029 — the threat model, package-wide; JSON nesting bounded before the decoder on both transports

[HackTuah]

The package-wide threat model, and the one wire bound it found missing.

docs/threat-model.md. Who is trusted for what — the host for everything, the client on the wire for nothing, the node for everything by physics, this package for holding no tool, key, signature, session, authority or client. Then the wire, vector by vector, each refused, bounded, or delegated to the HTTP server or the host by decision, with the test that enforces it by path and by name and the OWASP id it answers to (the December 2025 Top 10 for Agentic Applications; the 2025 LLM Top 10 by edition — the ids were read from the project's pages, not recalled). It extends the tracer's model shipped in 0.4.0: the node-local adversary stays out of scope, now for every module, with the reason. Prompt injection through tool results is the host's (LLM01:2025) — this package carries bytes and never reads them. A federation section states the trust domains a merge would cross — attribution, identity, signs, integrity in transit, the peer as a client — so the seam is designed against them rather than discovering them. Where the Plug goes in a host's pipeline: ahead of Plug.Parsers, or its path excluded — behind the parsers every request is -32700 Parse error: empty body (measured). A census holds every citation on the page to a test in the tree, by the reader the will-not-implement census now shares; it caught three misquoted names while the page was being written.

JSON nesting is bounded before the decoder runs, on both transports. Measured first: the 1 MiB body cap bounds how deep a body can nest but not what decoding it costs — a 1 MiB body nested 524,288 levels deep was decoded in full, 79–96 ms and a 38 MiB heap for one request, about 36× the body, and refused only afterwards by its shape. BeamMCP.JSON.decode/1 is now the one place the wire's JSON is read: a byte walk in front of the decoder (brackets outside strings, escapes honoured) refuses a body nesting past 64 levels with -32600 "Request body nests deeper than 64 levels" — 400 over HTTP with the connection kept, the same object on stdio — building nothing. The worst body under the cap is refused in microseconds; a request-sized body pays nothing measurable; a 1 MiB well-formed one +1.7 ms. Red first (six tests failing on behaviour with the constant present and nothing enforcing it), then green; ten mutants over the walk and the two transport clauses, zero survivors, every kill a named test. Only a client nesting past 64 levels sees a change; no field, method or capability moves — the conformance rows are unchanged (16/37, 5/6; 0/30 by design).

Gate on the head: thirteen pass, GATE_EXIT=0. 11 properties, 611 tests, 0 failures — 604 at v0.5.0 plus the seven of the threat-model test. The package-reach census refused a Jason.DecodeError named in a @spec on the way (struct() instead) — the census working as built.