Published Docs The Pages site that teaches the operating model and links users into the bundle.
doc Getting Started docs/getting-started.md doc Bundle Walkthrough docs/bundle-walkthrough.md doc Security Model docs/security-model.md doc Rule Engine docs/rule-engine.md doc Control Maps docs/control-maps.md doc Bundle Readiness docs/bundle-readiness.md doc Catalog Submission docs/catalog-submission.md doc Release Process docs/release-process.md doc Adoption And Launch docs/adoption-and-launch.md doc Agent Environments docs/agent-environments.md doc Agent Fleet docs/agent-fleet.md doc System Context docs/architecture/system-context.md doc Architecture docs/architecture.md doc Cloud IaC docs/cloud-iac.md doc Completeness Matrix docs/completeness-matrix.md doc Control Applicability docs/compliance/control-applicability.md doc README docs/compliance/control-maps/README.md doc Evidence Index docs/compliance/evidence-index.md doc Docs And Diagrams docs/docs-and-diagrams.md doc Docs Impact docs/docs-impact.md doc Extensions docs/extensions.md doc Data Classification docs/governance/data-classification.md doc Tagging Taxonomy docs/governance/tagging-taxonomy.md doc Getting Started docs/guides/getting-started.md doc Start Here docs/guides/start-here.md doc Machine User PR Flow docs/machine-user-pr-flow.md doc Maintainer Operations docs/maintainer-operations.md doc OpenSSF docs/openssf.md doc Brownfield Adoption docs/playbooks/brownfield-adoption.md doc Custom Rule docs/playbooks/custom-rule.md doc First Spec docs/playbooks/first-spec.md doc Initial Setup Selection docs/playbooks/initial-setup-selection.md doc Investigate Failing Gate docs/playbooks/investigate-failing-gate.md doc Override Shipped Rule docs/playbooks/override-shipped-rule.md doc Read Evidence As Reviewer docs/playbooks/read-evidence-as-reviewer.md doc Select Frameworks docs/playbooks/select-frameworks.md doc Spec Authoring docs/playbooks/spec-authoring.md doc Wire CI docs/playbooks/wire-ci.md doc Presets docs/presets.md doc Profiles docs/profiles.md doc Repository Settings docs/repository-settings.md doc Accepted Risk Log docs/risk/accepted-risk-log.md doc Risk Register docs/risk/risk-register.md doc Security Exceptions docs/risk/security-exceptions.md doc Abuse Cases docs/security/abuse-cases.md doc Threat Model docs/security/threat-model.md doc Vendor Evaluation docs/vendor-evaluation.md
Spec Kit Presets Profiles users install or compose to add SicarioSpec governance to target repos.
preset Agent Fleet presets/sicario-agent-fleet/preset.yml preset AI System presets/sicario-ai-system/preset.yml preset Appsec presets/sicario-appsec/preset.yml preset Cloud IaC presets/sicario-cloud-iac/preset.yml preset Compliance presets/sicario-compliance/preset.yml preset Core presets/sicario-core/preset.yml preset Docs presets/sicario-docs/preset.yml preset Enterprise Strict presets/sicario-enterprise-strict/preset.yml preset SaaS presets/sicario-saas/preset.yml preset Security Toolchain presets/sicario-security-toolchain/preset.yml preset Supply Chain presets/sicario-supply-chain/preset.yml
Verify Rule Engine Deterministic code and schema that make governance checks enforceable in CI.
engine Rule Engine sicario_cli/rules/engine.py schema Rule Schema sicario_cli/rules/schema.json evaluator Classification Complete sicario_cli/rules/kinds/classification_complete.py evaluator File Exists sicario_cli/rules/kinds/file_exists.py evaluator File Glob sicario_cli/rules/kinds/file_glob.py evaluator Keyword Absent sicario_cli/rules/kinds/keyword_absent.py evaluator Keyword Exists sicario_cli/rules/kinds/keyword_exists.py evaluator Regex Forbidden sicario_cli/rules/kinds/regex_forbidden.py evaluator Regex Required sicario_cli/rules/kinds/regex_required.py evaluator Risk Rows Valid sicario_cli/rules/kinds/risk_rows_valid.py evaluator Section Exists sicario_cli/rules/kinds/section_exists.py evaluator Tagging Complete sicario_cli/rules/kinds/tagging_complete.py
Control Maps Framework mappings that turn project artifacts into standards evidence.
control-map AI RMF control_maps/ai-rmf-sicario.json control-map Bsi C5 2026 control_maps/bsi-c5-2026-sicario.json control-map CCM V4.1 control_maps/ccm-v4.1-sicario.json control-map EU AI Act control_maps/eu-ai-act-sicario.json control-map Fedramp Rev5 control_maps/fedramp-rev5-sicario.json control-map GDPR CPRA control_maps/gdpr-cpra-sicario.json control-map HIPAA Security Rule control_maps/hipaa-security-rule-sicario.json control-map ISO 27001 2022 control_maps/iso-27001-2022-sicario.json control-map NIST 800 53 R5 control_maps/nist-800-53-r5-sicario.json control-map OWASP ASVS control_maps/owasp-asvs-sicario.json control-map PCI DSS V4.0 control_maps/pci-dss-v4.0-sicario.json control-map Soc2 Trust Services control_maps/soc2-trust-services-sicario.json control-map SOX 404 ITGC control_maps/sox-404-itgc-sicario.json control-map SSDF 800 218 control_maps/ssdf-800-218-sicario.json
CI, Pages, Release GitHub Actions and workflow templates that publish, verify, and package the project.
workflow CodeQL .github/workflows/codeql.yml workflow Issue Triage .github/workflows/issue-triage.yml workflow Pages .github/workflows/pages.yml workflow Publish PyPI .github/workflows/publish-pypi.yml workflow Release .github/workflows/release.yml workflow Scorecard .github/workflows/scorecard.yml workflow Test .github/workflows/test.yml workflow Docs Site workflow_templates/docs-site.yml workflow Security Toolchain workflow_templates/security-toolchain.yml workflow Verify workflow_templates/sicario-verify.yml
Examples And Demo Working and failing target projects used to show the verifier in action.
example Custom Rules examples/custom-rules example Python API examples/python-api example Python API Failing examples/python-api-failing
Planning Artifacts Spec Kit feature histories that explain why the repo is shaped this way.
spec 001 Maintainer Operations specs/001-maintainer-operations spec 001 Preset Refactor specs/001-preset-refactor spec 002 Governance Rule Schema specs/002-governance-rule-schema spec 003 Issue Email Alerts specs/003-issue-email-alerts spec 004 Advisory Quality Tier specs/004-advisory-quality-tier spec 005 Spec Change Control specs/005-spec-change-control spec 006 Complete Secret Scan Reporting specs/006-complete-secret-scan-reporting spec 007 Onboarding Guides And Playbooks specs/007-onboarding-guides-and-playbooks
Bundle And CLI The package, CLI, demo, and submission files that make the repo bundle-ready.
package Sicario CLI sicario_cli/cli.py package Python Project Metadata pyproject.toml package Legacy Package Build setup.py package Package Asset Manifest MANIFEST.in package Bundle Version VERSION package Bundle Manifest bundle.yml package Demo Runner demo/run.sh package Catalog Submission SUBMISSION.md