threat-modellisted

# Threat Model Framework definitions (STRIDE matrix, STRIDE-to-CAPEC bridge, DREAD-lite scoring, .NET CAPEC patterns, mitigation-discovery greps) live in [references/stride-capec-reference.md](references/stride-capec-reference.md). This file is the workflow and the repo-specific conventions. ## Usage ```bash /threat-model web # Full threat model for a domain/project /threat-model web --scope endpoints # Scope to a subsystem /threat-model --refresh # Re-run against updated lode/ docs /threat-model --register-only # Skip DFD, use existing diagram ``` ## Arguments | Argument | Required | Description | | ------------------ | -------- | ------------------------------------------------------------------- | | `domain` | Yes | Target domain -- a `src/` project (e.g., `web`, `cli`, `core`, `analyzers`) or a `lode/` subdirectory | | `--scope` | No | Narrow to a subsystem within the domain (e.g., `endpoints`, `auth`, `parsing`) | | `--refresh` | No | Force re-read of lode/ sources even if cached in session | | `--register-only` | No | Skip DFD generation, jump to STRIDE analysis using prior DFD | | `--min-score` | No | Filter final register to findings at or above this DREAD-lite score (1-27) | ## Design decisions - Skill reads lode/ and code, not agents -- domain context is already documen