GuardLink

Executive Summary

14Open threats3 critical or high 3Critical / high open2 critical · 35 high in total 0Accepted riskssigned off by a human 88%Mitigation coverage101 of 115 exposures 38%Verified claims175 stale · 234 unverified

What to do next5 items

3 critical or high exposures open

0 critical, 3 high. Each needs a @mitigates with a real control, or a human @accepts with a reason.

guardlink review .

Show

175 claims went stale

The code beneath them changed since they were verified; 26 of them are mitigations or acceptances that may no longer hold. Re-check the code, then re-lock.

guardlink verify --stale

Show

1 open exposure introduced with AI help

The introducing commit credits an AI tool. Worth a closer review, and worth knowing which tool and model.

Show

8 exposed assets have no owner

#agent-launcher, #mcp, #tui, #llm-client and 4 more carry open exposures but no @owns, so nobody is accountable for closing them. Name the team in the definitions file.

Show

24 audit items await human review

Each @audit marks a risk with no control yet. Review it and either add a control or record a decision.

Show

Threat mitigation coverage

88% 101 of 115 exposures mitigated

An exposure counts as mitigated when a @mitigates on the same asset and threat covers it. Accepted risks are not mitigations.

Severity breakdownall exposures

Critical

High

Medium

Low

Worst open exposures6 of 14

high

#agent-launcher → #prompt-injection

User prompt concatenated into agent instruction text

src/agents/prompts.ts:6

high

#mcp → #cmd-injection

Accepts tool calls from external MCP clients

src/mcp/index.ts:6

high

#tui → #cmd-injection

/annotate and /threat-report spawn child processes

src/tui/commands.ts:11

medium

#agent-launcher → #prompt-injection

User prompt passed to agent CLI as argument

src/agents/launcher.ts:13

medium

#agent-launcher → #config-tamper

Translate prompt may read CXG reference paths from environment overrides

src/agents/prompts.ts:10

medium

#llm-client → #prompt-injection

User prompts sent to LLM API

src/analyze/llm.ts:17

See all 14 open exposures →

Who introduces exposed codeAttribution →

From git history: the author, co-authors and any AI tool credited on the commit that introduced each exposure's code. 49 of 115 exposures were introduced with AI help.

People

human:Animesh Srivastava80 introduced · 14 open

human:zippon35 introduced · 0 open

human:Jordi Murgó0 introduced · 0 open

human:jpmo0 introduced · 0 open

AI tools

claude-code Claude Fable 5.127 introduced · 0 open

claude-code Claude Opus 5 (1M context)19 introduced · 1 open

claude-code Claude Sonnet 4.63 introduced · 0 open

warp0 introduced · 0 open

Model inventoryclick a tile to open its page

Analytics

Where the exposure is concentrated, who owns it, what covers it, and what nothing covers. Every cell is a link into the filtered Threats page. Pick a feature in the top bar and every grid recomputes for it.

13Assets with exposuresof 18 declared 14Threat classes seenof 15 declared 14Open pairs to close13 asset·threat pairs 12Controls in use1 declared but unused 2Most open in one filesrc/agents/prompts.ts

Who owns the open risk0 teams · 8 unowned

Open exposures rolled up to the team named by @owns on the asset. An exposed asset with no owner has nobody accountable for closing it.

No @owns in the model, so no team is accountable for anything here.

8 exposed, unowned #agent-launcher3 open #mcp3 open #tui2 open #llm-client2 open #init1 open #parser1 open #sarif1 open #suggest1 open

Sensitive data under open exposure3 classifications

Assets recorded with @handles, and how many of them carry an open exposure. Click a class for its rows; each pill is one exposed asset.


`internal` `#agent-launcher`3 `#mcp`3 `#llm-client`2 `#init`1 `#parser`1	7	5	10	high
`secrets` `#agent-launcher`3 `#llm-client`2 `#tui`2	4	3	7	high
`pii` `#mcp`3 `#tui`2	6	2	5	high

Asset × threat13 assets · 14 threats

Each cell is how many exposures that asset carries for that threat. Red means at least one is open (or confirmed), green means all are mitigated, blue all accepted; darker is more. Click a cell for those rows, a row for the asset, a column for the threat.

asset \ threat	#arbitrary-write	#path-traversal	#dos	#cmd-injection	#api-key-exposure	#data-exposure	#redos	#insecure-deser	#prompt-injection	#xss	#config-tamper	#info-disclosure	#ssrf	#child-proc-injection
#mcp	2	2	1	1	1	1	1		1			2
#agent-launcher	1	2	2		1				2		1			1
#llm-client	1	2	1		1	1		1	1				2
#tui	1	2	1	1	3				1
#parser	3	5	5			1	2	3			1
#init	3	2				1
#suggest		1	1				1
#sarif						1
#cli	10	1		2	1		1	2
#dashboard	1	3	2	1		1				3
#blame		3	3	1		1	2
#diff	1	1		3
#gate	1

Severity × status115 exposures

Open critical and high cells are the ones to close first; a large mitigated column with a small open one is a model in good shape.

severity \ status	Open	Mitigated
critical		2
high	3	32
medium	6	29
low	5	38

Threats by frequencyexposures per threat class

How often each threat class appears across the model; the hint says how many of those are still open.

#arbitrary-write

24 all covered

#path-traversal

24 all covered

#dos

16 1 open

#cmd-injection

9 2 open

#api-key-exposure

7 all covered

#data-exposure

7 5 open

#redos

7 all covered

#insecure-deser

6 all covered

#prompt-injection

5 5 open

#xss

3 all covered

#config-tamper

2 1 open

#info-disclosure

2 all covered

Control coverage12 used · 1 unused

What each declared control actually mitigates. A control declared in the definitions that no @mitigates names is doing nothing for the model — either it is missing annotations or it is not real.

#path-validation

41 2 threats · 12 assets

#output-encoding

20 2 threats · 2 assets

#resource-limits

14 3 threats · 7 assets

#regex-anchoring

10 2 threats · 6 assets

#config-validation

8 4 threats · 4 assets

#input-sanitize

6 4 threats · 4 assets

#key-redaction

6 1 threat · 5 assets

#param-commands

6 2 threats · 4 assets

#glob-filtering

4 1 threat · 3 assets

#prefix-ownership

2 1 threat · 2 assets

#identity-redaction

1 1 threat · 1 asset

#yaml-validation

1 1 threat · 1 asset

1 unused #process-sandbox

Files with the most open exposurestop 10

Where the open exposure concentrates in the tree. Click to see that file's open rows.

src/agents/prompts.ts

src/mcp/server.ts

src/tui/commands.ts

src/agents/launcher.ts

src/analyze/index.ts

src/analyze/llm.ts

src/analyzer/sarif.ts

src/init/index.ts

src/mcp/index.ts

src/mcp/suggest.ts

People × timetop 2 introducers · by quarter

Exposures each person's commits introduced, per quarter. A row that stays dark is someone who keeps introducing exposed code; a row that fades is improvement. Click a name for their claims.

person \ quarter	2026-Q1	2026-Q3
human:Animesh Srivastava	62	18
human:zippon	3	32

AI tool × severity3 tools

Exposures whose introducing commit credited each AI tool, by severity. Credit is declared by the commit's trailers, never detected.

tool \ severity	high	medium	low
claude-code (Claude Fable 5.1)		4	23
claude-code (Claude Opus 5 (1M context))	4	4	11
claude-code (Claude Sonnet 4.6)		2	1

Counting only the files tagged @feature "Dashboard" and the definitions they reference.

1Assets with exposuresof 1 declared 2Threat classes seenof 2 declared 0Open pairs to close0 asset·threat pairs 2Controls in use0 declared but unused 0Most open in one fileno open exposure

Who owns the open risk0 teams · 0 unowned

Open exposures rolled up to the team named by @owns on the asset. An exposed asset with no owner has nobody accountable for closing it.

No @owns in the model, so no team is accountable for anything here.

Sensitive data under open exposure2 classifications

Assets recorded with @handles, and how many of them carry an open exposure. Click a class for its rows; each pill is one exposed asset.


`internal`	1	0	0	0	—
`pii`	1	0	0	0	—

Asset × threat1 assets · 2 threats

asset \ threat	#path-traversal	#xss
#dashboard	1	1

Severity × status2 exposures

Open critical and high cells are the ones to close first; a large mitigated column with a small open one is a model in good shape.

severity \ status	Mitigated
high	1
medium	1

Threats by frequencyexposures per threat class

How often each threat class appears across the model; the hint says how many of those are still open.

#path-traversal

1 all covered

#xss

1 all covered

Control coverage2 used · 0 unused

What each declared control actually mitigates. A control declared in the definitions that no @mitigates names is doing nothing for the model — either it is missing annotations or it is not real.

#output-encoding

2 1 threat · 1 asset

#path-validation

1 1 threat · 1 asset

Files with the most open exposurestop 0

Where the open exposure concentrates in the tree. Click to see that file's open rows.

No open exposures.

People × timetop 1 introducers · by quarter

Exposures each person's commits introduced, per quarter. A row that stays dark is someone who keeps introducing exposed code; a row that fades is improvement. Click a name for their claims.

person \ quarter	2026-Q1
human:Animesh Srivastava	2

AI tool × severity0 tools

Exposures whose introducing commit credited each AI tool, by severity. Credit is declared by the commit's trailers, never detected.

No AI tool is credited on an introducing commit.

Counting only the files tagged @feature "MCP Integration" and the definitions they reference.

1Assets with exposuresof 2 declared 5Threat classes seenof 5 declared 2Open pairs to close2 asset·threat pairs 2Controls in use0 declared but unused 2Most open in one filesrc/mcp/server.ts

Who owns the open risk0 teams · 1 unowned

Open exposures rolled up to the team named by @owns on the asset. An exposed asset with no owner has nobody accountable for closing it.

No @owns in the model, so no team is accountable for anything here.

1 exposed, unowned #mcp2 open

Sensitive data under open exposure2 classifications

Assets recorded with @handles, and how many of them carry an open exposure. Click a class for its rows; each pill is one exposed asset.


`internal` `#mcp`2	1	1	2	0	medium
`pii` `#mcp`2	1	1	2	0	medium

Asset × threat1 assets · 5 threats

asset \ threat	#arbitrary-write	#api-key-exposure	#data-exposure	#path-traversal	#prompt-injection
#mcp	2	1	1	1	1

Severity × status6 exposures

Open critical and high cells are the ones to close first; a large mitigated column with a small open one is a model in good shape.

severity \ status	Open	Mitigated
high		2
medium	2	2

Threats by frequencyexposures per threat class

How often each threat class appears across the model; the hint says how many of those are still open.

#arbitrary-write

2 all covered

#api-key-exposure

1 all covered

#data-exposure

1 1 open

#path-traversal

1 all covered

#prompt-injection

1 1 open

Control coverage2 used · 0 unused

What each declared control actually mitigates. A control declared in the definitions that no @mitigates names is doing nothing for the model — either it is missing annotations or it is not real.

#path-validation

3 2 threats · 1 asset

#key-redaction

1 1 threat · 1 asset

Files with the most open exposurestop 1

Where the open exposure concentrates in the tree. Click to see that file's open rows.

src/mcp/server.ts

People × timetop 1 introducers · by quarter

Exposures each person's commits introduced, per quarter. A row that stays dark is someone who keeps introducing exposed code; a row that fades is improvement. Click a name for their claims.

person \ quarter	2026-Q1
human:Animesh Srivastava	6

AI tool × severity0 tools

Exposures whose introducing commit credited each AI tool, by severity. Credit is declared by the commit's trailers, never detected.

