feat: enterprise-grade DBShield package, workflows, SLA, and SOC 2 readiness

.github/workflows/ci.yml

@@ -1,11 +1,14 @@
-name: CI
+name: CI & Matrix Tests
 
 on:
   push:
     branches: [main]
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test (Node ${{ matrix.node }} on ${{ matrix.os }})
@@ -14,26 +17,31 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest]
-        node: [22, 24]
+        node: [20, 22, 24]
 
     steps:
       - name: Configure Git for consistent line endings
         run: git config --global core.autocrlf false
 
       - name: Checkout Code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
         with:
           version: 9
 
       - name: Setup Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
           cache: "pnpm"
 
+      - name: Setup Python
+        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
+        with:
+          python-version: "3.11"
+
       - name: Install Dependencies
         run: pnpm install --frozen-lockfile
 
@@ -43,8 +51,13 @@ jobs:
       - name: Build TypeScript
         run: pnpm run build
 
+      - name: Run Performance Benchmark
+        env:
+          PYTHONIOENCODING: "utf-8"
+        run: python benchmarks/proxy_overhead_benchmark.py
+
       - name: Run Test Suite
         run: pnpm test
 
-      - name: Verify Tarball Packaging
+      - name: Verify Tarball Packaging Gate
         run: npm pack --dry-run

.github/workflows/codeql.yml

@@ -0,0 +1,43 @@
+name: "CodeQL Analysis"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '0 6 * * 1'
+
+permissions: read-all
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: javascript-typescript
+            build-mode: none
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/publish-package.yml

@@ -0,0 +1,93 @@
+name: Publish Package & Sigstore Provenance
+
+on:
+  release:
+    types: [published]
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+*"
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  publish-gpr:
+    name: Publish to GitHub Packages
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          version: 9
+
+      - name: Setup Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.0.0
+        with:
+          node-version: 22
+          registry-url: "https://npm.pkg.github.com"
+          scope: "@ritualdev-lab"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run Tests
+        run: pnpm test
+
+      - name: Build DBShield
+        run: pnpm run build
+
+      - name: Publish to GitHub Packages
+        continue-on-error: true
+        run: |
+          echo "@ritualdev-lab:registry=https://npm.pkg.github.com" > .npmrc
+          echo "//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}" >> .npmrc
+          pnpm publish --no-git-checks --provenance=false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish-npm:
+    name: Publish to npm with Sigstore SLSA Provenance
+    runs-on: ubuntu-latest
+    if: github.repository == 'RitualDev-Lab/DBShield'
+    permissions:
+      contents: read
+      id-token: write        # Required for OIDC token minting & Sigstore Rekor ledger signing
+      attestations: write    # Required for GitHub build provenance attestations
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          version: 9
+
+      - name: Setup Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.0.0
+        with:
+          node-version: 22
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run Test Suite
+        run: pnpm test
+
+      - name: Build DBShield
+        run: pnpm run build
+
+      - name: Generate SLSA Build Provenance Attestation
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.0.0
+        with:
+          subject-path: 'dist/**'
+
+      - name: Publish to npm with Sigstore Provenance
+        run: pnpm publish --no-git-checks --access public --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/release.yml

@@ -74,6 +74,15 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
+      - name: Reconfigure for GitHub Packages
+        continue-on-error: true
+        run: |
+          echo "@ritualdev-lab:registry=https://npm.pkg.github.com" > .npmrc
+          echo "//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}" >> .npmrc
+          pnpm publish --no-git-checks --provenance=false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Create GitHub Release with SBOM Artifacts
         uses: softprops/action-gh-release@c062e08bd5328157348241fa0833b7d8b97943b7 # v2.0.8
         with:

.github/workflows/scorecard.yml

@@ -0,0 +1,39 @@
+name: OpenSSF Scorecard Security Analysis
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '30 1 * * 1'
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard Analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run OpenSSF Scorecard
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload SARIF to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif

