CryptoShield-upload

.github/ISSUE_TEMPLATE/control-update.md

@@ -0,0 +1,47 @@
+---
+name: Control Update
+about: Propose an update to an existing CryptoSHIELD control
+title: "[CONTROL] [DOMAIN-ID]: Control Update"
+labels: control-update
+assignees: ''
+
+---
+
+## Control Update Proposal
+
+**Control ID:** (e.g., WKS-03)
+**Domain:** (e.g., Domain 01: Wallet and Key Sovereignty)
+**Update Type:**
+- [ ] Implementation guidance update
+- [ ] Priority change (with justification)
+- [ ] New failure mode identified
+- [ ] Threat coverage expansion
+- [ ] Deprecation
+
+## Current Control Text
+
+> Paste the existing control definition and implementation guidance here.
+
+## Proposed Change
+
+Describe what should change and why.
+
+## Evidence for Change
+
+What has changed in the threat landscape, technology, or available tooling that requires this update?
+
+1. [Evidence source 1]
+2. [Evidence source 2]
+
+## Impact Assessment
+
+- Does this change affect CTRS scores for related threats?
+- Does this change require updates to related playbooks?
+- Does this create compatibility issues with AI SAFE² or CSF companion controls?
+
+## Adversarial Reproduction Test
+
+An independent analyst should arrive at the same proposed change using the same evidence. Confirm: [ ] Evidence is publicly verifiable
+
+---
+*CSI CryptoSHIELD Framework | Contributor: @yourhandle*

.github/ISSUE_TEMPLATE/new-threat-entry.md

@@ -0,0 +1,72 @@
+---
+name: New Threat Entry
+about: Submit a new threat for inclusion in the CryptoSHIELD taxonomy
+title: "[THREAT] CS-XXX-00: Threat Name"
+labels: new-threat, taxonomy
+assignees: ''
+
+---
+
+## Threat Proposal
+
+**Proposed Threat ID:** (follow existing convention: CS-[CATEGORY]-[NUMBER])
+**Category:** (PHY / INS / SOC / MAL / WAL / DFI / SC / AI / MKT / SOV / FRD / EXT)
+**Threat Name:**
+
+## Threat Description
+
+Describe the attack in concrete terms. What does the attacker do? What is the victim's experience?
+
+## Attack Vector
+
+How is this attack delivered to the victim?
+
+## OODA Phase
+
+Which OODA phase does this attack primarily operate in?
+- [ ] Observe
+- [ ] Orient
+- [ ] Decide
+- [ ] Act
+
+## Evidence
+
+**Documented Cases (minimum 2 required):**
+1. [Case 1: date, platform/target, loss amount, source link]
+2. [Case 2: date, platform/target, loss amount, source link]
+
+**Financial Scale:**
+Estimated annual losses or incident volume:
+
+## CTRS Scoring Proposal
+
+Rate each component (0-4):
+- Likelihood (L): ___ | Rationale:
+- Impact on Sovereignty (I): ___ | Rationale:
+- Reach/Scale (R): ___ | Rationale:
+- Detection Difficulty (D): ___ | Rationale:
+- Recovery Difficulty (RecD): ___ | Rationale:
+
+**Proposed CTRS:** (use formula from taxonomy/ctrs-scoring.md)
+
+## Proposed Controls
+
+What 1-3 controls would mitigate this threat? Refer to existing controls where possible.
+
+1.
+2.
+3.
+
+## Adversarial Reproduction Test
+
+An independent analyst using the same sources and methodology should arrive at the same threat classification and CTRS score. Provide sufficient documentation for this test to pass.
+
+## Metadata Tags
+
+- `false_flag_prob`: (float 0.0-1.0)
+- `insider_vector`: (true/false)
+- `ai_assisted`: (true/false)
+- `sovereignty_impact`: (LOW/MEDIUM/HIGH/CRITICAL)
+
+---
+*CSI CryptoSHIELD Framework | Contributor: @yourhandle*

