dominicrume/cantor8_kya_rails: docs/threat-model.md

Threat model What this system defends against, what it does not, and what an attacker gets if each part fails. Written to be argued with. The asset: a float held in one country, spent by an operator in another, under a mandate issued by a principal who cannot be present. The trust boundary: the…