# Threat Strata

> Threat Strata turns an architecture description into a validated, interactive threat model.
> An AI agent fetches the contract, builds the model, encrypts it, and returns a viewer link.
> The server stores ciphertext only.

## Start

- [Agent contract](/agent.json): endpoints, crypto, hashes, and instructions. Canonical copy: /.well-known/threat-strata.json
- [Schema](/threat-model.schema.json): JSON Schema for format `threat-model-studio`, version `1.0.0`.
- [Node runner](/submit.mjs): validates, encrypts, and submits. Needs Node 20 or newer.
- [Python runner](/submit.py): same flow. Needs the `cryptography` package for encryption.
- [Example model](/example-threat-model.json): a complete valid model.

## Rules

- Ask the user for the system and architecture before you build the model.
- Omit node and boundary positions. The viewer computes the layout.
- Validate before you submit. Fix every error and warning.
- The viewer link has the form `/m/{id}#{key}`. The key stays in the fragment and never reaches the server.