Publish CSPTF v0.1.0 draft

[sr-maximus]

Summary

Publishes the foundational CSPTF v0.1.0-draft: an open framework for
authorized security assessment and penetration testing across
cryptocurrency, blockchain, Web3, DeFi, CeFi and digital-asset
ecosystems.

Included

• 20 assessment domains
• 160 controls
• 240 authorized test cases
• 100 threats
• 100 weaknesses
• Spanish technical paper and consolidated specification in PDF/DOCX
• JSON/CSV catalogs, schemas, templates and examples
• Python validation tools
• MkDocs documentation
• GitHub Actions validation
• Release notes, validation report and checksums

Attribution

Created and maintained by Edwin Javier Peñuela Camacho (sr-maximus).
Licensed under Apache License 2.0.

Validation

$ python3 tools/validate_catalogs.py
CSPTF validation PASSED
Counts: domains=20, controls=160, tests=240, threats=100, weaknesses=100
Unique IDs: 620

$ python3 -m unittest discover -s tests
...
----------------------------------------------------------------------
Ran 3 tests in 0.014s

OK

$ python3 tools/generate_checklist.py --profile AP2 --output build/checklist-ap2.csv
Wrote 140 tests to build/checklist-ap2.csv

$ shasum -a 256 -c publication/SHA256SUMS.txt
All listed files verified OK.

$ python3 -m pytest
Skipped: pytest was not available locally; no optional dependency was installed solely for this run.

Additional local checks:

$ find . -type f -size +99M -print
(no output)

$ find . -type l -print
(no output)

Secret scan fallback:
- gitleaks was not installed.
- Strict rg patterns for private keys, shaped API tokens, GitHub tokens, AWS keys, and credential assignments returned no matches.

Status and limitations

This is a foundational public draft, not a certification. Risk weights,
severity thresholds and mappings require independent review and empirical
calibration. References to external standards do not imply endorsement,
certification or affiliation.