "draft a security strategy" or "create the security strategy". Do NOT use for "audit existing security strategy" (use security-strategy-audit instead). Author a SECURITY_STRATEGY markdown from source artefact(s). Generates a versioned security-strategy@1 file under output_dir, with per-claim authority markers and provenance to the source. Chains naturally into security-strategy-audit by d... |
| license | Apache-2.0 |
| metadata | {"version":"1.0.0","module":"skill","stage":"cross","cyberos-template":"task@1","cyberos-rubric-target":"security-strategy_rubric@1.0"} |
| allowed_memory_scopes | {"read":["project:*","module:*","company:locked-decisions","memories:decisions","memories:projects","memories:refinements"],"write":["project:*","memories:projects"]} |
| allowed_mcp_tools | ["kb.read","kb.search","memory.search","memory.write_memory","audit.append","chat.notify"] |
| escalation | {"to_persona_on_legal":"cuo-clo","to_persona_on_security":"cuo-cseco","to_persona_on_compliance":"cuo-clo","to_human_on_irreversible":true} |
| invocation_modes | ["standalone","chained"] |
| expects | {"schema_ref":"./envelopes/input.json","required_fields":["source_files","output_dir"],"optional_fields":["manifest_path","batch_size","caller_persona","trace_id","chain_to"],"standalone_interview_ref":"./STANDALONE_INTERVIEW.md"} |
| produces | {"schema_ref":"./envelopes/output.json","output_kind":"artefact","human_summary_ref":"./HUMAN_SUMMARY.md"} |
| depends_on_contracts | [{"id":"security-strategy","version":"v1","purpose":"generation_skeleton","pin_path":"cyberos/skill/contracts/security-strategy/"},{"id":"nats-subjects","version":"v1","purpose":"wire_protocol_emission","pin_path":"cyberos/skill/contracts/nats-subjects/"}] |
| exposable_as | {"internal":true,"agent_plugin":true,"mcp_tool":true,"partner_connector":false} |
| audit | {"emit_to":"genie.action_log","row_kind":"artefact_write","payload_hash_field":"artefact_hash","explanation_pane":"required"} |
| confidence_band | {"default":0.7,"defer_below":0.5,"cite_sources":"required"} |
| untrusted_inputs | {"wrap_in_marker":"untrusted_content","injection_scan":"required","on_marker_hit":"surface_to_human"} |
| self_audit | {"invariants_ref":"./INVARIANTS.md","check_at":["on_node_boundary",{"on_audit_row_count":25},"on_completion"],"anomaly_signals":{"confidence_low_streak":{"threshold":3,"window":10},"user_correction_streak":{"threshold":2,"window":5},"denylist_near_miss_streak":{"threshold":2,"window":20},"scope_rejection_streak":{"threshold":1,"window":1},"citation_missing_streak":{"threshold":2,"window":10}},"on_breach":{"emit":"refinement_proposal","pause_pipeline":true,"resume_token_field":"refinement_run_id"}} |
| human_fine_tune | {"fine_tuner_role":"cpo","review_required":{"on_minor_bump":false,"on_major_bump":true,"on_safety_change":true},"signals_to_initiate":[{"acceptance_rate_below":0.6},{"hitl_pause_rate_above":0.4},{"drift_signal_count_above":3},"user_complaint_received","regulator_inquiry_received",{"self_audit_refinement_proposal_count_above":2}],"procedure_ref":null,"required_artifacts":["changelog_entry","acceptance_test_added","memory_refinement_entry"],"blackout_windows":[]} |
| determinism | {"reproducible":false,"fixity_notes":"Authoring is judgement; manifest state IS reproducible. Re-running on settled state is a no-op except for last_audit_at refresh."} |
| emitted_source_freshness_tier | 30 |
| gated_until_phase | null |
| untrusted_content_wrapping | required |
