chore: establish phase 0 baseline

docs/phase-0/threat-model.md

@@ -0,0 +1,17 @@
+# Initial threat model
+
+## Assets and boundaries
+
+- Provider manifests, custom launch definitions, artwork, and frontend descriptors are untrusted.
+- Discovery and launch parsing run as the gaming user, never root.
+- Provider credentials remain owned by their provider/configuration owner.
+- Project state is per-user under XDG paths and must use atomic replacement.
+- Future IPC is local, owner-only, size-limited, authenticated by OS credentials, and optional.
+
+## Mandatory controls before provider work
+
+Use argument arrays rather than interpolated shells; reject traversal, control
+characters, oversized inputs, unsafe symlinks, and unexpected encodings; redact tokens
+and personal paths from evidence; constrain reads to documented roots; and keep fixtures
+free of proprietary library dumps and live credentials.
+