No AI tool is credited on an introducing commit.

Threat Reports1 saved

Reports written by guardlink threat-report (STRIDE, DREAD, PASTA, attacker, rapid, general or a custom prompt). Pick one to read it here; copy or download it to share.

Write another:

guardlink threat-report strideguardlink threat-report dreadguardlink threat-report pastaguardlink threat-report attackerguardlink threat-report rapidguardlink threat-report general guardlink threat-report general --custom "focus on auth"

Threats & Exposures115 exposures

Every @exposes in the model, with whether a control covers it, whether the claim is still verified against the code beneath it, and who introduced that code. Click a row for detail and actions; click a column to sort; type / to search (every word must match, so #api sqli narrows to one pair).

Status Severity Claim

Exposures14 open · 101 mitigated · 0 accepted

One table, every exposure, open first. Open rows have no covering control; use the chips above to narrow, or click a column header to sort.

			Description
Openstale	high	`#agent-launcher#prompt-injection`	User prompt concatenated into agent instruction text	prompts.ts:6src/agents	human:Animesh Srivastava
Openverified	high	`#mcp#cmd-injection`	Accepts tool calls from external MCP clients	index.ts:6src/mcp	human:Animesh Srivastava
Openstale	high	`#tui#cmd-injection`	/annotate and /threat-report spawn child processes	commands.ts:11src/tui	human:Animesh Srivastava
Openverified	medium	`#agent-launcher#prompt-injection`	User prompt passed to agent CLI as argument	launcher.ts:13src/agents	human:Animesh Srivastava
Openstale	medium	`#agent-launcher#config-tamper`	Translate prompt may read CXG reference paths from environment overrides	prompts.ts:10src/agents	human:Animesh Srivastava
Openverified	medium	`#llm-client#prompt-injection`	User prompts sent to LLM API	llm.ts:17src/analyze	human:Animesh Srivastava
Openstale	medium	`#mcp#prompt-injection`	annotate and threat_report tools pass user prompts to LLM	server.ts:37src/mcp	human:Animesh Srivastava
Openstale	medium	`#mcp#data-exposure`	Resources expose full threat model to MCP clients	server.ts:41src/mcp	human:Animesh Srivastava
Openstale	medium	`#tui#prompt-injection`	Freeform chat sends user text to LLM	commands.ts:15src/tui	human:Animesh Srivastava
Openstale	low	`#llm-client#data-exposure`	Serializes full threat model and code snippets for LLM	index.ts:12src/analyze	human:Animesh Srivastava
Openstale	low	`#sarif#data-exposure`	Exposes threat model findings to SARIF consumers	sarif.ts:34src/analyzer	human:Animesh Srivastava
Openstale	low	`#init#data-exposure`	Writes API key config to .guardlink/config.json	index.ts:12src/init	human:Animesh Srivastava
Openverified	low	`#suggest#dos`	Large files loaded into memory for pattern scanning	suggest.ts:16src/mcp	human:Animesh Srivastava
Openverified	low	`#parser#data-exposure`	Reads every annotated source file into memory	migrate-mode.ts:26src/parser	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedverified	critical	`#agent-launcher#child-proc-injection`	spawn/spawnSync execute external binaries	launcher.ts:10src/agents	human:Animesh Srivastava
Mitigatedstale	critical	`#cli#cmd-injection`	Agent launcher spawns child processes	index.ts:39src/cli	human:Animesh Srivastava
Mitigatedverified	high	`#agent-launcher#api-key-exposure`	API keys loaded from env vars, files; stored in config.json	config.ts:13src/agents	human:Animesh Srivastava
Mitigatedverified	high	`#llm-client#api-key-exposure`	API keys passed in Authorization headers	llm.ts:15src/analyze	human:Animesh Srivastava
Mitigatedstale	high	`#cli#path-traversal`	User-supplied dir argument resolved via path.resolve	index.ts:33src/cli	human:Animesh Srivastava
Mitigatedstale	high	`#cli#arbitrary-write`	init/report/sarif/dashboard write files to user-specified paths	index.ts:35src/cli	human:Animesh Srivastava
Mitigatedstale	high	`#cli#api-key-exposure`	API keys handled in config set/show commands	index.ts:37src/cli	human:Animesh Srivastava
Mitigatedunverified	high	`#dashboard#xss`	buildExploreData carries asset ids, threat names, file paths and annotation descriptions from the model into strings the Explore page renders	explore.ts:20src/dashboard	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedunverified	high	`#dashboard#xss`	generateDashboardHTML() interpolates model descriptions, asset names, git identities and commit trailers into the page markup and the embedded JSON constants	generate.ts:23src/dashboard	human:Animesh Srivastava
Mitigatedstale	high	`#dashboard#xss`	Generates HTML with threat model data	index.ts:4src/dashboard	human:Animesh Srivastava
Mitigatedverified	high	`#diff#cmd-injection`	execSync runs git commands with ref argument	git.ts:6src/diff	human:Animesh Srivastava
Mitigatedverified	high	`#diff#cmd-injection`	ref is interpolated into an execSync git command	git.ts:92src/diff	human:zippon
Mitigatedverified	high	`#diff#cmd-injection`	git.ts uses execSync with ref argument	index.ts:4src/diff	human:Animesh Srivastava
Mitigatedstale	high	`#init#arbitrary-write`	Creates/modifies files: .guardlink/, CLAUDE.md, .cursorrules, etc.	index.ts:8src/init	human:Animesh Srivastava
Mitigatedverified	high	`#init#arbitrary-write`	Creates directories for agent-file writes	index.ts:511src/init	human:Animesh Srivastava
Mitigatedverified	high	`#init#arbitrary-write`	Decides whether init may overwrite an existing definitions/config file	preserve.ts:16src/init	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedstale	high	`#mcp#path-traversal`	Tool arguments include 'root' directory path from external client	server.ts:33src/mcp	human:Animesh Srivastava
Mitigatedstale	high	`#mcp#arbitrary-write`	report, dashboard, sarif tools write files	server.ts:35src/mcp	human:Animesh Srivastava
Mitigatedverified	high	`#suggest#path-traversal`	File path from MCP client joined with root	suggest.ts:12src/mcp	human:Animesh Srivastava
Mitigatedverified	high	`#parser#arbitrary-write`	Writes annotation sidecars from tool input	apply-annotations.ts:17src/parser	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedverified	high	`#parser#arbitrary-write`	Writes modified content back to discovered files	clear.ts:8src/parser	human:Animesh Srivastava
Mitigatedverified	high	`#parser#path-traversal`	Glob patterns determine which files are modified	clear.ts:9src/parser	human:Animesh Srivastava
Mitigatedverified	high	`#parser#arbitrary-write`	Rewrites source files and creates sidecars across the project	migrate-mode.ts:24src/parser	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedstale	high	`#parser#path-traversal`	File path from caller read via readFile; no validation here	parse-file.ts:6src/parser	human:Animesh Srivastava
Mitigatedstale	high	`#parser#path-traversal`	Glob patterns could escape root directory	parse-project.ts:5src/parser	human:Animesh Srivastava
Mitigatedverified	high	`#cli#arbitrary-write`	Accepting a proposal writes an @entitles line into a source file named by the proposal	entitlements.ts:27src/review	human:zippon
Mitigatedverified	high	`#cli#arbitrary-write`	Agent-supplied rationale and human decision notes are interpolated into annotation text, where a newline would forge a second annotation	entitlements.ts:32src/review	human:zippon
Mitigatedunverified	high	`#cli#arbitrary-write`	Reviewer-supplied justification and author name are interpolated into annotation text, where a newline would forge a second annotation	index.ts:30src/review	human:Animesh Srivastava
Mitigatedverified	high	`#cli#arbitrary-write`	Writes annotation lines into a caller-supplied file path	index.ts:390src/review	human:Animesh Srivastava
Mitigatedstale	high	`#tui#path-traversal`	File paths from user args in /view, /sarif -o	commands.ts:7src/tui	human:Animesh Srivastava
Mitigatedstale	high	`#tui#arbitrary-write`	/report, /sarif, /dashboard write files	commands.ts:9src/tui	human:Animesh Srivastava
Mitigatedstale	high	`#tui#api-key-exposure`	/model handles API key input and storage	commands.ts:13src/tui	human:Animesh Srivastava
Mitigatedverified	high	`#tui#api-key-exposure`	API keys loaded from and saved to config files	config.ts:7src/tui	human:Animesh Srivastava
Mitigatedstale	high	`#tui#path-traversal`	User-supplied dir argument resolved via path.resolve	index.ts:9src/tui	human:Animesh Srivastava
Mitigatedverified	medium	`#agent-launcher#path-traversal`	Config paths resolved from root and homedir	config.ts:15src/agents	human:Animesh Srivastava
Mitigatedverified	medium	`#agent-launcher#arbitrary-write`	saveProjectConfig writes to .guardlink/config.json	config.ts:17src/agents	human:Animesh Srivastava
Mitigatedstale	medium	`#agent-launcher#path-traversal`	Reads reference docs from root-relative paths	prompts.ts:8src/agents	human:Animesh Srivastava
Mitigatedstale	medium	`#llm-client#path-traversal`	buildProjectContext reads files from root-relative paths	index.ts:8src/analyze	human:Animesh Srivastava
Mitigatedstale	medium	`#llm-client#arbitrary-write`	writeFileSync saves threat reports to .guardlink/	index.ts:10src/analyze	human:Animesh Srivastava
Mitigatedverified	medium	`#llm-client#ssrf`	fetch() calls external LLM API endpoints	llm.ts:13src/analyze	human:Animesh Srivastava
Mitigatedverified	medium	`#llm-client#ssrf`	lookupCve fetches from NVD API with user-controlled CVE ID	tools.ts:9src/analyze	human:zippon claude-code (Claude Sonnet 4.6)
Mitigatedverified	medium	`#llm-client#path-traversal`	searchCodebase reads files from project root	tools.ts:11src/analyze	human:zippon claude-code (Claude Sonnet 4.6)
Mitigatedstale	medium	`#dashboard#arbitrary-write`	Writes .mmd, model.json and MANIFEST.json under a caller-supplied root	emit.ts:27src/artifacts	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedunverified	medium	`#blame#data-exposure`	identityFor() turns author.name and author.email from git history into identity strings that buildBlamePayload() writes into reports, dashboards and MCP responses	trailers.ts:19src/blame	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	medium	`#dashboard#path-traversal`	readFileSync reads the file each annotation's location names, for the code context	annotations.ts:5src/dashboard	human:zippon claude-code (Claude Fable 5.1)
Mitigatedstale	medium	`#dashboard#path-traversal`	readFileSync reads code files for annotation context	generate.ts:25src/dashboard	human:Animesh Srivastava
Mitigatedverified	medium	`#diff#arbitrary-write`	writeFileSync creates files in temp directory	git.ts:8src/diff	human:Animesh Srivastava
Mitigatedverified	medium	`#diff#path-traversal`	git show extracts files based on ls-tree output	git.ts:10src/diff	human:Animesh Srivastava
Mitigatedunverified	medium	`#gate#arbitrary-write`	stripViolations rewrites source files named by the model's locations	gate.ts:11src/gate	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	medium	`#cli#arbitrary-write`	writeConfirmedLine() edits the source file a claim's location names; importScan() reads the scan path the user passed	commands.ts:10src/hypothesis	human:zippon claude-code (Claude Fable 5.1)
Mitigatedstale	medium	`#init#path-traversal`	Reads/writes files based on root argument	index.ts:10src/init	human:Animesh Srivastava
Mitigatedverified	medium	`#mcp#path-traversal`	Caller-supplied file path is resolved against the project root	context.ts:17src/mcp	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedstale	medium	`#mcp#api-key-exposure`	threat_report tool uses API keys from environment	server.ts:39src/mcp	human:Animesh Srivastava
Mitigatedstale	medium	`#mcp#arbitrary-write`	guardlink_entitlement_propose writes a client-supplied claim into .guardlink/entitlement-proposals.json	server.ts:43src/mcp	human:Animesh Srivastava
Mitigatedverified	medium	`#suggest#redos`	Complex regex patterns applied to source code	suggest.ts:14src/mcp	human:Animesh Srivastava
Mitigatedunverified	medium	`#parser#config-tamper`	readAcceptancePolicy reads .guardlink/config.json to decide how strict this project's acceptance rule is, so anyone who can edit that file can lower the bar their own acceptances have to clear	acceptance.ts:47src/parser	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedunverified	medium	`#parser#redos`	Marker and decoration matching runs on every line of every scanned file, including attacker-supplied source	comment-strip.ts:7src/parser	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedstale	medium	`#parser#dos`	Large files loaded entirely into memory	parse-file.ts:7src/parser	human:Animesh Srivastava
Mitigatedstale	medium	`#parser#redos`	Complex regex patterns applied to annotation text	parse-line.ts:5src/parser	human:Animesh Srivastava
Mitigatedstale	medium	`#parser#dos`	Large projects with many files could exhaust memory	parse-project.ts:7src/parser	human:Animesh Srivastava
Mitigatedverified	medium	`#cli#insecure-deser`	JSON.parse of .guardlink/entitlement-proposals.json, which an agent or another repo may have written	entitlements.ts:29src/review	human:zippon
Mitigatedstale	medium	`#cli#arbitrary-write`	Writes @accepts/@audit annotations into source files	index.ts:28src/review	human:Animesh Srivastava
Mitigatedstale	medium	`#tui#api-key-exposure`	API keys displayed in banner via resolveLLMConfig	index.ts:11src/tui	human:Animesh Srivastava
Mitigatedverified	low	`#agent-launcher#dos`	No timeout on foreground spawn; agent controls duration	launcher.ts:15src/agents	human:Animesh Srivastava
Mitigatedverified	low	`#agent-launcher#dos`	Prompt size now scales with model size: uncapped flow and exposure rows mean a large repo assembles a large prompt	prompts.ts:65src/agents	human:zippon claude-code (Claude Opus 5 (1M context))
Mitigatedunverified	low	`#llm-client#insecure-deser`	JSON.parse over a block the model wrote	findings.ts:8src/analyze	human:zippon claude-code (Claude Fable 5.1)
Mitigatedverified	low	`#llm-client#dos`	searchCodebase reads many files; the LLM now sets max_results itself	tools.ts:13src/analyze	human:zippon claude-code (Claude Sonnet 4.6)
Mitigatedunverified	low	`#blame#path-traversal`	safeRelPath() receives location.file from each parsed record; a sidecar @source path is author text that can carry ../ into the argv computeBlame() hands to git	compute.ts:23src/blame	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	low	`#blame#dos`	computeBlame() spawns git blame once per annotated file, git log -L once per distinct symbol span and listCommits() once over the whole history; a large model multiplies the spawns	compute.ts:25src/blame	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	low	`#blame#redos`	readBlameConfig() compiles blame.tools[].match from .guardlink/config.json into RegExp objects that attributeCommit() runs against every author and trailer in the history	config.ts:22src/blame	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	low	`#blame#path-traversal`	ignore_revs names a file git will open with --ignore-revs-file	config.ts:24src/blame	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	low	`#blame#cmd-injection`	gitExec() builds the argv it spawns from location.file and the start/end line numbers of each parsed record	git.ts:13src/blame	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	low	`#blame#path-traversal`	blameFile(), spanOldestCommit() and fileAddCommit() pass location.file to git blame, git log and git ls-files, which read whatever path it names	git.ts:15src/blame	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	low	`#blame#dos`	git log -L walks history once per distinct span, blame reads every annotated file, and listCommits reads the whole history reachable from HEAD	git.ts:17src/blame	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	low	`#blame#dos`	listCommits() runs git log over every commit reachable from HEAD and parseLogRecords() parses each trailer block; history size, not model size, sets the cost	git.ts:201src/blame	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	low	`#blame#redos`	attributeCommit() runs every compiled ToolRule.match against each author and Co-Authored-By trailer in the history	trailers.ts:21src/blame	human:zippon claude-code (Claude Fable 5.1)
Mitigatedverified	low	`#cli#arbitrary-write`	The one command that writes .guardlink/verified.json	index.ts:503src/cli	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	low	`#dashboard#path-traversal`	detectRepoLinks reads <root>/.git/config and, when .git is a worktree file, follows its `gitdir:` pointer to a config elsewhere on disk; a crafted .git file can name any readable path	links.ts:10src/dashboard	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	low	`#dashboard#data-exposure`	detectRepoLinks() reads remote.origin.url from .git/config, which may embed user:token@host credentials that would land in the committed HTML	links.ts:12src/dashboard	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	low	`#dashboard#dos`	Measures caller-supplied diagram text with regular expressions	render-budget.ts:57src/dashboard	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedunverified	low	`#dashboard#cmd-injection`	loadSince() passes the --since ref the user typed to parseAtRef() and into the git log and git rev-list argv	since.ts:6src/dashboard	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	low	`#dashboard#dos`	measureLegibility scans caller-supplied diagram text with regular expressions, once per line	legibility.ts:90src/graph	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedunverified	low	`#cli#insecure-deser`	importScan() JSON.parses a scan report	commands.ts:12src/hypothesis	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	low	`#cli#arbitrary-write`	writeHypotheses() writes .guardlink/hypotheses.json under the root the caller resolved	ledger.ts:10src/hypothesis	human:zippon claude-code (Claude Fable 5.1)
Mitigatedverified	low	`#init#path-traversal`	Reads package.json, pyproject.toml, etc. from root	detect.ts:5src/init	human:Animesh Srivastava
Mitigatedverified	low	`#mcp#info-disclosure`	Envelope discloses the absolute project root and git SHA to the connected client	freshness.ts:17src/mcp	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedverified	low	`#mcp#redos`	Regex patterns applied to query strings	lookup.ts:19src/mcp	human:Animesh Srivastava
Mitigatedstale	low	`#mcp#dos`	Unbounded depth on a dense graph expands the frontier	subgraph.ts:42src/mcp	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedstale	low	`#mcp#info-disclosure`	D34: the subgraph spread carried the whole repo's unannotated_files inventory into a neighbourhood answer — 8094 paths, 654.8 KB, on a query that resolved nothing	subgraph.ts:44src/mcp	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedunverified	low	`#parser#insecure-deser`	JSON.parse of a repository file	acceptance.ts:51src/parser	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedverified	low	`#parser#insecure-deser`	Annotation lines arrive as caller-supplied text	apply-annotations.ts:19src/parser	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedverified	low	`#parser#dos`	Fingerprint globs the project tree on every call	fingerprint.ts:20src/parser	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedverified	low	`#parser#insecure-deser`	JSON.parse on a committed file under .guardlink/	ledger.ts:18src/parser	human:zippon claude-code (Claude Fable 5.1)
Mitigatedverified	low	`#cli#arbitrary-write`	writeLedger writes one fixed path under root	ledger.ts:20src/parser	human:zippon claude-code (Claude Fable 5.1)
Mitigatedverified	low	`#parser#path-traversal`	Reads source files named by @source blocks	reanchor.ts:19src/parser	human:Animesh Srivastava claude-code (Claude Opus 5 (1M context))
Mitigatedverified	low	`#cli#cmd-injection`	git is spawned for the verifier name and HEAD	verify.ts:13src/parser	human:zippon claude-code (Claude Fable 5.1)
Mitigatedunverified	low	`#cli#redos`	selectAnnotatePlaybook() runs each Playbook.triggers RegExp against the prompt text the user typed	select.ts:6src/playbooks	human:zippon claude-code (Claude Fable 5.1)
Mitigatedverified	low	`#parser#path-traversal`	Reads the file each annotation's location names, and a .gal @source path is author-supplied text that survives normalisation with ../ intact	attach.ts:10src/structure	human:zippon claude-code (Claude Fable 5.1)
Mitigatedverified	low	`#parser#dos`	One structure parse per annotated file	attach.ts:12src/structure	human:zippon claude-code (Claude Fable 5.1)
Mitigatedverified	low	`#parser#dos`	Grammar WASM is loaded into memory per language; a pathological source file costs one parse	runtime.ts:16src/structure	human:zippon claude-code (Claude Fable 5.1)
Mitigatedverified	low	`#tui#dos`	Rapid keystrokes could consume CPU in raw mode	input.ts:15src/tui	human:Animesh Srivastava

