security-architecturesolid

# security-architecture Optional, lightweight threat-modeling pass over a design before it is built. Selected when the user deliberately requests threat modeling of a sensitive design, with or without `$ca-threat-model`. Never forced on an ordinary change. Reviews architectural intent before code exists; for code already written, dispatch `security-reviewer` instead. ## Entry boundaries Read-only: modify no project file, decision record, control or implementation. Optional reviewers inherit this read-only analysis scope. An explanation-only security question does not start the pass; mentioning authentication in an ordinary change does not opt in. The user need not repeat a slash command to request it. Missing required security-controls input is a prerequisite failure, separate from the severity of a finding. A lesser gap is a constraint, not blanket denied clearance. ## Pre-flight - Read `<project-root>/.codearbiter/security-controls.md` — approved primitives, declared security boundaries and their permitted crossings, what is and is not allowed. If it cannot be read, STOP and surface the gap; do not guess the boundary model. - Establish the scope from the user's request: the feature, component, or design under review. - Read relevant security ADRs under `<project-root>/.codearbiter/decisions/`; do not invent decisions or interpret their absence as approval. ## Phase 1 — Attack surface · gate: BLOCK Map what the change exposes. Name, for the scope: - New or changed en