# Threat Model — killinchu Flagship
**Doctrine v11 LOCKED 749/14/163 | STRIDE/DREAD | Generated: 2026-06-03**  
**Review cadence:** Quarterly  
**Next review:** 2026-09-01

## Scope

The killinchu HuggingFace Space and its GitHub-hosted source code under `szl-holdings/killinchu`.

## Assets

| Asset | Sensitivity |
|-------|-------------|
| Doctrine parameters (749/14/163/c7c0ba17) | Critical |
| DSSE receipt signing keys | High |
| API endpoint contract | High |
| HF_TOKEN / GitHub PAT | Critical |
| User query inputs | Medium |

## Threat Categories (STRIDE)

### Spoofing
- **T-01**: Attacker impersonates doctrine endpoint → Return falsified doctrine version
  - *Mitigation*: DSSE-signed receipts on responses; Doctrine v11 hardcoded in source
  - *DREAD*: Damage=8, Reproducibility=5, Exploitability=4, Affected=7, Discoverability=6 → **DREAD=6.0**

### Tampering
- **T-02**: Commit that modifies DOCTRINE constant to a non-v11 value
  - *Mitigation*: Branch protection requires CI pass; doctrine-grep.yml blocks stale doctrine patterns
  - *DREAD*: D=9, R=4, E=3, A=9, D=5 → **DREAD=6.0**
- **T-03**: HF Space race condition overwrites correct serve.py
  - *Mitigation*: Lesson learned — use 5-min wait between same-Space pushes; git pull before commit
  - *DREAD*: D=7, R=6, E=6, A=8, D=4 → **DREAD=6.2**

### Repudiation
- **T-04**: Agent denies which commit introduced a doctrine violation
  - *Mitigation*: DCO trailers on every commit; GitHub audit log; Sigstore transparency log
  - *DREAD*: D=5, R=5, E=3, A=6, D=4 → **DREAD=4.6**

### Information Disclosure
- **T-05**: Secrets (HF_TOKEN, PAT) leaked in logs or responses
  - *Mitigation*: TruffleHog in HF repo; GitHub secret scanning enabled; tokens never logged
  - *DREAD*: D=9, R=3, E=4, A=8, D=3 → **DREAD=5.4**

### Denial of Service
- **T-06**: HF Space overwhelmed by requests → rate limit triggers cold restart
  - *Mitigation*: HF free-tier has built-in rate limiting; honest disclosure in SLO (cold start ≤ 120s)
  - *DREAD*: D=5, R=7, E=7, A=7, D=7 → **DREAD=6.6**

### Elevation of Privilege
- **T-07**: GHA workflow with write:packages scope runs attacker-controlled PR
  - *Mitigation*: Least-privilege GHA permissions (contents:read, security-events:write only for scan jobs)
  - *DREAD*: D=8, R=3, E=3, A=7, D=3 → **DREAD=4.8**

## Accepted Risks

| Risk | Reason Accepted |
|------|-----------------|
| SLSA L1 (not L2+) | Honest disclosure; keyless Sigstore signing is roadmap (Series-A) |
| No HSM for DSSE key | Founder decision; key rotation documented; ephemeral Fulcio certs cover builds |
| HF cold-start unavailability | Free-tier constraint; honest in SLO and HONEST_DISCLOSURE.md |

## Mitigations in Place

- Doctrine-grep CI blocks SLSA overclaims, supply-chain compliance overclaims, FedRAMP claims
- Branch protection on main (1 reviewer required on PRs)
- DCO enforcement via dco.yml
- TruffleHog on HF Space
- Section 889 compliance verified (5 vendors listed, no prohibited components)

**Signed-off-by: Yachay <yachay@szlholdings.ai>**  
**Co-Authored-By: Perplexity Computer Agent <agent@perplexity.ai>**