Synthesizes trust boundaries, attack surfaces, and attacker profiles into a living threat model. Use as Stage B of the Knowledge Base generation process, reading architecture and entity definitions from the KB. Don't use for analyzing source code or extracting raw learnings from JSONL files.

Threat Modeler (/mantis threat model) System Goal Security Architect. Synthesizes trust boundaries, attack surfaces, and attacker profiles into THREAT MODEL.md based exclusively on the entities and architecture defined in the Knowledge Base (KB). Command Definition Command: /mantis threat model Description: Evaluates architectural perimeters, entry points, and trust boundaries to construct the threat model. Arguments (all optional; absent → today's behavior): state root <dir : parent of workspace/ . If absent, use ./workspace/... relative to the current directory. Locates .mantis state.json , the KB, and the archive directory. snapshot id <id : the SNAPSHOT ID this pass is pinned to. Used ONLY as the provenance value stamped into THREAT MODEL.md (the KB SNAPSHOT: line). If absent, fall back to active snapshot.snapshot id from state; if that is also absent or snapshot pinned is false, the stamp is the literal UNPINNED . snapshot root <dir : accepted for interface uniformity but NOT used — this stage never reads target source (Block A step 0, findings only role). Input/Output Contract Reads : workspace/.mantis state.json — pass number (to archive per pass) and, for provenance only, active snapshot ( {root, snapshot id, snapshot pinned} ). Both optional; absent → degraded (see Backward compat). workspace/kb/architecture.md . workspace/kb/entities/ .md . The EXISTING workspace/kb/THREAT MODEL.md from the previous pass, if present — only its first KB SNAPSHOT: line, for the freshness check in step 0. Writes : workspace/kb/THREAT MODEL.md (first line is a KB SNAPSHOT: provenance header). Archives the previous workspace/kb/THREAT MODEL.md (if any) to workspace/archive/kb/THREAT MODEL pass ${N}.md BEFORE overwriting. Preconditions : Knowledge Base files must exist and be populated. Idempotency Guarantee : Copies the prior THREAT MODEL.md (if any) to the pass archive, then deterministically overwrites workspace/kb/THREAT MODEL.md in place. Re running a pass with an unchanged snapshot reproduces an equivalent model plus a STALE banner (see step 0 and the final save step). Instructions Role for this stage (findings only / KB only). /mantis threat model NEVER reads target source. Every input it uses — architecture.md , entities/ .md , the prior THREAT MODEL.md , and .mantis state.json — is STATE RELATIVE (read under state root/workspace , NEVER under CODE ROOT ). This stage therefore takes Block A step 0's FINDINGS ONLY path: SKIP Block A steps 2–6, but STILL read active snapshot from state for provenance, and NEVER stop merely because a code root is unset or unpinned. Maintain a high level Threat Model that explicitly defines who the attackers are and where they can interact with the system, relying on the pre processed entities in the KB. Execute the threat modeling process as follows: 0. Resolve Snapshot Provenance, Freshness, and Archive the Prior Model: a. Compute CUR (the snapshot this threat model is stamped against): If snapshot id was passed → CUR = that value. Else if state active snapshot.snapshot pinned is true → CUR = active snapshot.snapshot id . Else → CUR = the literal UNPINNED (degraded / today's behavior). b. Compute PREV TM (what the last model was stamped against): read the FIRST line matching ^KB SNAPSHOT: in the existing workspace/kb/THREAT MODEL.md ; its value (trimmed) is PREV TM . If the file is absent, has no such line, or the value is empty → PREV TM = the empty string "" . c. SYNC DELTA DECISION (mechanical; exact string equality, no fuzzy compare): CUR == "UNPINNED" → SYNC OCCURRED = true (degraded: always re derive). else PREV TM == "" → SYNC OCCURRED = true (first run / legacy KB). else PREV TM != CUR → SYNC OCCURRED = true (a sync or dirty edit advanced the snapshot). else ( PREV TM == CUR ) → SYNC OCCURRED = false (snapshot unchanged since the last model). d. Archive the prior model (per pass), so overwrite is non destructive: Resolve N : read "pass number" from workspace/.mantis state.json . If missing or invalid, scan workspace/archive/ for folders matching findings pass N or loopN findings and set N = max found + 1 , defaulting to 1 if no archives exist. (Same rule the architecture stage uses.) If workspace/kb/THREAT MODEL.md exists: ensure workspace/archive/kb/ exists ( mkdir p workspace/archive/kb/ ) and COPY (do NOT move) the file to workspace/archive/kb/THREAT MODEL pass ${N}.md . You will overwrite the live file in step 3. If the file does not exist, skip the copy. All paths in this step are STATE RELATIVE (under state root/workspace ); NEVER prefix CODE ROOT . Carry CUR , SYNC OCCURRED , and N forward into steps 1–3 and the final save. 1. Read the Synthesized KB: Read workspace/kb/architecture.md to understand the system's data flows and high level design. Read the files inside workspace/kb/entities/ to understand the individual components and any historical constraints or vulnerability patterns mapped to them by the /mantis architecture stage. 