Version: v1.0.0-RFC-4
Status: Active
Last Updated: 2026-06-26

CI-144 is built on Zero Trust Architecture with the following core principles:

Only the following versions receive security updates:

CI-144 implements a 4-layer security model:

┌─────────────────────────────────────────────────────────┐
│ Layer 4: Semantic Security (INTENT-7)                   │
│   • JSON Schema validation                              │
│   • Intent verb whitelist                               │
│   • Metadata integrity check                            │
└─────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────┐
│ Layer 3: Capability Security (CAPABILITY-13)            │
│   • Permission mapping verification                     │
│   • Ed25519 signature verification                      │
│   • HITL consensus for high-risk operations             │
└─────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────┐
│ Layer 2: Transport Security (BIND-19)                   │
│   • Frame integrity checksum                            │
│   • Sequence-based anti-replay                          │
│   • Version negotiation downgrade protection            │
└─────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────┐
│ Layer 1: Cryptographic Security (INTENT-7-SECURE)       │
│   • mTLS 1.3 (public networks)                          │
│   • SO_PEERCRED (local UDS)                             │
│   • Certificate pinning (L0 Gene Lock)                  │
│   • Credential isolation (Edge Gateway + KMS)           │
└─────────────────────────────────────────────────────────┘

DO NOT create public GitHub Issues for security vulnerabilities.

Instead:

1. Email: Send details to security@commonintents.org
2. Encrypt: Use our PGP key (fingerprint in L0 Gene Lock)
3. Include:
   • Affected protocol and version
   • Vulnerability description
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

We use CVSS v3.1 for severity assessment:

Key rotation follows the CAPABILITY-13 Key Rotation Protocol:

1. Generate New Key: Create new Ed25519 key pair
2. Sign Transaction: Create KeyRotationTransaction signed by old key
3. Multi-Signature: Requires 3-of-3 signature from Seed instances
4. Atomic Replacement: All mappings re-signed with new key
5. Announcement: Publish rotation event via BIND-19 Control Frame

If a private key is compromised:

1. Immediate: Revoke compromised key via emergency transaction
2. Short-Term: Use backup key for signing
3. Long-Term: Complete key rotation with new key pair
4. Notification: Announce via all channels (GitHub, email, etc.)

// Example: BIND-19 frame validation
fn validate_frame(frame: &Frame) -> Result<(), SecurityError> {
    // 1. Check version compatibility
    if frame.version != BIND_19_VERSION {
        return Err(SecurityError::VersionMismatch);
    }
    
    // 2. Verify checksum
    if !frame.verify_checksum() {
        return Err(SecurityError::IntegrityCheckFailed);
    }
    
    // 3. Check sequence ID (anti-replay)
    if frame.sequence_id <= self.last_sequence_id[frame.channel_id] {
        return Err(SecurityError::ReplayDetected);
    }
    
    Ok(())
}

// Example: mTLS configuration
fn configure_mtls(config: &mut ServerConfig) {
    // 1. Set minimum TLS version to 1.3
    config.set_min_proto_version(ProtocolVersion::TLSv1_3);
    
    // 2. Restrict cipher suites
    config.set_cipher_suites(&[
        CipherSuite::TLS_AES_256_GCM_SHA384,
        CipherSuite::TLS_CHACHA20_POLY1305_SHA256,
    ]);
    
    // 3. Configure client certificate verification
    config.set_client_certificate_verifier(
        ClientCertificateVerifier::new()
            .require_client_cert(true)
            .add_trusted_fingerprint(gene_lock_fingerprint),
    );
}

// Example: Edge Gateway credential injection
async fn inject_credentials(
    request: &mut Request,
    identity_label: &str,
) -> Result<(), SecurityError> {
    // 1. Parse identity label (namespace/identifier@instance-id)
    let label = IdentityLabel::parse(identity_label)?;
    
    // 2. Retrieve decrypted credential from KMS
    let credential = kms.retrieve_credential(&label).await?;
    
    // 3. Inject into HTTP header
    request.headers_mut().insert(
        HeaderName::from_static("authorization"),
        HeaderValue::from_str(&format!("Bearer {}", credential.token))?,
    );
    
    Ok(())
}

Every transaction in CI-144 generates an audit trail:

A security patch will be released when:

• A vulnerability is reported and confirmed
• The CVSS score is ≥ 4.0 (Medium)
• A working exploit exists in the wild
• The vulnerability affects a supported version

Security patches will NOT break backward compatibility unless absolutely necessary.

If a security fix requires breaking changes:

• It will be released as a new major version
• Migration guide will be provided
• 6-month overlap support for previous major version

• Security Email: security@commonintents.org
• PGP Key: pgp_keys.asc in repository root
• Fingerprint: Published in L0 Gene Lock
• Response Time: As per Section 5.2

We welcome responsible disclosure of security vulnerabilities.
Contributors will be credited in security advisories unless they wish to remain anonymous.

"Trust must be proven, not assumed."