SpecterSpec: Spec-Driven Security & Chaos Auditor (.kiro)

SpecterSpec: Spec-Driven Multi-Agent Security & Chaos Auditor powered by .kiro Specs, Steering, Hooks & MCP (Kiroween 2026)

Comment

SpecterSpec — Spec-Driven Multi-Agent Security & Chaos Auditor powered by Kiro

Kiroween 2026 (https://kiroween.devpost.com/ — $100,000 Cash across 15 Cash Winners + 100 Bonus Blog Prize Winners)

SpecterSpec Architecture

1. Overview

SpecterSpec eliminates the "haunted gap" between system architecture specifications and production source code. Built natively around Kiro's four core primitives (.kiro/specs, .kiro/steering, .kiro/hooks, and .kiro/settings/mcp.json), SpecterSpec parses EARS (Easy Approach to Requirements Syntax) requirements into machine-verifiable AST invariants, audits Python and TypeScript code for spec drift and security vulnerabilities, simulates adversarial chaos fault vectors, and synthesizes unified Git patch diffs that restore 100% EARS Spec Compliance.

2. Authentic .kiro/ Directory Structure Included

kiroween-2026/
├── .kiro/
│   ├── specs/
│   │   └── specter-chaos-auditor/
│   │       ├── requirements.md         # 10 EARS-formatted security & chaos requirements
│   │       ├── design.md               # Formal correctness properties & architecture
│   │       └── tasks.md                # Implementation task DAG
│   ├── steering/
│   │   └── security-invariants.md      # Always-on zero-trust agent steering rules
│   ├── hooks/
│   │   └── on-save-spec-verify.json    # Automated on-save Kiro agent hook invoking MCP tools
│   └── settings/
│       └── mcp.json                    # Kiro Model Context Protocol (MCP) server config
├── index.html                          # Interactive Spec-to-Code Traceability Matrix & Ghost Chaos Simulator UI
├── src/
│   ├── __init__.py
│   └── specter_kiro_engine.py          # EARS Parser, AST Auditor, Ghost Chaos Simulator, Patch Synthesizer & MCP Server
├── tests/
│   └── test_specter_kiro.py            # 7 unit tests (100% pass rate)
├── scripts/
│   └── generate_demo_video.py          # Generates 1080p assets/architecture.png & assets/kiroween_demo.mp4
├── assets/
│   ├── architecture.png                # 1080p System Architecture Diagram
│   └── kiroween_demo.mp4               # 1080p H.264 Demo Video
├── KIRO_BLOG_POST.md                   # Publication-ready technical blog post for the 100-Winner Bonus Blog Prize
├── DEVPOST_SUBMISSION.md               # Complete Devpost submission copy
└── README.md

3. Quickstart & Verification

Run the Full Kiroween Verification & Chaos Simulation Demo

python3 src/specter_kiro_engine.py --demo

Execute a Raw Kiro MCP JSON-RPC 2.0 Request

python3 src/specter_kiro_engine.py --mcp-request '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"kiro_run_ghost_chaos","arguments":{}}}'

Run the Unit Test Suite

python3 -m unittest discover -s tests -v

Regenerate 1080p Architecture Diagram & MP4 Demo Video

python3 scripts/generate_demo_video.py

4. EARS Spec-to-Code Traceability Matrix

EARS Requirement EARS Clause ID AST Security Rule Vulnerability / Chaos Vector Audited Post-Patch Compliance
EARS Spec Parsing REQ-EARS-001.1 / .2 SPEC_AMBIGUITY_WARNING Verifies mandatory WHEN/IF/WHILE/WHERE ... THE SYSTEM SHALL structure 100% (10/10 Clauses)
SQL Parameterization REQ-SEC-002.1 / .2 SPECTER-SQLI-001 Blocks f-string, %, and .format() interpolation inside execute() 100% Contained
Subprocess Sandbox REQ-SEC-003.1 / .2 SPECTER-RCE-002 Blocks subprocess.run(..., shell=True), os.system(), eval(), exec() 100% Contained
Credential Hygiene REQ-SEC-004.1 / .2 SPECTER-SECRET-003 Blocks hardcoded API keys & JWT secrets; rewrites to os.environ.get() 100% Contained
Chaos Timeout Guard REQ-CHAOS-005.1 / .2 SPECTER-CHAOS-004 Enforces timeout <= 10.0s on outbound HTTP calls against 5000ms socket hangs 100% Contained

Built With

Share this project:

Updates