feat: STPA-Sec gap closure — 112 new artifacts for v0.6.x features

[avrabe]

Summary

Complete STPA-Sec analysis for all v0.6.x features that were implemented without coverage.

Phase 1: STPA-Sec Gap Closure (112 new artifacts)

Category	IDs	Count
Loss	L-10	1
Hazards	H-21–H-35	15
System Constraints	SC-20–SC-33	14
Controllers	CTRL-11–13	3
Control Actions	CA-12–14	3
Controlled Process	CP-8	1
Data Flows	DF-17–22	6
Security Properties	SP-11–12	2
UCAs	UCA-22–35	14
Controller Constraints	CC-13–26	14
Attack Scenarios	AS-22–33	12
Assets	ASSET-023–25	3
Threat Scenarios	TS-019–24	6
Cybersecurity Reqs	CR-18–24	7
Cybersecurity Designs	CD-23–27	5
Cybersecurity Verifications	CV-30–34	5
Feature	FEAT-11	1

Coverage areas

• WASM Component Model signing (L-10, H-21-22, SC-20-21, UCA-22-23, AS-22)
• PQC hybrid signatures (H-23-24, SC-22-23, UCA-24-25, AS-23)
• Rekor proof cache (H-25-26, SC-24-25, UCA-26-27, AS-24-25)
• SCT monitoring (H-27-28, SC-26-27, UCA-28-29, AS-26-27)
• Checkpoint consistency (H-29-30, SC-28-29, UCA-30-31, AS-28-29)
• Sigstore bundle (H-31-32, SC-30-31, UCA-32-33, AS-30)
• Build environment (H-33-34, SC-32, UCA-34, AS-31-32)
• DSSE multi-sig (H-35, SC-33, UCA-35, AS-33)

Fixes

• CV-25–29: method: test → method: automated-test
• CV-16–19: added missing description field

Validation

• rivet validate: 0 local errors
• cargo test: 721 passed
• 452 total artifacts (up from 340)

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!