docs: add canonical CLI security model

[jbeckwith-oai]

Summary

• add docs/architecture/security-model.md as the single detailed repository threat model
• keep SECURITY.md focused on disclosure and defer trust-boundary authority to the canonical model
• distinguish tracked executable checkout code from genuine runtime/parser/network and protected CI/release boundaries

Validation

• git diff --check
• resolved SECURITY.md policy chain for docs/architecture/security-model.md
• validated 81 local Markdown citation targets and line bounds
• adversarial review converged after two consecutive clean rounds

Follow-up

• after this document is visible to the Codex Security scanned revision, replace the existing cloud threat-model text with a short pointer to this file

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T21:18:04.960335Z	58b7bbd	PR opened
🔒 Security Review	✅ Completed 2026-09-01T21:18:34.832479Z	58b7bbd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Castiron custom code

✅ No new custom-code files detected.

5 mixed files remain; 0 existing customizations changed.

Compared 5933dd50fbea → e0267ca4b1a6. Generated baselines verified.

5 existing customizations unchanged

• pkg/cmd/adminorganizationcertificate.go
• pkg/cmd/cmd.go
• scripts/castiron/README.md
• scripts/castiron/custom_code_report.py
• scripts/castiron/test_custom_code_report.py

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 33562560300 --repo openai/openai-cli \
  --name castiron-custom-code-33562560300-1 --dir /tmp/castiron-custom-code-33562560300-1
git apply --stat /tmp/castiron-custom-code-33562560300-1/custom-code.patch
cat /tmp/castiron-custom-code-33562560300-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 5933dd50fbea96b54cb11c46221bd70ed1aa6a52 e0267ca4b1a651161b23eb1739c7b14d98b607bc
python3 scripts/castiron/custom_code_report.py report \
  --base 5933dd50fbea96b54cb11c46221bd70ed1aa6a52 \
  --head e0267ca4b1a651161b23eb1739c7b14d98b607bc --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-e0267ca4b1a6
cat /tmp/castiron-custom-code-e0267ca4b1a6/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[Copilot]

Pull request overview

Adds a canonical, repository-wide security/threat model document and updates the existing security policy to defer detailed trust-boundary guidance to that new reference, while keeping disclosure/reporting instructions centralized in SECURITY.md.

Changes:

• Add docs/architecture/security-model.md as the single detailed threat model and trust-boundary authority for security reviews/scans.
• Update SECURITY.md to explicitly point reviewers/scanners to the canonical model for boundary/privilege decisions while retaining disclosure guidance.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
SECURITY.md	Adds a “Canonical threat model” section that points to the new detailed security model document.
docs/architecture/security-model.md	Introduces a comprehensive threat model/trust-boundary reference with evidence links into the codebase and CI/release workflows.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[HAYDEN-OAI]

Reviewed e0267ca4b1a6 — no substantive issues found. The model matches the CLI's input provenance, mTLS, diagnostic/output, and CI/release source contracts, including CodeQL's separate scoped write permission. The checkout-code distinction retains parser input, mutable artifacts/dependencies, and protected credentials as security boundaries.

Static review of both changed files and their relevant source contracts; external repository/environment protections and deployment assumptions were not certified.