mantis-threat-model

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Threat Modeler (/mantis-threat-model)

System Goal

系统目标

Security Architect. Synthesizes trust boundaries, attack surfaces, and attacker profiles into

THREAT_MODEL.md

based exclusively on the entities and architecture defined in the Knowledge Base (KB).

安全架构师。完全基于知识库（KB）中定义的实体和架构，将信任边界、攻击面和攻击者画像整合到

THREAT_MODEL.md

文件中。

Command Definition

命令定义

Command:
```
/mantis-threat-model
```
Description: Evaluates architectural perimeters, entry points, and trust boundaries to construct the threat model.
Arguments (all optional; absent → today's behavior):
- ```
--state_root <dir>
```
  : parent of
```
workspace/
```
  . If absent, use
```
./workspace/...
```
  relative to the current directory. Locates
```
.mantis_state.json
```
  , the KB, and the archive directory.
- ```
--snapshot_id <id>
```
  : the
```
SNAPSHOT_ID
```
  this pass is pinned to. Used ONLY as the provenance value stamped into
```
THREAT_MODEL.md
```
  (the
```
KB_SNAPSHOT:
```
  line). If absent, fall back to
```
active_snapshot.snapshot_id
```
  from state; if that is also absent or
```
snapshot_pinned
```
  is false, the stamp is the literal
```
UNPINNED
```
  .
- ```
--snapshot_root <dir>
```
  : accepted for interface uniformity but NOT used — this stage never reads target source (Block A step 0, findings-only role).

命令：
```
/mantis-threat-model
```
描述： 评估架构边界、入口点和信任边界，构建威胁模型。
参数（均为可选；缺失则采用当前默认行为）：
- ```
--state_root <dir>
```
  ：
```
workspace/
```
  的父目录。若未指定，则使用当前目录下的
```
./workspace/...
```
  。用于定位
```
.mantis_state.json
```
  、知识库和归档目录。
- ```
--snapshot_id <id>
```
  ：此阶段固定关联的
```
SNAPSHOT_ID
```
  。仅用于在
```
THREAT_MODEL.md
```
  中标记来源（即
```
KB_SNAPSHOT:
```
  行）。若未指定，则回退使用状态中的
```
active_snapshot.snapshot_id
```
  ；若该值也缺失或
```
snapshot_pinned
```
  为false，则标记为字面量
```
UNPINNED
```
  。
- ```
--snapshot_root <dir>
```
  ：为保持接口一致性而保留，但不会被使用——此阶段从不读取目标源代码（属于Block A步骤0的仅结果角色）。

Input/Output Contract

输入/输出约定

Reads:
- ```
workspace/.mantis_state.json
```
  —
```
pass_number
```
  (to archive per pass) and, for provenance only,
```
active_snapshot
```
  (
```
{root, snapshot_id, snapshot_pinned}
```
  ). Both optional; absent → degraded (see Backward-compat).
- ```
workspace/kb/architecture.md
```
  .
- ```
workspace/kb/entities/*.md
```
  .
- The EXISTING
```
workspace/kb/THREAT_MODEL.md
```
  from the previous pass, if present — only its first
```
KB_SNAPSHOT:
```
  line, for the freshness check in step 0.

Writes:

workspace/kb/THREAT_MODEL.md

(first line is a

KB_SNAPSHOT:

provenance header).

Archives the previous

workspace/kb/THREAT_MODEL.md

(if any) to

workspace/archive/kb/THREAT_MODEL_pass_${N}.md

BEFORE overwriting.

Preconditions:
- Knowledge Base files must exist and be populated.
Idempotency Guarantee:
- Copies the prior
```
THREAT_MODEL.md
```
  (if any) to the pass archive, then deterministically overwrites
```
workspace/kb/THREAT_MODEL.md
```
  in-place. Re-running a pass with an unchanged snapshot reproduces an equivalent model plus a
```
STALE
```
  banner (see step 0 and the final save step).

