Multi round debat

.claude/skills/secopstm-threat-modeling/SKILL.md

@@ -25,7 +25,7 @@ description: Perform comprehensive threat modeling for target systems using SecO
 
 ```
 {system-name}/
-├── model.md                    # Threat model
+├── model.md                    # System model
 ├── context/
 │   └── {system-name}_context.yaml
 ├── BOM/
@@ -129,7 +129,7 @@ Output modeling strategy for user confirmation: system name, complexity (high/me
   - "Drone 350" → `drone-350`
 
 **Filename Consistency**:
-- model.md title: `# Threat Model: DJI Power Inspection`
+- model.md title: `# System Model: DJI Power Inspection`
 - Context file: `context/dji-power-inspection_context.yaml`
 - Ensure consistent use of hyphens/underscores
 

.claude/skills/secopstm-threat-modeling/references/context-format.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-The GDAF (Generic Threat Modeling and Attack Framework) context file defines the attack context for threat modeling. It includes attack objectives, threat actors, and risk criteria.
+The GDAF (Goal-Driven Attack Flow) context file defines the attack context used for attack path analysis. It includes attack objectives, threat actors, and risk criteria.
 
 ## File Location
 

.claude/skills/secopstm-threat-modeling/references/dsl-syntax.md

@@ -18,7 +18,7 @@
 
 ## Overview
 
-SecOpsTM threat model is a Markdown file parsed in three passes:
+A SecOpsTM system model is a Markdown file parsed in three passes:
 
 1. **Pass 0** — `## Context` (model-level configuration)
 2. **First pass** — `## Boundaries`, `## Actors`, `## Servers`, `## Data` (element definitions)
@@ -40,14 +40,16 @@ SecOpsTM threat model is a Markdown file parsed in three passes:
 **⚠️ CRITICAL**: model.md must use the following title format:
 
 ```markdown
-# Threat Model: {System Name}
+# System Model: {System Name}
 ```
 
 **Format requirements**:
-- Must start with `# Threat Model: ` (English colon `:` + space)
+- Must start with `# System Model: ` (English colon `:` + space)
 - System name follows after the space
-- **Correct**: `# Threat Model: DJI Power Inspection Drone System`
-- **Incorrect**: `# DJI Power Inspection Drone System - Threat Model`
+- **Correct**: `# System Model: DJI Power Inspection Drone System`
+- **Incorrect**: `# DJI Power Inspection Drone System - System Model`
+- The legacy `# Threat Model: {System Name}` form is still read correctly (with a
+  deprecation warning) — always write new models with `# System Model:`.
 
 **Impact**: Incorrect title format causes SecOpsTM to fail generating report filenames correctly.
 
@@ -163,7 +165,7 @@ Actors represent people, external systems, or roles interacting with the system,
 
 ## Section: Servers
 
-Servers represent assets, components, or systems in the threat model.
+Servers represent assets, components, or systems in the system model.
 
 ### Server Attributes
 
@@ -482,7 +484,7 @@ Use `config/asset_types_community.yaml` and `config/protocols_community.yaml` to
 **⚠️ CRITICAL FORMAT REQUIREMENT**: SecOpsTM parser requires EXACT DSL syntax. DO NOT use custom Markdown formats like `### Boundary:` or `**Name**:`. Use ONLY the list format shown below.
 
 ```markdown
-# Threat Model: {System English Name}
+# System Model: {System English Name}
 
 ## Description
 {High-level system description in English}

.claude/skills/secopstm-threat-modeling/references/modeling-strategy.md

@@ -41,7 +41,7 @@ Use single-model when **ALL** of the following are true:
 
 ```
 {system-name}/
-├── model.md                    # Single threat model
+├── model.md                    # Single system model
 ├── context/
 │   └── {system-name}_context.yaml
 ├── BOM/

.claude/skills/secopstm-threat-modeling/references/naming-conventions.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-Proper naming conventions ensure consistency and readability in threat models.
+Proper naming conventions ensure consistency and readability in system models.
 
 ## Asset Names
 

.claude/skills/secopstm-threat-modeling/references/output-structure.md

@@ -8,7 +8,7 @@ This document describes the output structure for SecOpsTM threat modeling.
 
