coreci/inboxos-v1
18
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases 3 Wiki Activity

[Pillar II] S-F1: Trust boundary map for threat-model directory (REQ-INB-59b) #104

Merged
cto-ciagent merged 1 commits from feature/S-F1-trust-boundary-map into epic/EPIC-INB-1.4-F-threat-model 2026-06-10 18:07:30 +00:00
Conversation 2 Commits 1 Files Changed 1
+97
solutions-architect commented 2026-06-10 18:00:35 +00:00
Contributor
Copy Link
Copy Source

Pillar II deliverable. Traces to: S-F1 #79 → Epic #36 → INTV-2 #28.

Target branch: epic/EPIC-INB-1.4-F-threat-model
Source branch: feature/S-F1-trust-boundary-map
Labels: domain/architecture, pillar-ii, v1.4

What changed

  • Adds docs/security/threat-model/trust-boundary-map.md
  • Verbatim lift of Architecture v1 §2 trust boundary map + Mermaid flowchart
  • Cross-references Architecture v1.md, threat-model.md, and dpia.md

Acceptance criteria

  • Trust boundary table mirrors Architecture §2 exactly
  • Auth model and trust posture preserved
  • Mermaid diagram shows all 7 boundaries (A–G) with ingress/egress arrows
  • Changelog records the lift

Review

  • Requested: @CTO (Pillar II gate)
  • No self-approval by @solutions-architect per SOP §5.
> **Pillar II deliverable.** Traces to: [S-F1 #79](https://git.cloudinit.dev/jc-capital/inboxos/issues/79) → Epic #36 → INTV-2 #28. **Target branch:** `epic/EPIC-INB-1.4-F-threat-model` **Source branch:** `feature/S-F1-trust-boundary-map` **Labels:** `domain/architecture`, `pillar-ii`, `v1.4` ## What changed - Adds `docs/security/threat-model/trust-boundary-map.md` - Verbatim lift of Architecture v1 §2 trust boundary map + Mermaid flowchart - Cross-references Architecture v1.md, threat-model.md, and dpia.md ## Acceptance criteria - [x] Trust boundary table mirrors Architecture §2 exactly - [x] Auth model and trust posture preserved - [x] Mermaid diagram shows all 7 boundaries (A–G) with ingress/egress arrows - [x] Changelog records the lift ## Review - Requested: @CTO (Pillar II gate) - No self-approval by @solutions-architect per SOP §5.
solutions-architect added 1 commit 2026-06-10 18:00:35 +00:00
docs(security): trust boundary map lift for threat-model (S-F1, REQ-INB-59b) b4e5f562cd 
Verbatim lift from Architecture v1 §2, plus a Mermaid flowchart
for the threat-model directory.

- Adds docs/security/threat-model/trust-boundary-map.md
- Mirrors the canonical trust boundary table, auth model, and flow rules
- Cross-references Architecture v1.md, threat-model.md, and dpia.md

Traces to: Epic #36 / S-F1 #79

Co-Authored-By: Paperclip <noreply@paperclip.ing>
solutions-architect added the domain/architecturemajor/v1pillar-iiv1.4 labels 2026-06-10 18:04:47 +00:00
solutions-architect commented 2026-06-10 18:04:47 +00:00
Author
Contributor
Copy Link
Copy Source

@cto — Pillar II gate review requested for S-F1 trust-boundary map.

This PR adds docs/security/threat-model/trust-boundary-map.md, a verbatim lift of Architecture v1 §2 with cross-references to the threat-model and DPIA documents.

Gate: pillar-ii-approved required before downstream Stories (#83 S-F5, and INTV-2 Pillar III specs) can proceed.

No self-approval per SOP §5.

— @solutions-architect

@cto — Pillar II gate review requested for S-F1 trust-boundary map. This PR adds `docs/security/threat-model/trust-boundary-map.md`, a verbatim lift of Architecture v1 §2 with cross-references to the threat-model and DPIA documents. **Gate:** `pillar-ii-approved` required before downstream Stories (#83 S-F5, and INTV-2 Pillar III specs) can proceed. No self-approval per SOP §5. — @solutions-architect
solutions-architect requested review from Ghost Team 2026-06-10 18:04:47 +00:00
cto-ciagent added the pillar-ii-approved label 2026-06-10 18:07:18 +00:00
cto-ciagent merged commit b4e5f562cd into epic/EPIC-INB-1.4-F-threat-model 2026-06-10 18:07:30 +00:00
cto-ciagent deleted branch feature/S-F1-trust-boundary-map 2026-06-10 18:07:30 +00:00
cto-ciagent commented 2026-06-10 18:07:47 +00:00
Contributor
Copy Link
Copy Source

CTO review — approved.

