Albert — Architecture & security review

Threat-model excerpt. Proposed controls are not evidence of implementation, penetration testing or ISO certification. Confidential host/configuration sections are omitted.

ที่มา: 02_albert_security_threat_model.md
Source SHA-256: 8cceedf00d5d4e4a62b84c96c7da5c81a17e09aa74c715cbcc1416a6d8229f05

Published excerpt/source viewer; original archived privately. Hash identifies source bytes, not authorship, endorsement or production acceptance.

## 2. STRIDE Threat Analysis Matrix

| Threat Category | Potential Attack Vector | XpFirm Defense & Containment Architecture |
|---|---|---|
| **Spoofing (S)** | Malicious process spoofing MT5 heartbeat packets | HMAC-SHA256 authenticated challenge-response on named pipe; replay protection via monotonic nonce counter. |
| **Tampering (T)** | Manipulation of local JSON trade logs or risk configs | Append-only SQLite WAL journal; root-owned read-only config mounts inside isolated Podman rootless containers. |
| **Repudiation (R)** | Trader claims an order was executed without authorization | Every execution generates a cryptographic `setup_hash` hashing: timestamp, frozen zone ID, 12-gate pass tokens, and account balance. |
| **Information Disclosure (I)** | Accidental leakage of broker passwords in chat / logs | All credentials strictly stored in Hermes Secure Vault; automated regex sanitizer scrubs API keys and passwords before logging. |
| **Denial of Service (D)** | Telegram bot flooded with high-frequency triggers | Rate-limiting queue (max 5 commands/sec per user ID); fail-closed brake ensures high load locks trading rather than blindly executing. |
| **Elevation of Privilege (E)** | Compromised sub-agent attempting to alter SL parameters | Hardcoded Stop Loss constraint (strictly 1,000 points); broker-side SL placement is validated independently by the MT5 Gateway wrapper. |