tools/security-tracker/

Capability: contract:security-tracker

Kind: interface

Vendor: agnostic

The seam between the security-* skills and the place a project keeps its security reports. contract:tracker covers issue trackers in general; this contract adds what handling embargoed reports needs on top of it — named body fields, the single status rollup, attachments for the CVE record, a confidentiality guard that refuses to write to a tracker that is not access-restricted, and an explicit publish step for backends that write to a working copy.

See contract.md for the operations, outputs, exit codes and backend rules.

Prerequisites

• Runtime: None — this directory is a Markdown contract spec; no executable code ships here.
• CLIs / credentials / network: Provided by the backend tracker.platform selects; see each backend’s README.

Configuration

In <project-config>/project.md, under the tracker: block:

tracker:
  platform: local-files          # github (default) | local-files | jira
  local:
    root: security/reports       # tracker folder, relative to the tracker working copy
    checkout: ""                 # working copy path; empty = the repository the skill runs in
  jira:
    url: https://issues.example.org/jira
    project: FOOSEC
    security_level: "Security Team"
    issue_type: Bug
    deployment: server           # server | cloud

/magpie-setup config asks for the platform when it configures the security family, and for local-files runs detect against the folder to learn the existing format before writing anything.