apiVersion: intentspec.io/v1alpha1
kind: IntentSpec
metadata:
  id: 01J0R3C7J0S8K1KQX8J4VQKJ1A
  createdAt: '2026-02-19T12:00:00Z'
  createdBy:
    type: user
    id: security-lead
    displayName: Carol Security Lead
  target:
    repo:
      type: git
      locator: git@company.internal:security/auth-service.git
    baseRef: main
    labels:
      change: AUTHZ-CRITICAL
      cve: CVE-2026-XXXX
      severity: HIGH
      team: security
intent:
  summary: Fix auth middleware conditional bypass vulnerability (CVE-2026-XXXX) and add regression tests
  problemStatement: 'A security audit found that the JWT validation logic in src/auth/middleware.py contains a conditional
    bypass under a specific HTTP header combination (when both X-Forwarded-For and Authorization are present): an attacker
    can bypass JWT verification and gain unauthorised API access. CVSS score: 8.1 (High). Related CVE: CVE-2026-XXXX, internal
    bug AUTHZ-9901. Required actions: (1) fix the bypass path; (2) add regression tests covering the bypass scenario; (3)
    generate a complete auditable provenance chain.'
  changeType: security
  objectives:
  - Fix the JWT validation conditional bypass path in src/auth/middleware.py — ensure the Authorization header is always validated
    first and cannot be influenced by X-Forwarded-For
  - Add at least 3 regression test cases in tests/security/test_auth_bypass.py that reproduce the bypass scenario and verify
    all bypass paths are blocked
  - Generate a complete SBOM + SLSA provenance attestation + Rekor inclusion proof for compliance audit
  inScope:
  - Middleware and JWT validation logic under src/auth/
  - Security regression tests under tests/security/
  outOfScope:
  - Do not change permission model semantics (fix JWT validation implementation only, do not alter permission assignment logic)
  - 'Do not introduce any new dependencies (enforced by dependencyPolicy: no-new)'
  - Do not modify API response structures or interface contracts
  - Audit log module (src/audit/) — read-only, logic must not be modified
  touchHints:
    files:
    - src/auth/middleware.py
    - src/auth/jwt_validator.py
    - tests/security/test_auth_bypass.py
    symbols:
    - verify_jwt
    - check_permission
    - AuthMiddleware
    - extract_token
    apis: []
acceptance:
  successCriteria:
  - All bypass reproduction test cases (at least 3) are blocked (pytest passes)
  - Full unit tests and E2E tests show no regression
  - No High or above severity findings from SAST/SCA; no secrets scan alerts
  - SBOM generated and licence allowlist validated
  - SLSA provenance attestation generated with IntentSpec digest embedded
  - Rekor inclusion proof obtained and written to artifacts
  - At least 2 members of the security team have approved
  verificationPlan:
    fastChecks:
    - id: unit
      kind: command
      command: pytest -q tests/unit/test_auth.py -v
      timeoutSeconds: 900
      expectedExitCode: 0
      required: true
      artifactsProduced:
      - test-log
    - id: mypy
      kind: command
      command: mypy src/auth/ --strict
      timeoutSeconds: 180
      expectedExitCode: 0
      required: true
      artifactsProduced: []
    integrationChecks:
    - id: e2e-bypass
      kind: command
      command: pytest -q tests/security/test_auth_bypass.py -v --tb=long
      timeoutSeconds: 3600
      expectedExitCode: 0
      required: true
      artifactsProduced:
      - test-log
    - id: e2e-full
      kind: command
      command: pytest -q tests/e2e/ -v --tb=short -x
      timeoutSeconds: 7200
      expectedExitCode: 0
      required: true
      artifactsProduced: []
    securityChecks:
    - id: sast
      kind: policy
      command: semgrep --config p/owasp-top-ten --config p/python --config r/python.jwt --sarif --output reports/sast-report.sarif
        src/auth/
      timeoutSeconds: 1200
      expectedExitCode: 0
      required: true
      artifactsProduced:
      - sast-report
    - id: sca
      kind: policy
      command: pip-audit --format json --output reports/sca-report.json
      timeoutSeconds: 600
      expectedExitCode: 0
      required: true
      artifactsProduced:
      - sca-report
    - id: sbom-generate
      kind: policy
      command: cyclonedx-py --format json --output reports/sbom.json
      timeoutSeconds: 300
      expectedExitCode: 0
      required: true
      artifactsProduced:
      - sbom
    - id: secrets-scan
      kind: policy
      command: detect-secrets scan --all-files --only-allowlisted --baseline .secrets.baseline
      timeoutSeconds: 300
      expectedExitCode: 0
      required: true
      artifactsProduced: []
    releaseChecks:
    - id: human-approval
      kind: policy
      command: require-approvers --min 2 --group security-reviewers --require-security-team
      timeoutSeconds: 172800
      expectedExitCode: 0
      required: true
      artifactsProduced: []
    - id: release-notes-security
      kind: policy
      command: security-advisory-check --require-cve-entry --require-cvss-score
      timeoutSeconds: 60
      expectedExitCode: 0
      required: true
      artifactsProduced:
      - release-notes
    - id: provenance-attest
      kind: policy
      command: generate-slsa-attestation --intentspec-digest $INTENTSPEC_DIGEST --slsa-level 3 --output reports/provenance.json
      timeoutSeconds: 300
      expectedExitCode: 0
      required: true
      artifactsProduced:
      - provenance-attestation
    - id: rekor-submit
      kind: policy
      command: rekor-cli upload --artifact reports/provenance.json --signature reports/provenance.json.sig --public-key cosign.pub
        --output reports/rekor-proof.json
      timeoutSeconds: 120
      expectedExitCode: 0
      required: true
      artifactsProduced:
      - transparency-proof
  qualityGates:
    maxAllowedRegression: none
constraints:
  security:
    networkPolicy: deny
    dependencyPolicy: no-new
    cryptoPolicy: Prohibit custom cryptographic primitives; only use audited libraries (PyJWT >= 2.8.0) and stdlib hmac/hashlib;
      algorithms other than HS256 require security architect approval.
