Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, this project adheres to Semantic Versioning, commits follow Conventional Commits, and this changelog is generated by Structured Changelog.

Unreleased

v0.9.0 - 2026-09-13

Highlights

• Agentic-collective modeling: agent collectives, emergent coordination channels, and reward-hacking constructs
• Incident modeling: vulnerability inventory (KEV-cross-referenceable), timeline, and alignment-failure-mode mappings
• Finding framework categorization (STRIDE/OWASP/MITRE) with deterministic coverage checks and computed stage gates

Added

• Agent collective modeling: members, coordination channel, emergent behaviors, population/scale (27ec614)
• coordination flow type for covert/emergent inter-agent channels (27ec614)
• reward-hacking and emergent-agent-coordination attack-pattern templates (27ec614)
• Vulnerability inventory (software CVEs and non-software config/credential/design weaknesses) and Timeline (27ec614)
• AlignmentFailureMode mappings and per-section summaries; flattened MITRE ATLAS mapping (id/name) (27ec614)
• Emergent coordination channel rendering (distinct teal dashed stroke) (2dba5f5)
• Agentic-collective emergent-coordination flagship example (2bce3f9)
• STRIDE/OWASP/MITRE framework categorization fields on Finding (21bf4bd)
• ComputeCoverageChecks for deterministic coverage computation (268422d)
• Compute and record stage gates in tms analyze --apply (04897ca)
• Prohibited-outcome requirement in the flagship example (91fd8ae)
• Product-definition-analyst guidance for authoring prohibited outcomes (4c9565c)

Changed

• Regenerate threat-model and diagram JSON schemas for agentic-collective types (8a26c12)
• Regenerate threat-model schema for Finding framework fields (09c0365)

Documentation

• v0.9.0 versioned specification snapshot (8b8d098)
• Document lifecycle IR objects and wire into the spec nav (29483fb)
• CLI reference pages for analyze, gate, report, status, profile (6c35d5e)
• Document the assistantkit regeneration workflow for agent plugins (6efce98)
• Add INIT-THREATMODELSPEC-003 specs (PRD/TRD/PLAN/ROADMAP) (b342f0a)
• Cancel INIT-003 Phase 2 (embedded Dolt persistence) (9a3ca31)

v0.8.0 - 2026-08-15 (13d50d2)

Highlights

• PDLC-aware lifecycle analysis: seven new object types (Artifact, AnalysisRun, Evidence, Finding, SecurityRequirement, ArchitectureAssertion, Gate) tracking stage-by-stage analysis across a six-stage Product Development Lifecycle
• 10-domain Application Security Posture Management (ASPM) overlay on the three builder-side PDLC stages
• StageReportProfile and ArtifactAvailabilityProfile: normative per-stage report contracts and first-party/third-party/open-source availability profiles, so every stage is always accounted for
• Six calibrated stage rubrics and EvaluateStageGate, distinguishing an unevaluated coverage check from a failed one
• tms analyze: two-phase plan/apply orchestration around an AI agent's reasoning step, with atomic apply
• tms status, tms report, tms gate, tms profile: read verbs with human and --json output modes and CI-meaningful exit codes
• FrameworkReport: computed STRIDE/LINDDUN/MITRE ATT&CK/OWASP/attack-tree views derived fresh from the canonical model, with staleness detection for materialized snapshots
• Six PDLC stage-analyst agent specs generated into Claude Code, Kiro, and Gemini plugins
• Two real dogfood runs (first-party self-assessment; open-source-profile assessment of lodash/CVE-2021-23337), both graded honestly against the new rubrics

Added

• ir.Stage enum and ASPM domain overlay (ir.ASPMDomain) (47e2e99)
• PDLC lifecycle IR objects: Artifact, AnalysisRun, Evidence, Finding, SecurityRequirement, ArchitectureAssertion, Gate (2ba1338)
• evaluation.StageReviewType and Finding-status/claims.Verdict conventions (a5fa190)
• StageReportProfile and ArtifactAvailabilityProfile (first-party/third-party/open-source) (6b93b0e)
• Six stage rubrics with calibration fixtures (evaluation/rubrics/stages/) (bf2be21)
• evaluation.EvaluateStageGate (42d7fa1)
• tms gate command (57280fd)
• Six PDLC stage-analyst agent specs and /analyze-<stage> slash commands (1eedc17)
• AnalysisResults output-object contract; producerRunId provenance on Asset/ThreatActor/Scenario/Mitigation (304f240)
• tms analyze command (plan/apply orchestration) (bbc4f64)
• FrameworkReport computed views (STRIDE/LINDDUN/MITRE ATT&CK/OWASP/attack-tree) (2065652)
• FrameworkReport.RenderMarkdown() and ir.FrameworkReportDigest for staleness detection (2d1ff3a)
• tms report command and tms validate staleness warning (d3247af)
• --json output on tms gate (b21da97)
• tms status command (369e880)
• tms profile command (204fa44)