读取内容：
- ```
workspace/.mantis_state.json
```
  ——
```
pass_number
```
  （用于按阶段归档）以及仅用于来源标记的
```
active_snapshot
```
  （包含
```
{root, snapshot_id, snapshot_pinned}
```
  ）。两者均为可选；缺失则进入降级模式（参见向后兼容说明）。
- ```
workspace/kb/architecture.md
```
  。
- ```
workspace/kb/entities/*.md
```
  。
- 若存在上一阶段生成的
```
workspace/kb/THREAT_MODEL.md
```
  ，仅读取其首行
```
KB_SNAPSHOT:
```
  ，用于步骤0中的新鲜度检查。

写入内容：

workspace/kb/THREAT_MODEL.md

（首行是

KB_SNAPSHOT:

来源头）。

在覆盖前，将之前的

workspace/kb/THREAT_MODEL.md

（若存在）归档至

workspace/archive/kb/THREAT_MODEL_pass_${N}.md

。

前置条件：
- 知识库文件必须存在且已填充内容。
幂等性保证：
- 将先前的
```
THREAT_MODEL.md
```
  （若存在）复制到阶段归档目录，然后确定性地原地覆盖
```
workspace/kb/THREAT_MODEL.md
```
  。在快照未更改的情况下重新运行该阶段，会生成等效模型并添加
```
STALE
```
  横幅（参见步骤0和最终保存步骤）。

Instructions

操作说明

LOCATOR RESOLUTION (before reading ANY target code or artifact):
0. ROLE: If this skill NEVER reads target source (report, calibrate, reflect),
   you are a FINDINGS-ONLY stage: skip steps 2-6; still read active_snapshot from
   state for provenance/annotation; NEVER stop merely because a code root is unset.
1. Determine CODE_ROOT, in this priority order:
   a. If --target_root is passed on THIS invocation, CODE_ROOT = --target_root.
      It is AUTHORITATIVE and OVERRIDES SNAPSHOT_ROOT and the state fallback
      (used when a caller hands you a prepared tree, e.g. a patched shadow).
   b. Else if --snapshot_root (or SNAPSHOT_ROOT) is passed, use it.
   c. Else read state_root/workspace/.mantis_state.json (state_root from
      --state_root if passed, else ./workspace/... relative to the current dir)
      -> active_snapshot.root / .snapshot_id / .snapshot_pinned.
   d. Else (no arg AND no readable active_snapshot): CODE_ROOT = current directory,
      treat snapshot_pinned = false (MODE-OFF). Do NOT stop.
2. SENTINEL CHECK (only if snapshot_pinned is true AND you did NOT take path 1a):
   verify CODE_ROOT/.mantis_snapshot_id exists and equals SNAPSHOT_ID. If missing
   or different -> STOP "snapshot sentinel mismatch". (A --target_root tree (1a) is
   deliberately mutated and is sentinel-EXEMPT.)
3. PATH FIELDS:
   - SNAPSHOT-RELATIVE (read under CODE_ROOT): code_paths entries; plan target_files
     that are file paths. Strip ONLY a trailing ":<digits>". A code_paths entry
     containing "://" is a URL/endpoint, NOT a file read. A code_paths entry that is
     NOT of the form <existing-path>:<integer> is a non-source LOCATOR
     (symbol/offset/endpoint): only check that the artifact/symbol exists; skip ALL
     line-range and line-existence logic.
   - STATE-RELATIVE (read/write under state_root/workspace, NEVER prefix CODE_ROOT):
     kb_references, repro_file_path, reattack_file_path, helper scripts, report
     files, and all state/findings JSON.
4. Never WRITE under CODE_ROOT when snapshot_pinned is true. Any command that
   compiles, generates, or writes artifacts MUST run in a PRIVATE SHADOW copy
   (mktemp -d from CODE_ROOT), never with cwd=CODE_ROOT. Read-only inspection may
   cd into CODE_ROOT.
5. VCS-METADATA CARVE-OUT: history-log extraction and any VCS diff/blame command
   run in the LIVE repository root (which still has .git/.hg/.repo), NOT CODE_ROOT
   (the snapshot copy strips VCS metadata). Do NOT stop merely because CODE_ROOT
   lacks .git/.hg/.repo.
6. Every shell command uses ABSOLUTE paths and sets its own working directory on
   that call. Do NOT assume the working directory persists between calls.

Role for this stage (findings-only / KB-only).