Explore

One question at a time, and an answer sized to be read. Each panel states what it is for, how big the drawing is against the 12-node / 16-edge legibility budget measured for this panel, and what fell just outside the frame. Diagrams here are drawn at full size and never shrunk to fit — where long labels make one wider than the panel, drag to pan or press Fit. The whole-model pictures are still on Diagrams, where they say their own size.

component \ weakness	#arbitrary-write	#path-traversal	#dos	#cmd-injection	#api-key-exposure	#data-exposure	#redos	#insecure-deser	#prompt-injection	#xss	#config-tamper	#info-disclosure	#ssrf	#child-proc-injection
#mcp	2	2	1	1	1	1	1		1			2
#agent-launcher	1	2	2		1				2		1			1
#llm-client	1	2	1		1	1		1	1				2
#tui	1	2	1	1	3				1
#parser	3	5	5			1	2	3			1
#init	3	2				1
#suggest		1	1				1
#sarif						1
#cli	10	1		2	1		1	2
#dashboard	1	3	2	1		1				3
#blame		3	3	1		1	2
#diff	1	1		3
#gate	1

13 components against 14 weakness classs — 65 pairs in all. A matrix has no legibility budget to exceed: one cell per pair, however many pairs there are.

Red means at least one claim in that cell is open or confirmed, green that all are mitigated, blue accepted; darker is more. Click a cell or a row to open that component's diagrams, a column for everywhere that weakness was declared.

