Skip to content

feat(141): MAESTRO Phase 2 — Cross-Layer Attack Chain Analysis#159

Merged
davidmatousek merged 11 commits intomainfrom
141-maestro-phase-2
Apr 12, 2026
Merged

feat(141): MAESTRO Phase 2 — Cross-Layer Attack Chain Analysis#159
davidmatousek merged 11 commits intomainfrom
141-maestro-phase-2

Conversation

@davidmatousek
Copy link
Copy Markdown
Owner

@davidmatousek davidmatousek commented Apr 12, 2026

Summary

  • Implements cross-layer attack chain correlation engine that identifies multi-layer MAESTRO attack paths from threat findings
  • Adds attack-chains.md artifact with chain detection, impact amplification scoring, and mitigation sequencing
  • Extends threat report with Section 6 narrative for cross-layer attack chains
  • Adds attack chain diagram pages to PDF security report via new Typst template
  • Schema bump: finding.yaml gains chain_id, chain_role, amplification_factor fields
  • New shared parser parse_attack_chains() in tachi_parsers.py; 800+ lines of new test coverage
  • All 6 examples regenerated; 5 PDF baselines byte-identical (backward compatible)

Commits

  • feat(141): add Section 6 Cross-Layer Attack Chains to threat report agent
  • feat(141): expand threat-report input contract for attack-chains.md
  • feat(141): validate threat report narrative against agentic-app (T015)
  • feat(141): implement Waves 1-4 — schema, parser, correlation engine, threat report narrative
  • feat(141): implement Wave 5 — PDF attack chain diagram pages (T016-T021)
  • feat(141): implement Wave 6 — example regeneration and chain artifact (T022-T028)
  • feat(141): implement Wave 7 — ADR, README, final validation (T029-T033)
  • fix(141): address P2 architect review MEDIUM concerns
  • security(141): run security scan

Governance

  • 34/34 tasks complete across 7 waves
  • Checkpoints: P0 APPROVED, P1 APPROVED, P2 APPROVED (all concerns addressed)
  • Final Validation: Architect APPROVED, Security PASSED
  • SAST: PASSED (4 files scanned), SCA: SKIPPED (no dependency changes)

Test plan

  • Verify pytest tests/scripts/test_attack_chain*.py passes
  • Verify pytest tests/scripts/test_backward_compatibility.py passes (5 baselines byte-identical)
  • Verify agentic-app example contains attack-chains.md with valid chain data
  • Verify PDF report includes attack chain diagram pages when chains are present

🤖 Generated with Claude Code

davidmatousek and others added 11 commits April 12, 2026 14:29
@davidmatousek @claude
feat(141): add Section 6 Cross-Layer Attack Chains to threat report a…
af4ce65 
…gent

Insert conditional Section 6 after Attack Trees (Section 5) in the
threat-report agent workflow. Renumber Remediation Roadmap (6→7),
Appendix (7→8), Delta Summary (8→9) across agent, template, and
schema. Add Attack Chain quality validation checklist items.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@davidmatousek @claude
feat(141): expand threat-report input contract for attack-chains.md
cad1e17 
Update frontmatter description, Core Mission, Metadata, Skill
References, Input Contract, and Input Validation to document
attack-chains.md as conditional input consumed by Section 6.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@davidmatousek @claude
feat(141): validate threat report narrative against agentic-app (T015)
f6db5ec 
Design validation confirms Section 6 instructions produce valid output
for the agentic-app example: 6/7 MAESTRO layers covered, at least one
3-layer chain (L2→L1→L3) structurally possible, all causal vocabulary
referenced, 150-300 word constraint specified, CSA canonical structure
(initial exploit → intermediate cascades → business impact) aligned.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@davidmatousek @claude
feat(141): implement Waves 1-4 — schema, parser, correlation engine, …
3a4ee2d 
…threat report narrative

