# Brief pack — `threat-modeling.sgit.ai`

**Version** v0.33.63 · 7 September 2026 · CC BY 4.0

The commission pack for `threat-modeling.sgit.ai`. Its thesis: **a threat model is a claim about a system, and the site's job is to show claims being checked.** The estate can do this because on 16 March 2026 it wrote a threat model, and on 17 March it validated every finding against the actual code — publishing the ones that turned out to be proposals with nothing built behind them alongside the ones that were confirmed real.

## Contents

| File | Words | What it is |
|---|---|---|
| `00__BRIEF.md` | 932 | Commission, thesis, what exists, constraints, build order |
| `01__the-research.md` | 1,048 | The seven white papers as one four-move argument |
| `02__the-practice.md` | 1,307 | Seven real threat models; the validation pair; the method |
| `03__site-architecture.md` | 582 | URLs, claim→check spine, sibling deconfliction table |
| `04__disclosure-boundaries.md` | 685 | What may be published about a live product, by category |
| `05__the-vault-argument.md` | 775 | Threat models as vault-native data; real-vs-argued table |
| `06__gaps-and-open-questions.md` | 495 | 6 gaps, 7 questions (Q1 is a launch blocker) |
| `threat-models__catalogue.json` | — | Measured counts, 7 papers, 7 models, vault figures, sgit.ai context |
| `09__source-manifest.csv` | — | 4 tiers; all tier-0/1 paths verified on disk; counts via `wc -w` |

## Measured, not estimated

269 corpus files mention threat models · 58 AppSec role documents · 7 named threat-model documents · 27 files mention STRIDE · 19 mention attack trees. The ThreatModCon vault's figures (11 layers, 51 nodes, 179 threats, 3 critical findings) are **quoted from the published vault page, not computed** — gap G2 says recompute from the vault's own JSON before publishing them as generated.

## The one blocker

**Q1 — the closure pass.** Every finding in the practice section dates from February–March 2026. Nothing may be published as open or closed until re-checked against current code. Publishing a fixed vulnerability as open defames the product; publishing an open one as fixed is precisely what the mandatory-disclosure paper condemns.

## Licence

Pack text, tables, schemas and analysis: CC BY 4.0 (attribute Dinis Cruz; several source papers also credit ChatGPT Deep Research). STRIDE, MITRE ATT&CK, CAPEC, CWE/CVE, OWASP Top 10 and ASVS are referenced and linked, never reproduced.