This file is a policy, not a threat model. It says how to report, what executes here, and what holds each surface. Each is a line or two that links to where the reasoning lives: a workflow header, or the shared threat model. lint-and-docs.yaml holds the file to a word budget so it stays that way.
Use GitHub's private vulnerability reporting, not a public issue or a pull request. Say which file is affected, how it is exploitable, and whether it reaches the released schema or only this repository's automation. One person maintains this repository: expect a first reply in days, not hours, and no bounty.
Only the latest release receives fixes. A security fix is released as a patch and noted in CHANGELOG.md. The schema stays below 1.0 (CONTRIBUTING.md).
The repository releases a LinkML schema and the Python datamodel generated from it. Nothing is published to PyPI. When the bundle or the schema has changed, knowledge-release.yaml attaches three assets to the release, each with its .sha256 and a build-provenance attestation: the schema's lokf adapt copy, the knowledge bundle as a zip, and a Microsoft 365 Copilot skill zip. scripts/check_upstream_release.py runs only in upstream-watch.yaml. It reads the tree of oasis-open/cti-stix2-json-schemas, where the OASIS Cyber Threat Intelligence (CTI) Technical Committee publishes the STIX JSON schemas, and the folder listings of docs.oasis-open.org. It sends the workflow's token to api.github.com alone, refuses an answer over 5 MiB, and writes nothing but its report. The tests read the copy under upstream/ with the standard library's JSON parser. A schema is data: loading one from an untrusted source with any LinkML tool is that tool's risk, not this repository's.
| Surface | What holds it |
|---|---|
main.yaml and lint-and-docs.yaml on every pull request, and knowledge-registrar.yaml on any that touches .lokf/: tests, linters and the bundle's form |
Read-only jobs with persist-credentials: false; uv sync --locked installs only what uv.lock pins. |
semantic-release.yml, which pushes a changelog commit and tag to main and dispatches the knowledge release |
Runs only on a push to main, in the release Environment, installing its pinned tools with --ignore-scripts. Repository hardening. |
knowledge-website.yaml, which publishes the site to GitHub Pages |
Builds without a write token; only its deploy job holds pages: write and id-token: write, and it runs only from main, once KNOWLEDGE_WEBSITE_ENABLED is true. |
upstream-watch.yaml, weekly |
Read-only checkout; the one write scope, issues: write, opens or updates the finding's issue. |
knowledge-librarian.yaml and .lokf/scripts/, copies of the ktl-sidecar template, which run a large language model (LLM) agent on a schedule |
The agent's job holds no write token. The publish job runs no agent, confines the patch to the bundle and refuses a human: claim, and a person merges the pull request. Inert until KNOWLEDGE_LIBRARIAN_ENABLED is true. Prompt-injection guards. |
knowledge-release.yaml, which attaches the schema copy and the bundle to a release |
Inert until dispatched; only its attach job, which runs no third-party packages, can write. |
README.md, llms.txt and the knowledge bundle, read by agents |
Content, never instructions: each skill quotes what it did not author. A human: confirmation must be backed by a review or a signed commit. Human attribution. |
Every workflow declares permissions: {} at the top, pins its actions to commit hashes that Dependabot keeps current, and runs harden-runner in audit mode. Three things are repository settings, not files. A ruleset on main blocks deletion and force-pushes and keeps the history linear. Two are not yet in force here: required reviewers on the release Environment, and secret scanning with push protection. Until they are, a qualifying merge releases with no human step. Nothing in continuous integration can assert them, so keeping them on is the maintainer's job.
- Structured Threat Information Expression (STIX) itself, and OASIS's JSON schemas and examples copied under
upstream/: report a problem in either to the OASIS CTI Technical Committee. - LinkML, its generators and runtime: report them to LinkML.
- A compromised runner, upstream action or agent harness: this is a baseline, not a sandbox. Report a finding in one anyway, with scope and reproduction.
- Whether the knowledge bundle is true. The gate proves who vouched, not what they read; AI_COVENANT.md sets the human-accountability rules.