v0.8.0 Release Notes¶

Release Date: 2026-08-15

This release makes Threat Model Spec PDLC-aware: a threat model can now accumulate stage-by-stage analysis across the six-stage Product Development Lifecycle, track it through gate evaluation, and export computed framework-specific reports — all from one canonical model, orchestrated (not authored) by tms.

Highlights¶

Seven new lifecycle object types (Artifact, AnalysisRun, Evidence, Finding, SecurityRequirement, ArchitectureAssertion, Gate) tracking stage-by-stage analysis
Six-stage PDLC model (product-definition, builder-definition, implementation, deployment, builder-operations, product-operations) with a 10-domain ASPM overlay on the three builder-side stages
StageReportProfile and ArtifactAvailabilityProfile — normative per-stage contracts and first-party/third-party/open-source availability profiles, so every stage is always accounted for (permitted or explicitly not-analyzable with a reason)
Six calibrated stage rubrics and EvaluateStageGate, distinguishing an unevaluated coverage check from a failed one
tms analyze — two-phase plan/apply orchestration around an AI agent's reasoning step, with atomic apply (an invalid merge writes nothing)
Four new/extended read verbs — tms status, tms report, tms gate, tms profile — with human and --json output modes and CI-meaningful exit codes
FrameworkReport — computed STRIDE/LINDDUN/MITRE ATT&CK/OWASP/attack-tree views derived fresh from the canonical model, with staleness detection for materialized snapshots
Six PDLC stage-analyst agent specs, generated into Claude Code, Kiro, and Gemini plugins
Two real dogfood runs: a first-party self-assessment of this project, and an open-source-profile assessment of a real external dependency (lodash, CVE-2021-23337) — both graded honestly against the new rubrics, both surfacing real gaps rather than rubber-stamping

What's New¶

PDLC Lifecycle Objects¶

{
  "lifecycle": {"currentStage": "implementation"},
  "artifacts": [{"id": "artifact-1", "type": "source-tree", "uri": "src/handler.go", "stage": "implementation"}],
  "analysisRuns": [{
    "id": "run-1", "stage": "implementation", "profile": "first-party",
    "producer": {"type": "agent", "name": "implementation-analyst"},
    "inputArtifactIds": ["artifact-1"], "status": "completed"
  }],
  "findings": [{
    "id": "finding-1", "type": "vulnerability", "stage": "implementation",
    "title": "SQL injection via unsanitized query parameter",
    "evidenceIds": ["evidence-1"], "confidence": 0.95, "status": "validated",
    "aspmDomainId": "code-security"
  }]
}

Asset, ThreatActor, Scenario, and Mitigation gained an optional producerRunId, so objects produced by an analysis run are traceable back to it the same way Finding already was.

`tms analyze`¶

# Plan mode: resolve inputs, open an AnalysisRun
tms analyze model.json --stage implementation --profile first-party \
  --producer implementation-analyst src/handler.go

# Apply mode: validate + merge atomically, close the run
tms analyze model.json --stage implementation --apply results.json --run <run-id>

tms analyze is the only command that writes to the model — every other command (status, report, gate, profile, validate) is a pure read.

Read Verbs¶

tms status model.json --json          # per-stage runs/gates + findings summary
tms gate model.json --stage deployment --ci
tms report model.json --framework attack-tree --format markdown
tms profile third-party

FrameworkReport¶

tms report model.json --framework stride

{
  "framework": "stride",
  "strideBody": {
    "categoriesCovered": ["S", "I", "E"],
    "categoriesMissing": ["T", "R", "D"]
  }
}

New Types¶

Type	Description
`Stage`	Six-value PDLC stage enum
`ASPMDomain`	One of ten ASPM domains overlaying the builder-side stages
`Artifact`	A source input an analysis run was performed against
`AnalysisRun`	Records who analyzed what, how, and when
`Evidence`	Tagged-union locator (file/document/config/query/url)
`Finding`	An analyzer's claim requiring adjudication
`SecurityRequirement`	An invariant or prohibited outcome
`ArchitectureAssertion`	Intended-vs-observed drift detection
`Gate`	Stage-gate evaluation criteria and result
`StageReportProfile`	Normative per-stage report contract
`ArtifactAvailabilityProfile`	Maps available artifacts to analyzable stages
`FrameworkReport`	Computed framework-specific view
`AnalysisResults`	The output-object contract an agent returns to `tms analyze --apply`

Dependency Updates¶

github.com/plexusone/structured-evaluation updated to v0.14.0
New cross-repo dependencies: github.com/ProductBuildersHQ/pdlc, github.com/ProductBuildersHQ/specification-workflow-spec, github.com/ProductBuildersHQ/productbuildershq-frameworks (the PDLC stage taxonomy's source of truth)

Installation¶

Go Library¶

go get github.com/grokify/threat-model-spec@v0.8.0

CLI Tool¶

go install github.com/grokify/threat-model-spec/cmd/tms@v0.8.0

Requirements¶

Go 1.25+
D2 v0.6+ (for SVG rendering)