docs: document security threat model

[wemeetagain]

Summary

• add a repository-specific threat model for security reviewers and automated agents
• document trusted beacon-state provenance, hostile P2P inputs, STF and fork-choice validation contracts, optimistic execution, DA assumptions, cache ownership, and integration maturity
• require security reviews in AGENTS.md to identify the attacker, reachable path, trusted preconditions, violated objective, and concrete impact

Why

Security reports have produced faulty findings because the Lodestar and Ethereum trust model was implicit. In particular, agents treated trusted beacon states and local ERA/database data as hostile inputs, confused sync ancestry checks with full validation, and overlooked validation performed by Lodestar-ts before planned Lodestar-z integration points.

Impact

Documentation only. This gives maintainers and automated reviewers a shared basis for classifying vulnerabilities, consensus bugs, integration-readiness issues, trusted-input reliability problems, and operator misuse.

AI assistance

This documentation was primarily AI-authored through an extended collaborative threat-modeling discussion with maintainer-provided Lodestar and Ethereum domain guidance.

[lodekeeper-z]

The structure and attacker/path/classification discipline are strong, but I found five threat-model accuracy gaps that should be resolved before this becomes the review baseline. The most important are the DA ordering claim and the process-wide pubkey-cache rollback/finalization description. Details are inline.

Review scope: AGENTS.md and THREAT_MODEL.md at b8d60d4. I also checked the corresponding Lodestar-ts block verification path and current Lodestar-z state-transition/cache code. CI is green on Ubuntu, ARM, bindings, title, and spec preparation; macOS was still pending at the time of review.

[lodekeeper-z]

Supplemental review after the independent security and consistency passes completed. These are distinct from the five findings in my first review and focus on boundary coverage and terminology.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6d54ee28ab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".