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  mcp["GuardLink.MCP"]
  cmd_injection{{"Command_Injection (cwe:CWE-78)"}}:::sev_crit
  path_traversal{{"Path_Traversal (cwe:CWE-22)"}}:::sev_high
  arbitrary_write{{"Arbitrary_File_Write (cwe:CWE-73)"}}:::sev_high
  api_key_exposure{{"API_Key_Exposure (cwe:CWE-798)"}}:::sev_high
  path_validation(["Path_Validation"]):::control
  key_redaction(["Key_Redaction"]):::control
  mcp -. exposes .-> cmd_injection
  mcp -. exposes .-> path_traversal
  mcp -. exposes .-> arbitrary_write
  path_validation -- mitigates --> path_traversal
  path_validation -. protects .-> mcp
  path_validation -- mitigates --> arbitrary_write
  key_redaction -- mitigates --> api_key_exposure
  key_redaction -. protects .-> mcp
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

7 nodes / 8 edges, within the 12 / 16 legibility budget · narrowed to high and critical — 12 lower-severity claims hidden, all of them in the rows below

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.MCP · Trust boundary at MCP protocol"]
    mcp["GuardLink.MCP"]
  end
  subgraph Z1["MCPClient · Trust boundary at MCP protocol"]
    mcpclient(["MCPClient"])
  end
  threatmodel["ThreatModel"]
  llm_client(["GuardLink.LLM_Client"])
  gitrepo["GitRepo"]
  configfile["ConfigFile"]
  querystring["QueryString"]
  filesystem["FileSystem"]
  mcp -.-|Trust boundary at MCP protocol| mcpclient
  threatmodel -- "serializeModel" --> llm_client
  mcpclient -- "guardlink_context" --> mcp
  threatmodel -- "fileContext" --> mcp
  threatmodel -- "buildEnvelope" --> mcp
  gitrepo -- "readFileSync" --> mcp
  mcpclient -- "stdio" --> mcp
  configfile -- "readFileSync" --> mcp
  querystring -- "lookup" --> mcp
  mcpclient -- "tool_call" --> mcp
  mcp -- "writeFile" --> filesystem
  mcp -- "generateThreatReport" --> llm_client
  mcp -- "resource" --> mcpclient
  gitrepo -- "computeBlame" --> mcp
  threatmodel -- "selectSubgraph" --> mcp

8 nodes / 15 edges, within the 12 / 16 legibility budget · 20 neighbours just outside the frame: #agent-launcher, #blame, #cli, #dashboard, #diff, #gate, #init, LLMConfig, and 12 more

Every claim on #mcp— rows · 3 open

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  agent_launcher["GuardLink.Agent_Launcher"]
  api_key_exposure{{"API_Key_Exposure (cwe:CWE-798)"}}:::sev_high
  child_proc_injection{{"Child_Process_Injection (cwe:CWE-78)"}}:::sev_crit
  prompt_injection{{"Prompt_Injection (cwe:CWE-77)"}}:::sev_high
  path_traversal{{"Path_Traversal (cwe:CWE-22)"}}:::sev_high
  arbitrary_write{{"Arbitrary_File_Write (cwe:CWE-73)"}}:::sev_high
  cmd_injection{{"Command_Injection (cwe:CWE-78)"}}:::sev_crit
  key_redaction(["Key_Redaction"]):::control
  path_validation(["Path_Validation"]):::control
  param_commands(["Parameterized_Commands"]):::control
  agent_launcher -. exposes .-> api_key_exposure
  agent_launcher -. exposes .-> child_proc_injection
  agent_launcher -. exposes .-> prompt_injection
  key_redaction -- mitigates --> api_key_exposure
  key_redaction -. protects .-> agent_launcher
  path_validation -- mitigates --> path_traversal
  path_validation -. protects .-> agent_launcher
  path_validation -- mitigates --> arbitrary_write
  param_commands -- mitigates --> child_proc_injection
  param_commands -. protects .-> agent_launcher
  param_commands -- mitigates --> cmd_injection
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

10 nodes / 11 edges, within the 12 / 16 legibility budget · narrowed to high and critical — 8 lower-severity claims hidden, all of them in the rows below

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.Agent_Launcher · Trust boundary at process spawn"]
    agent_launcher["GuardLink.Agent_Launcher"]
  end
  subgraph Z1["AgentProcess · Trust boundary at process spawn"]
    agentprocess["AgentProcess"]
  end
  envvars["EnvVars"]
  configfile["ConfigFile"]
  userprompt(["UserPrompt"])
  threatmodel["ThreatModel"]
  agentprompt["AgentPrompt"]
  tui(["GuardLink.TUI"])
  agent_launcher -.-|Trust boundary at process spawn| agentprocess
  envvars -- "process.env" --> agent_launcher
  configfile -- "readFileSync" --> agent_launcher
  agent_launcher -- "writeFileSync" --> configfile
  userprompt -- "launchAgent" --> agent_launcher
  agent_launcher -- "spawn" --> agentprocess
  agentprocess -- "stdout" --> agent_launcher
  userprompt -- "buildAnnotatePrompt" --> agent_launcher
  userprompt -- "buildTranslatePrompt" --> agent_launcher
  userprompt -- "buildAskPrompt" --> agent_launcher
  threatmodel -- "model" --> agent_launcher
  agent_launcher -- "return" --> agentprompt
  tui -- "launchAgent" --> agent_launcher
  configfile -- "loadProjectConfig" --> tui
  tui -- "saveProjectConfig" --> configfile

8 nodes / 15 edges, within the 12 / 16 legibility budget · 19 neighbours just outside the frame: #blame, #cli, Commands, #dashboard, #diff, FileSystem, #gate, GitRepo, and 11 more

Every claim on #agent-launcher— rows · 3 open

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  llm_client["GuardLink.LLM_Client"]
  api_key_exposure{{"API_Key_Exposure (cwe:CWE-798)"}}:::sev_high
  path_traversal{{"Path_Traversal (cwe:CWE-22)"}}:::sev_high
  arbitrary_write{{"Arbitrary_File_Write (cwe:CWE-73)"}}:::sev_high
  path_validation(["Path_Validation"]):::control
  key_redaction(["Key_Redaction"]):::control
  glob_filtering(["Glob_Pattern_Filtering"]):::control
  llm_client -. exposes .-> api_key_exposure
  path_validation -- mitigates --> path_traversal
  path_validation -. protects .-> llm_client
  path_validation -- mitigates --> arbitrary_write
  key_redaction -- mitigates --> api_key_exposure
  key_redaction -. protects .-> llm_client
  glob_filtering -- mitigates --> path_traversal
  glob_filtering -. protects .-> llm_client
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

7 nodes / 8 edges, within the 12 / 16 legibility budget · narrowed to high and critical — 13 lower-severity claims hidden, all of them in the rows below

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.LLM_Client · Trust boundary at external API call"]
    llm_client(["GuardLink.LLM_Client"])
  end
  subgraph Z1["LLMProvider · Trust boundary at external API call"]
    llmprovider["LLMProvider"]
  end
  subgraph Z2["NVD · Trust boundary at external API"]
    nvd["NVD"]
  end
  savedreport["SavedReport"]
  projectfiles["ProjectFiles"]
  reportfile["ReportFile"]
  pentestfindings["PentestFindings"]
  llmconfig["LLMConfig"]
  llmtoolcall["LLMToolCall"]
  mcp["GuardLink.MCP"]
  tui(["GuardLink.TUI"])
  llm_client -.-|Trust boundary at external API call| llmprovider
  llm_client -.-|Trust boundary at external API| nvd
  savedreport -- "parseFindingsBlock" --> llm_client
  projectfiles -- "readFileSync" --> llm_client
  llm_client -- "writeFileSync" --> reportfile
  pentestfindings -- "readFileSync" --> llm_client
  llmconfig -- "chatCompletion" --> llm_client
  llm_client -- "fetch" --> llmprovider
  llmprovider -- "response" --> llm_client
  llmtoolcall -- "createToolExecutor" --> llm_client
  llm_client -- "fetch" --> nvd
  mcp -- "generateThreatReport" --> llm_client
  tui -- "chatCompletion" --> llm_client

11 nodes / 13 edges, within the 12 / 16 legibility budget · 12 neighbours just outside the frame: #agent-launcher, Commands, ConfigFile, FileSystem, GitRepo, MCPClient, QueryString, RawStdin, and 4 more

Every claim on #llm-client— rows · 2 open

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  tui["GuardLink.TUI"]
  path_traversal{{"Path_Traversal (cwe:CWE-22)"}}:::sev_high
  arbitrary_write{{"Arbitrary_File_Write (cwe:CWE-73)"}}:::sev_high
  cmd_injection{{"Command_Injection (cwe:CWE-78)"}}:::sev_crit
  api_key_exposure{{"API_Key_Exposure (cwe:CWE-798)"}}:::sev_high
  prompt_injection{{"Prompt_Injection (cwe:CWE-77)"}}:::sev_med
  dos{{"Denial_of_Service (cwe:CWE-400)"}}:::sev_med
  path_validation(["Path_Validation"]):::control
  key_redaction(["Key_Redaction"]):::control
  resource_limits(["Resource_Limits"]):::control
  tui -. exposes .-> path_traversal
  tui -. exposes .-> arbitrary_write
  tui -. exposes .-> cmd_injection
  tui -. exposes .-> api_key_exposure
  tui -. exposes .-> prompt_injection
  tui -. exposes .-> dos
  path_validation -- mitigates --> path_traversal
  path_validation -. protects .-> tui
  path_validation -- mitigates --> arbitrary_write
  key_redaction -- mitigates --> api_key_exposure
  key_redaction -. protects .-> tui
  resource_limits -- mitigates --> dos
  resource_limits -. protects .-> tui
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

10 nodes / 13 edges, within the 12 / 16 legibility budget

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.TUI · Trust boundary at interactive input"]
    tui(["GuardLink.TUI"])
  end
  subgraph Z1["UserInput · Trust boundary at interactive input"]
    userinput(["UserInput"])
  end
  configfile["ConfigFile"]
  agent_launcher["GuardLink.Agent_Launcher"]
  userargs(["UserArgs"])
  filesystem["FileSystem"]
  llm_client(["GuardLink.LLM_Client"])
  gitrepo["GitRepo"]
  commands["Commands"]
  rawstdin["RawStdin"]
  terminal["Terminal"]
  tui -.-|Trust boundary at interactive input| userinput
  configfile -- "readFileSync" --> agent_launcher
  agent_launcher -- "writeFileSync" --> configfile
  userargs -- "args" --> tui
  tui -- "writeFile" --> filesystem
  tui -- "launchAgent" --> agent_launcher
  tui -- "chatCompletion" --> llm_client
  gitrepo -- "computeBlame" --> tui
  configfile -- "loadProjectConfig" --> tui
  tui -- "saveProjectConfig" --> configfile
  userinput -- "readline" --> tui
  tui -- "dispatch" --> commands
  rawstdin -- "process.stdin" --> tui
  tui -- "process.stdout" --> terminal

11 nodes / 14 edges, within the 12 / 16 legibility budget · 22 neighbours just outside the frame: AgentProcess, AgentPrompt, #blame, #cli, #dashboard, #diff, EnvVars, #init, and 14 more

Every claim on #tui— rows · 2 open

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  parser["GuardLink.Parser"]
  arbitrary_write{{"Arbitrary_File_Write (cwe:CWE-73)"}}:::sev_high
  path_traversal{{"Path_Traversal (cwe:CWE-22)"}}:::sev_high
  path_validation(["Path_Validation"]):::control
  glob_filtering(["Glob_Pattern_Filtering"]):::control
  parser -. exposes .-> arbitrary_write
  parser -. exposes .-> path_traversal
  path_validation -- mitigates --> arbitrary_write
  path_validation -. protects .-> parser
  glob_filtering -- mitigates --> path_traversal
  glob_filtering -. protects .-> parser
  path_validation -- mitigates --> path_traversal
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

5 nodes / 7 edges, within the 12 / 16 legibility budget · narrowed to high and critical — 27 lower-severity claims hidden, all of them in the rows below

