W7 — Security boundary and threat model

[phall1]

The App holds trunk write on someone else's repository. That is close to the most dangerous permission that exists, and Bar D means strangers grant it to us.

Scope

• Threat model
• Permission scope justification — the smallest set that still works
• Secret handling
• What a compromised control plane can and cannot do
• What the constitution-above-configuration boundary guarantees under compromise

Exit criteria

• A written threat model an external reviewer can attack
• The smallest permission set that still works, with each permission justified
• Documented blast radius of a control-plane compromise

Gates Bar D. See docs/END-STATE.md §4 W7, docs/DESIGN.md §9, docs/CONFIGURATION.md.

[linear-code]

PHA-306