.github/workflows/taxonomy-lint.yml

@@ -0,0 +1,132 @@
+name: Taxonomy Integrity Check
+
+on:
+  push:
+    paths:
+      - 'taxonomy/registry.json'
+      - 'metadata/threat-event-schema.json'
+  pull_request:
+    paths:
+      - 'taxonomy/**'
+      - 'metadata/**'
+
+jobs:
+  validate-registry:
+    runs-on: ubuntu-latest
+    name: Validate Threat Registry
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: '22'
+
+      - name: Install ajv-cli for JSON Schema validation
+        run: npm install -g ajv-cli ajv-formats
+
+      - name: Validate registry.json against schema
+        run: |
+          ajv validate \
+            -s metadata/threat-event-schema.json \
+            -d taxonomy/registry.json \
+            --all-errors \
+            --strict=false \
+            2>&1 || echo "::warning::Schema validation produced warnings"
+
+      - name: Check CTRS scores are within range
+        run: |
+          python3 - <<'EOF'
+          import json
+          import sys
+
+          with open('taxonomy/registry.json') as f:
+              data = json.load(f)
+
+          errors = []
+          threats = data.get('threats', data) if isinstance(data, dict) else data
+
+          if isinstance(threats, dict):
+              threats = list(threats.values())
+
+          for threat in threats:
+              tid = threat.get('id', 'UNKNOWN')
+              ctrs = threat.get('ctrs_score')
+              if ctrs is not None:
+                  if not (0 <= ctrs <= 20):
+                      errors.append(f"{tid}: CTRS score {ctrs} out of range (0-20)")
+              severity = threat.get('severity', '').upper()
+              if severity and severity not in ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW']:
+                  errors.append(f"{tid}: Invalid severity '{severity}'")
+
+          if errors:
+              print("::error::Registry validation errors:")
+              for e in errors:
+                  print(f"  - {e}")
+              sys.exit(1)
+          else:
+              print(f"Registry validation passed: {len(threats)} threats checked")
+          EOF
+
+      - name: Check threat ID uniqueness
+        run: |
+          python3 - <<'EOF'
+          import json
+          import sys
+
+          with open('taxonomy/registry.json') as f:
+              data = json.load(f)
+
+          threats = data.get('threats', data) if isinstance(data, dict) else data
+          if isinstance(threats, dict):
+              threats = list(threats.values())
+
+          ids = [t.get('id') for t in threats if t.get('id')]
+          duplicates = [id for id in set(ids) if ids.count(id) > 1]
+
+          if duplicates:
+              print(f"::error::Duplicate threat IDs found: {duplicates}")
+              sys.exit(1)
+          else:
+              print(f"ID uniqueness check passed: {len(ids)} unique IDs")
+          EOF
+
+  validate-markdown:
+    runs-on: ubuntu-latest
+    name: Validate Domain Documentation
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Check all domain READMEs exist
+        run: |
+          domains=(
+            "00-cross-domain"
+            "01-wallet-key-sovereignty"
+            "02-endpoint-device-defense"
+            "03-opsec-physical-security"
+            "04-social-media-platform-security"
+            "05-on-chain-monitoring"
+            "06-supply-chain-defense"
+            "07-ai-agent-security"
+            "08-governance-compliance-sovereignty"
+            "09-consumer-fraud-defense"
+          )
+          missing=0
+          for d in "${domains[@]}"; do
+            if [ ! -f "${d}/README.md" ]; then
+              echo "::warning::Missing README: ${d}/README.md"
+              missing=$((missing + 1))
+            fi
+          done
+          echo "Domain README check: $missing missing"
+
+      - name: Check for em dashes in all markdown files
+        run: |
+          # CSI style: no em dashes
+          if grep -r " — " --include="*.md" . 2>/dev/null | grep -v ".git"; then
+            echo "::warning::Em dashes found in markdown files. Replace with colon, semicolon, or parentheses."
+          else
+            echo "Em dash check passed"
+          fi

00-cross-domain/README.md

@@ -0,0 +1,41 @@
+# Domain 00: Cross-Domain Sovereignty Governance (CDG)
+
+**CSI CryptoSHIELD Framework v1.1 | May 2026**
+
+---
+
+## Philosophy
+
+Sovereignty is not a feature. It is the architecture.
+
+Every control in every other domain derives its legitimacy from this domain's foundational commitment: individual sovereignty over financial assets is a constitutional right, not a privilege granted by regulatory permission. The January 2025 Executive Order, the Fifth Circuit Tornado Cash ruling, and the CTA enforcement blocks by federal courts are not policy preferences: they are legal affirmations of what CryptoSHIELD operationalizes.
+
+This domain sets the governance context that all other domains operate within. It does not replace legal counsel. It establishes the constitutional and philosophical alignment of the entire framework.
+
+---
+
+## Controls
+
+| Control | Description | Priority |
+|---------|-------------|---------|
+| CDG-01 | Sovereignty-First Policy Declaration: explicit written commitment to self-custody as the default | CRITICAL |
+| CDG-02 | U.S. Constitutional Alignment Protocol: framework review against applicable court rulings quarterly | HIGH |
+| CDG-03 | CBDC Non-Adoption Commitment: documented organizational policy against CBDC participation | CRITICAL |
+| CDG-04 | Self-Custody Rights Documentation: maintain documented record of self-custody rights per jurisdiction | HIGH |
+| CDG-05 | Annual Sovereignty Architecture Review: annual comprehensive review of all framework controls against updated threat and regulatory landscape | HIGH |
+
+---
+
+## U.S. Constitutional Alignment Reference
+
+| Legal Precedent | Relevance | CryptoSHIELD Alignment |
+|----------------|-----------|------------------------|
+| Trump EO, January 2025 | Self-custody rights protected; CBDC prohibited | CDG-01, CDG-03, GCS-01, GCS-02 |
+| Fifth Circuit: Tornado Cash (November 2024) | Immutable smart contracts not "property" under IEEPA | GCS-03 (legal awareness) |
+| FinCEN CTA enforcement blocked (January 2025) | Reporting overreach blocked by courts | GCS-03, GCS-04 |
+| March 2026 SEC/CFTC joint interpretation | Most crypto assets confirmed not securities | GCS-03 |
+| GENIUS Act | AML at CEX boundary; innovation-preserving | GCS-04 |
+
+---
+
+*Domain 00: Cross-Domain Sovereignty Governance | CryptoSHIELD v1.1*