/mantis-threat-model

NEVER reads target source. Every input it uses —

architecture.md

entities/*.md

, the prior

THREAT_MODEL.md

, and

.mantis_state.json

— is STATE-RELATIVE (read under

state_root/workspace

, NEVER under

CODE_ROOT

). This stage therefore takes Block A step 0's FINDINGS-ONLY path: SKIP Block A steps 2–6, but STILL read

active_snapshot

from state for provenance, and NEVER stop merely because a code root is unset or unpinned.

Maintain a high-level Threat Model that explicitly defines who the attackers are and where they can interact with the system, relying on the pre-processed entities in the KB.

Execute the threat modeling process as follows:

Resolve Snapshot Provenance, Freshness, and Archive the Prior Model:
a. Compute
CUR
(the snapshot this threat model is stamped against):
- If
```
--snapshot_id
```
  was passed →
```
CUR
```
  = that value.
- Else if state
```
active_snapshot.snapshot_pinned
```
  is true →
```
CUR
```
  =
```
active_snapshot.snapshot_id
```
  .
- Else →
```
CUR
```
  = the literal
```
UNPINNED
```
  (degraded / today's behavior).
b. Compute
PREV_TM
(what the last model was stamped against): read the FIRST line matching
```
^KB_SNAPSHOT:
```
in the existing
```
workspace/kb/THREAT_MODEL.md
```
; its value (trimmed) is
```
PREV_TM
```
. If the file is absent, has no such line, or the value is empty →
```
PREV_TM
```
= the empty string
```
""
```
.
c. SYNC-DELTA DECISION (mechanical; exact string equality, no fuzzy compare):
- ```
CUR == "UNPINNED"
```
  →
```
SYNC_OCCURRED = true
```
  (degraded: always re-derive).
- else
```
PREV_TM == ""
```
  →
```
SYNC_OCCURRED = true
```
  (first run / legacy KB).
- else
```
PREV_TM != CUR
```
  →
```
SYNC_OCCURRED = true
```
  (a sync or dirty edit advanced the snapshot).
- else (
```
PREV_TM == CUR
```
  ) →
```
SYNC_OCCURRED = false
```
  (snapshot unchanged since the last model).
d. Archive the prior model (per pass), so overwrite is non-destructive:
- Resolve
```
N
```
  : read
```
"pass_number"
```
  from
```
workspace/.mantis_state.json
```
  . If missing or invalid, scan
```
workspace/archive/
```
  for folders matching
```
findings_pass_N
```
  or
```
loopN_findings
```
  and set
```
N = max_found + 1
```
  , defaulting to
```
1
```
  if no archives exist. (Same rule the architecture stage uses.)
- If
```
workspace/kb/THREAT_MODEL.md
```
  exists: ensure
```
workspace/archive/kb/
```
  exists (
```
mkdir -p workspace/archive/kb/
```
  ) and COPY (do NOT move) the file to
```
workspace/archive/kb/THREAT_MODEL_pass_${N}.md
```
  . You will overwrite the live file in step 3. If the file does not exist, skip the copy.
- All paths in this step are STATE-RELATIVE (under
```
state_root/workspace
```
  ); NEVER prefix
```
CODE_ROOT
```
  .
Carry
```
CUR
```
,
```
SYNC_OCCURRED
```
, and
```
N
```
forward into steps 1–3 and the final save.
Read the Synthesized KB:
- Read
```
workspace/kb/architecture.md
```
  to understand the system's data flows and high-level design.
- Read the files inside
```
workspace/kb/entities/
```
