feat: add the Security Map foundation

[mattaereal]

What does this PR change?

Replace the radial Attack Surface Overview prototype at /intro/attack-surface with a first production Security Map: a versioned, validated graph of SEAL knowledge plus an interactive explorer and local control assessment.

Closes nothing. Foundation PR.

Type of change

• New content
• Edit to existing content
• Outline / structure change
• Typo or formatting fix
• Tooling / config

Problem

The old dashboard was a fixed 12-node radial SVG. Threats defaulted to red "gaps", could be marked "secured", and stored threat-level yes/no/partial in attackSurface-posture. Incident examples and loss figures had no sources. Relationships lived in a handwritten TypeScript array instead of repository data.

Scope

Foundation only. Seed graph for the migrated threat concepts, generator/validator, UI, local assessment, maintainer docs. Not a repo-wide framework mapping, not an incident database, not accounts or synced assessments.

Architecture

docs/data/security-map/ (taxonomy, schema, nodes, edges, views, optional MDX securityMap frontmatter)
→ utils/security-map-lib.cjs loads, merges, validates
→ writes public/security-map.json and components/security-map/securityMap.generated.ts from the same in-memory graph
→ React Security Map at /intro/attack-surface
→ control assessments in localStorage key seal-security-map-assessment:v1

Renderer is original SVG/HTML, not Cytoscape. Overview shows eight domains and saved entry points, not the full graph. The list is the primary keyboard/AT interface; the canvas is aria-hidden.

Schema and validation

• schemaVersion 1.0.0
• Prefixed kebab-case IDs
• Bounded node/edge types and an edge compatibility matrix
• Guidance href resolved against docs/pages
• Incidents require sources (seed ships zero incident nodes)
• Threats must targets something and have a mitigates or documented-by path
• assessmentEligible only on controls
• Build fails on invalid graph (docs:dev / docs:build run generate-security-map)

UI

Search, AND-across / OR-within filters, domain overview, curated views, 1-hop focus, expand-one-hop, detail panel, guidance links, seven-state control assessment, import/export with preview.

Shareable query params: focus, domain, view. Never assessment state.

Privacy and security

• No assessment API, analytics, or remote layout
• Assessment stays in this browser
• Import validates size, schema, enums, and drops __proto__ / unknown IDs
• Replace-after-preview, no partial apply
• No dangerouslySetInnerHTML, no CDN runtime, no CSP changes
• Legacy attackSurface-posture is detected and not converted into control evidence

Accessibility

Semantic list/tree for the same tasks as the graph. Icon-only controls named. Live region for search/focus, not pan. Reduced motion respected. Color is not the only encoding.

Migration

• Route /intro/attack-surface kept
• Sidebar and page title: Security Map
• AttackSurfaceDashboard re-exports SecurityMap
• threatData.ts and AttackSurface.css removed
• SDLC pipeline now owns categoryMeta / Category / FrameworkLink so it no longer imports the deleted catalogue
• Stale threatData routes remapped (e.g. /front-end-web-app/overview, /incident-management/playbooks/hacked-dprk)

Validation

Command	Result
pnpm run test:security-map	26 pass, 0 fail
pnpm run validate:security-map	OK, 127 nodes, 165 edges, 7 views
pnpm run validate:content -- --path docs/pages/intro	attack-surface.mdx passed. Other intro pages still have pre-existing content-debt failures (missing tags/contributors). Not introduced here.
pnpm exec cspell on touched MDX	0 issues
pnpm run docs:build	succeeded
git diff --check	clean
Preview :4173/intro/attack-surface	title Security Map; search found Hardware-backed signer isolation; focus URL ?focus=control-signer-isolation; assessment stored locally and not in the URL; graph hidden at 390px

markdownlint-cli2 is not installed in this environment; justfile lint could not run that half.

Visual evidence

Screenshots taken during preview (desktop dark, focused control + assessment, desktop light, mobile 390). Not committed. Attach via PR comment for /img-bot if wanted.

Known limitations

• Seed is proposed, not steward-reviewed
• Not every framework is mapped
• No incident nodes (unsourced one-liners from the old catalogue were not promoted)
• Custom SVG neighborhood, not a full layout engine
• Assessment parser exists in utils/security-map-assessment.cjs (tested) and is wrapped by the client module

Follow-up

1. Map one framework per PR (feat/security-map-<framework>), steward review
2. Sourced incidents in evidence-only PRs
3. Coverage reports (threats without controls, controls without guidance, assets without response)
4. Schema migrations before ID/enum changes
5. Later: search, MCP/retrieval, cert mappings

OKcontract Interactive Onchain Attack Map was used only as interaction inspiration (select, trace, filter, share a focused view). No OKcontract code, data, assets, branding, or undocumented behavior was copied.

If applicable

• Editing existing content: tagged the current contributors from the attribution list
• Framework has a steward: asked them to review
• Outline change: updated vocs.config.ts with the dev: true parameter
• Want community feedback: shared this PR in our Discord

[cloudflare-workers-and-pages]

Deploying frameworks with    Cloudflare Pages

Latest commit:	98b3a42
Status:	✅  Deploy successful!
Preview URL:	https://d779a207.frameworks-573.pages.dev
Branch Preview URL:	https://feat-security-map-foundation.frameworks-573.pages.dev

View logs

[github-actions]

Sidebar Configuration Reminder

Documentation files update:

New in this push:

• docs/pages/map.mdx (added) ← NEW

Please ensure that:

• The sidebar in vocs.config.ts has been updated to include these files
• New content has the dev: true parameter so it's marked as under development
• Sidebar links match the file paths - use the preview deployment to verify

See Contributing guidelines - Sidebar / Navigation for more details.

---

_{This is an automated reminder. If this PR doesn't need sidebar changes, you can ignore this message.}

[github-actions]

Sidebar Configuration Reminder

Documentation files update:

New in this push:

• docs/pages/intro/security-map.mdx (added) ← NEW

Previously seen:

• docs/pages/map.mdx (added)

Please ensure that:

• The sidebar in vocs.config.ts has been updated to include these files
• New content has the dev: true parameter so it's marked as under development
• Sidebar links match the file paths - use the preview deployment to verify

See Contributing guidelines - Sidebar / Navigation for more details.

---

_{This is an automated reminder. If this PR doesn't need sidebar changes, you can ignore this message.}