Changed

• Cross-repo dependencies added: github.com/ProductBuildersHQ/pdlc, specification-workflow-spec, productbuildershq-frameworks (bf564e6)
• structured-evaluation updated to v0.14.0 (de45034)
• agents/plugins/{claude,kiro,gemini}/ regenerated to include the six new stage-analyst agents alongside the existing three diagram agents (763f5e0)
• JSON schemas regenerated for the full PDLC lifecycle IR; schema version bumped to v0.8.0 (additive, fully backward compatible with v0.7.0) (3e6e691)

Documentation

• Stage report and artifact-availability specification sections (b7058b7)
• v0.8.0 versioned specification, release notes, and CHANGELOG

v0.7.0 - 2026-06-01 (7c716a2)

Highlights

• Agentic AI threat modeling with agent capabilities and execution context
• Credential flow tracking for token exfiltration and replay attack modeling
• WebSocket security configuration and CSWSH modeling
• LLM-as-Judge evaluation package with structured-evaluation integration

Added

• AgentCapabilities type for AI agent tool access and autonomy levels (73cdb1a)
• ExecutionContext type for runtime environment and privilege modeling (6fc628f)
• CredentialFlow type for token lifecycle tracking (839bbf2)
• AttackPattern type for reusable attack pattern templates (8d84b0e)
• WebSocketConfig type for WebSocket endpoint security (03bd00b)
• Trust modeling fields: ImplicitlyTrusted, TrustAssumption, TrustViolationRisk on Boundary (f08b533)
• Flow security fields: Protocol, Encrypted, Authenticated, CrossOrigin (f08b533)
• New boundary types: container, sandbox, agent, origin (e1088c7)
• New flow types: credential, websocket, cswsh, lateral (e1088c7)
• evaluation package for LLM-as-Judge workflows (ae518ae)
• Embedded rubrics: VulnerabilityArticleRubric(), ThreatModelRubric(), DiagramRubric() (ae518ae)
• ToEvaluationReport() and ToClaimsReport() conversion methods (de42ab8)
• Vulnerability article template for security advisory evaluation (ba6fcc0)

Changed

• JSON schemas regenerated for v0.7.0 types (e922b4f)
• Updated structured-evaluation dependency to v0.6.0 (57c149a)
• ThreatModel extended with CredentialFlows and AttackPatterns fields (e8030e9)

Fixed

• Windows compatibility for embedded rubric loading (path.Join for embed.FS) (5d2785b)

Documentation

• v0.7.0 release notes with agentic AI and evaluation features (7c716a2)

v0.6.0 - 2026-05-02 (a09ce96)

Highlights

• Role-based security data for Red Team, Blue Team, and Remediation workflows
• FAIR risk assessment with annualized loss expectancy calculations
• Purple team capabilities with Atomic Red Team mapping and detection coverage
• Supply chain security with SBOM integration and VEX statements
• OWASP Agentic Security Top 10 (ASI 2026) support

Added

• OWASPCategoryAgentic for OWASP ASI 2026 mappings (4b11ee2)
• ExploitationGuidance type for red team exploitation steps (6d46d99)
• DefenseGuidance type for blue team detection rules and IOCs (b458b62)
• RemediationGuidance type for developer fix patterns (2fdfa71)
• IncidentPlaybook type for IR procedures (f4aa70e)
• FAIRAssessment type with ALE calculation (a070bc0)
• EPSSData type for exploit prediction scoring (606b93f)
• KEVEntry type for CISA KEV catalog (8fe4ca3)
• AtomicTestMapping type for Atomic Red Team tests (c5d9af2)
• DetectionCoverageMatrix type for ATT&CK coverage (67d29a8)
• SecurityMetrics type for MTTD/MTTR/MTTC (e0c8f6e)
• SSVCAssessment type for CISA SSVC prioritization (6a2fb26)
• SBOMReference and VEXStatement types for supply chain (bd020f9)
• AttackGraph and AttackPath types for path analysis (4fe2bcc)
• STIX 2.1 export with IOCs and detection rules (390dcdc)
• TestReference type for app-test-spec integration (0490ece)