 ```
 {system-name}/
-├── model.md                    # Threat model
+├── model.md                    # System model
 ├── context/
 │   └── {system-name}_context.yaml
 ├── BOM/
@@ -22,7 +22,7 @@ This document describes the output structure for SecOpsTM threat modeling.
 
 | File | Required | Description |
 |------|----------|-------------|
-| `model.md` | ✅ | Main threat model file in SecOpsTM DSL format |
+| `model.md` | ✅ | Main system model file in SecOpsTM DSL format |
 | `context/{system-name}_context.yaml` | ✅ | GDAF attack context (objectives, threat actors, risk criteria) |
 | `BOM/{asset_name}.yaml` | ✅ | Bill of Materials - one file per key asset |
 | `config/asset_types_community.yaml` | ❌ | Custom asset type definitions (if needed) |
@@ -56,7 +56,7 @@ This document describes the output structure for SecOpsTM threat modeling.
 |------|----------|-------------|
 | `main.md` | ✅ | Top-level architecture showing subsystem boundaries and data flows |
 | `context/{project-name}_context.yaml` | ✅ | Global GDAF context for the entire project |
-| `{subsystem}/model.md` | ✅ | Subsystem-specific threat model |
+| `{subsystem}/model.md` | ✅ | Subsystem-specific system model |
 | `{subsystem}/BOM/{asset}.yaml` | ✅ | Subsystem-specific BOM files |
 | `config/*` | ❌ | Custom asset types and protocols (shared across subsystems) |
 

.claude/skills/secopstm-threat-modeling/references/staging-format.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-Before generating the threat model, collect and structure information in the `{project-name}/.tm-raw/` directory. This enables incremental collection, source tracking, and conflict resolution.
+Before generating the system model, collect and structure information in the `{project-name}/.tm-raw/` directory. This enables incremental collection, source tracking, and conflict resolution.
 
 ## Directory Structure
 

.claude/skills/secopstm-threat-modeling/references/workflow.md

@@ -266,11 +266,11 @@ After information gathering and complexity assessment, **present the modeling st
 - Rationale: {Why this decomposition}
 
 Please confirm if the modeling strategy is appropriate:
-1. Confirm - Generate threat model with this strategy
+1. Confirm - Generate system model with this strategy
 2. Adjust - User provides modification suggestions (e.g., merge some subsystems/change to single-model)
 ```
 
-**After user confirmation**, then generate the specific threat model files.
+**After user confirmation**, then generate the specific system model files.
 ---
 
 ### Step 6: Generate Model File

.gitignore

@@ -210,8 +210,15 @@ package-lock.json
 node_modules/
 .claude/settings.local.json
 CLAUDE.md
+decisions.md
+tasks.md
 external_data.tar.gz.sha256
 external_data.tar.gz
 
 # Git worktrees
 .worktrees/
+
+# Subagent-driven-development scratch workspace (briefs, diffs, ledger)
+.superpowers/
+*.docx
+/docs/superpowers

DOCKER_HUB.md

@@ -11,14 +11,18 @@ An [OWASP project](https://owasp.org/www-project-secopstm/) · Apache 2.0
 ## Quick start — offline, no API key
 
 ```bash
-docker run -p 5000:5000 \
+docker run -p 127.0.0.1:5000:5000 \
   -v $(pwd)/output:/app/output \
   ellipse2v/secopstm:latest
 ```
 
-Open **http://localhost:5000**, paste your threat model and click **Generate**.
+Open **http://localhost:5000**, paste your system model and click **Generate**.
 Reports land in `$(pwd)/output/<timestamp>/`.
 
+> **Security note:** there is no authentication on any route (single-user
+> tool by design). `-p 127.0.0.1:5000:5000` binds to localhost only. Only
+> use `-p 5000:5000` (all interfaces) on a network you fully trust.
+
 ---
 
 ## Quick start — with AI enrichment (LLM + RAG)
@@ -37,8 +41,8 @@ docker run --rm \
 **Step 2 — Run the server:**
 
