Model Coherence Report

Static-analysis report on coherence between the model's component declarations, the code-binding strings on its controls and assertions, and the structural reachability of every CO.

Pass co_id to scope the report to findings carrying that CO id (the co_* reachability findings + the attestation cross-link findings). Component- and assertion-level findings without a CO binding are excluded in single-CO mode. 404 if the CO doesn't exist on the model.

The report carries up to twelve finding types, grouped below by concern. Each finding includes the entity IDs it concerns (co_id, asset_id, attacker_id, component_id, etc.) so the agent can dispatch the resolution tool directly without re-fetching the model.

Component / assertion bindings:

• control_component_unknown — control references a component ID that no longer exists. Resolve: assign_to_components (target_type="control").

• asset_component_unknown — asset references a missing component. Resolve: edit_asset (with corrected component_ids).

• assertion_repo_mismatch — an assertion's repo does not match the repo_url of any component scoping its control. Resolve: rebind the assertion or rescope the control.

• assertion_repo_orphan — an assertion has a repo but its control is unscoped. Resolve: assign_to_components (target_type="control") to scope the control, or correct the assertion's repo.

• control_unscoped_with_scoped_assertions — control is unscoped, but its assertions all carry a single component's repo. Resolve: assign_to_components (target_type="control") to that component.

• component_unbound — a component has no repo_url. Two cases, told apart by the component's trust boundary. An internal-zone component (your own code) that isn't linked yet: resolve with edit_component pointing at the real repo. An external-zone component (e.g. a third-party service, the customer's IdP, or other external infrastructure you call but don't own): leave it unbound — the finding is a permanent, auditor-visible external- dependency marker, NOT a TODO. Never bind an external component to your repo to silence this; "some client code touches it" is not a reason to bind (that client code lives in your repo for every dependency).

Reachability findings (deterministic composer; indeterminate verdicts surface as findings, never auto-decided by an LLM):

• co_attacker_unpositioned — the CO's attacker has no positioned trust boundaries. Resolve by REPAIRING THE MODEL: edit_attacker (set trust_boundary_ids).

• co_asset_unbounded — the CO's asset has no component-derived trust boundaries. Resolve by REPAIRING THE MODEL: assign_to_components (target_type="asset") or edit_asset (with component_ids).

• co_no_shared_boundary — attacker and asset boundaries do not intersect. Resolve by REPAIRING THE MODEL: re-position the attacker via edit_attacker, or scope the asset to a shared component via assign_to_components (target_type="asset").

  An indeterminate verdict means the derivation could not decide, so the first move is to supply the structure it is missing. It does NOT mean the objective is inapplicable, and asserting that it is would answer a structural question with a judgment.

  co_no_shared_boundary can also fire where the connecting structure genuinely does not exist rather than merely going unstated, so supplying it is the first thing to try, not a guaranteed resolution. If the boundaries really do not meet, that is still a modelling answer.

  If the objective genuinely does not apply to this system, that is a separate claim: record it with create_co_disposition, which keeps the objective visible, owned and expiring rather than hiding it.

• co_missing_entity — the CO references a missing asset/attacker; model state inconsistent. Resolve: restore the entity (restore_entity (entity_type="asset") / restore_entity (entity_type="attacker")) or remove the orphaned CO via refine_threat_model.

Use this before relying on component-scoped control discovery, when assertion verification fails for path/repo reasons, or to enumerate structural-completeness gaps the operator should address before treating the model as audit-ready. get_reachability_verdicts exposes the underlying composer verdicts directly when the finding-shape summary isn't enough.