Changed

• ThreatModel extended with role-based guidance fields (abb1492)
• Attack struct extended with role-based notes (4e0ec8a)
• JSON schemas regenerated for v0.6.0 (1c4caab)

Documentation

• v0.6.0 release notes (49bd42c)
• v0.6.0 versioned specification (f8c0691)
• OWASP ASI documentation (c6fe925)
• Homepage updated with v0.6.0 features (f714846)
• Mappings spec with OWASP agentic category (a09ce96)

Tests

• Mappings and attack tree validation tests (52b36f7)

v0.5.0 - 2026-04-19

Highlights

• Design-time threat modeling for proactive security analysis during SDLC
• Structured risk assessment with likelihood × impact scoring
• Asset inventory with sensitivity classification and compliance mapping
• What-if scenario modeling for attack path analysis
• Network topology mapping for infrastructure diagrams

Added

• RiskAssessment type with likelihood × impact scoring (1-5 scales) (cf1bb0d)
• RiskLevel categorical risk levels (critical/high/medium/low/info) (cf1bb0d)
• ModelPhase for SDLC phase tracking (design/development/review/production/incident) (cf1bb0d)
• Asset type with sensitivity classification and compliance mapping (cf1bb0d)
• SensitivityLevel for data classification (public/internal/confidential/restricted/secret) (cf1bb0d)
• Scenario type for what-if attack scenario modeling (cf1bb0d)
• ScenarioType categorization (external-attack/insider-threat/supply-chain/etc.) (cf1bb0d)
• NetworkInfo and CloudInfo for network topology mapping (aa4390a)
• ThreatStatusPotential for hypothetical threats from design review (48dcc7c)
• ThreatStatusTheoretical for threats derived from STRIDE/LINDDUN (48dcc7c)
• Design-time threat modeling guide with SDLC integration (c10ab34)
• Risk assessment guide with likelihood/impact scales (c10ab34)

Changed

• ThreatModel extended with Phase, Assets, and Scenarios fields (48dcc7c)
• ThreatEntry extended with Risk, LINDDUNCategory, AffectedAssets, AttackVector, Preconditions (48dcc7c)
• Element extended with Network and AssetIDs fields (aa4390a)
• JSON schemas regenerated for v0.5.0 (5a09bac)

Documentation

• Design-time threat modeling guide (guides/design-time-threat-modeling.md) (c10ab34)
• Risk assessment guide (guides/risk-assessment.md) (c10ab34)
• MkDocs Guides section added to navigation (c10ab34)

v0.4.0 - 2026-04-19

Highlights

• Versioned specification structure following OpenAPI pattern (versions/v0.4.0/)
• Comprehensive security lifecycle: mitigations, detections, and response actions
• Attack tree diagrams with AND/OR logic gates
• LINDDUN privacy threat framework with D2 rendering
• Control framework mappings: NIST CSF, CIS Controls v8, ISO 27001
• Compliance framework references: SOC 2, PCI-DSS, HIPAA, GDPR, FedRAMP

Added

• Security lifecycle types: Assumption, AttackTree, Compliance, Controls, Detection, LINDDUN, Mitigation, ThreatActor (b117a41)
• Attack tree diagram type with AND/OR logic gates (attack-tree) (b117a41)
• LINDDUN privacy threat framework with 7 categories (L, I, N, D, Di, U, Nc) (b117a41)
• Mitigations tracking with status lifecycle (planned, implemented, partial, accepted, transferred) (b117a41)
• Threat status tracking with ThreatEntry and ThreatStatus types (80479b5)
• Control framework mappings: NIST CSF, CIS Controls v8, ISO 27001 (b117a41)
• Compliance framework references: SOC 2, PCI-DSS, HIPAA, GDPR, CCPA, FedRAMP, NIST SP 800-53 (b117a41)
• Threat actor profiles with sophistication, motivation, and resources (b117a41)
• Detection capabilities with coverage levels and data sources (b117a41)
• Response actions for incident response workflows (80479b5)
• Assumptions and prerequisites for documenting model constraints (b117a41)
• CVE references in mappings (CVEMapping type) (80479b5)
• D2 legend rendering for LINDDUN threats and mitigation status (80479b5)
• Attack tree D2 rendering with AND/OR gate visualization (80479b5)
• STIX 2.1 export for CVE, OWASP, and mitigations (09d37e2)
• Version parameter for genschema command (a5be772)
• Versioned specification structure (versions/v0.4.0/) (f3cceee)

