What you need to run the harness, tiered from "any skill at all" up to the full multi-repository pipeline. This is the requirements overview; the two companion references are:
- setup.md — the installation steps (
install_traust, clone,uv sync, hooks, env vars, toolchain). - external-dependencies.md — the complete dependency inventory: every tool with the skills that require it, its license, and an evidence link.
| Requirement | Detail |
|---|---|
| OS | macOS or Linux. No Windows support. |
| Python | 3.11+ |
| Git | Any recent version; most audit skills clone their targets |
| An AI coding agent | Claude Code or Crush — the harness is prompt-and-skill tooling driven by an agent, not a standalone scanner. Skills are auto-discovered via the .claude/skills/ and .crush/skills/ symlink trees |
| Python dependencies | uv sync in the harness repo (installs traust-engine, traust-ledger, traust-contracts from the git tags pinned in uv.lock); optional extras via uv sync --extra graph or --extra signing |
| Operational configuration | A directory named by TRAUST_CONFIG_HOME (default ~/.traust/config) holding the nine operational config files — corpus registry, product map, budget policy, safe-exec profiles, rule-pack allowlist, hardening weights, dist-git watch list, internal vocabulary, ledger signing public key. scripts/install_traust creates it from the templates in config/; install_traust --doctor verifies it. Nothing runs without it — a missing file fails closed. See config/README.md |
| Disk | A few GB free — audit skills clone target repositories into the workspace |
Each skill states a Minimum Viable Model in the README's skill tables.
Column semantics: the MVM is the registry floor of the skill's primary
role in config/model-registry.yaml — the resolution-time-enforced minimum
(python3 -m traust.cli registry models resolve), not a recommendation;
model-routing.md is the contract. The four tier classes:
- haiku-class — pure rendering/narration roles (
render-narrate) with no analysis or validity-writing. - sonnet-class — mechanical guardrail skills (doc-drift, licensing, alignment checks).
- opus-class — inventory, dashboards, packaging, most rollups,
fuzz-harness authoring (
fuzz-authorfloor). - mythos-class — the analysis-heavy core: audits, threat models, triage, validation, remediation. Running these on a weaker model measurably degrades recall; the error model (error-model.md) describes how that is measured.
When in doubt, run audits on the strongest model available and dashboards on whatever is cheap.
Nothing beyond the baseline is needed until you use a skill that calls for it.
scripts/install-toolchain.sh <profile> installs the scanner binaries at the
versions pinned in config/external-tools.yaml (the manifest /drift-watch
checks installs against); the per-skill mapping and every license are in
external-dependencies.md. By capability:
| If you want to… | You need |
|---|---|
Run source-code audits (secure-code-audit, vuln-scan, threat-model, triage) |
Nothing extra — optional deterministic pre-scanners sharpen results: opengrep, osv-scanner, gitleaks, govulncheck, and one of tokei/scc/cloc for LoC (toolchain profile secure-code-audit) |
Audit container images (secure-container-audit) |
skopeo, syft, grype, cosign, podman. Optional: yara for the known-malware-family pre-scan over the exported rootfs (pinned rule pack fetched at run time) — toolchain profile secure-container-audit |
Audit RPM packaging (secure-rpm-audit) |
GitLab MCP tools, git, access to the dist-git lookaside cache; optional syft/grype/osv-scanner/govulncheck over the prepared source tree, and yara — toolchain profile secure-rpm-audit |
Audit IaC (cloud-config-audit) |
checkov, pinned to the version in harnessing/3-audit/cloud-config-audit/scripts/run_checkov.py — the runner hard-fails on a mismatch and always runs offline. Optional: the bicep CLI (pinned PINNED_BICEP_VERSION, same file) for the transpile fallback on .bicep files checkov's parser rejects — install to ~/.cache/cca-tools/bicep-<version>/bicep (0700) or set $CCA_BICEP; verify the downloaded binary against PINNED_BICEP_SHA256. Without it those files stay loud NOT-ASSESSED gaps |
Inventory operator-catalog and release-payload targets (inventory-repositories) |
oc, skopeo, podman, opm/operator-sdk |
Validate findings on a live cluster (validate-findings, deploy-operator (internal extension), operator-priv-profile tier 3) |
oc, kubectl, and a disposable, explicitly authorized cluster named in the rules-of-engagement file. How the cluster is provisioned is the deployment's concern |
Validate browser findings (validate-browser-finding) |
Playwright (pip install -r requirements.txt from the repo root, then playwright install chromium) |
Fuzz (create-fuzzing) |
The target language's toolchain: Go native, atheris (Python), Jazzer.js (JS/TS), jazzer (JVM, pinned), cargo-fuzz (Rust) |
Generate remediations on forks (remediate-finding) |
A GITHUB_TOKEN with fork-push rights — fork setup goes through the GitHub REST API directly (curl), no gh needed. (glab belongs to fleet-fix MR automation) |
PQC readiness (pqc-readiness) |
Rust toolchain (builds the pinned pqc-scan binary); Go toolchain + callgraph/digraph for call-graph reachability |
| Sign disposition ledgers | cosign, plus the signing private key in your secret store (LAAS_SIGNING_KEY_PATH) — toolchain profile ledger-signing; see signing.md |
| Tier | What it unlocks | Skills affected |
|---|---|---|
| Offline | Everything that reads a local checkout: audits, threat models, triage, fuzzing, patch generation | Most of the harness — audit skills default to read-only against the target; the documented exceptions (sanitizer probes via probe_sanitizers.py --run, govulncheck, remediation build checks) execute target code only through the safe_exec sandbox or a rootless container (gate rule S10) |
| Public internet | Vulnerability feeds (OSV, Go vulndb, EPSS, CISA KEV, grype DB, vendor CSAF), forge API lookups, cloning public repositories | dependency pre-scans, CVE enrichment, dependency-watch, impact-analysis, portfolio-graph, the rescan router |
| Private network | Your directory service (owner assignment, countersign identity verification), a private forge, an internal product registry, distro packaging hosts | assign-findings-owners (internal extension), reassign-findings-owners, countersign, secure-rpm-audit; sla-view's registry join is optional and degrades cleanly when the registry is unreachable |
| Issue tracker | Defect filing and backlog sync (Jira, via MCP server or CLI with target-project access) | file-security-defect (internal extension) |
| Disposable cluster | Live validation — always against disposable, explicitly authorized clusters, never production | validate-findings, deploy-operator (internal extension), operator-priv-profile tier 3 |
| Collaboration suite | Findings distribution and ownership-tracker updates (gws CLI for Google Workspace) |
reassign-findings-owners (internal extension) |
Running the full pipeline across a fleet additionally requires the sibling
data repositories cloned beside the harness — an inputs inventory, the
findings store, and the progress-tracker tree (setup.md has the
layout) — and the git hooks enabled (git config core.hooksPath .githooks) so
the doc-consistency, licensing, skill-alignment, and skill security-posture
gates run locally. MCP servers for the flows that use them (GitHub, GitLab,
Jira, Playwright) are inventoried in
external-dependencies.md.
All security testing this harness performs is against explicitly authorized targets only. Scope validation is fail-closed in the validation skills, live work targets disposable clusters, and the constraints in AGENTS.md apply to every run. If you are not authorized to assess a target, no tier above applies — don't point the harness at it.