docs: port THREAT_MODEL.md to master - #86
Conversation
The 198-line threat-model document was written on branch docs/threat-model-phase-d (Apr 16-17, 2026) during the pre-audit hardening sprint. That branch diverges from master with orphan history and cannot be merged cleanly — this commit ports just the doc artifact to current master. Content includes: - Phase D deferred-findings resolution status (F-6, SP-2 fixed; C-7, C-12 accepted risk with monitoring plan; SP-5 governance policy) - Experimental/not-audited disclaimers - Spec v12.17.0 threat model overview Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 42 minutes and 43 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The v12.17 upstream sync (session 2026-04-15 v2) was done on laptop but never pushed to origin. Meanwhile PR #85 (Kani resurrect) and PR #86 (threat model port) were merged against the stale v12.1.0 main, creating a mismatch with percolator-prog and SDK beta.34 which both expect v12.17. This merge restores consistency: - Core engine now at v12.17.0 (ADL_ONE=1e15, MIN_A_SIDE=1e14, f_snap, two-bucket warmup, no entry_price/account_id) - 457 proofs in tests/proofs_*.rs (replaces 349 v12.1-adapted proofs in tests/kani.rs that had 18 spec-behavior FAILs) - THREAT_MODEL.md preserved (identical file) - LIQ_BUDGET_PER_CRANK = 24 (today's fix to fit 1.4M CU budget) The prior main state (v12.1.0 + PR #85 + PR #86) is preserved on branch 'archive/v12.1-pre-sync' for reference. Using git merge -s ours to keep laptop's tree verbatim; main's tree content is intentionally dropped. See decision_freeze_engine_at_v12_15.md in session memory for the reasoning behind the v12.17 decision.
1 participant
Summary
Ports the 198-line THREAT_MODEL.md from the stale `docs/threat-model-phase-d` branch to current master.
Why a fresh port instead of a merge
`docs/threat-model-phase-d` branches off from a pre-rebase version of `main` and has orphan history vs current `master`. Merging the branch would conflict with 200+ commits of v12.17 work that landed on master via different PRs. The only unique artifact worth preserving is this document, so it is ported directly.
Contents
Risk
Docs-only — no code change. Safe to fast-forward.
🤖 Generated with Claude Code