Changed

• Mappings struct extended with CVE, LINDDUN, Controls, and Compliance fields (80479b5)
• DiagramIR extended with AttackTree, Threats, Mitigations, Detections, ResponseActions (80479b5)
• Legend extended with ShowLINDDUN and ShowMitigations options (80479b5)
• JSON schemas regenerated to include all new types (22cbf10)

Documentation

• Versioned specification document (versions/v0.4.0/specification.md) (f3cceee)
• v0.4.0 release notes (2f6bdf4)
• README updated with new framework tables and usage examples (f3cceee)

v0.3.0 - 2026-04-18

Highlights

• Agent specifications and Claude Code plugin for threat model diagram creation
• Examples moved to separate repository for focused maintenance

Added

• Agent specifications for threat model visualization (attack-flow-visualizer, diagram-quality-reviewer, dfd-creator) (989e963)
• Claude Code plugin with agents, commands, and skills (989e963)

Changed

• Examples directory removed (moved to separate repository) (cddf666)

Dependencies

• 2 dependency updates

v0.2.0 - 2026-03-02

Highlights

• ThreatModel canonical format for multi-diagram threat models with shared metadata and framework mappings
• JSON Schema generation and embedding for validation support

Added

• ThreatModel type as canonical format for multi-diagram threat models with shared metadata (70801bd)
• schema/ package with JSON Schema generation and embedding (threat-model.schema.json, diagram.schema.json) (70801bd)
• cmd/genschema tool for generating JSON schemas from Go types (70801bd)
• CLI auto-detection of ThreatModel vs DiagramIR format (2763dc1)
• CLI generates separate D2 files for each diagram when processing ThreatModel (2763dc1)
• STIX 2.1 export for OpenClaw example (4d7e2f1)

Changed

• Unified examples/openclaw/openclaw.json replaces separate diagram files (70801bd)
• CLI validate command reports ThreatModel format and diagram count (2763dc1)
• Consolidated STIX exports into single vulnerability file (65585f1)

Documentation

• Architecture diagram added to README showing ThreatModel flow (433e1a2)
• README updated for ThreatModel as recommended format (3d12567)
• MkDocs documentation updated for ThreatModel format (6c120a5)
• JSON Schema documentation page added (2763dc1)

v0.1.0 - 2026-03-01

Highlights

• JSON-based intermediate representation for threat modeling diagrams with D2 and STIX 2.1 export
• Comprehensive security framework mappings: MITRE ATT&CK, MITRE ATLAS, OWASP Top 10 (API/LLM/Web), CWE, CVSS, STRIDE

Added

• JSON IR schema for threat modeling diagrams (DFD, Attack Chain, Sequence) (cf579f5)
• ir package with types for elements, boundaries, flows, attacks, actors, and messages (cf579f5)
• ir/mappings.go with framework mapping types for MITRE ATT&CK, ATLAS, OWASP, CWE, CVSS, and STRIDE (cf579f5)
• diagram package for programmatic diagram construction with D2 rendering (622761e)
• stix package for STIX 2.1 export (Bundle, AttackPattern, ThreatActor, Infrastructure, Indicator, Vulnerability) (a04d572)
• stride package with STRIDE threat category types and color mappings (06828c7)
• killchain package with MITRE ATT&CK tactics and Lockheed Martin Cyber Kill Chain phases (156ae02)
• tms CLI with generate, validate, and version subcommands (38cb8fa)
• tms generate --stix flag for STIX 2.1 JSON export (38cb8fa)
• tms generate --svg flag to render D2 diagrams to SVG (38cb8fa)
• D2 style library with classes for STRIDE threats, trust boundaries, DFD elements, and attack flows (fb84caf)
• OpenClaw WebSocket vulnerability example with DFD, attack chain, and sequence diagrams (923f9b8)
• Demo vulnerable server and malicious page for educational attack demonstration (29d839c)
• Validation for diagram type-specific field requirements (cf579f5)

Changed

• CLI migrated from flag to Cobra framework for consistent experience and extensibility (5c4bc99)

Documentation

• README with installation, quick start, and framework mapping reference (084c3a1)
• OpenClaw article.html with comprehensive vulnerability analysis and OWASP mappings (923f9b8)
• D2 style reference for STRIDE threat annotations and trust boundaries (084c3a1)
• README badges for CI, lint, SAST, Go Report Card, and docs (b356c7a)
• MkDocs documentation site with Material theme (ece6be6)

Build

• GitHub Actions workflows for CI, lint, and CodeQL SAST (cf9f749)
• Dependabot configuration for Go modules and GitHub Actions (d9ddcdc)