 ```bash
-docker run -p 5000:5000 \
-  -e NVIDIA_API_KEY=your_key \
+docker run -p 127.0.0.1:5000:5000 \
+  -e NVIDIA_NIM_API_KEY=your_key \
   -v secopstm-rag:/app/rag \
   -v $(pwd)/output:/app/output \
   ellipse2v/secopstm:latest
@@ -52,10 +56,12 @@ The named volume `secopstm-rag` persists across restarts and image upgrades.
 
 | Provider | Environment variable | Free tier |
 |---|---|---|
-| NVIDIA NIM *(default)* | `NVIDIA_API_KEY` | ✅ [build.nvidia.com](https://build.nvidia.com/meta/llama-3_3-70b-instruct) |
+| NVIDIA NIM *(default)* | `NVIDIA_NIM_API_KEY` | ✅ [build.nvidia.com](https://build.nvidia.com/meta/llama-3_3-70b-instruct) |
 | Google Gemini | `GEMINI_API_KEY` | ✅ |
 | OpenAI | `OPENAI_API_KEY` | ❌ |
 | Mistral | `MISTRAL_API_KEY` | ✅ |
+| Groq | `GROQ_API_KEY` | ✅ [console.groq.com](https://console.groq.com) |
+| xAI | `XAI_API_KEY` | ❌ [console.x.ai](https://console.x.ai) |
 | Ollama (local, fully offline) | — no key needed — | ✅ |
 
 ---
@@ -65,7 +71,7 @@ The named volume `secopstm-rag` persists across restarts and image upgrades.
 | What | Docker flag | Notes |
 |---|---|---|
 | Output reports | `-v $(pwd)/output:/app/output` | Files land in `output/<timestamp>/` on the host |
-| Threat model files | `-v $(pwd)/models:/models` | Then pass `--model-file /models/model.md` |
+| System model files | `-v $(pwd)/models:/models` | Then pass `--model-file /models/model.md` |
 | AI config | `-v $(pwd)/ai_config.yaml:/app/config/ai_config.yaml:ro` | Change provider or model without rebuilding |
 | LLM prompts | `-v $(pwd)/prompts.yaml:/app/config/prompts.yaml:ro` | Override system prompts |
 | CVE definitions | `-v $(pwd)/cve_definitions.yml:/app/cve_definitions.yml:ro` | Per-asset CVE list |
@@ -74,8 +80,8 @@ The named volume `secopstm-rag` persists across restarts and image upgrades.
 ### Full example with all mounts
 
 ```bash
-docker run -p 5000:5000 \
-  -e NVIDIA_API_KEY=your_key \
+docker run -p 127.0.0.1:5000:5000 \
+  -e NVIDIA_NIM_API_KEY=your_key \
   -v $(pwd)/ai_config.yaml:/app/config/ai_config.yaml:ro \
   -v secopstm-rag:/app/rag \
   -v $(pwd)/models:/models \
@@ -88,7 +94,7 @@ docker run -p 5000:5000 \
 ## Changing the port
 
