ci(high/easy): enforce threat-model anchor checks

docs/CI.md

@@ -83,3 +83,16 @@ print order are asserted by:
 ```bash
 node --test scripts/check-bindings-cli.test.mjs
 ```
+
+## Threat-model anchor check
+
+CI runs `threat-model:test` and `threat-model:check`
+(`scripts/check-threat-model-anchors.mjs docs/THREAT_MODEL.md`) as blocking
+steps so `docs/THREAT_MODEL.md` always covers the 5 required sealed-round risk
+topics (`commit-privacy`, `drand-reveal-timing`, `escrow-settlement`,
+`keeper-permissionlessness`, and `receipt-verification`):
+
+```bash
+pnpm threat-model:test
+pnpm threat-model:check
+```

package.json

@@ -76,7 +76,7 @@
     "snapshot:check": "node scripts/check-snapshots.mjs",
     "docs:check": "node scripts/check-deploy-docs.mjs",
     "docs:check-links": "node scripts/check-links.js",
-    "coverage:test": "node --test scripts/run-ts-coverage.test.mjs && node scripts/run-ts-coverage.mjs",
+    "coverage:test": "node --test scripts/check-threat-model-anchors.test.mjs && node scripts/check-threat-model-anchors.mjs docs/THREAT_MODEL.md && node --test scripts/run-ts-coverage.test.mjs && node scripts/run-ts-coverage.mjs",
     "drand:test": "pnpm --filter @sub-rosa/drand-tools test",
     "drand:typecheck": "pnpm --filter @sub-rosa/drand-tools typecheck",
     "receipt:test": "pnpm --filter @sub-rosa/receipt-cli test",

scripts/check-links.js

@@ -6,6 +6,7 @@ const diagnostics = createLogger("scripts.check-links");
 
 const fs = require('fs');
 const path = require('path');
+const { execFileSync } = require('child_process');
 
 const ROOT = path.resolve(__dirname, '..');
 
@@ -157,6 +158,13 @@ if (external.length > 0) {
 
 if (broken === 0) {
   diagnostics.info("ok", `OK  ${checked} local link(s) checked, ${skipped} allowlisted`);
+  if (!process.argv.includes('--links-only')) {
+    execFileSync(
+      process.execPath,
+      [path.join(ROOT, 'scripts', 'check-threat-model-anchors.mjs'), 'docs/THREAT_MODEL.md'],
+      { cwd: ROOT, stdio: 'inherit' },
+    );
+  }
   process.exit(0);
 } else {
   diagnostics.error("fail", `\nFAIL  ${broken} broken link(s) — fix the paths above or add to ALLOWLIST in scripts/check-links.js`);

scripts/check-threat-model-anchors.test.mjs

@@ -1,19 +1,19 @@
 // Copyright (c) 2026 Sub Rosa contributors
 import { execFileSync } from "node:child_process";
-import { copyFileSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { copyFileSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
 
-const SCRIPT_PATH = new URL(
-  "check-threat-model-anchors.mjs",
-  import.meta.url,
-).pathname;
-const PROJECT_ROOT = new URL("..", import.meta.url).pathname;
+const SCRIPT_PATH = fileURLToPath(
+  new URL("check-threat-model-anchors.mjs", import.meta.url),
+);
+const PROJECT_ROOT = fileURLToPath(new URL("..", import.meta.url));
 
 function runScript(args = [], options = {}) {
-  return execFileSync("node", [SCRIPT_PATH, ...args], {
+  return execFileSync(process.execPath, [SCRIPT_PATH, ...args], {
     encoding: "utf-8",
     cwd: PROJECT_ROOT,
     ...options,
@@ -164,4 +164,25 @@ describe("check-threat-model-anchors", () => {
     const combined = outcome.stdout + outcome.stderr;
     assert.match(combined, /not found/);
   });
+
+  it("wires threat-model:test and threat-model:check as blocking CI steps", () => {
+    const pkg = JSON.parse(readFileSync(join(PROJECT_ROOT, "package.json"), "utf8"));
+    assert.equal(
+      pkg.scripts["threat-model:check"],
+      "node scripts/check-threat-model-anchors.mjs docs/THREAT_MODEL.md",
+    );
+    assert.equal(
+      pkg.scripts["threat-model:test"],
+      "node --test scripts/check-threat-model-anchors.test.mjs",
+    );
+    assert.match(pkg.scripts["coverage:test"], /check-threat-model-anchors\.test\.mjs/);
+    assert.match(pkg.scripts["coverage:test"], /check-threat-model-anchors\.mjs/);
+
+    const checkLinks = readFileSync(join(PROJECT_ROOT, "scripts", "check-links.js"), "utf8");
+    assert.match(checkLinks, /check-threat-model-anchors\.mjs/);
+
+    const ciDocs = readFileSync(join(PROJECT_ROOT, "docs", "CI.md"), "utf8");
+    assert.match(ciDocs, /pnpm threat-model:test/);
+    assert.match(ciDocs, /pnpm threat-model:check/);
+  });
 });