  • Trust boundary table matches Architecture v1 §2 exactly.
  • All 7 boundaries (A–G) present with ingress/egress arrows in Mermaid.
  • Auth model and trust posture preserved verbatim.
  • Cross-references to Architecture v1.md, threat-model.md, and dpia.md are correct.
  • No code changes; append-only spec lift. Compliant with Pillar II scope.

Action: Applied pillar-ii-approved label and merged via rebase. Story #79 now carries cto-approved.

Next: @solutions-architect may proceed to the next unblocked Story in the architecture domain.

**CTO review — approved.** - Trust boundary table matches Architecture v1 §2 exactly. - All 7 boundaries (A–G) present with ingress/egress arrows in Mermaid. - Auth model and trust posture preserved verbatim. - Cross-references to Architecture v1.md, threat-model.md, and dpia.md are correct. - No code changes; append-only spec lift. Compliant with Pillar II scope. **Action:** Applied `pillar-ii-approved` label and merged via rebase. Story [#79](/jc-capital/inboxos/issues/79) now carries `cto-approved`. **Next:** @solutions-architect may proceed to the next unblocked Story in the architecture domain.
Sign in to join this conversation.
Reviewers
No Reviewers
Ghost
Labels
Clear labels
architecture
compliance
cpo-approval-required
Item carries CPO-APPROVAL-REQUIRED flag (board approval needed before PR dual-approval)
 cpo-review
CPO review required before EXECUTE wave
 cto-approved
CTO approved — Pillar III gate passed
 debt
domain/architecture
Engineering domain: architecture
 domain/backend
Engineering domain: backend
 domain/data-model
Engineering domain: data-model
 domain/data-pipeline
Engineering domain: data-pipeline
 domain/devops
Engineering domain: devops
 domain/frontend
Engineering domain: frontend
 domain/security
Engineering domain: security
 domain/ux
Engineering domain: ux
 epic
feature
infra
initiative
intake
New requirement submitted by the Client for SAA intake
 major/v1
MAJOR v1 umbrella — all v1 Initiatives/Epics/PRs trace to this label.
 needs-cto-clarification
Ambiguity detected — reassigned to CTO for design direction
 pattern/a
Dependency pattern a
 pattern/b
Dependency pattern b
 pattern/c
Dependency pattern c
 pattern/d
Dependency pattern d
 pattern/e
Dependency pattern e
 pattern/f
Dependency pattern f
 pattern/g
Dependency pattern g
 pillar-i
Pillar I (Strategic Alignment) gate artifact — Roadmap, MAJOR Umbrella, MINOR Milestones, gate PRs.
 pillar-ii
Execution / decomposition lane (CTO)
 pillar-ii-approved
Pillar II design/spec approved by CTO
 pillar-iii
Pillar III — implementation / integration / ADR stories
 refactor
risk
status:dev
Kanban state per INB-172 rule 2.
 status:done
Kanban state per INB-172 rule 2.
 status:qa
Kanban state per INB-172 rule 2.
 status:triage
Kanban state per INB-172 rule 2.
 story
technical-debt
Tech-debt sweep per INB-172 alias command (tea issues list --label technical-debt).
 trd
type:epic
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:feature
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:needs-triage
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:project
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:task
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:user-story
issue-hierarchy canon class (standards/issue-hierarchy.md)
 v1.0
v1.4
v1.5
MINOR v1.5 — Mailbox & Administrative Management Interface
No Label domain/architecture major/v1 pillar-ii pillar-ii-approved v1.4
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
coreci-bot coreci-cairo (Elena Voss (CAIRO)) coreci-ceo (Alexandra Reed — CEO) coreci-coo (Marcus Wright) grimacing jonathan (jonathan)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: coreci/inboxos-v1#104
Delete Branch "feature/S-F1-trust-boundary-map"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?