 ```bash
-docker run -p 8080:5000 ...   # accessible on http://localhost:8080
+docker run -p 127.0.0.1:8080:5000 ...   # accessible on http://localhost:8080
 ```
 
 ---

README.md

@@ -15,21 +15,42 @@ This project is a Python-based, end-to-end STRIDE threat modeling and analysis f
 -   **Generate optimized Attack Flow diagrams** for key objectives (Tampering, Spoofing, Information Disclosure, Repudiation).
 -   **Extend and customize** all mappings, calculations, and reporting logic.
 -   **Run as a web-based editor** for live, interactive threat modeling.
--   **AI-Enhanced Threat Analysis (Hybrid Mode)**: Threats from three independent engines — pytm rule engine, component-level LLM, and a cross-model RAG pipeline (ChromaDB + HuggingFace) — are automatically deduplicated and unified before reporting. Boundary objects are also analysed as AI targets. Supports Ollama (offline), Gemini, OpenAI, Mistral, and any LiteLLM-compatible provider. Configured in `config/ai_config.yaml`.
+-   **AI-Enhanced Threat Analysis (Hybrid Mode)**: Threats from three independent engines — pytm rule engine, component-level LLM, and a cross-model RAG pipeline (ChromaDB + HuggingFace) — are automatically deduplicated and unified before reporting. Boundary objects are also analysed as AI targets. Supports Ollama (offline), Gemini, OpenAI, Mistral, Groq, xAI, and any LiteLLM-compatible provider. Configured in `config/ai_config.yaml`.
 -   **Pure CLI & CI integration**: A `secopstm` command ships after `pip install -e .`. Use `--output-format json --stdout` to pipe structured output to dashboards or SIEM without starting a server.
 -   **Versioned JSON output**: Every JSON export is stamped `schema_version: "1.0"` and validated against `threat_analysis/schemas/v1/threat_model_report.schema.json`.
 
 > **Based on [PyTM](https://github.com/OWASP/pytm):** This framework leverages PyTM's modeling primitives and extends them with advanced reporting, MITRE mapping, and diagram generation.
 
 [![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
-[![Maintenance](https://img.shields.io/badge/Maintained%3F-yes-green.svg)](https://github.com/yourusername/cybersec-mapping/graphs/commit-activity)
+[![Maintenance](https://img.shields.io/badge/Maintained%3F-yes-green.svg)](https://github.com/ellipse2v/SecOpsTM/graphs/commit-activity)
+
+---
+
+## 🤖 AI Roles
+
+When AI is enabled, SecOpsTM runs several distinct LLM passes, each with its own system
+prompt and purpose (all defined in `config/prompts.yaml`, editable without touching Python
+code). All roles share the one provider configured in `config/ai_config.yaml` — there's no
+per-role provider selection — and every pass degrades gracefully offline: if no provider is
+reachable, the tool falls back to the pytm rule engine silently.
+
+| Role | Purpose | Where it shows up |
+|---|---|---|
+| **DSL Generation** | Turns a natural-language system description into a valid SecOpsTM Markdown model | "Generate from prompt" in the web editor |
+| **STRIDE Component Analysis** | Generates STRIDE threats per actor/server/boundary, strictly scoped to the component's declared technology tags (no invented stacks) | Per-component AI enrichment, `(AI)`-sourced threats in the report |
+| **RAG System-Level Analysis** | Cross-component/cross-boundary threats retrieved from a local ChromaDB knowledge base (CVE, CAPEC, ATT&CK, D3FEND) | System-level pass, `(LLM)`-sourced threats — skipped on small models below `rag.min_components` |
+| **SOC Analyst** | Detection-engineering pass: Sigma/Splunk SPL/KQL rule suggestions and IOCs per threat | HTML report "SOC Analysis" section |
+| **CISO Triage** | Board-level risk briefing summarizing the highest-priority threats | HTML report "CISO Briefing" section |
+| **Red Team** | Attempts to advance a GDAF attack scenario, citing only facts from the grounding block (CVE, misconfig, exposed ports) | Red/Blue adversarial debate on top GDAF scenarios |
+| **Blue Team** | Challenges the Red team's attempt with SIEM/EDR/IDS controls and calls out detection gaps | Red/Blue adversarial debate |
+| **Attack Path Narrator** | Short grounded narrative + business impact for each automatically discovered attack path (already-fixed hops/techniques — explains them, never adds new ones). Instructed to never emit an ID (T-number, CVE, CAPEC, D3-); any response that does is discarded, not trusted | "Automatically Discovered Attack Paths" section |
 
 ---
 
 ## ✨ New Interactive Features
 
-The framework's web interface has been significantly updated to provide a more powerful and seamless threat modeling experience.
+The web interface now supports the following.
 
 ### Interactive Diagrams
 The generated diagrams (both in the live editor and in exported HTML reports) are not static images. They are fully interactive SVGs that allow you to:
@@ -40,13 +61,12 @@ The generated diagrams (both in the live editor and in exported HTML reports) ar
 ### Interactive Legend
 -   **Filter Connections**: The diagram legend is now interactive. Click on a protocol (e.g., HTTPS, TCP) to instantly show or hide all dataflows using that protocol, making it easy to analyze specific parts of your data flow.
 
-### Robust Project Generation
--   The **"Generate All"** feature is designed to handle complex projects with nested sub-models.
--   If you have a project with multiple threat model files, it intelligently detects if any referenced sub-models are not currently open in the editor and prompts you to select your project's root directory. This ensures that all necessary files are found and included for a complete and accurate generation of all reports and diagrams.
+### Project Generation
+-   The **"Generate All"** feature handles projects with nested sub-models.
+-   If you have a project with multiple system model files, it detects when a referenced sub-model is not currently open in the editor and prompts you to select your project's root directory, so all files are found before generating reports and diagrams.
 
 ### Simple Server Mode
--   The integrated web server can be started with a path to a project directory (`--project path/to/your/project`). It will automatically find all `*.md` threat model files within that project and open them in tabs, ready for editing.
-[![Maintenance](https://img.shields.io/badge/Maintained%3F-yes-green.svg)](https://github.com/ellipse2v/cybersec-mapping/graphs/commit-activity)
+-   The integrated web server can be started with a path to a project directory (`--project path/to/your/project`). It automatically finds all `*.md` system model files within that project and opens them in tabs, ready for editing.
 
 ---
 
@@ -61,13 +81,18 @@ For detailed information on features, usage, and advanced customization, please
 ### Option A — Docker (no Python setup required)
 
