Deterministic, code-owned verdicts
Pass/fail comes from sicario verify — a stdlib-only gate with no model call and no AI import. The LLM is explanation-only, structurally barred from the decision path.
Spec Kit governance for AI-era delivery
SicarioSpec
Kill risk before it ships. Give AI agents and human reviewers one shared workflow for classification, trust boundaries, controls, gates, evidence paths, owners, and release approval.
feature intentclassificationtrust boundaryabuse casecontrol gateevidence ownerapproval state
How to use it
Pick the operating mode first.
Catalog path
Use the preset
Install sicario-core with Spec Kit when you want the smallest upstream-compatible governance layer.
specify preset add --dev /path/to/sicario-coreFull bundleBootstrap a repo
Use the SicarioSpec CLI when you want docs, risk registers, workflows, control maps, and verification.
sicario init my-project --integration all --profile public-coreWalkthroughUnderstand the bundle
Read the plain-English walkthrough before cutting a release or showing the bundle to another user.
docs/bundle-walkthroughReview loopVerify evidence
Run deterministic checks so missing security evidence is visible before release approval.
sicario verifyWhat it changes
Risk becomes delivery work.
A mandatory governance contract
Specs, plans, and tasks must contain required governance sections. Missing classification, trust boundaries, abuse cases, or AI/fleet guardrails is a hard fail, not advice.
A halting gate plus control maps
sicario verify blocks merge/release on violation and is wired into CI. Starter evidence maps cover 14 frameworks (11 supported, 3 experimental): CSA CCM v4.1, SOX 404 / ICFR, SOC 2, FedRAMP Rev. 5, BSI C5, NIST SSDF, ISO/IEC 27001:2022, NIST SP 800-53 Rev 5, EU AI Act, GDPR (+ CPRA), HIPAA Security Rule, plus experimental-tier NIST AI RMF, PCI DSS v4.0, and OWASP ASVS.
Security Evidence Chain
Risks and decisions trace to controls, tests, gates, evidence paths, owners, reviewers, and approval or accepted-risk states.
Current bundle surface
Version 0.5.1 is more than a template pack.
The bundle now combines Spec Kit presets, a Python CLI, declarative verify rules, framework maps, release assets, Docusaurus documentation, GitHub workflows, maintainer operations, a custom-rule example, and expanded SOC 2, FedRAMP, and BSI C5 control-map coverage.
Composable Spec Kit profiles for core governance, docs, appsec, AI systems, agent fleets, cloud/IaC, security tooling, supply chain, compliance, SaaS, and enterprise-strict delivery.
Default `.rule.json` gates cover files, sections, keywords, secret scanning (generic secrets, AWS keys, provider tokens, private key material), required regexes, risk rows, classification, tagging, AI guardrails, and fleet guardrails.
Starter maps connect SicarioSpec evidence to CCM, SOX, SOC 2, FedRAMP, BSI C5, SSDF, ISO 27001, NIST 800-53, EU AI Act, GDPR/CPRA, and HIPAA — plus experimental-tier AI RMF, PCI DSS, and OWASP ASVS maps that are enforced only when selected explicitly.
Spec Kit extension commands cover init, assess, threat modeling, controls, evidence, verify, review, and apply-findings workflows.
Declarative verification
Custom gates are JSON files, not Python forks.
SicarioSpec 0.5.1 loads `*.rule.json` files, validates them, and runs fixed evaluator modules. A project can add, override, or disable a governance gate in `.sicario/rules/` — project rules win by id, and every override or disable is recorded in the gate evidence — while keeping the same deterministic pass/fail path in CI.
Read the rule engine docs- load shipped rules, then project `.sicario/rules/*.rule.json` (same id: project wins)
- validate required fields, kind-specific params, and finding caps
- dispatch to fixed evaluator modules
- emit named findings with severity and path
- record overrides, disabled rules, and scan coverage as evidence
- write gate evidence under `generated/sicario/`
- exit non-zero when required evidence is missing
How it differs
Enforces, not just advises.
SicarioSpec is not the first or only security-governance preset for Spec Kit. Most presets in the ecosystem follow an advisory-append pattern: they enrich the spec and plan with secure-SDLC guidance and regulatory notes for an agent and reviewer to consider. SicarioSpec operates at a different layer — a mandatory governance contract whose pass/fail verdict is owned by deterministic, stdlib-only code with no LLM in the decision path, backed by a halting verify gate (non-zero exit blocks the merge) and selectable control maps across 14 frameworks (11 supported, 3 experimental). The two are complementary: keep the advice you like, then gate the result.
One command
Bootstrap a governed target repo.
SicarioSpec installs Spec Kit presets, governance docs, risk registers, Security Evidence Chain templates, workflows, docs-site scaffolding, and agent instructions.
sicario init my-project --integration all --profile public-core
cd my-project
sicario verifyAgent environments
Built for mixed AI delivery teams.
Release closure
The starter issues are folded into the bundle.
The repo should stay in a boring state: green checks, current docs, no stale triage labels, and a release that demonstrates both public extension points: rule files and control-map JSON.
0.5.1 release track
Custom rule example
`examples/custom-rules/` shows how an external team adds a deterministic JSON gate without forking Python.
/docs/rule-engine#example-rule0.5.1 release trackExpanded standards evidence
SOC 2, FedRAMP Rev. 5, and BSI C5 maps are part of the selectable framework set for 0.5.1.
/docs/control-maps