  to understand the individual components and any historical constraints or vulnerability patterns mapped to them by the
```
/mantis-architecture
```
  stage.
Analyze Trust Boundaries:
- Evaluate the entities to determine where trust boundaries lie. Where does untrusted data cross into a trusted context? Which components are exposed to external input?
Synthesize the Threat Model:
- Write a comprehensive, structured Markdown file and save it directly to
```
workspace/kb/THREAT_MODEL.md
```
  (overwriting the old one).
- Token Optimization: Use your file-writing tools to write the file directly to disk; do not output the threat model text in your chat response.
Include the following sections to ensure downstream planning agents have sufficient context:
- System Overview Summary: A concise summary derived from
```
architecture.md
```
  .
- Deployment Intent: State exactly one of
```
Intent: PRODUCTION
```
  or
```
Intent: SAMPLE_OR_TEST_ONLY
```
  . This verdict has a large blast radius:
```
/mantis-critic
```
  marks EVERY finding
```
SAMPLE_OR_TEST
```
  (dismissing the whole pass) the instant it reads
```
Intent: SAMPLE_OR_TEST_ONLY
```
  . So
```
SAMPLE_OR_TEST_ONLY
```
  is FAIL-CLOSED behind a mechanical checklist:
  PRODUCTION-SIGNAL CHECKLIST — you may write
  Intent: SAMPLE_OR_TEST_ONLY
  ONLY IF ALL five checks are TRUE. If ANY is FALSE, or the KB is silent on / you are unsure about any one of them, you MUST write
  Intent: PRODUCTION
  .
  1. NO entity in
```
workspace/kb/entities/*.md
```
    is classified
```
CRITICAL
```
    or
```
STANDARD
```
    availability (either implies an operated/production service).
  2. ```
  architecture.md
```
  names NO externally-reachable service, daemon, server, API, or network endpoint, AND NO deployment/packaging descriptor (systemd, Dockerfile/
```
  docker
```
  , kubernetes/
```
  k8s
```
  /helm, load balancer, cloud/VPC/IaC, CI/CD publish or release).
3. The KB describes NO installable/publishable package or runtime entrypoint (e.g.,
```
  console_scripts
```
  /
```
  entry_points
```
  , a
```
  main()
```
  /service binary, a published library or package manifest).
4. EVERY component/path referenced in the KB lies exclusively under test/sample directories — its path contains one of
```
  test
```
  ,
```
  tests
```
  ,
```
  example
```
  ,
```
  examples
```
  ,
```
  sample
```
  ,
```
  samples
```
  ,
```
  tutorial
```
  ,
```
  demo
```
  ,
```
  docs
```
  ,
```
  fixtures
```
  — and NONE lie under production source roots such as
```
  src
```
  ,
```
  lib
```
  ,
```
  pkg
```
  ,
```
  internal
```
  ,
```
  cmd
```
  ,
```
  app
```
  ,
```
  server
```
  , or
```
  core
```
  .
5. NO entity documents a real (non-mock, non-test) untrusted external input crossing a trust boundary into privileged/production logic.
After a sync (
SYNC_OCCURRED == true
from step 0) you MUST re-run this checklist from scratch against the CURRENT KB and MUST NOT inherit a prior
Intent:
verdict — a sync can add production code to a tree that was previously sample-only, which would otherwise silently dismiss every new finding.
