security-architecture

# security-architecture Optional, lightweight threat-modeling pass over a design before it is built. Routed to only when the user deliberately invokes `/threat-model <scope>` for a sensitive feature — never forced on an ordinary change. Reviews architectural intent before code exists; for code already written, dispatch `security-reviewer` instead. ## Pre-flight - Read `<project-root>/.codearbiter/security-controls.md` — approved primitives, declared security boundaries and their permitted crossings, what is and is not allowed. If it cannot be read, STOP and surface the gap; do not guess the boundary model. - Establish the scope from the user's `/threat-model` argument: the feature, component, or design under review. ## Phase 1 — Attack surface · gate: BLOCK Map what the change exposes. Name, for the scope: - New or changed entry points — routes, endpoints, message consumers, CLI surfaces. - New egress — outbound calls, external dependencies, new data sinks. - Security boundaries crossed, as declared in `security-controls.md` (trust transitions, privilege changes, data leaving a controlled zone). - The data handled and its sensitivity. A boundary crossing not described in `security-controls.md` is a finding, not a silent pass. A finding outside this scope gets one line with an inline `[NEEDS-TRIAGE]` marker. Gate: the attack surface and every boundary crossing in scope are enumerated. ## Phase 2 — STRIDE pass · gate: STOP Walk the surface from Phase 1 through STRIDE....