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.Parser · Trust boundary between parser and disk I/O"]
    parser["GuardLink.Parser"]
  end
  subgraph Z1["FileSystem · Trust boundary between parser and disk I/O"]
    filesystem["FileSystem"]
  end
  configfile["ConfigFile"]
  mcpclient(["MCPClient"])
  projectroot["ProjectRoot"]
  sourcefiles["SourceFiles"]
  sourcefile["SourceFile"]
  ledgerfile["LedgerFile"]
  filepath["FilePath"]
  annotations["Annotations"]
  parsediagnostics["ParseDiagnostics"]
  grammarfile["GrammarFile"]
  parser -.-|Trust boundary between parser and disk I/O| filesystem
  configfile -- "readAcceptancePolicy" --> parser
  mcpclient -- "applyAnnotations" --> parser
  parser -- "writeFileSync" --> filesystem
  projectroot -- "fast-glob" --> parser
  parser -- "writeFile" --> sourcefiles
  sourcefile -- "resolveGalPath" --> parser
  ledgerfile -- "readLedger" --> parser
  filepath -- "readFile" --> parser
  parser -- "parseString" --> annotations
  parser -- "parseString" --> parsediagnostics
  ledgerfile -- "classifyClaims" --> parser
  sourcefiles -- "attachAnchors" --> parser
  sourcefile -- "parseStructure" --> parser
  grammarfile -- "Language.load" --> parser

12 nodes / 15 edges, within the 12 / 16 legibility budget · 10 neighbours just outside the frame: #agent-launcher, #blame, #cli, #dashboard, #gate, #init, #mcp, #suggest, and 2 more

Every claim on #parser— rows · 1 open

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  init["GuardLink.Init"]
  path_traversal{{"Path_Traversal (cwe:CWE-22)"}}:::sev_high
  arbitrary_write{{"Arbitrary_File_Write (cwe:CWE-73)"}}:::sev_high
  data_exposure{{"Sensitive_Data_Exposure (cwe:CWE-200)"}}:::sev_med
  path_validation(["Path_Validation"]):::control
  config_validation(["Config_Validation"]):::control
  init -. exposes .-> path_traversal
  init -. exposes .-> arbitrary_write
  init -. exposes .-> data_exposure
  path_validation -- mitigates --> path_traversal
  path_validation -. protects .-> init
  path_validation -- mitigates --> arbitrary_write
  config_validation -- mitigates --> arbitrary_write
  config_validation -. protects .-> init
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

6 nodes / 8 edges, within the 12 / 16 legibility budget

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 47, "rankSpacing": 67, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  configfile["ConfigFile"]
  agent_launcher["GuardLink.Agent_Launcher"]
  blame["GuardLink.Blame"]
  projectroot["ProjectRoot"]
  init["GuardLink.Init"]
  agentfiles["AgentFiles"]
  definitionsfile["DefinitionsFile"]
  mcp["GuardLink.MCP"]
  parser["GuardLink.Parser"]
  tui(["GuardLink.TUI"])
  workspace_link["Workspace.Link"]
  configfile -- "readFileSync" --> agent_launcher
  agent_launcher -- "writeFileSync" --> configfile
  configfile -- "readBlameConfig" --> blame
  projectroot -- "detectProject" --> init
  projectroot -- "options.root" --> init
  init -- "writeFileSync" --> agentfiles
  init -- "writeFileSync" --> configfile
  definitionsfile -- "definitionsArePopulated" --> init
  configfile -- "configIsCustomised" --> init
  configfile -- "readFileSync" --> mcp
  configfile -- "readAcceptancePolicy" --> parser
  projectroot -- "fast-glob" --> parser
  tui -- "launchAgent" --> agent_launcher
  configfile -- "loadProjectConfig" --> tui
  tui -- "saveProjectConfig" --> configfile
  workspace_link -- "updateAgentWorkspaceContext" --> agentfiles

11 nodes / 16 edges, within the 12 / 16 legibility budget · 25 neighbours just outside the frame: AgentProcess, AgentPrompt, Annotations, #cli, Commands, CommitTrailers, #dashboard, EnvVars, and 17 more

Every claim on #init— rows · 1 open

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  suggest["GuardLink.Suggest"]
  path_traversal{{"Path_Traversal (cwe:CWE-22)"}}:::sev_high
  redos{{"ReDoS (cwe:CWE-1333)"}}:::sev_med
  dos{{"Denial_of_Service (cwe:CWE-400)"}}:::sev_med
  path_validation(["Path_Validation"]):::control
  regex_anchoring(["Regex_Anchoring"]):::control
  suggest -. exposes .-> path_traversal
  suggest -. exposes .-> redos
  suggest -. exposes .-> dos
  path_validation -- mitigates --> path_traversal
  path_validation -. protects .-> suggest
  regex_anchoring -- mitigates --> redos
  regex_anchoring -. protects .-> suggest
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

6 nodes / 7 edges, within the 12 / 16 legibility budget

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.Parser · Trust boundary between parser and disk I/O"]
    parser["GuardLink.Parser"]
  end
  subgraph Z1["FileSystem · Trust boundary between parser and disk I/O"]
    filesystem["FileSystem"]
  end
  filepath["FilePath"]
  suggest["GuardLink.Suggest"]
  suggestions["Suggestions"]
  configfile["ConfigFile"]
  mcpclient(["MCPClient"])
  projectroot["ProjectRoot"]
  ledgerfile["LedgerFile"]
  annotations["Annotations"]
  parsediagnostics["ParseDiagnostics"]
  grammarfile["GrammarFile"]
  parser -.-|Trust boundary between parser and disk I/O| filesystem
  filepath -- "readFileSync" --> suggest
  suggest -- "suggestAnnotations" --> suggestions
  configfile -- "readAcceptancePolicy" --> parser
  mcpclient -- "applyAnnotations" --> parser
  parser -- "writeFileSync" --> filesystem
  projectroot -- "fast-glob" --> parser
  ledgerfile -- "readLedger" --> parser
  filepath -- "readFile" --> parser
  parser -- "parseString" --> annotations
  parser -- "parseString" --> parsediagnostics
  ledgerfile -- "classifyClaims" --> parser
  grammarfile -- "Language.load" --> parser

12 nodes / 13 edges, within the 12 / 16 legibility budget · 10 neighbours just outside the frame: #agent-launcher, #blame, #cli, #dashboard, #init, #mcp, SourceFile, SourceFiles, and 2 more

Every claim on #suggest— rows · 1 open

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  sarif["GuardLink.SARIF"]
  data_exposure{{"Sensitive_Data_Exposure (cwe:CWE-200)"}}:::sev_med
  sarif -. exposes .-> data_exposure
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

2 nodes / 1 edge, within the 12 / 16 legibility budget

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  threatmodel["ThreatModel"]
  sarif["GuardLink.SARIF"]
  sariflog["SarifLog"]
  parser["GuardLink.Parser"]
  threatmodel -- "generateSarif" --> sarif
  sarif -- "return" --> sariflog
  threatmodel -- "findAcceptanceDefects" --> parser
  threatmodel -- "computeAnnotationHash" --> parser
  threatmodel -- "detectAnnotationMode" --> parser
  threatmodel -- "canonicalizeModelOrder" --> parser
  threatmodel -- "isCovered" --> parser
  threatmodel -- "migrateAnnotationMode" --> parser
  parser -- "assembleModel" --> threatmodel
  threatmodel -- "findAnchorDrift" --> parser
  threatmodel -- "classifyClaims" --> parser
  threatmodel -- "findUnmitigatedPaths" --> parser

4 nodes / 12 edges, within the 12 / 16 legibility budget · 21 neighbours just outside the frame: #agent-launcher, Annotations, #blame, #cli, ConfigFile, #dashboard, #diff, FilePath, and 13 more

Every claim on #sarif— rows · 1 open

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  cli["GuardLink.CLI"]
  path_traversal{{"Path_Traversal (cwe:CWE-22)"}}:::sev_high
  arbitrary_write{{"Arbitrary_File_Write (cwe:CWE-73, cwe:CWE-74)"}}:::sev_high
  api_key_exposure{{"API_Key_Exposure (cwe:CWE-798)"}}:::sev_high
  cmd_injection{{"Command_Injection (cwe:CWE-78)"}}:::sev_crit
  path_validation(["Path_Validation"]):::control
  key_redaction(["Key_Redaction"]):::control
  param_commands(["Parameterized_Commands"]):::control
  input_sanitize(["Input_Sanitization"]):::control
  cli -. exposes .-> path_traversal
  cli -. exposes .-> arbitrary_write
  cli -. exposes .-> api_key_exposure
  cli -. exposes .-> cmd_injection
  path_validation -- mitigates --> path_traversal
  path_validation -. protects .-> cli
  path_validation -- mitigates --> arbitrary_write
  key_redaction -- mitigates --> api_key_exposure
  key_redaction -. protects .-> cli
  param_commands -- mitigates --> cmd_injection
  param_commands -. protects .-> cli
  input_sanitize -- mitigates --> arbitrary_write
  input_sanitize -. protects .-> cli
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

9 nodes / 13 edges, within the 12 / 16 legibility budget · narrowed to high and critical — 13 lower-severity claims hidden, all of them in the rows below

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  blame["GuardLink.Blame"]
  cli["GuardLink.CLI"]
  gitrepo["GitRepo"]
  ledgerfile["LedgerFile"]
  filesystem["FileSystem"]
  gate["GuardLink.Gate"]
  agentproposal["AgentProposal"]
  gitconfig["GitConfig"]
  blame -- "formatBlameText" --> cli
  gitrepo -- "execFileSync" --> blame
  gitrepo -- "listCommits" --> blame
  blame -- "buildBlamePayload" --> cli
  ledgerfile -- "readLedger" --> cli
  cli -- "writeFile" --> filesystem
  gitrepo -- "attachBlame" --> cli
  ledgerfile -- "readHypotheses" --> cli
  gitrepo -- "computeBlame" --> cli
  cli -- "runGate" --> gate
  gitrepo -- "loadSince" --> cli
  cli -- "writeHypotheses" --> ledgerfile
  cli -- "writeLedger" --> ledgerfile
  cli -- "applyVerification" --> ledgerfile
  agentproposal -- "proposeEntitlement" --> cli
  gitconfig -- "execFileSync" --> cli

8 nodes / 16 edges, within the 12 / 16 legibility budget · 17 neighbours just outside the frame: AgentPrompt, CommitTrailers, ConfigFile, #dashboard, #diff, #mcp, PackageJson, ParseDiagnostics, and 9 more

Every claim on #cli— rows · 0 open

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  dashboard["GuardLink.Dashboard"]
  arbitrary_write{{"Arbitrary_File_Write (cwe:CWE-73)"}}:::sev_high
  path_traversal{{"Path_Traversal (cwe:CWE-22)"}}:::sev_high
  xss{{"Cross_Site_Scripting (cwe:CWE-79)"}}:::sev_high
  data_exposure{{"Sensitive_Data_Exposure (cwe:CWE-200)"}}:::sev_med
  dos{{"Denial_of_Service (cwe:CWE-400)"}}:::sev_med
  cmd_injection{{"Command_Injection (cwe:CWE-78)"}}:::sev_crit
  path_validation(["Path_Validation"]):::control
  output_encoding(["Output_Encoding"]):::control
  regex_anchoring(["Regex_Anchoring"]):::control
  param_commands(["Parameterized_Commands"]):::control
  dashboard -. exposes .-> arbitrary_write
  dashboard -. exposes .-> path_traversal
  dashboard -. exposes .-> xss
  dashboard -. exposes .-> data_exposure
  dashboard -. exposes .-> dos
  dashboard -. exposes .-> cmd_injection
  path_validation -- mitigates --> arbitrary_write
  path_validation -. protects .-> dashboard
  path_validation -- mitigates --> path_traversal
  output_encoding -- mitigates --> xss
  output_encoding -. protects .-> dashboard
  output_encoding -- mitigates --> data_exposure
  regex_anchoring -- mitigates --> dos
  regex_anchoring -. protects .-> dashboard
  param_commands -- mitigates --> cmd_injection
  param_commands -. protects .-> dashboard
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