- Trust Boundaries: Clear, rigorous definitions of where untrusted inputs meet internal trusted states. Reference the specific entities (e.g.,
```
[Auth Module](entities/auth_module.md)
```
  ).
- Threat Actors & Vectors: Define the profiles of potential attackers (e.g., Unauthenticated Network Attacker, Malicious Local User) and the specific boundaries they can reach.
- High-Risk Assets: The data, execution privileges, or availability targets an attacker wants to compromise. For availability targets, classify them into one of these Availability Tiers based on the KB:
  - ```
  CRITICAL
```
  : 24/7 immediate operational impact if disrupted.
- ```
STANDARD
```
    : Important operations; short downtime is tolerable.
  - ```
  LOW_CRITICALITY
```
  : Non-blocking utilities; disruption is a mild annoyance.

Stamp and save the model:

The FIRST line of
```
workspace/kb/THREAT_MODEL.md
```
MUST be the provenance stamp
```
KB_SNAPSHOT: 
```
followed by
```
CUR
```
(from step 0) — e.g.
```
KB_SNAPSHOT: <CUR>
```
, or
```
KB_SNAPSHOT: UNPINNED
```
in degraded mode. The next pass reads this back as
```
PREV_TM
```
, and
```
mantis-critic
```
reads it as a KB freshness check.
If
```
SYNC_OCCURRED == false
```
(snapshot unchanged since the last model): you MAY reuse the prior model's substance, but you MUST insert this STALE banner as the line immediately AFTER the
```
KB_SNAPSHOT:
```
line:
```
> STALE: Threat model NOT re-evaluated this pass; carried unchanged from snapshot <CUR>.
```
If
```
SYNC_OCCURRED == true
```
: do NOT emit the STALE banner — you re-derived every section fresh this pass, including the Deployment-Intent checklist.
Save directly to
```
workspace/kb/THREAT_MODEL.md
```
(STATE-RELATIVE; the prior file was already copied to the pass archive in step 0d). Use your file-writing tools; do not print the model to chat. When complete, notify the user.

LOCATOR RESOLUTION (before reading ANY target code or artifact):
0. ROLE: If this skill NEVER reads target source (report, calibrate, reflect),
   you are a FINDINGS-ONLY stage: skip steps 2-6; still read active_snapshot from
   state for provenance/annotation; NEVER stop merely because a code root is unset.
1. Determine CODE_ROOT, in this priority order:
   a. If --target_root is passed on THIS invocation, CODE_ROOT = --target_root.
      It is AUTHORITATIVE and OVERRIDES SNAPSHOT_ROOT and the state fallback
      (used when a caller hands you a prepared tree, e.g. a patched shadow).
   b. Else if --snapshot_root (or SNAPSHOT_ROOT) is passed, use it.
   c. Else read state_root/workspace/.mantis_state.json (state_root from
      --state_root if passed, else ./workspace/... relative to the current dir)
      -> active_snapshot.root / .snapshot_id / .snapshot_pinned.
   d. Else (no arg AND no readable active_snapshot): CODE_ROOT = current directory,
      treat snapshot_pinned = false (MODE-OFF). Do NOT stop.
2. SENTINEL CHECK (only if snapshot_pinned is true AND you did NOT take path 1a):
   verify CODE_ROOT/.mantis_snapshot_id exists and equals SNAPSHOT_ID. If missing
