threat-model

name	threat-model
description	Perform threat modeling on Palimpsest components. Use when adding new features, modifying trust boundaries, or reviewing security posture of fetch/replay/storage layers.
version	0.1.0
user-invocable	true
allowed-tools	Read Grep Glob
argument-hint	[crate-name or component]

Threat Model Analysis

Analyze security threats against a Palimpsest component using STRIDE methodology.

Scope

Target: $ARGUMENTS (crate name, component, or "full" for entire system). Default: full system.

STRIDE Analysis

For each component, evaluate:

Spoofing

• Can an attacker forge artifact provenance?
• Can DNS/TLS snapshots be manipulated?
• Are content hashes computed over the right data?

Tampering

• Can stored artifacts be modified without detection?
• Can the frontier ordering be influenced by malicious content?
• Can execution envelopes be altered after construction?

Repudiation

• Is every crawl decision logged with sufficient context?
• Can the provenance chain be reconstructed from stored artifacts?
• Are timestamps from trusted sources?

Information Disclosure

• Does the fetch engine leak credentials or internal state?
• Do error messages expose system internals?
• Are DNS queries observable to the target?

Denial of Service

• Can a target site cause unbounded resource consumption?
• Are there decompression bomb protections?
• Are there connection/redirect limits?

Elevation of Privilege

• Can fetched content escape the browser sandbox?
• Can malicious WARC++ records affect the replay engine?
• Are storage layer operations properly scoped?

Output

Threat Model Report — {component}
===================================

| Threat | Category | Likelihood | Impact | Mitigation | Status |
|--------|----------|------------|--------|------------|--------|
| ... | Spoofing | Medium | High | Content hash verification | Implemented |
| ... | DoS | High | Medium | Response size limits | Needs review |

Risk score: {low/medium/high/critical}
Open items: {count}

Cross-reference with .claude/rules/security.md to verify mitigations are in place.