  privacy:
    dataClassesAllowed:
    - confidential
    - pii
    redactionRequired: true
    retentionDays: 14
  licensing:
    allowedSpdx:
    - Apache-2.0
    - MIT
    forbidNewLicenses: true
  platform:
    languageRuntime: python3.11
    supportedOS:
    - linux
  resources:
    maxWallClockSeconds: 28800
    maxCostUnits: 3000
risk:
  level: high
  rationale: Authorisation bypass vulnerability (CVSS 8.1 High), capable of enabling unauthorised access to all protected
    APIs. CVE is public; rapid remediation is required with full provenance for compliance audit. This touches core security
    infrastructure — changes carry high risk and require two-person review.
  factors:
  - authz
  - cve-assigned
  - cvss-high
  - security-critical
  - release-blocking
  - compliance-required
  humanInLoop:
    required: true
    minApprovers: 2
evidence:
  strategy: repo-first
  trustTiers:
  - repo
  - standards
  domainAllowlistMode: allowlist-only
  allowedDomains:
  - nvlpubs.nist.gov
  - slsa.dev
  - owasp.org
  - pyjwt.readthedocs.io
  - docs.python.org
  blockedDomains:
  - '*'
  minCitationsPerDecision: 3
security:
  toolAcl:
    allow:
    - tool: workspace.fs
      actions:
      - read
      - write
      constraints:
        writeRoots:
        - ./src/auth
        - ./tests/security
        - ./reports
        maxWriteBytes: 10485760
    - tool: workspace.command
      actions:
      - execute
      constraints:
        allowCommands:
        - pytest
        - mypy
        - semgrep
        - pip-audit
        - cyclonedx-py
        - detect-secrets
        - require-approvers
        - security-advisory-check
        - generate-slsa-attestation
        - rekor-cli
        maxOutputBytes: 20971520
    - tool: workspace.search
      actions:
      - search
      constraints:
        maxResultBytes: 524288
    - tool: workspace.lsp
      actions:
      - hover
      - goto-definition
      - find-references
      constraints: {}
    deny:
    - tool: workspace.command
      actions:
      - execute
      constraints:
        denySubstrings:
        - 'curl '
        - 'wget '
        - 'pip install '
        - apt-get
        - 'ssh '
        - 'nc '
        - 'ncat '
        - bash -c
        - python -c
        - eval(
        - exec(
    - tool: workspace.fs
      actions:
      - write
      - delete
      constraints:
        denyPaths:
        - ./src/api/
        - ./src/models/
        - ./migrations/
        - ./.secrets.baseline
  secrets:
    policy: deny-all
    allowedScopes: []
  promptInjection:
    treatRetrievedContentAsUntrusted: true
    enforceOutputSchema: true
    disallowInstructionFromEvidence: true
  outputHandling:
    encodingPolicy: contextual-escape
    noDirectEval: true
execution:
  retry:
    maxRetries: 2
    backoffSeconds: 60
  replan:
    triggers:
    - repeated-test-fail
    - security-gate-fail
    - evidence-conflict
    - unknown-api
    - scope-creep
  concurrency:
    maxParallelTasks: 1
artifacts:
  required:
  - name: patchset
    stage: per-task
    required: true
    format: git-diff
  - name: test-log
    stage: integration
    required: true
    format: junit+xml
  - name: sast-report
    stage: security
    required: true
    format: sarif
  - name: sca-report
    stage: security
    required: true
    format: json
  - name: sbom
    stage: security
    required: true
    format: cyclonedx-json
  - name: release-notes
    stage: release
    required: true
    format: markdown
  - name: provenance-attestation
    stage: release
    required: true
    format: in-toto+json
  - name: transparency-proof
    stage: release
    required: true
    format: rekor-inclusion-proof
  retention:
    days: 365
provenance:
  requireSlsaProvenance: true
  requireSbom: true
  transparencyLog:
    mode: rekor
  bindings:
    embedIntentSpecDigest: true
    embedEvidenceDigests: true
lifecycle:
  schemaVersion: 1.0.0
  status: active
  changeLog: []
libra:
  objectStore:
    backend: git-native
    blobRetentionStrategy: ref-anchoring
    aiRefPrefix: refs/ai/
  contextPipeline:
    maxFrames: 64
    seedFrameKind: IntentAnalysis
    checkpointOnReplan: true
  planGeneration:
    decompositionMode: per-objective
    conflictResolution: force-serial
    gateTaskPerStage: true
  runPolicy:
    patchsetFormat: GitDiff
    snapshotOnRunStart: true
    metricsSchema:
      wall_clock_seconds:
        type: integer
      cost_usd:
        type: number
      tokens_used:
        type: integer
      patchsets_generated:
        type: integer
      retries:
        type: integer
  actorMapping:
    orchestratorActorId: libra-orchestrator
    coderActorId: libra-security-coder
    reviewerActorId: libra-security-reviewer
  decisionPolicy:
    abandonOnSecurityGateFail: true
    checkpointBeforeReplan: true
    rollbackOnProvenanceFail: true
extensions:
  security.io/cve-id: CVE-2026-XXXX
  security.io/cvss-score: '8.1'
  security.io/patch-priority: critical
  security.io/notification-required: 'true'
  security.io/compliance-frameworks: SOC2,ISO27001