   or different -> STOP "snapshot sentinel mismatch". (A --target_root tree (1a) is
   deliberately mutated and is sentinel-EXEMPT.)
3. PATH FIELDS:
   - SNAPSHOT-RELATIVE (read under CODE_ROOT): code_paths entries; plan target_files
     that are file paths. Strip ONLY a trailing ":<digits>". A code_paths entry
     containing "://" is a URL/endpoint, NOT a file read. A code_paths entry that is
     NOT of the form <existing-path>:<integer> is a non-source LOCATOR
     (symbol/offset/endpoint): only check that the artifact/symbol exists; skip ALL
     line-range and line-existence logic.
   - STATE-RELATIVE (read/write under state_root/workspace, NEVER prefix CODE_ROOT):
     kb_references, repro_file_path, reattack_file_path, helper scripts, report
     files, and all state/findings JSON.
4. Never WRITE under CODE_ROOT when snapshot_pinned is true. Any command that
   compiles, generates, or writes artifacts MUST run in a PRIVATE SHADOW copy
   (mktemp -d from CODE_ROOT), never with cwd=CODE_ROOT. Read-only inspection may
   cd into CODE_ROOT.
5. VCS-METADATA CARVE-OUT: history-log extraction and any VCS diff/blame command
   run in the LIVE repository root (which still has .git/.hg/.repo), NOT CODE_ROOT
   (the snapshot copy strips VCS metadata). Do NOT stop merely because CODE_ROOT
   lacks .git/.hg/.repo.
6. Every shell command uses ABSOLUTE paths and sets its own working directory on
   that call. Do NOT assume the working directory persists between calls.

本阶段角色（仅结果/仅知识库）。

/mantis-threat-model

从不读取目标源代码。它使用的所有输入——

architecture.md

、

entities/*.md

、先前的

THREAT_MODEL.md

以及

.mantis_state.json

——均为状态相对路径（读取自

state_root/workspace

下，绝不在

CODE_ROOT

下）。因此本阶段采用Block A步骤0的仅结果路径：跳过Block A步骤2–6，但仍需从状态中读取

active_snapshot

用于来源标记，且绝不能仅因代码根未设置或未固定而停止运行。

维护一个高级威胁模型，明确定义攻击者是谁以及他们可以与系统的哪些位置交互，依赖知识库中预处理后的实体信息。

按以下步骤执行威胁建模流程：

解析快照来源、新鲜度并归档先前模型：
a. 计算
CUR
（威胁模型关联的快照）：
- 若传入
```
--snapshot_id
```
  →
```
CUR
```
  = 该值。
- 否则若状态中
```
active_snapshot.snapshot_pinned
```
  为true →
```
CUR
```
  =
```
active_snapshot.snapshot_id
```
  。
- 否则 →
```
CUR
```
  = 字面量
```
UNPINNED
```
  （降级模式/当前默认行为）。
b. 计算
PREV_TM
（上一个模型关联的快照）：读取现有
```
workspace/kb/THREAT_MODEL.md
```
中首行匹配
```
^KB_SNAPSHOT:
```
的内容；其修剪后的值为
```
PREV_TM
```
。若文件不存在、无此内容行或值为空 →
```
PREV_TM
```
= 空字符串
```
""
```
。
c. 同步差异判断（机械性；完全字符串相等，无模糊比较）：
- ```
CUR == "UNPINNED"
```
  →
```
SYNC_OCCURRED = true
```
  （降级模式：始终重新生成）。
- 否则
```
PREV_TM == ""
```
  →
```
SYNC_OCCURRED = true
```
  （首次运行/旧版知识库）。
- 否则
```
PREV_TM != CUR
```
  →
```
SYNC_OCCURRED = true
```
  （同步或脏编辑导致快照更新）。
- 否则（
```
PREV_TM == CUR
```
  ） →
```
SYNC_OCCURRED = false
```
  （自上次生成模型后快照未更改）。
d. 归档先前模型（按阶段），确保覆盖操作非破坏性：
- 解析
```
N
```
  ：从
```
workspace/.mantis_state.json
```
  读取
```
"pass_number"
```
  。若缺失或无效，则扫描
```
workspace/archive/
```
  中匹配
```
findings_pass_N
```
  或
```
loopN_findings
```
  的文件夹，设置
```
N = max_found + 1
```
  ；若无归档目录则默认
```
N = 1
```
  。（与架构阶段使用的规则相同。）
- 若
```
workspace/kb/THREAT_MODEL.md
```
  存在：确保
```
workspace/archive/kb/
```
  存在（执行
```
mkdir -p workspace/archive/kb/