ENTERPRISE_SLA.md

@@ -0,0 +1,61 @@
+# 📜 Formal Enterprise Service Level Agreement (SLA)
+
+> **Document Version**: 1.0.0  
+> **Effective Date**: November 2026  
+> **Vendor Entity**: RitualDev Lab (`ritualdev.in`)  
+> **Applies to**: DBShield Enterprise, Database Guardrail Proxy & MCP Sandboxing Suite  
+> **Official Intake**: `support@ritualdev.in` | `security@ritualdev.in` | `developer@ritualdev.in`  
+> **Enterprise Trust Portal**: [https://ritualdev.in/trust](https://ritualdev.in/trust)  
+> **Status**: Active & Operationally Guaranteed  
+
+---
+
+## 1. Executive Summary & Purpose
+
+This Enterprise Service Level Agreement (**"SLA"**) governs the technical support response guarantees, availability targets, and critical incident escalation workflows provided by **RitualDev Lab** to enterprise customers deploying **DBShield** within on-premises, hybrid cloud, or private VPC architectures.
+
+DBShield provides deterministic, zero-overhead database guardrails, PostgreSQL/MySQL wire proxies, virtual schema masking, and autonomous agent sandboxing to protect relational databases from unconstrained mutations, accidental table drops, and PII leakage.
+
+---
+
+## 2. Priority Classification & Response Time Guarantees
+
+All inquiries submitted to `support@ritualdev.in` or `security@ritualdev.in` are automatically triaged by severity classification based on the operational impact to customer database integrity:
+
+| Severity Level | Definition & Operational Impact | Initial Response Guarantee | Target Resolution / Mitigation | Coverage Window |
+| :--- | :--- | :---: | :---: | :---: |
+| **P1 — Critical Outage / Data Protection Failure** | Complete database wire proxy outage; critical mutation firewall bypass; unauthorized production table lock or drop; zero-day SQL injection vulnerability. | **< 1 Hour** | **< 4 Hours** | **24/7/365** |
+| **P2 — High Severity / Partial Degradation** | Core guardrail impairment; wire proxy throughput degradation exceeding 5ms P99 latency; false-positive mutation blockages impacting developer workflows; SSO/OIDC authentication disruption. | **< 4 Hours** | **< 1 Business Day** | **24/7/365** |
+| **P3 — General Support & Architecture Advisory** | General questions; configuration tuning; new SQL AST rule definitions; query execution plan advice; virtual schema masking advisory. | **< 1 Business Day** | Next Sprint / Scheduled Release | Standard Business Hours (Mon–Fri, 9am–6pm IST/UTC) |
+
+---
+
+## 3. Availability & Uptime Commitments
+
+### 3.1 Availability Metric (99.95%)
+For customers utilizing managed or containerized DBShield wire proxy sidecars deployed per RitualDev High-Availability (HA) reference architecture, RitualDev Lab commits to an operational uptime of **99.95%** per calendar month.
+
+### 3.2 Service Credits
+If monthly proxy availability falls below the guaranteed threshold:
+- **99.0% – 99.95%**: 10% monthly service fee credit.
+- **95.0% – 99.0%**: 25% monthly service fee credit.
+- **< 95.0%**: 50% monthly service fee credit.
+
+---
+
+## 4. Security Incident Response & Zero-Day Patching
+
+1. **Security Vulnerability Intake**: Dedicated cryptographically monitored channel at `security@ritualdev.in`.
+2. **Triaging & Advisory SLA**:
+   - Critical vulnerabilities (CVSS $\ge 9.0$): Formal CVE advisory & hotfix container build dispatched within **24 hours**.
+   - High vulnerabilities (CVSS $7.0 - 8.9$): Patch released within **72 hours**.
+3. **Automated CycloneDX & SPDX SBOM**: Every release attaches automated cryptographic SBOMs detailing sub-dependencies with SHA-256 hashes for enterprise supply-chain compliance (NIST SP 800-218 and US Executive Order 14028).
+
+---
+
+## 5. Escalation & Contact Channels
+
+- **Enterprise Commercial & Support**: `support@ritualdev.in`
+- **Security Incident Response Team**: `security@ritualdev.in`
+- **Core Engineering & Technical Reviews**: `developer@ritualdev.in`
+- **Customer Portal**: [https://ritualdev.in/enterprise](https://ritualdev.in/enterprise)

README.md

@@ -5,6 +5,9 @@
 **The Safety-First Database Guardrail & Sandboxing MCP Server for AI Coding Agents**
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+[![npm version](https://img.shields.io/npm/v/@ritualdev-lab/dbshield.svg?color=cb3837&logo=npm)](https://www.npmjs.com/package/@ritualdev-lab/dbshield)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/RitualDev-Lab/DBShield/badge)](https://securityscorecards.dev/viewer/?repo=github.com/RitualDev-Lab/DBShield)
+[![SOC 2 Audit Ready](https://img.shields.io/badge/SOC%202%20Type%20II-Audit%20Ready-10b981?logo=shield&logoColor=white)](https://ritualdev.in/trust)
 [![Website](https://img.shields.io/badge/Website-ritualdev.in%2Fdbshield-00F59B.svg)](https://ritualdev.in/dbshield)
 [![IDE Extension](https://img.shields.io/badge/Open_VSX-Ritual_Agent_Defense-blue.svg)](https://open-vsx.org/extension/ritualdev-lab/ritual-agent-defense)
 [![MCP Protocol](https://img.shields.io/badge/MCP-Protocol%201.0-8A2BE2.svg)](https://modelcontextprotocol.io/)
@@ -297,5 +300,26 @@ helm install dbshield ./charts/dbshield \
 
 ---
 
+## 🏛️ Enterprise Compliance & SLA Guarantees
+
+DBShield provides deterministic, zero-data-custody database protection backed by enterprise contractual assurances:
+
+* **Formal Enterprise Service Level Agreement**: [ENTERPRISE_SLA.md](./ENTERPRISE_SLA.md)  
+  Guaranteed response times: **< 1 hour** for P1 critical outages (24/7/365 coverage), **< 4 hours** for P2 high severity, **99.95%** availability SLA.
+* **SOC 2 Type II & ISO/IEC 27001:2022 Readiness Matrix**: [SOC2_ISO27001_COMPLIANCE.md](./SOC2_ISO27001_COMPLIANCE.md)  
+  Comprehensive AICPA Trust Services Criteria (CC1–CC9, A1, C1, PI1, P1–P8) and ISO 27001 Annex A mapping for enterprise procurement audits.
+* **Autonomous AI Coding Agent Skill Definition**: [SKILL.md](./SKILL.md)  
+  Standardized instructions and tool-calling directives for Antigravity, Cursor, Windsurf, and Claude Code.
+* **GitHub Action CI/CD Migration Gate**: [action.yml](./action.yml)  
+  Pre-merge migration validation and unindexed cascade lock detection (`uses: RitualDev-Lab/DBShield@v0.2.0`).
+
+### Enterprise Contact & Incident Triage
+* **Security & SOC 2 Packages**: `security@ritualdev.in`
+* **Commercial & SLA Support**: `support@ritualdev.in`
+* **Technical Architecture Review**: `developer@ritualdev.in`
+* **Trust & Security Portal**: [https://ritualdev.in/trust](https://ritualdev.in/trust)
+
+---
+
 ## 📄 License
 MIT © [RitualDev Lab](https://github.com/RitualDev-Lab)