ultrasafe

Pre-release simulated penetration testing from the AI/LLM red-team perspective — direct/indirect prompt injection, model extraction, jailbreak, hallucination-leverage, agentic misalignment, alignment-faking probe. Model-invoked by the Ultrasafe orchestrator (Workflow fan-out, Phase B) during ≥3 iteration pre-release fuzz cycles, or when the publish PreToolUse hook (npm publish / pip upload / git push --tags to public) fires advisory-mode trigger. Emits findings via ULTRASAFE_FINDING A2A intent (Constellation §13.16) with `value.advisory: true` in v0.2.x (report-only, no publish block). Skip for purely local dev runs without LLM-integrated surface.

Pre-release simulated penetration testing from the cryptography attacker perspective — key management / random source / TLS misuse / signature scheme / constant-time violation / PQC readiness / cryptographic agility envelope. Triggered by Ultrasafe orchestrator (`ultrasafe_run_fanout` MCP tool) when the axis-set includes `usf-crypto`, or by the PreToolUse `ultrasafe-trigger.cjs` hook on publish-equivalent commands (npm publish / pip upload / git push --tags to public). Emits findings via the `ULTRASAFE_FINDING` A2A intent (Constellation §13.16.9), conforming to the Ultrasafe.md §4 finding output contract with the `perspective.primary = "crypto-reviewer"` variant. Advisory mode in v0.2.x (report-only, no publish block); blocking mode deferred to v0.3+.

Use BEFORE a publish-equivalent release (npm publish / pip upload / git push --tags to public) — Ultrasafe 8-agent fan-out 의 Methodology / Compliance attacker 시각. Test methodology gap · coverage cliff · compliance catalog (NIST 800-115 / OSSTMM / OWASP WSTG / PTES / ISO 27001:2022 / CIS v8.1) 의 16-cell 2D dispatch matrix 로 read-only repo audit 수행 → `ULTRASAFE_FINDING` intent emit. v0.2.x advisory mode (report-only, publish 차단 X). Dispatch trigger = axis-set 에 `usf-iam-config` 또는 methodology-related axis 포함 + Tier 2+ 활성. "secure" 단어 사용 금지 — *"passed coverage X% under catalog v_Y as of date Z"* 한정 표현. catalog_version + coverage_percentage_under_catalog + untested_classes[] mandatory 강제 (§2.1.6).

Pre-release security testing — simulated penetration from the social-engineering / human-factor attacker perspective. Use when the Ultrasafe orchestrator dispatches Agent 5 of the 8-agent fan-out at iteration N (`usf-social-eng` axis 포함 시), or when a publish-equivalent command triggers the PreToolUse hook and the `social-engineer` role is in the active axis set. Scans for phishing surface (credential prompts, OAuth UX traps), docs leak (README/CHANGELOG/commit messages exposing OPSEC slips, internal hostnames, sample tokens), human-factor exploitation (Cialdini 6 × Hadnagy 9 × FBI 8-elicitation cross-tuple), and A2A inbound Spotlighting bypass attempts. Emits findings via `ULTRASAFE_FINDING` Constellation intent (§13.16) — advisory mode in v0.2.x (report-only, publish 차단 없음). SKIP when iteration ≤ 0 (no baseline) or when axis-set excludes `usf-social-eng`.

Pre-release simulated penetration testing from the dependency / SBOM / typosquatting / signing-chain perspective. Invoke as Agent 3 of the Ultrasafe 8-agent fan-out (Ultrasafe.md §15.3) whenever the iteration axis-set includes `usf-supply-chain`, or whenever a release candidate touches dependency manifests (package.json / pyproject.toml / Cargo.toml / go.mod / requirements*.txt / lockfiles / SBOM artifacts / signed-attestation chains). Emits `ULTRASAFE_FINDING` A2A intents (Constellation §13.16, §18.1) with PURL canonical ids, OSV CVE matches, SLSA provenance verdicts, cosign+Rekor attestation chain status, and maintainer-anomaly flags. v0.2.x = advisory mode (report-only, never auto-blocks publish); v0.3+ = blocking gate for deterministic signals only. Maintainer-anomaly findings are always human-gated (Ultrasafe §2.1.3 CT1) regardless of mode.

Pre-release security testing — retire-barrier fan-out sink. Aggregate the 7 attacker agents' findings (ai-llm / web-api / supply-chain / crypto / social-eng / methodology / threat-model) via BFT quorum 2f+1 cross-axis confirmation, diversity-enforced source independence (perspective × prompt_template_hash × seed 3-tuple distinct ≥ 3), ACH multi-hypothesis matrix, CIM tri-format export (SARIF 2.1.0 + STIX 2.1 + ATT&CK Navigator), then emit 3-layer hybrid synthesis report (OSCAL Assessment Result Layer 1 + Hyperbrief 9-section IR Layer 2 + Greatpractice tree candidate Layer 3) along with the iteration boundary record (resolved / regression / persistent / new 4-set diff + untested_classes[] coverage). Fires automatically at retire-barrier after all 7 attacker findings emit complete. v0.2.x advisory mode — report-only, publish 차단 없음.

Pre-release simulated penetration testing from the threat modeling (STRIDE/PASTA) + incident lifecycle + disclosure timing attacker perspective. Invoke as one of 8 attackers in Ultrasafe fan-out runtime when a publish-equivalent action (npm publish / pip upload / git push --tags to public / release-gate trigger) is approaching, OR when orchestrator dispatches ULTRASAFE_RUN_FANOUT with role=threat-model-lifecycle, OR when SECURITY_DISCLOSURE_INTAKE/MPCVD_COORDINATION inbound requires lifecycle-timing review. Emits ULTRASAFE_FINDING via Constellation §13.16 (advisory mode in v0.2.x — report-only, no publish blocking). Output tone is lifecycle-systematic — every finding traces to a named threat-model element (STRIDE letter or PASTA stage) and an incident-lifecycle phase (prepare/detect/contain/eradicate/recover/lessons).

Pre-release simulated penetration testing from the OWASP Top 10 / API contract / auth-bypass / SQLi / XSS / SSRF / CSRF / open-redirect / IDOR attacker perspective. Invoke during Ultrasafe ≥3-iteration fan-out when the axis-set includes `usf-web-sast-dast` or `usf-web-infra`, or when a PreToolUse trigger matches a publish-equivalent command (npm publish / pip upload / git push --tags public). Emits `ULTRASAFE_FINDING` A2A intent per finding (Constellation §13.16) with OSCAL-aligned payload + attack-path-graph flat-list candidate. v0.2.x advisory mode — report-only, no publish blocking; blocking promotion deferred to v0.3+.