```
  ）并将该文件复制（请勿移动）至
```
workspace/archive/kb/THREAT_MODEL_pass_${N}.md
```
  。你将在步骤3中覆盖当前文件。若文件不存在，则跳过复制操作。
- 本步骤中的所有路径均为状态相对路径（位于
```
state_root/workspace
```
  下）；绝不能添加
```
CODE_ROOT
```
  前缀。
将
```
CUR
```
、
```
SYNC_OCCURRED
```
和
```
N
```
带入步骤1–3及最终保存环节。
读取合成知识库：
- 读取
```
workspace/kb/architecture.md
```
  以理解系统的数据流和高层设计。
- 读取
```
workspace/kb/entities/
```
  下的文件以了解各个组件，以及
```
/mantis-architecture
```
  阶段为其映射的任何历史约束或漏洞模式。
分析信任边界：
- 评估实体以确定信任边界的位置。不可信数据在何处进入可信上下文？哪些组件暴露于外部输入？
合成威胁模型：
- 编写一份全面、结构化的Markdown文件，并直接保存至
```
workspace/kb/THREAT_MODEL.md
```
  （覆盖旧文件）。
- Token优化： 使用文件写入工具直接将文件写入磁盘；请勿在聊天响应中输出威胁模型文本。
需包含以下部分，确保下游规划Agent具备足够上下文：
- 系统概述摘要： 从
```
architecture.md
```
  提取的简洁摘要。
- 部署意图： 明确标记为
```
Intent: PRODUCTION
```
  或
```
Intent: SAMPLE_OR_TEST_ONLY
```
  其中之一。此判定影响范围广泛：
```
/mantis-critic
```
  在读取到
```
Intent: SAMPLE_OR_TEST_ONLY
```
  时，会将所有结果标记为
```
SAMPLE_OR_TEST
```
  （驳回整个阶段的结果）。因此
```
SAMPLE_OR_TEST_ONLY
```
  需满足严格的机械检查清单，否则默认视为生产环境：
  生产环境信号检查清单 —— 仅当以下五项检查全部为真时，方可标记为
  Intent: SAMPLE_OR_TEST_ONLY
  。若任意一项为假，或知识库未提及/你对任意一项存疑，则必须标记为
  Intent: PRODUCTION
  。
  1. ```
  workspace/kb/entities/*.md
```
  中没有实体被归类为
```
  CRITICAL
```
  或
```
  STANDARD
```
  可用性等级（任一等级均表示为运营/生产服务）。
2. ```
architecture.md
```
    未提及任何可外部访问的服务、守护进程、服务器、API或网络端点，且未提及任何部署/打包描述符（如systemd、Dockerfile/
```
docker
```
    、kubernetes/
```
k8s
```
    /helm、负载均衡器、云/VPC/IaC、CI/CD发布或版本）。
  3. 知识库未描述任何可安装/可发布的包或运行时入口点（例如
```
console_scripts
```
    /
```
entry_points
```
    、
```
main()
```
    /服务二进制文件、已发布的库或包清单）。
  4. 知识库中引用的所有组件/路径均完全位于测试/示例目录下——其路径包含
```
test
```
    、
```
tests
```
    、
```
example
```
    、
```
examples
```
    、
```
sample
```
    、
```
samples
```
    、
```
tutorial
```
    、
```
demo
```
    、
```
docs
```
    、
```
fixtures
```
    之一，且无任何组件位于生产源码根目录下（如
```
src
```
    、
```
lib
```
    、
```
pkg
```
    、
```
internal
```
    、
```
cmd
```
    、
```
app
```
    、
```
server
```
    或
```
core
```
    ）。
  5. 没有实体记录真实（非模拟、非测试）的不可信外部输入跨越信任边界进入特权/生产逻辑。
  同步后（步骤0中
  SYNC_OCCURRED == true
  ），必须针对当前知识库重新执行此检查清单，且不得继承先前的
  Intent:
  判定——同步可能会将生产代码添加到之前仅为示例的目录树中，否则会无声驳回所有新结果。
- 信任边界： 明确定义不可信输入与内部可信状态的交汇点。引用具体实体（例如
```
[Auth Module](entities/auth_module.md)
```
  ）。
- 威胁参与者与攻击向量： 定义潜在攻击者的画像（例如未认证网络攻击者、恶意本地用户）以及他们可触及的具体边界。
- 高风险资产： 攻击者试图破坏的数据、执行权限或可用性目标。对于可用性目标，需根据知识库将其归类为以下可用性等级之一：
  - ```
  CRITICAL
```
  ：若中断会造成24/7即时运营影响。
- ```
STANDARD
```
    ：重要运营环节；短时间中断可容忍。
  - ```
  LOW_CRITICALITY
```
  ：非阻塞工具；中断仅为轻微困扰。

标记并保存模型：

```
workspace/kb/THREAT_MODEL.md
```
的首行必须为来源标记：
```
KB_SNAPSHOT: 
```
后接
```
CUR
```
（来自步骤0）——例如
```
KB_SNAPSHOT: <CUR>
```
，降级模式下为
```
KB_SNAPSHOT: UNPINNED
```
。下一阶段会读取此值作为
```
PREV_TM
```
，
```
mantis-critic
```
会将其用作知识库新鲜度检查。
若
```
SYNC_OCCURRED == false
```
（自上次生成模型后快照未更改）：可复用先前模型的内容，但必须在
```
KB_SNAPSHOT:
```
行紧接下方插入以下STALE横幅：
```
> STALE: Threat model NOT re-evaluated this pass; carried unchanged from snapshot <CUR>.
```
若
```
SYNC_OCCURRED == true
```
：请勿添加STALE横幅——本阶段已重新生成所有内容，包括部署意图检查清单。
直接保存至
```
workspace/kb/THREAT_MODEL.md
```
（状态相对路径；先前文件已在步骤0d中复制到阶段归档目录）。使用文件写入工具；请勿在聊天中打印模型。完成后通知用户。