 ```bash
-docker run -p 5000:5000 \
+docker run -p 127.0.0.1:5000:5000 \
   -v $(pwd)/output:/app/output \
   ellipse2v/secopstm:latest
 ```
 
 Open <http://localhost:5000>. Reports land in `$(pwd)/output/<timestamp>/`.
 
+> **Security note:** the server has no authentication on any route (it's a
+> single-user tool). `-p 127.0.0.1:5000:5000` keeps it reachable only from
+> this machine. Only bind it to all interfaces (`-p 5000:5000`) on a network
+> you fully trust.
+
 #### With AI enrichment (LLM + RAG)
 
 **Default provider: NVIDIA NIM** (Llama 3.3 70B) — free API key at https://build.nvidia.com/meta/llama-3_3-70b-instruct
@@ -77,14 +102,14 @@ Open <http://localhost:5000>. Reports land in `$(pwd)/output/<timestamp>/`.
 docker run --rm -v secopstm-rag:/app/rag ellipse2v/secopstm:latest --init-rag
 
 # Step 2 — Run
-docker run -p 5000:5000 \
-  -e NVIDIA_API_KEY=your_key \
+docker run -p 127.0.0.1:5000:5000 \
+  -e NVIDIA_NIM_API_KEY=your_key \
   -v secopstm-rag:/app/rag \
   -v $(pwd)/output:/app/output \
   ellipse2v/secopstm:latest
 ```
 
-Other supported providers: `GEMINI_API_KEY`, `OPENAI_API_KEY`, `MISTRAL_API_KEY`. Ollama works fully offline (no key needed).
+Other supported providers: `GEMINI_API_KEY`, `OPENAI_API_KEY`, `MISTRAL_API_KEY`, `GROQ_API_KEY`, `XAI_API_KEY`. Ollama works fully offline (no key needed).
 
 ---
 

ROADMAP_SUMMARY.md

@@ -3,9 +3,9 @@
 This roadmap outlines the SecOpsTM framework's current capabilities and future plans.
 
 ### Implemented Features:
-- **Hierarchical & Interactive Threat Models**: Support for linked sub-models and navigable diagrams.
+- **Hierarchical & Interactive System Models**: Support for linked sub-models and navigable diagrams.
 - **Automated Mitigations**: Context-aware suggestions from OWASP ASVS, NIST, and CIS Controls.
-- **Ansible IaC Integration**: Automatic threat model generation from Ansible playbooks.
+- **Ansible IaC Integration**: Automatic system model generation from Ansible playbooks.
 - **Web-Based GUI**: Interactive web interface for real-time model editing and preview.
 - **MITRE ATT&CK Integration**: Export to Navigator and STIX 2.1 formats for visualization and threat intelligence.
 

SECURITY.md

@@ -39,7 +39,7 @@
 
   - Remote code execution via the web server (`--server` mode)
   - Unauthorized access to the filesystem through the API
-  - Injection vulnerabilities (YAML, template, command) in threat model parsing
+  - Injection vulnerabilities (YAML, template, command) in system model parsing
   - Authentication bypass (if authentication is added in future versions)
 
   The following are **out of scope**: