docs: publish Tend Compose continuity evidence

Export the reviewed allowlisted snapshot from private source commit 07c1655921f21ee5e4fc4d85639d199e8867b17d. This records the Docker Compose activation, schema-compatible rollback, and stateful migration resource findings from Observatory Preview 19 dogfooding.

AI-Assisted: OpenAI Codex
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

docs/THREAT_MODEL.md

@@ -0,0 +1,55 @@
+# Threat model
+
+## Protected properties
+
+- A release is identified by an operator-approved SHA-256 digest.
+- Only regular, bounded, allowlisted archive entries are extracted.
+- Release roots, state, pointers, and Caddy files reject symlink substitution
+  at their checked boundaries.
+- Configuration is strict JSON and is never interpolated into a shell command.
+- Candidate health is established before traffic or any current release
+  pointer changes. New deployments also satisfy configured content smoke
+  checks; rollback uses health and readiness because future-release content
+  markers are not valid requirements for an older retained release.
+- Caddy configuration validates before reload.
+- Canonical routed origins and the previous blue/green slot or singleton
+  handoff candidate remain under probe for the configured activation window; a
+  failure restores the old handler and release pointer.
+- Desired, candidate, active, previous, and failed-attempt identities remain
+  distinct in state. Bounded deployment events contain no arbitrary command
+  output or environment values and cannot block deployment.
+- An activation failure restores the previously observed state.
+- Active and previous releases survive pruning.
+- The restricted receiver accepts one versioned bounded stream, one allowlisted
+  service name, and one explicitly approved digest. It accepts no remote path,
+  URL, environment value, or shell expression.
+- OpenSSH host keys are pinned; forwarding, PTYs, proxy commands, local commands,
+  and user SSH configuration are disabled by the client invocation.
+- Production secret values are absent from configuration, process arguments,
+  artifacts, manifests, reports, deployment state, and Tend logs.
+- One host-wide lock serializes shared Caddy activation without stopping or
+  reconfiguring unrelated services.
+
+## Trusted inputs
+
+Reviewed source, the pinned Go toolchain, root-owned server policy and service
+configuration, systemd unit files, the Caddy handler template, the operator,
+and the target host's root account are trusted. Packaging a hostile repository
+can execute hostile Go compiler hooks or consume resources; Tend is not a
+source-code sandbox.
+
+## Adversarial inputs
+
+Artifact paths and bytes, protocol frames, requested service names, archive
+metadata, stale or malformed state, HTTP responses, subprocess failures, and
+filesystem objects at managed paths are validated and fail closed. Process
+output and receive fields are bounded.
+
+## Non-goals and preview limits
+
+Tend does not defend against a concurrently malicious root user, a compromised
+kernel/toolchain/systemd/Caddy/OpenSSH installation, denial of service by the
+trusted application, or secrets an application itself exposes. It does not
+manage data migrations, databases, containers, Kubernetes, or application-specific
+activation. EQL therefore remains outside the generic deployment adapter until
+its SQLite/catalog publication checkpoints can be modeled explicitly.