threat-modellisted

# Threat Model Reply in the project conversation language (CLAUDE.md → Language); code, identifiers, paths and commit messages stay in English. Template `.claude/docs/templates/threat-model.md`; `security-baseline.md`, `security-standards.md`, `graphql.md` (security). ## Phase 1: System Read the product spec (data, jurisdiction), technical-preferences (including Deploy target, Infra repo and Proxy config — proxy requirements need an owner and a file), the API contract, compose/infra, the existing threat model. Draw the DFD (mermaid) with trust boundaries; ask about the non-obvious (external integrations, admin access, payments). ## Phase 2: Surfaces and threats Per surface — STRIDE threats with likelihood/impact; mitigations referencing the baseline; status (exists/planned/none). GraphQL separately: introspection, complexity, batching, field authorisation, persisted ops. Games — anti-cheat, modified clients, chat spam, room DoS. `appsec-engineer` and `network-security-engineer` via Task in parallel — complete their areas. ## Phase 3: Priorities Top 5 unmitigated threats → stories/ADRs; residual risks explicitly accepted by the user. ## Phase 4: Write The gate follows coordination-rules rule 7's exact order: the draft (or a tight summary of it) in the chat message first, then "May I write `docs/architecture/threat-model.md`?" — one `AskUserQuestion`: write (Recommended) · show the draft/diff first · not now — and `Write` only after that answer, never write-then-ask. Add