Threat model · RFC 014
Split ingestion reduces blast radius but does not settle overload behavior
The review gate is 2026-10-28; isolation improves while RAID-02 remains unresolved.
System and trust boundaries
Producers use mTLS and an audience claim. The gateway accepts events, the dispatcher partitions by ID, queues isolate work, consumers write to the warehouse, and the operator overview is read-only.
Threat and treatment ledger
| ID | Threat | Control | Residual state |
|---|---|---|---|
| THR-01 | Forged caller audience | mTLS + audience claim | Negative tests |
| THR-02 | Replayed event ID | Idempotent write | Test both queues |
| THR-03 | Queue-flood denial of service | Bounded shedding + isolation | RAID-02 unresolved |
| THR-04 | Operator metadata exposure | Read-only least privilege | Review before go-live |
Platform owns evidence; Reliability accepts residual availability risk.