feat: implement project bus MVP

docs/THREAT_MODEL.md

@@ -0,0 +1,83 @@
+# Threat Model
+
+## Assets
+
+- project instructions, decisions, results, reviews, and escalations;
+- actor-role assignments and identity bindings;
+- event ordering and audit integrity;
+- bearer credentials;
+- commit, artifact, and baseline references;
+- service/database availability.
+
+## Adversaries
+
+- an unauthenticated network client;
+- an authenticated actor exceeding their formal mandate;
+- an implementer attempting self-review or self-acceptance;
+- a compromised bearer token;
+- a malicious artifact URI or oversized request;
+- an operator or database account attempting audit-history mutation;
+- concurrent clients exploiting check/write races.
+
+## Implemented controls
+
+| Threat | MVP control |
+|---|---|
+| Identity spoofing in tool args | no actor argument; identity comes from transport |
+| Token timing comparison | SHA-256 digest and constant-time comparison |
+| Unauthorized project access | active membership lookup per call |
+| PA decision overreach | explicit decision/gate/baseline denial |
+| Product decision overreach | PO-only product decisions |
+| Self-review | reviewer role plus actor independence checks |
+| Self-acceptance | PM/PO role and result-submitter identity check |
+| Premature gate acceptance | independent APPROVE review required |
+| Double claim / TOCTOU | `BEGIN IMMEDIATE` and conditional state update |
+| Duplicate delivery | scoped request hash and idempotency record |
+| Audit update/delete | SQLite triggers reject both operations |
+| Cross-project reads | project filter plus membership resolution |
+| Browser cross-origin request | exact configurable Origin allowlist |
+| Oversized request | one MiB body limit |
+| MIME confusion/caching | strict JSON input, nosniff, no-store |
+| SQL injection | parameterized SQL; one controlled placeholder expansion |
+
+Artifact URIs and review evidence are recorded as untrusted data and are never
+fetched or executed by the bus.
+
+## Residual risks and production requirements
+
+1. Static bearer credentials have no built-in expiry, rotation endpoint,
+   audience, issuer, or proof-of-possession. Replace the adapter with validated
+   OIDC/JWT or mTLS identities.
+2. Plain HTTP is available. Use TLS and prohibit direct public access to the
+   application port.
+3. SQLite append-only triggers do not protect against an operator replacing
+   the entire database file or disabling triggers. Use restricted DB roles,
+   PostgreSQL permissions, PITR, backups, and an external immutable audit
+   export for production assurance.
+4. The event payload is not cryptographically chained or signed. Add hash
+   chaining/signatures only if the agreed threat model requires tamper
+   evidence against privileged database operators.
+5. No application rate limiter exists. Apply per-identity limits and request
+   quotas at the trusted edge.
+6. The server emits access metadata but no security audit sink or metrics.
+   Integrate structured logs, alerts, and privacy-aware retention.
+7. Membership deactivation and credential revocation are not exposed as MVP
+   tools. Operators must treat compromised tokens as an immediate
+   configuration/restart incident.
+8. Role assignment is one role per actor/project. Shared human/agent accounts
+   undermine independence even when IDs differ and are prohibited operationally.
+9. Evidence and artifact digests are caller assertions; the bus does not
+   verify repository ownership or retrieve content.
+10. Dependency-free MCP handling reduces supply-chain surface but has not yet
+    been interoperability-tested against every intended client version.
+
+## Security verification before activation
+
+- run all tests and an independent code review;
+- test the exact Claude Code and ChatGPT MCP clients;
+- replace all example tokens and restrict origin/host exposure;
+- confirm backup/restore and audit export;
+- review log contents for sensitive project data;
+- add abuse limits and operational monitoring;
+- decide whether privileged-operator tamper evidence is required.
+