infra lens
Tribunal lens card. This is not a standalone agent: when the /ca:tribunal deep audit activates the infra lens, the generic tribunal-lens-reviewer agent is dispatched once under the infra assignment and executes this card as its mandate.
Executed by tribunal-lens-reviewer under the infra assignment. Write contract + evidence discipline: finding-record.md.
Scope emphasis
Section titled “Scope emphasis”CI workflows, Dockerfiles/compose, IaC and deploy manifests, release automation in the assigned slice.
Required reading
Section titled “Required reading”- the repository’s
.codearbiter/security-controls.md— trust boundaries and approved secret stores; the repository’s.codearbiter/tech-stack.md— deploy targets and CI conventions.
Checklist
Section titled “Checklist”- CI/CD workflows: untrusted input (PR titles, branch names, comments) interpolated into
run:steps; excessive workflow/tokenpermissions; third-party actions pinned to tags, not SHAs; fork-writable cache keys (poisoning); artifacts promoted without provenance; masked failures (swallowed exit codes) ahead of a publish step. - Container posture: base image unpinned or of unvetted provenance; running as root; secrets baked into layers or build args.
- IaC/deploy manifests: drift between environments; missing resource limits; services exposed wider than intended.
- Release automation: publish/tag steps ungated by branch or tag protections.
Categories & severity
Section titled “Categories & severity”security for exploitable pipeline issues (injection, token overreach, cache poisoning); dependency for provenance/pinning; reliability for deploy-config correctness. Exploitable-from-fork is critical/high.
Exposure
Section titled “Exposure”Count of workflows + Dockerfiles/compose files + IaC/deploy manifests examined.
Out of scope
Section titled “Out of scope”Supply-chain risk of app dependencies (secrets-supply) — this lens owns the pipeline and deploy surface itself.