11 nodes / 16 edges, within the 12 / 16 legibility budget

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  dashboard["GuardLink.Dashboard"]
  filesystem["FileSystem"]
  gitrepo["GitRepo"]
  blame["GuardLink.Blame"]
  sourcefiles["SourceFiles"]
  ledgerfile["LedgerFile"]
  gitconfig["GitConfig"]
  html["HTML"]
  dashboardhtml["DashboardHTML"]
  diagramsource["DiagramSource"]
  dashboard -- "writeFileSync" --> filesystem
  gitrepo -- "execFileSync" --> blame
  gitrepo -- "listCommits" --> blame
  blame -- "summarise" --> dashboard
  sourcefiles -- "readFileSync" --> dashboard
  ledgerfile -- "readLedger" --> dashboard
  gitrepo -- "loadSince" --> dashboard
  ledgerfile -- "computeLedgerStates" --> dashboard
  gitconfig -- "detectRepoLinks" --> dashboard
  dashboard -- "return" --> html
  ledgerfile -- "readHypotheses" --> dashboard
  gitconfig -- "readFileSync" --> dashboard
  dashboard -- "RepoLinks" --> dashboardhtml
  diagramsource -- "checkRenderBudget" --> dashboard
  gitrepo -- "parseAtRef" --> dashboard
  diagramsource -- "measureLegibility" --> dashboard

10 nodes / 16 edges, within the 12 / 16 legibility budget · 10 neighbours just outside the frame: #cli, CommitTrailers, ConfigFile, #diff, #gate, #mcp, #parser, #report-metadata, and 2 more

Every claim on #dashboard— rows · 0 open

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  blame["GuardLink.Blame"]
  path_traversal{{"Path_Traversal (cwe:CWE-22)"}}:::sev_high
  dos{{"Denial_of_Service (cwe:CWE-400)"}}:::sev_med
  redos{{"ReDoS (cwe:CWE-1333)"}}:::sev_med
  cmd_injection{{"Command_Injection (cwe:CWE-78)"}}:::sev_crit
  data_exposure{{"Sensitive_Data_Exposure (cwe:CWE-200)"}}:::sev_med
  path_validation(["Path_Validation"]):::control
  resource_limits(["Resource_Limits"]):::control
  regex_anchoring(["Regex_Anchoring"]):::control
  param_commands(["Parameterized_Commands"]):::control
  identity_redaction(["Identity_Redaction"]):::control
  blame -. exposes .-> path_traversal
  blame -. exposes .-> dos
  blame -. exposes .-> redos
  blame -. exposes .-> cmd_injection
  blame -. exposes .-> data_exposure
  path_validation -- mitigates --> path_traversal
  path_validation -. protects .-> blame
  resource_limits -- mitigates --> dos
  resource_limits -. protects .-> blame
  regex_anchoring -- mitigates --> redos
  regex_anchoring -. protects .-> blame
  param_commands -- mitigates --> cmd_injection
  param_commands -. protects .-> blame
  identity_redaction -- mitigates --> data_exposure
  identity_redaction -. protects .-> blame
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

11 nodes / 15 edges, within the 12 / 16 legibility budget

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  configfile["ConfigFile"]
  blame["GuardLink.Blame"]
  cli["GuardLink.CLI"]
  gitrepo["GitRepo"]
  dashboard["GuardLink.Dashboard"]
  committrailers["CommitTrailers"]
  configfile -- "readBlameConfig" --> blame
  blame -- "formatBlameText" --> cli
  gitrepo -- "execFileSync" --> blame
  gitrepo -- "listCommits" --> blame
  blame -- "buildBlamePayload" --> cli
  blame -- "summarise" --> dashboard
  committrailers -- "parseTrailerBlock" --> blame
  gitrepo -- "attachBlame" --> cli
  gitrepo -- "computeBlame" --> cli
  gitrepo -- "loadSince" --> cli
  gitrepo -- "loadSince" --> dashboard
  gitrepo -- "parseAtRef" --> dashboard

6 nodes / 12 edges, within the 12 / 16 legibility budget · 23 neighbours just outside the frame: #agent-launcher, AgentProposal, DashboardHTML, DiagramSource, #diff, FileSystem, #gate, GitConfig, and 15 more

Every claim on #blame— rows · 0 open

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  diff["GuardLink.Diff"]
  cmd_injection{{"Command_Injection (cwe:CWE-78)"}}:::sev_crit
  arbitrary_write{{"Arbitrary_File_Write (cwe:CWE-73)"}}:::sev_high
  path_traversal{{"Path_Traversal (cwe:CWE-22)"}}:::sev_high
  input_sanitize(["Input_Sanitization"]):::control
  path_validation(["Path_Validation"]):::control
  glob_filtering(["Glob_Pattern_Filtering"]):::control
  diff -. exposes .-> cmd_injection
  diff -. exposes .-> arbitrary_write
  diff -. exposes .-> path_traversal
  input_sanitize -- mitigates --> cmd_injection
  input_sanitize -. protects .-> diff
  path_validation -- mitigates --> arbitrary_write
  path_validation -. protects .-> diff
  glob_filtering -- mitigates --> path_traversal
  glob_filtering -. protects .-> diff
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

7 nodes / 9 edges, within the 12 / 16 legibility budget

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.Diff · Trust boundary at git command execution"]
    diff["GuardLink.Diff"]
  end
  subgraph Z1["GitRepo · Trust boundary at git command execution"]
    gitrepo["GitRepo"]
  end
  threatmodel["ThreatModel"]
  gitref["GitRef"]
  tempdir["TempDir"]
  changedfilelist["ChangedFileList"]
  diff -.-|Trust boundary at git command execution| gitrepo
  threatmodel -- "diffModels" --> diff
  gitref -- "execSync" --> diff
  diff -- "writeFileSync" --> tempdir
  diff -- "parseProject" --> threatmodel
  diff -- "return" --> changedfilelist
  gitref -- "parseAtRef" --> diff

6 nodes / 7 edges, within the 12 / 16 legibility budget · 12 neighbours just outside the frame: #agent-launcher, #blame, #cli, #dashboard, #gate, #llm-client, #mcp, #parser, and 4 more

Every claim on #diff— rows · 0 open

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  gate["GuardLink.Gate"]
  arbitrary_write{{"Arbitrary_File_Write (cwe:CWE-73)"}}:::sev_high
  path_validation(["Path_Validation"]):::control
  gate -. exposes .-> arbitrary_write
  path_validation -- mitigates --> arbitrary_write
  path_validation -. protects .-> gate
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

3 nodes / 3 edges, within the 12 / 16 legibility budget

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  threatmodel["ThreatModel"]
  cli["GuardLink.CLI"]
  sourcefiles["SourceFiles"]
  gate["GuardLink.Gate"]
  agentprompt["AgentPrompt"]
  threatmodel -- "runCiChecks" --> cli
  sourcefiles -- "findAnchorDrift" --> cli
  cli -- "runGate" --> gate
  threatmodel -- "findUnmitigatedPaths" --> cli
  threatmodel -- "runGate" --> gate
  gate -- "buildGateFollowUp" --> agentprompt
  gate -- "stripViolations" --> sourcefiles
  threatmodel -- "lintAnnotations" --> gate
  threatmodel -- "classifyHypotheses" --> cli
  cli -- "attachHypotheses" --> threatmodel
  cli -- "writeConfirmedLine" --> sourcefiles
  cli -- "applyProposalDecision" --> sourcefiles
  threatmodel -- "getReviewableExposures" --> cli
  cli -- "writeFile" --> sourcefiles

5 nodes / 14 edges, within the 12 / 16 legibility budget · 21 neighbours just outside the frame: #agent-launcher, AgentProposal, #blame, #dashboard, #diff, FileSystem, GitConfig, GitRepo, and 13 more

Every claim on #gate— rows · 0 open

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  merge_engine["Workspace.Merge"]
  tag_collision{{"Tag_Collision"}}:::sev_med
  prefix_ownership(["Prefix_Ownership"]):::control
  prefix_ownership -- mitigates --> tag_collision
  prefix_ownership -. protects .-> merge_engine
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

3 nodes / 2 edges, within the 12 / 16 legibility budget

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  reportjson["ReportJSON"]
  merge_engine["Workspace.Merge"]
  mergedreport["MergedReport"]
  reportjson -- "mergeReports" --> merge_engine
  merge_engine -- "mergeReports" --> mergedreport

3 nodes / 2 edges, within the 12 / 16 legibility budget

Every claim on #merge-engine— rows · 0 open

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  report["GuardLink.Report"]
  xss{{"Cross_Site_Scripting (cwe:CWE-79)"}}:::sev_high
  output_encoding(["Output_Encoding"]):::control
  output_encoding -- mitigates --> xss
  output_encoding -. protects .-> report
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

3 nodes / 2 edges, within the 12 / 16 legibility budget

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  threatmodel["ThreatModel"]
  parser["GuardLink.Parser"]
  featurename["FeatureName"]
  report["GuardLink.Report"]
  markdown["Markdown"]
  threatmodel -- "findAcceptanceDefects" --> parser
  threatmodel -- "computeAnnotationHash" --> parser
  threatmodel -- "detectAnnotationMode" --> parser
  threatmodel -- "canonicalizeModelOrder" --> parser
  threatmodel -- "isCovered" --> parser
  threatmodel -- "migrateAnnotationMode" --> parser
  parser -- "assembleModel" --> threatmodel
  threatmodel -- "findAnchorDrift" --> parser
  threatmodel -- "classifyClaims" --> parser
  threatmodel -- "findUnmitigatedPaths" --> parser
  featurename -- "filtered_by_features" --> report
  threatmodel -- "generateReport" --> report
  report -- "return" --> markdown
  threatmodel -- "generateSequenceDiagram" --> report

5 nodes / 14 edges, within the 12 / 16 legibility budget · 21 neighbours just outside the frame: #agent-launcher, Annotations, #blame, #cli, ConfigFile, #dashboard, #diff, FilePath, and 13 more

Every claim on #report— rows · 0 open

Exposed tothreats declared on this component, and the controls that answer them

This component declares no @exposes, @mitigates, @confirmed or @accepts.

