14. Threat model

A living, adversarial view of the storage system: what is worth attacking, where the trust boundaries are, who the adversaries are, and which attacks a distributed file store must withstand — each mapped to the decision that mitigates it. The trust framing follows single-provider, closed federation (section 8.5, ADR-0005); this chapter is the model itself. STRIDE classifies (section 14.4); the reader and abuse-case tests are the verification rubric, run under the deterministic-simulation harness (ADR-0009, section 13). It is v0/evolving and hardens as surfaces are built — a threat model is never "complete", and most of Wyrd's attack surface (the network and the multi-tenant boundary) does not exist in code until M2.

14.1 Assets

14.2 Trust boundaries

Boundaries from least- to most-trusted. The shape follows the dumb-storage / thick-client / centralized-policy split (sections 3, 5, 8.5).

• Internet — external clients (SDK, S3, WebDAV callers), relying applications. Untrusted.
• Access layer / gateway (L1) — the authentication and authorization boundary: it resolves the caller, fetches the version-fenced ACL, and enforces quota / rate before issuing any storage operation. Nothing below L1 re-authenticates the external principal (section 8.5).
• D servers (the dumb storage tier) — the least-trusted internal data tier: tenant-oblivious, holding only opaque (ciphertext, when encryption is on) fragments and their checksums, addressed by chunk id. They may run on less-trusted storage hardware (ADR-0021).
• Zonal metadata + coordination (L4 / L5) — the commit authority and the lease/fencing store; network-isolated to the zone's control components, fronted by the mTLS fabric (section 8.5).
• Global namespace / control plane (L2) — the most-trusted tier: the linearizable namespace, placement, zone registry, and the authoritative ACLs (ADR-0020).
• Custodian (L4) — the single-active, fenced maintenance plane; it holds the GC delete authority, so it is a high-consequence component (ADR-0011).
• KMS / KeyService — the key-custody boundary; it holds KEKs and never sees plaintext data (ADR-0021).
• Admin / management plane — the operator surface (ADR-0013).
• Tenant isolation — a cross-cutting boundary: no cross-tenant read or traversal on any path (section 8.8, ADR-0022).

D-server-compromise blast radius (a stated property). An attacker who fully compromises a D server gains only ciphertext fragments and their checksums — no keys (KMS-held), no metadata or namespace, no ACLs. They cannot forge a commit (the commit point is the metadata store's, fenced by version), and they cannot cause durability loss of a chunk they do not hold (its k+m fragments are placed across distinct failure domains, so any k survivors reconstruct it). They can deny service for the fragments they hold, or return a stale / corrupted fragment — which is caught on read by the crc32c payload checksum and by the scrubber, then reconstructed from survivors. This bounded blast radius is the security payoff of the dumb-D-server / thick-client split (section 8.5, ADR-0019, ADR-0021) and is the storage analog of an edge-cache compromise: a less-trusted tier holds no secret worth stealing.

14.3 Adversaries

Anonymous internet attacker · malicious or compromised external client (S3 / SDK / WebDAV) · malicious or compromised tenant administrator · a co-tenant (isolation breach) · network MITM on the internal fabric · a compromised D server (less-trusted storage hardware) · a compromised custodian or coordination node · malicious insider / operator · supply-chain attacker · a non-Rust thick-client re-implementer that writes corrupt or non-atomic data (a correctness adversary, section 8.6).

14.4 STRIDE, per boundary

14.5 The storage attack catalog

Each defended attack maps to the decision that owns it.

14.6 Abuse-case tests

The catalog above is made mechanical: each defended attack is asserted to fail, seed-reproducible, from the milestone where its surface first exists — the security analog of the conformance vectors (section 8.6). Representative cases:

• a fragment with a corrupted header checksum is rejected, before any header field is trusted (M0);
• a fragment with a flipped payload byte is rejected, and the chunk still reconstructs from k survivors (M1);
• a write interrupted at every step leaves either the old version or the new, never a hybrid, and its orphans are collected (M0, Q3);
• a referenced fragment is never reclaimed while a reader holds the old version (M3, Q3);
• a lease expired past the skew budget does not renew (M3, ADR-0024);
• a fragment offered under the wrong chunk id is rejected (M2);
• a plaintext (non-mTLS) internal dial is refused (M2, ADR-0025).

A defended attack that ever succeeds becomes a permanent regression. The reader's parse path (chunk_format::decode) should additionally be fuzzed continuously (a planned addition, section 14.9), since it is the one component that consumes fully untrusted bytes — a fixed conformance corpus cannot explore the input space the way coverage-guided fuzzing does.

14.7 Threat → test map

The catalog mapped to where each threat is verified. Tiers are the realism-and-cost ladder of section 13; "DST" is Tier 0, the correctness authority.

14.8 Residual and accepted risks

• Replication-lag staleness window — stale-tolerant reads may lag the latest by up to the replication lag; the deliberate cost of edge-local reads (section 8.1).
• Bounded repair / scrub latency — corruption is detected within the scrub-cycle period P, not instantaneously (Q2).
• D-server-held ciphertext — a compromised D server holds ciphertext; confidentiality rests on the KEK staying in the KMS, bounded by per-tenant key separation (ADR-0021).
• Admission fail-closed availability cost — under pressure a write is refused, never half-done; correctness outranks admission (section 8.9).
• Single-provider operator trust — operators are trusted within the provider (no cross-operator verify-everything, ADR-0005); insider risk is bounded by the append-only audit log and envelope encryption (the operator cannot read a tenant's directory).

14.9 Gaps and their disposition

The threat model records its own holes and tracks them to closure.

Decided in (Proposed) ADRs (they refine the architecture):

• Clock / time-source trust — bounded skew + authenticated time + implausible-clock fail-closed (ADR-0024).
• Internal service-to-service trust — the enforcement contract for the mTLS fabric already chosen in ADR-0005: least authority per component, certificate-as-identity, no plaintext fallback (ADR-0025). M2 refuses plaintext on the wire; the enforcement half — authorization against a first-class identity, so a valid certificate cannot do out-of-role operations — is retired at M5 (proposal 0013), which cites this gap as its load-bearing risk.
• Build / release integrity — signed releases (Sigstore/cosign keyless), SLSA build provenance, and commit-SHA-pinned Actions (ADR-0030); binding from the first published release artifact.

Still genuinely open:

• Key-compromise emergency response — a runbook for wholesale KEK revocation + forced re-encryption (distinct from planned re-wrap rotation, ADR-0021) is not yet written.
• The proto / network input-validation surface — fuzzing and hardening of the gRPC decode path land with the networked tier (M2); only the on-disk reader is hardened today.
• CI security workflows — a CodeQL (Rust) static-analysis workflow and a coverage-guided fuzz target on chunk_format::decode are planned additions, alongside the existing cargo-deny, Dependabot, and cargo-mutants jobs; OSS-Fuzz / Scorecard enrolment is reserved.
• Privacy threat modeling (LINDDUN) — a deeper privacy pass over metadata / PII is reserved, not built into this STRIDE pass.