model_coherence_report

Static-analysis report on coherence between the model's component declarations, the code-binding strings on its controls and assertions, and the structural reachability of every CO.

Pass co_id to scope the report to findings carrying that CO id (the co_* reachability findings + the attestation cross-link findings). Component- and assertion-level findings without a CO binding are excluded in single-CO mode. 404 if the CO doesn't exist on the model.

The report carries up to twelve finding types, grouped below by concern. Each finding includes the entity IDs it concerns (co_id, asset_id, attacker_id, component_id, etc.) so the agent can dispatch the resolution tool directly without re-fetching the model.

Component / assertion bindings:

• control_component_unknown — control references a component ID that no longer exists. Resolve: assign_to_components (target_type="control").

• asset_component_unknown — asset references a missing component. Resolve: edit_asset (with corrected component_ids).

• assertion_repo_mismatch — an assertion's repo does not match the repo_url of any component scoping its control. Resolve: rebind the assertion or rescope the control.

• assertion_repo_orphan — an assertion has a repo but its control is unscoped. Resolve: assign_to_components (target_type="control") to scope the control, or correct the assertion's repo.

• control_unscoped_with_scoped_assertions — control is unscoped, but its assertions all carry a single component's repo. Resolve: assign_to_components (target_type="control") to that component.

• component_unbound — a component has no repo_url. Two cases, told apart by the component's trust boundary. An internal-zone component (your own code) that isn't linked yet: resolve with edit_component pointing at the real repo. An external-zone component (e.g. a third-party service, the customer's IdP, or other external infrastructure you call but don't own): leave it unbound — the finding is a permanent, auditor-visible external- dependency marker, NOT a TODO. Never bind an external component to your repo to silence this; "some client code touches it" is not a reason to bind (that client code lives in your repo for every dependency).

Reachability findings (deterministic composer; indeterminate verdicts surface as findings, never auto-decided by an LLM):

• co_attacker_unpositioned — the CO's attacker has no positioned trust boundaries. Resolve: edit_attacker (set trust_boundary_ids), or add_assumption with a structured exclusion predicate.

• co_asset_unbounded — the CO's asset has no component-derived trust boundaries. Resolve: assign_to_components (target_type="asset"), edit_asset (with component_ids), or add_assumption with a structured exclusion.

• co_no_shared_boundary — attacker and asset boundaries do not intersect. Resolve: re-position the attacker via edit_attacker, scope the asset to a shared component via assign_to_components (target_type="asset"), or add_assumption with a structured exclusion.

• co_missing_entity — the CO references a missing asset/attacker; model state inconsistent. Resolve: restore the entity (restore_entity (entity_type="asset") / restore_entity (entity_type="attacker")) or remove the orphaned CO via refine_threat_model.

Use this before relying on component-scoped control discovery, when assertion verification fails for path/repo reasons, or to enumerate structural-completeness gaps the operator should address before treating the model as audit-ready. get_reachability_verdicts exposes the underlying composer verdicts directly when the finding-shape summary isn't enough.