From fa510dd28dd5f9ca4f81e5b3048ceab584f0b7d7 Mon Sep 17 00:00:00 2001 From: Jason Walker <913443@dadeschools.net> Date: Wed, 29 Jul 2026 02:52:46 -0400 Subject: [PATCH] docs(remote-mcp): restamp the #956 threat-model anchors onto the commit they resolve at The anchors and their citations moved in the previous commit because gitea_mcp_server.py gained the #948 worker-identity block. The fixture still named the commit the old line numbers resolved at, so the recorded provenance pointed at a tree where the new numbers do not hold. No anchor target or expectation changes; only the recorded commit does. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01F6Vomtndpq2gSBa88Tfcwy --- docs/remote-mcp/threat-model-anchors.json | 2 +- docs/remote-mcp/threat-model.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/remote-mcp/threat-model-anchors.json b/docs/remote-mcp/threat-model-anchors.json index 3aa0eb6..eaefd35 100644 --- a/docs/remote-mcp/threat-model-anchors.json +++ b/docs/remote-mcp/threat-model-anchors.json @@ -8,7 +8,7 @@ "document. #930's inventory had no such guard and its gitea_mcp_server.py", "anchors drifted between 7bf4f125 and aad5c8b4." ], - "generated_against_commit": "ca5f078d8a575ea3e2991771f8b4ea85e3dcaaa0", + "generated_against_commit": "1dd30ecb1508b559868c2d5d94367bc055d5138e", "anchors": [ { "anchor": "gitea_mcp_server.py:25087", diff --git a/docs/remote-mcp/threat-model.md b/docs/remote-mcp/threat-model.md index 3d67961..4f2c2f5 100644 --- a/docs/remote-mcp/threat-model.md +++ b/docs/remote-mcp/threat-model.md @@ -5,7 +5,7 @@ What the adversary is, what each boundary protects, and which services may share - **Issue:** #956 (Remote-MCP threat model), child of epic #929, cross-linked to #955. - **Depends on:** #930 (closed) — `docs/remote-mcp/coupling-inventory.md`. - **Blocks:** #932, #933, #934, #938. -- **Generated against commit:** `ca5f078d8a575ea3e2991771f8b4ea85e3dcaaa0` (#708's +- **Generated against commit:** `1dd30ecb1508b559868c2d5d94367bc055d5138e` (#708's namespace-attachment gate). Originally generated against `aad5c8b42361d380a8eeb07b94b90815e594c2c5` (`master`), re-anchored at `a143cd065ba06e1a2bdc5143a19ec156e53650ef` when #931's transport bind seam shifted the @@ -75,7 +75,7 @@ authenticate the *caller*, not the *intent*. ## 3. Trust boundaries "Crossing requires today" is what the code actually enforces at -`ca5f078d8a575ea3e2991771f8b4ea85e3dcaaa0`, not what the design intends. +`1dd30ecb1508b559868c2d5d94367bc055d5138e`, not what the design intends. | ID | Boundary | Protects | Crossing requires today | Crossing must require remotely | | -- | -------- | -------- | ----------------------- | ------------------------------ |