Origin
This follows #41 (a docs-only worked example), which @santosomar and @thomas-bartlett correctly sent back: the change "is a Target/unit change, it belongs in spec.md not docs," and both validated that agentic-artifact targets are a real gap. This issue proposes the spec-level amendment #41 should have been, opened issue-first per amendment-process.md.
The scenario the current spec handles worse
An operator points Foundry at an AI agent's MCP server manifests, skill files, and tool manifests — capability-granting artifacts that are a dominant attack surface for agentic systems. The source-function unit model can't reach them:
- FR-037 sweeps "each function in scope" — these artifacts have no functions, so the rule-based path yields nothing.
- FR-043 mandates location
(file, function) and FR-090 fingerprints on function/symbol name — neither exists for an artifact, so a finding can't be located or deduplicated, and SC-005 breaks on re-run.
Proposed shape (paired constitution-MINOR + spec-MINOR)
Additive throughout. Source functions stay the primary/default unit; every existing FR is kept verbatim; new behavior rides in lower-case suffix FRs — the same pattern FR-087a already set (an enumerated carve-out to a normative MUST for a class the default unit model doesn't fit).
- constitution.md — Principle VIII scope-widening (MINOR): "location in the code's structure (path, symbol)" becomes the source-code instance of a per-Target-class stable identity. VIII as written re-files every manifest entry as new on any edit (it keys on a "symbol name" an artifact has no equivalent of) — that's the documented failure case. Edit-stability and the line-number/snippet exclusion are unchanged.
- spec.md (MINOR): A-2a + A-10; Glossary
Target / Detection rule generalized in place (the source reading preserved verbatim as the stated default) plus Evaluation unit and Agentic artifact; FR-020a/FR-022a (the Indexer produces an artifact-unit inventory; FR-020/021's function table and call graph are declared N/A for the class, mirroring how FR-038 drops for a no-dependency target); FR-032a (provenance/capability map); FR-037a (rule-based artifact analysis); FR-043a (in-artifact locator); FR-051a (artifact investigation branch); FR-066a (Static-Artifact Mode); FR-087b (artifact evidence-gate carve-out); FR-090a (per-class stable identity).
Two points I want to be explicit about, because they're where the source-function model genuinely doesn't carry over:
- Static-Artifact Mode (FR-066a) never carries
exploited. A static artifact has no testbed, so per Constitution VII the exploited flag is structurally unreachable for this class. I state that as visible scoping, not a footnote.
- FR-087b strengthens, not relaxes, the evidence gate. All three legs require FR-088-resolvable literal in-artifact citations, and the trust-boundary leg and impact leg must cite distinct addresses. The carve-out is narrowed to presence-is-the-vulnerability units only — a tool description that literally contains an injected instruction, analogous to a hard-coded secret. Inferred over-permission ("it declares Bash") is routed to needs-review, never true-positive, and FR-087b explicitly does not relax the three-leg floor for inferred data-flow findings.
IO-trace targets are a candidate unit class but lack a demonstrated edit-survivable identity, so I've deferred them as [NEEDS CLARIFICATION] rather than assert a fingerprint I can't ground.
Rule format — your call
The source-function class has an externally-governed incumbent (CodeGuard, donated to CoSAI/OASIS). This class doesn't yet. The proposed normative text names no rule format and asserts no incumbent: an external open ruleset MAY be adopted, forked, or referenced — mirroring FR-041's CodeGuard language — and a worked example can be supplied in docs/ once you decide one is wanted. I defer to you on which format(s), if any, to exemplify.
Disclosure: I author and maintain Agent Threat Rules (ATR), an MIT ruleset. I will not propose it as the normative or sole exemplar for this class, and it appears nowhere in the proposed normative text. If a worked example is wanted later, that is the maintainers' call.
Ask
Before I open the paired constitution + spec PR: does this Target-class framing, the Principle VIII scope-widening, and the FR-087a-style carve-out approach look like the right shape to you? Glad to adjust the routing or scope first.
Origin
This follows #41 (a docs-only worked example), which @santosomar and @thomas-bartlett correctly sent back: the change "is a Target/unit change, it belongs in spec.md not docs," and both validated that agentic-artifact targets are a real gap. This issue proposes the spec-level amendment #41 should have been, opened issue-first per
amendment-process.md.The scenario the current spec handles worse
An operator points Foundry at an AI agent's MCP server manifests, skill files, and tool manifests — capability-granting artifacts that are a dominant attack surface for agentic systems. The source-function unit model can't reach them:
(file, function)and FR-090 fingerprints onfunction/symbol name— neither exists for an artifact, so a finding can't be located or deduplicated, and SC-005 breaks on re-run.Proposed shape (paired constitution-MINOR + spec-MINOR)
Additive throughout. Source functions stay the primary/default unit; every existing FR is kept verbatim; new behavior rides in lower-case suffix FRs — the same pattern FR-087a already set (an enumerated carve-out to a normative MUST for a class the default unit model doesn't fit).
Target/Detection rulegeneralized in place (the source reading preserved verbatim as the stated default) plusEvaluation unitandAgentic artifact; FR-020a/FR-022a (the Indexer produces an artifact-unit inventory; FR-020/021's function table and call graph are declared N/A for the class, mirroring how FR-038 drops for a no-dependency target); FR-032a (provenance/capability map); FR-037a (rule-based artifact analysis); FR-043a (in-artifact locator); FR-051a (artifact investigation branch); FR-066a (Static-Artifact Mode); FR-087b (artifact evidence-gate carve-out); FR-090a (per-class stable identity).Two points I want to be explicit about, because they're where the source-function model genuinely doesn't carry over:
exploited. A static artifact has no testbed, so per Constitution VII theexploitedflag is structurally unreachable for this class. I state that as visible scoping, not a footnote.IO-trace targets are a candidate unit class but lack a demonstrated edit-survivable identity, so I've deferred them as
[NEEDS CLARIFICATION]rather than assert a fingerprint I can't ground.Rule format — your call
The source-function class has an externally-governed incumbent (CodeGuard, donated to CoSAI/OASIS). This class doesn't yet. The proposed normative text names no rule format and asserts no incumbent: an external open ruleset MAY be adopted, forked, or referenced — mirroring FR-041's CodeGuard language — and a worked example can be supplied in
docs/once you decide one is wanted. I defer to you on which format(s), if any, to exemplify.Disclosure: I author and maintain Agent Threat Rules (ATR), an MIT ruleset. I will not propose it as the normative or sole exemplar for this class, and it appears nowhere in the proposed normative text. If a worked example is wanted later, that is the maintainers' call.
Ask
Before I open the paired constitution + spec PR: does this Target-class framing, the Principle VIII scope-widening, and the FR-087a-style carve-out approach look like the right shape to you? Glad to adjust the routing or scope first.