2. Analyze Trust Boundaries: Evaluate the entities to determine where trust boundaries lie. Where does untrusted data cross into a trusted context? Which components are exposed to external input? 3. Synthesize the Threat Model: Write a comprehensive, structured Markdown file and save it directly to workspace/kb/THREAT MODEL.md (overwriting the old one). Token Optimization: Use your file writing tools to write the file directly to disk; do not output the threat model text in your chat response. Include the following sections to ensure downstream planning agents have sufficient context: System Overview Summary: A concise summary derived from architecture.md . Deployment Intent: State exactly one of Intent: PRODUCTION or Intent: SAMPLE OR TEST ONLY . This verdict has a large blast radius: /mantis critic marks EVERY finding SAMPLE OR TEST (dismissing the whole pass) the instant it reads Intent: SAMPLE OR TEST ONLY . So SAMPLE OR TEST ONLY is FAIL CLOSED behind a mechanical checklist: PRODUCTION SIGNAL CHECKLIST — you may write Intent: SAMPLE OR TEST ONLY ONLY IF ALL five checks are TRUE. If ANY is FALSE, or the KB is silent on / you are unsure about any one of them, you MUST write Intent: PRODUCTION . 1. NO entity in workspace/kb/entities/ .md is classified CRITICAL or STANDARD availability (either implies an operated/production service). 2. architecture.md names NO externally reachable service, daemon, server, API, or network endpoint, AND NO deployment/packaging descriptor (systemd, Dockerfile/ docker , kubernetes/ k8s /helm, load balancer, cloud/VPC/IaC, CI/CD publish or release). 3. The KB describes NO installable/publishable package or runtime entrypoint (e.g., console scripts / entry points , a main() /service binary, a published library or package manifest). 4. EVERY component/path referenced in the KB lies exclusively under test/sample directories — its path contains one of test , tests , example , examples , sample , samples , tutorial , demo , docs , fixtures — and NONE lie under production source roots such as src , lib , pkg , internal , cmd , app , server , or core . 5. NO entity documents a real (non mock, non test) untrusted external input crossing a trust boundary into privileged/production logic. After a sync ( SYNC OCCURRED == true from step 0) you MUST re run this checklist from scratch against the CURRENT KB and MUST NOT inherit a prior Intent: verdict — a sync can add production code to a tree that was previously sample only, which would otherwise silently dismiss every new finding. Trust Boundaries: Clear, rigorous definitions of where untrusted inputs meet internal trusted states. Reference the specific entities (e.g., [Auth Module](entities/auth module.md) ). Threat Actors & Vectors: Define the profiles of potential attackers (e.g., Unauthenticated Network Attacker, Malicious Local User) and the specific boundaries they can reach. High Risk Assets: The data, execution privileges, or availability targets an attacker wants to compromise. For availability targets, classify them into one of these Availability Tiers based on the KB: CRITICAL : 24/7 immediate operational impact if disrupted. STANDARD : Important operations; short downtime is tolerable. LOW CRITICALITY : Non blocking utilities; disruption is a mild annoyance. Stamp and save the model: The FIRST line of workspace/kb/THREAT MODEL.md MUST be the provenance stamp KB SNAPSHOT: followed by CUR (from step 0) — e.g. KB SNAPSHOT: <CUR , or KB SNAPSHOT: UNPINNED in degraded mode. The next pass reads this back as PREV TM , and mantis critic reads it as a KB freshness check. If SYNC OCCURRED == false (snapshot unchanged since the last model): you MAY reuse the prior model's substance, but you MUST insert this STALE banner as the line immediately AFTER the KB SNAPSHOT: line: STALE: Threat model NOT re evaluated this pass; carried unchanged from snapshot <CUR . If SYNC OCCURRED == true : do NOT emit the STALE banner — you re derived every section fresh this pass, including the Deployment Intent checklist. Save directly to workspace/kb/THREAT MODEL.md (STATE RELATIVE; the prior file was already copied to the pass archive in step 0d). Use your file writing tools; do not print the model to chat. When complete, notify the user.

mantis-threat-model