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  threatmodel["ThreatModel"]
  parser["GuardLink.Parser"]
  gitrepo["GitRepo"]
  report_metadata["Workspace.Metadata"]
  threatmodel -- "findAcceptanceDefects" --> parser
  threatmodel -- "computeAnnotationHash" --> parser
  threatmodel -- "detectAnnotationMode" --> parser
  threatmodel -- "canonicalizeModelOrder" --> parser
  threatmodel -- "isCovered" --> parser
  threatmodel -- "migrateAnnotationMode" --> parser
  parser -- "assembleModel" --> threatmodel
  threatmodel -- "findAnchorDrift" --> parser
  threatmodel -- "classifyClaims" --> parser
  threatmodel -- "findUnmitigatedPaths" --> parser
  gitrepo -- "execSync" --> report_metadata
  report_metadata -- "populateMetadata" --> threatmodel

4 nodes / 12 edges, within the 12 / 16 legibility budget · 22 neighbours just outside the frame: #agent-launcher, Annotations, #blame, #cli, ConfigFile, #dashboard, #diff, FilePath, and 14 more

Every claim on #report-metadata— rows · 0 open

Exposed tothreats declared on this component, and the controls that answer them

%%{init: {"flowchart": {"nodeSpacing": 55, "rankSpacing": 150, "curve": "monotoneX", "htmlLabels": false, "padding": 24}}}%%
graph LR
  workspace_config["Workspace.Config"]
  config_tamper{{"Config_Tampering (cwe:CWE-15)"}}:::sev_med
  yaml_validation(["YAML_Validation"]):::control
  yaml_validation -- mitigates --> config_tamper
  yaml_validation -. protects .-> workspace_config
  classDef threat fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.3px
  classDef control fill:#102a24,stroke:#33d49d,color:#f0f0f0,stroke-width:1.3px
  classDef sev_crit fill:#3a1010,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.4px
  classDef sev_high fill:#402019,stroke:#ea1d1d,color:#f0f0f0,stroke-width:1.2px
  classDef sev_med fill:#1f3943,stroke:#55899e,color:#f0f0f0
  classDef sev_low fill:#10263b,stroke:#0360a2,color:#f0f0f0
  classDef sev_unset fill:#223942,stroke:#3b6779,color:#f0f0f0

3 nodes / 2 edges, within the 12 / 16 legibility budget

Talks todata flows and trust boundaries in its neighbourhood

This component declares no @flows or @boundary, so it has no flow neighbourhood to draw.

Every claim on #workspace-config— rows · 0 open

Exposed tothreats declared on this component, and the controls that answer them

This component declares no @exposes, @mitigates, @confirmed or @accepts.

Talks todata flows and trust boundaries in its neighbourhood

%%{init: {"flowchart": {"nodeSpacing": 47, "rankSpacing": 67, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  blame["GuardLink.Blame"]
  cli["GuardLink.CLI"]
  userargs(["UserArgs"])
  gate["GuardLink.Gate"]
  init["GuardLink.Init"]
  agentfiles["AgentFiles"]
  agentproposal["AgentProposal"]
  tui(["GuardLink.TUI"])
  agent_launcher["GuardLink.Agent_Launcher"]
  llm_client(["GuardLink.LLM_Client"])
  commands["Commands"]
  workspace_link["Workspace.Link"]
  blame -- "formatBlameText" --> cli
  blame -- "buildBlamePayload" --> cli
  userargs -- "process.argv" --> cli
  cli -- "runGate" --> gate
  init -- "writeFileSync" --> agentfiles
  agentproposal -- "proposeEntitlement" --> cli
  userargs -- "args" --> tui
  tui -- "launchAgent" --> agent_launcher
  tui -- "chatCompletion" --> llm_client
  tui -- "dispatch" --> commands
  userargs -- "linkProject" --> workspace_link
  workspace_link -- "updateAgentWorkspaceContext" --> agentfiles

12 nodes / 12 edges, within the 12 / 16 legibility budget · 31 neighbours just outside the frame: AgentProcess, AgentPrompt, CommitTrailers, ConfigFile, #dashboard, DefinitionsFile, EnvVars, FileSystem, and 23 more

Every claim on #workspace-link— rows · 0 open

#arbitrary-write10 components · 0 still open

Drawn as a node-link graph this would be one node with 10 spokes, every spoke labelled the same word — past the 12-node budget at 13 components, and carrying nothing the rows do not. Open a component to see this weakness in its context.

#path-traversal11 components · 0 still open

Drawn as a node-link graph this would be one node with 11 spokes, every spoke labelled the same word — past the 12-node budget at 13 components, and carrying nothing the rows do not. Open a component to see this weakness in its context.

#dos8 components · 1 still open

Drawn as a node-link graph this would be one node with 8 spokes, every spoke labelled the same word — past the 12-node budget at 13 components, and carrying nothing the rows do not. Open a component to see this weakness in its context.

#cmd-injection7 components · 2 still open

Drawn as a node-link graph this would be one node with 7 spokes, every spoke labelled the same word — past the 12-node budget at 13 components, and carrying nothing the rows do not. Open a component to see this weakness in its context.

#api-key-exposure5 components · 0 still open

Drawn as a node-link graph this would be one node with 5 spokes, every spoke labelled the same word — past the 12-node budget at 13 components, and carrying nothing the rows do not. Open a component to see this weakness in its context.

#data-exposure7 components · 5 still open

#redos5 components · 0 still open

#insecure-deser3 components · 0 still open

Drawn as a node-link graph this would be one node with 3 spokes, every spoke labelled the same word — past the 12-node budget at 13 components, and carrying nothing the rows do not. Open a component to see this weakness in its context.

#prompt-injection4 components · 5 still open

Drawn as a node-link graph this would be one node with 4 spokes, every spoke labelled the same word — past the 12-node budget at 13 components, and carrying nothing the rows do not. Open a component to see this weakness in its context.

#xss2 components · 0 still open

Drawn as a node-link graph this would be one node with 2 spokes, every spoke labelled the same word — past the 12-node budget at 13 components, and carrying nothing the rows do not. Open a component to see this weakness in its context.

#config-tamper3 components · 1 still open

#info-disclosure1 component · 0 still open

Drawn as a node-link graph this would be one node with 1 spoke, every spoke labelled the same word — past the 12-node budget at 13 components, and carrying nothing the rows do not. Open a component to see this weakness in its context.

#ssrf1 component · 0 still open

#child-proc-injection1 component · 0 still open

Trust boundary at process spawn#agent-launcher ↔ AgentProcess

Across the lineboth sides, and what flows between them

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.Agent_Launcher · Trust boundary at process spawn"]
    agent_launcher["GuardLink.Agent_Launcher"]
  end
  subgraph Z1["AgentProcess · Trust boundary at process spawn"]
    agentprocess["AgentProcess"]
  end
  envvars["EnvVars"]
  configfile["ConfigFile"]
  userprompt(["UserPrompt"])
  threatmodel["ThreatModel"]
  agentprompt["AgentPrompt"]
  tui(["GuardLink.TUI"])
  agent_launcher -.-|Trust boundary at process spawn| agentprocess
  envvars -- "process.env" --> agent_launcher
  configfile -- "readFileSync" --> agent_launcher
  agent_launcher -- "writeFileSync" --> configfile
  userprompt -- "launchAgent" --> agent_launcher
  agent_launcher -- "spawn" --> agentprocess
  agentprocess -- "stdout" --> agent_launcher
  userprompt -- "buildAnnotatePrompt" --> agent_launcher
  userprompt -- "buildTranslatePrompt" --> agent_launcher
  userprompt -- "buildAskPrompt" --> agent_launcher
  threatmodel -- "model" --> agent_launcher
  agent_launcher -- "return" --> agentprompt
  tui -- "launchAgent" --> agent_launcher
  configfile -- "loadProjectConfig" --> tui
  tui -- "saveProjectConfig" --> configfile

8 nodes / 15 edges, within the 12 / 16 legibility budget · 19 neighbours just outside the frame: #blame, #cli, Commands, #dashboard, #diff, FileSystem, #gate, GitRepo, and 11 more

Declared at src/agents/launcher.ts:20.

Trust boundary at external API call#llm-client ↔ LLMProvider

Across the lineboth sides, and what flows between them

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.LLM_Client · Trust boundary at external API call"]
    llm_client(["GuardLink.LLM_Client"])
  end
  subgraph Z1["LLMProvider · Trust boundary at external API call"]
    llmprovider["LLMProvider"]
  end
  subgraph Z2["NVD · Trust boundary at external API"]
    nvd["NVD"]
  end
  savedreport["SavedReport"]
  projectfiles["ProjectFiles"]
  reportfile["ReportFile"]
  pentestfindings["PentestFindings"]
  llmconfig["LLMConfig"]
  llmtoolcall["LLMToolCall"]
  mcp["GuardLink.MCP"]
  tui(["GuardLink.TUI"])
  llm_client -.-|Trust boundary at external API call| llmprovider
  llm_client -.-|Trust boundary at external API| nvd
  savedreport -- "parseFindingsBlock" --> llm_client
  projectfiles -- "readFileSync" --> llm_client
  llm_client -- "writeFileSync" --> reportfile
  pentestfindings -- "readFileSync" --> llm_client
  llmconfig -- "chatCompletion" --> llm_client
  llm_client -- "fetch" --> llmprovider
  llmprovider -- "response" --> llm_client
  llmtoolcall -- "createToolExecutor" --> llm_client
  llm_client -- "fetch" --> nvd
  mcp -- "generateThreatReport" --> llm_client
  tui -- "chatCompletion" --> llm_client

Declared at src/analyze/llm.ts:22.

Trust boundary at external API#llm-client ↔ NVD

Across the lineboth sides, and what flows between them

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.LLM_Client · Trust boundary at external API call"]
    llm_client(["GuardLink.LLM_Client"])
  end
  subgraph Z1["LLMProvider · Trust boundary at external API call"]
    llmprovider["LLMProvider"]
  end
  subgraph Z2["NVD · Trust boundary at external API"]
    nvd["NVD"]
  end
  savedreport["SavedReport"]
  projectfiles["ProjectFiles"]
  reportfile["ReportFile"]
  pentestfindings["PentestFindings"]
  llmconfig["LLMConfig"]
  llmtoolcall["LLMToolCall"]
  mcp["GuardLink.MCP"]
  tui(["GuardLink.TUI"])
  llm_client -.-|Trust boundary at external API call| llmprovider
  llm_client -.-|Trust boundary at external API| nvd
  savedreport -- "parseFindingsBlock" --> llm_client
  projectfiles -- "readFileSync" --> llm_client
  llm_client -- "writeFileSync" --> reportfile
  pentestfindings -- "readFileSync" --> llm_client
  llmconfig -- "chatCompletion" --> llm_client
  llm_client -- "fetch" --> llmprovider
  llmprovider -- "response" --> llm_client
  llmtoolcall -- "createToolExecutor" --> llm_client
  llm_client -- "fetch" --> nvd
  mcp -- "generateThreatReport" --> llm_client
  tui -- "chatCompletion" --> llm_client

Declared at src/analyze/tools.ts:19.

Trust boundary at CLI argument parsing#cli ↔ UserInput

Across the lineboth sides, and what flows between them

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.CLI · Trust boundary at CLI argument parsing"]
    cli["GuardLink.CLI"]
  end
  subgraph Z1["UserInput · Trust boundary at CLI argument parsing"]
    userinput(["UserInput"])
  end
  subgraph Z2["GuardLink.TUI · Trust boundary at interactive input"]
    tui(["GuardLink.TUI"])
  end
  blame["GuardLink.Blame"]
  filesystem["FileSystem"]
  gate["GuardLink.Gate"]
  agentproposal["AgentProposal"]
  gitconfig["GitConfig"]
  cli -.-|Trust boundary at CLI argument parsing| userinput
  tui -.-|Trust boundary at interactive input| userinput
  blame -- "formatBlameText" --> cli
  blame -- "buildBlamePayload" --> cli
  cli -- "writeFile" --> filesystem
  userinput -- "verify" --> cli
  cli -- "runGate" --> gate
  agentproposal -- "proposeEntitlement" --> cli
  gitconfig -- "execFileSync" --> cli
  tui -- "writeFile" --> filesystem
  userinput -- "readline" --> tui

8 nodes / 11 edges, within the 12 / 16 legibility budget · 20 neighbours just outside the frame: #agent-launcher, AgentPrompt, Commands, CommitTrailers, ConfigFile, #dashboard, GitRepo, LedgerFile, and 12 more

Declared at src/cli/index.ts:43.