Wave 1: Create attack-chain.yaml schema, correlation pattern lookup table,
and orchestration documentation (T001-T004).
Wave 2: Add parse_attack_chains() to tachi_parsers.py with detect_artifacts
support, insert Phase 3.5 skeleton into orchestrator (T005-T006).
Wave 3: Full correlation engine — cross-layer detection, chain assembly,
chain-breaking heuristic, artifact generation, 26 unit tests (T007-T012).
Wave 4: Threat report Section 6 with conditional chain narratives using
canonical CSA MAESTRO vocabulary (T013-T015).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@davidmatousek @claude
feat(141): implement Wave 5 — PDF attack chain diagram pages (T016-T021)
0edd726 
Add cross-layer attack chain rendering to the PDF security report:
- Chain parsing + Mermaid flowchart TD generation in extract-report-data.py
  with vertical MAESTRO layer stack (L1 top → L7 bottom), colored nodes,
  and causal edge labels (T016, T016a)
- New attack-chain.typ Typst template with severity badge, layer progression
  tag, diagram section, narrative, and finding IDs footer (T017)
- main.typ: import + has-attack-chains default + conditional page sequencing
  after Attack Path Analysis section (T018)
- mmdc preflight gate extended for attack-chains.md (T019)
- 27 integration tests: parser, Mermaid syntax, Typst data, conditional gate (T020)
- Validated: template compiles, 5/5 backward compat PDFs byte-identical (T021)

100/100 tests pass (27 new + 73 existing, zero regressions).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@davidmatousek @claude
docs(141): update NEXT-SESSION.md handoff for Wave 6 resume
ab3be11 
Waves 1-5 complete (22/34 tasks, 65%). P0+P1 checkpoints passed.
Next: Wave 6 example regeneration (pipeline execution).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@davidmatousek @claude
feat(141): implement Wave 6 — example regeneration and chain artifact…
e20b985 
… (T022-T028)

- T022: Architecture assessment — 6 MAESTRO layers sufficient for 3+ layer chains
- T023: Created attack-chains.md with 5 chains (4 surfaced), updated threat-report.md
  with Section 6 (Attack Chains), regenerated PDF with chain diagram pages
- T023 fix: Normalize long-form MAESTRO layer values (e.g., "L1 — Foundation Model")
  to short-form codes (L1) in generate_chain_mermaid() for valid Mermaid node IDs
- T024-T028: 5 non-chain examples verified byte-identical (5/5 backward compat pass)
- Full test suite: 100/100 pass

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@davidmatousek @claude
feat(141): implement Wave 7 — ADR, README, final validation (T029-T033)
5e43472 
- T029: ADR-020 updated with Phase 2 cross-layer correlation section
  documenting pipeline placement, correlation algorithm, chain schema, and
  downstream propagation
- T030: Backward-compat baselines verified (5/5 byte-identical)
- T031: Full pytest suite 100/100 pass
- T032: README.md updated with attack-chains.md artifact, chain diagram
  pages, and mmdc prerequisite clarification
- T033: All 7 success criteria (SC-001 through SC-007) validated

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@davidmatousek @claude
fix(141): address P2 architect review MEDIUM concerns
e1a1339 
- MEDIUM-001: Normalize MAESTRO layer names in Mermaid diagram labels
  from "&" shorthand to canonical "and" (L5 "Evaluation and Observability",
  L6 "Security and Compliance") matching Feature 136 canonical CSA names
- MEDIUM-002: Replace branded "OWASP 3x3" reference in attack-chain.yaml
  with "risk matrix in severity-bands-shared.md" per Feature 082 SC-004

100/100 pytest pass after fixes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@davidmatousek @claude
security(141): run security scan [e1a1339]
52b8b34 
SAST: 4 files scanned, 0 findings (PASSED)
SCA: skipped (no manifests changed)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@davidmatousek @claude
docs(141): update backlog for MAESTRO Phase 2
a02e4f6 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@davidmatousek davidmatousek merged commit 5a108e9 into main Apr 12, 2026
@davidmatousek davidmatousek deleted the 141-maestro-phase-2 branch April 12, 2026 19:40
@github-actions github-actions bot mentioned this pull request Apr 12, 2026
Merged
@davidmatousek davidmatousek mentioned this pull request Apr 12, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@davidmatousek