Write the MVP threat model and external-effect failure matrix

Outcome

The security/effects implementation backlog is driven by explicit threats, browser handoff boundaries, fixture privilege, and provider crash windows rather than optimistic flows.

Scope

• Model OAuth audience/tenant confusion, scope/role escalation, local versus broker revocation, and token-family races.
• Model handoff-locator enumeration/leakage, session theft/replay, CSRF, wrong-user use, approval reprice/grant TOCTOU, and mandate/access invalidation.
• Prove that a URL exposed to model context is a non-authorizing locator; OAuth/session/capability/Stripe secrets never enter URLs, receipts, or model context.
• Model PII/secret leakage and offline guessing through events, nested payloads, plain hashes, logs, errors, SSE, MCP, browser sessions, provider effect inputs, attempts, and reconciliation records.
• Model duplicate, reordered, late, unknown, timed-out, and success-before-domain-append provider outcomes, including browser-callback-before/after-webhook races.
• Model revocation racing planned/in-progress/unknown spend, supplier, setup, refund, and reconciliation effects; mandatory refunds/reconciliation continue.
• Treat fixture materialization as a privileged state-machine-bypass threat: no copied source envelopes/live provider refs and no active-run switch with unresolved decisions/effects.
• Map each threat/failure to a guard, event/operational outcome, and minimum test.

Acceptance

• Threats name attacker, asset, boundary, failure mode, mitigation, and evidence.
• The matrix includes setup, initial/recovery payment and required-action flows, search/reprice, supplier booking/recovery, refunds, browser/provider callback orders, and inactive-run callbacks.
• Approval/review/payment handoff invalidation and profile erasure races are covered.
• Immediate local 401 remains true when managed-broker propagation fails.
• Planned effect cancellation, in-progress reconciliation, late payment compensation, and already-accepted supplier outcomes have explicit truthful rules.
• Dispatcher attempt and reconciliation-job IDs are persisted before observation and no ambiguous attempt blindly repeats I/O.
• Planned effects remain restart-executable from versioned non-secret inputs without persisting PII; request/content fingerprints are keyed/versioned rather than guessable plain hashes.
• Fixture materialization and generic-seed misuse have explicit authorization, provenance, and demo-integrity mitigations.
• No mitigation depends on a model remembering hidden conversational context.

Dependencies

• M0-F auth/client ruling; draft event and supplier contracts.

Review

Input to both contract and later security/effects adversarial reviews.

Start with the M0-F auth/client ruling and the draft event and supplier contracts named in Dependencies. Build the threat and external-effect failure matrix across the listed flows, mapping each item to an attacker, asset, boundary, mitigation, outcome, and minimum test; done means every Acceptance item is addressed for the later contract and adversarial reviews.