Repository navigation
[Security] Publish the formal threat model and data classification #14
Description
Outcome
Turn security principles into owned threats, controls, residual risks, and verification work.
Scope
- Document assets, actors, trust boundaries, credential flows, data classes, abuse cases, tenancy assumptions, and unsupported deployment modes.
Acceptance criteria
- Every high-risk threat has a mitigation or linked follow-up.
- Credential, audit, personal, configuration, and operational data classes have handling rules.
- Provider credential blast radius and workspace isolation assumptions are explicit.
Test and evidence
- Merged implementation: PR #71
- Exact reviewed head:
f6cf58aade48ede569e49fecf6c93988223ee2a9 - Exact default-branch merge:
46cd97e130f39d67f73945591addd3a9fa30aae2 - Formal threat model
- Data-class handling contract
- Threat ledger
- Fail-closed verifier and 139 negative fixtures
- Local full contract:
./hack/dev checkpassed. - Exact post-merge
maincontract: Foundation bootstrap run 33562069207 passed. - Exact-head reviews completed with zero unresolved threads: code review and security-focused review.
Dependencies
- #11 is closed.
Activity
Merge pull request #71 from ArdurAI/gnanirahulnutakki/issue-14-threat…
gnanirahulnutakki commentedon Sep 1, 2026
Completion evidence verified on 2026-09-01:
46cd97e130f39d67f73945591addd3a9fa30aae2.108f8e846710f19e156797346fe4a16db6331c34and reviewed headf6cf58aade48ede569e49fecf6c93988223ee2a9.9618eb7be816719880de09c7bb883661e70138b2.mainrun 33562069207 passed.All acceptance criteria are checked above; closing as completed.