threat-model-discipline

在测试前建立并维护威胁模型，识别攻击面与覆盖漂移

先把要测的东西画清楚：哪儿是资产、入口、信任边界、已做的防护和可能用到的 ATT&CK 技术。启动测试、或环境变更（新接口、新依赖）时用，能发现那些“没被看过”的新攻击面。特别在长期项目里有用，能把盲点变成有意识的覆盖，避免随意测试漏掉关键路径。

# Threat-Model Discipline

## Overview

**You cannot test what you have not modeled.** A threat model names the assets, entry points, trust
boundaries, relevant ATT&CK techniques, and existing mitigations — so coverage is deliberate, not
accidental. On a long engagement the surface drifts (a new endpoint, a new dependency); **un-reviewed
drift is where bugs hide.** This skill keeps the model complete and re-checks it for drift.

## When to Activate

- At engagement start (after recon-osint), before weaponize/exploit.
- Whenever recon is re-run or the target changes — to catch new attack surface.
- At `/engage.gate` — the gate refuses to advance on un-acknowledged drift.

## The model (JSON,