Trust boundary at git command execution#diff ↔ GitRepo

Across the lineboth sides, and what flows between them

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.Diff · Trust boundary at git command execution"]
    diff["GuardLink.Diff"]
  end
  subgraph Z1["GitRepo · Trust boundary at git command execution"]
    gitrepo["GitRepo"]
  end
  blame["GuardLink.Blame"]
  cli["GuardLink.CLI"]
  dashboard["GuardLink.Dashboard"]
  changedfilelist["ChangedFileList"]
  mcp["GuardLink.MCP"]
  tui(["GuardLink.TUI"])
  diff -.-|Trust boundary at git command execution| gitrepo
  blame -- "formatBlameText" --> cli
  gitrepo -- "execFileSync" --> blame
  gitrepo -- "listCommits" --> blame
  blame -- "buildBlamePayload" --> cli
  blame -- "summarise" --> dashboard
  gitrepo -- "attachBlame" --> cli
  gitrepo -- "computeBlame" --> cli
  gitrepo -- "loadSince" --> cli
  gitrepo -- "loadSince" --> dashboard
  gitrepo -- "parseAtRef" --> dashboard
  diff -- "return" --> changedfilelist
  gitrepo -- "readFileSync" --> mcp
  gitrepo -- "computeBlame" --> mcp
  gitrepo -- "computeBlame" --> tui

8 nodes / 15 edges, within the 12 / 16 legibility budget · 28 neighbours just outside the frame: #agent-launcher, AgentProposal, Commands, CommitTrailers, ConfigFile, DashboardHTML, DiagramSource, FileSystem, and 20 more

Declared at src/diff/git.ts:15.

Trust boundary at MCP protocol#mcp ↔ MCPClient

Across the lineboth sides, and what flows between them

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.MCP · Trust boundary at MCP protocol"]
    mcp["GuardLink.MCP"]
  end
  subgraph Z1["MCPClient · Trust boundary at MCP protocol"]
    mcpclient(["MCPClient"])
  end
  subgraph Z2["GuardLink.Parser · Trust boundary between parser and disk I/O"]
    parser["GuardLink.Parser"]
  end
  subgraph Z3["FileSystem · Trust boundary between parser and disk I/O"]
    filesystem["FileSystem"]
  end
  gitrepo["GitRepo"]
  configfile["ConfigFile"]
  querystring["QueryString"]
  llm_client(["GuardLink.LLM_Client"])
  mcp -.-|Trust boundary at MCP protocol| mcpclient
  parser -.-|Trust boundary between parser and disk I/O| filesystem
  mcpclient -- "guardlink_context" --> mcp
  gitrepo -- "readFileSync" --> mcp
  mcpclient -- "stdio" --> mcp
  configfile -- "readFileSync" --> mcp
  querystring -- "lookup" --> mcp
  mcpclient -- "tool_call" --> mcp
  mcp -- "writeFile" --> filesystem
  mcp -- "generateThreatReport" --> llm_client
  mcp -- "resource" --> mcpclient
  gitrepo -- "computeBlame" --> mcp
  configfile -- "readAcceptancePolicy" --> parser
  mcpclient -- "applyAnnotations" --> parser
  parser -- "writeFileSync" --> filesystem

8 nodes / 15 edges, within the 12 / 16 legibility budget · 25 neighbours just outside the frame: #agent-launcher, Annotations, #blame, #cli, #dashboard, #diff, FilePath, GrammarFile, and 17 more

Declared at src/mcp/index.ts:9.

Trust boundary at tool argument parsing#mcp ↔ MCPClient

Across the lineboth sides, and what flows between them

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.MCP · Trust boundary at MCP protocol"]
    mcp["GuardLink.MCP"]
  end
  subgraph Z1["MCPClient · Trust boundary at MCP protocol"]
    mcpclient(["MCPClient"])
  end
  subgraph Z2["GuardLink.Parser · Trust boundary between parser and disk I/O"]
    parser["GuardLink.Parser"]
  end
  subgraph Z3["FileSystem · Trust boundary between parser and disk I/O"]
    filesystem["FileSystem"]
  end
  gitrepo["GitRepo"]
  configfile["ConfigFile"]
  querystring["QueryString"]
  llm_client(["GuardLink.LLM_Client"])
  mcp -.-|Trust boundary at MCP protocol| mcpclient
  parser -.-|Trust boundary between parser and disk I/O| filesystem
  mcpclient -- "guardlink_context" --> mcp
  gitrepo -- "readFileSync" --> mcp
  mcpclient -- "stdio" --> mcp
  configfile -- "readFileSync" --> mcp
  querystring -- "lookup" --> mcp
  mcpclient -- "tool_call" --> mcp
  mcp -- "writeFile" --> filesystem
  mcp -- "generateThreatReport" --> llm_client
  mcp -- "resource" --> mcpclient
  gitrepo -- "computeBlame" --> mcp
  configfile -- "readAcceptancePolicy" --> parser
  mcpclient -- "applyAnnotations" --> parser
  parser -- "writeFileSync" --> filesystem

8 nodes / 15 edges, within the 12 / 16 legibility budget · 25 neighbours just outside the frame: #agent-launcher, Annotations, #blame, #cli, #dashboard, #diff, FilePath, GrammarFile, and 17 more

Declared at src/mcp/server.ts:50.

Trust boundary between parser and disk I/O#parser ↔ FileSystem

Across the lineboth sides, and what flows between them

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.Parser · Trust boundary between parser and disk I/O"]
    parser["GuardLink.Parser"]
  end
  subgraph Z1["FileSystem · Trust boundary between parser and disk I/O"]
    filesystem["FileSystem"]
  end
  dashboard["GuardLink.Dashboard"]
  cli["GuardLink.CLI"]
  configfile["ConfigFile"]
  mcp["GuardLink.MCP"]
  filepath["FilePath"]
  annotations["Annotations"]
  grammarfile["GrammarFile"]
  tui(["GuardLink.TUI"])
  parser -.-|Trust boundary between parser and disk I/O| filesystem
  dashboard -- "writeFileSync" --> filesystem
  cli -- "writeFile" --> filesystem
  configfile -- "readFileSync" --> mcp
  mcp -- "writeFile" --> filesystem
  configfile -- "readAcceptancePolicy" --> parser
  parser -- "writeFileSync" --> filesystem
  filepath -- "readFile" --> parser
  parser -- "parseString" --> annotations
  grammarfile -- "Language.load" --> parser
  tui -- "writeFile" --> filesystem
  configfile -- "loadProjectConfig" --> tui
  tui -- "saveProjectConfig" --> configfile

10 nodes / 13 edges, within the 12 / 16 legibility budget · 28 neighbours just outside the frame: #agent-launcher, AgentProposal, #blame, Commands, DashboardHTML, DiagramSource, #gate, GitConfig, and 20 more

Declared at src/parser/parse-project.ts:14.

Trust boundary at interactive input#tui ↔ UserInput

Across the lineboth sides, and what flows between them

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.CLI · Trust boundary at CLI argument parsing"]
    cli["GuardLink.CLI"]
  end
  subgraph Z1["UserInput · Trust boundary at CLI argument parsing"]
    userinput(["UserInput"])
  end
  subgraph Z2["GuardLink.TUI · Trust boundary at interactive input"]
    tui(["GuardLink.TUI"])
  end
  configfile["ConfigFile"]
  agent_launcher["GuardLink.Agent_Launcher"]
  filesystem["FileSystem"]
  llm_client(["GuardLink.LLM_Client"])
  commands["Commands"]
  cli -.-|Trust boundary at CLI argument parsing| userinput
  tui -.-|Trust boundary at interactive input| userinput
  configfile -- "readFileSync" --> agent_launcher
  agent_launcher -- "writeFileSync" --> configfile
  cli -- "writeFile" --> filesystem
  userinput -- "verify" --> cli
  tui -- "writeFile" --> filesystem
  tui -- "launchAgent" --> agent_launcher
  tui -- "chatCompletion" --> llm_client
  configfile -- "loadProjectConfig" --> tui
  tui -- "saveProjectConfig" --> configfile
  userinput -- "readline" --> tui
  tui -- "dispatch" --> commands

8 nodes / 13 edges, within the 12 / 16 legibility budget · 31 neighbours just outside the frame: AgentProcess, AgentPrompt, AgentProposal, #blame, #dashboard, EnvVars, #gate, GitConfig, and 23 more

Declared at src/tui/index.ts:15.

Entry to sink with nothing in the way1 of 268 routes

UserArgs→#workspace-link→AgentFiles

no declared boundary on this route src/workspace/link.ts:8 · src/workspace/link.ts:9

Searched between 26 entry points and 16 sinks — endpoints that appear in the flow graph without an @asset declaration, classified by degree: no inbound flow means data originates there, no outbound flow means it terminates there. 267 further routes run entry to sink and are defended; those are not findings. Derived from the annotations with no model in the loop, so none of this can cite a line that does not exist.

src/mcp/server.ts5 components named here

Reachesthe components this file names, and where their data goes

%%{init: {"flowchart": {"nodeSpacing": 44, "rankSpacing": 58, "curve": "basis", "htmlLabels": false}}}%%
graph LR
  subgraph Z0["GuardLink.MCP · Trust boundary at MCP protocol"]
    mcp["GuardLink.MCP"]
  end
  subgraph Z1["MCPClient · Trust boundary at MCP protocol"]
    mcpclient(["MCPClient"])
  end
  subgraph Z2["GuardLink.Parser · Trust boundary between parser and disk I/O"]
    parser["GuardLink.Parser"]
  end
  subgraph Z3["FileSystem · Trust boundary between parser and disk I/O"]
    filesystem["FileSystem"]
  end
  cli["GuardLink.CLI"]
  gitrepo["GitRepo"]
  llm_client(["GuardLink.LLM_Client"])
  mcp -.-|Trust boundary at MCP protocol| mcpclient
  parser -.-|Trust boundary between parser and disk I/O| filesystem
  cli -- "writeFile" --> filesystem
  gitrepo -- "attachBlame" --> cli
  gitrepo -- "computeBlame" --> cli
  gitrepo -- "loadSince" --> cli
  mcpclient -- "guardlink_context" --> mcp
  gitrepo -- "readFileSync" --> mcp
  mcpclient -- "stdio" --> mcp
  mcpclient -- "tool_call" --> mcp
  mcp -- "writeFile" --> filesystem
  mcp -- "generateThreatReport" --> llm_client
  mcp -- "resource" --> mcpclient
  gitrepo -- "computeBlame" --> mcp
  mcpclient -- "applyAnnotations" --> parser
  parser -- "writeFileSync" --> filesystem

7 nodes / 16 edges, within the 12 / 16 legibility budget · 32 neighbours just outside the frame: AgentProposal, Annotations, #blame, ConfigFile, #dashboard, #diff, FilePath, #gate, and 24 more