feat: map Wallet Security onto the Security Map

docs/data/security-map/README.md

@@ -26,12 +26,19 @@ Do not hand-edit `public/security-map.json` or `components/security-map/security
 ```bash
 pnpm run generate-security-map
 pnpm run validate:security-map
+pnpm run coverage:security-map
 pnpm run test:security-map
 pnpm run docs:build
 ```
 
 `docs:dev` and `docs:build` both generate the graph before Vocs runs. An invalid graph fails the build.
 
+`coverage:security-map` does not fail the build. It prints the work queue: threats with no
+control, controls with no guidance, frameworks with zero nodes, and `## Related frameworks`
+links whose two framework slices share no graph node or edge. Use `--json` for machine output.
+Do not scrape those related-framework bullets into `related-to`.
+
+
 ## Node IDs
 
 IDs are public contracts.
@@ -113,8 +120,11 @@ The first seed is `proposed` on purpose.
 
 ## Follow-up
 
-1. Map one framework per PR (`feat/security-map-<framework>`).
-2. Steward review for security semantics.
-3. Sourced incidents in dedicated evidence PRs.
-4. Coverage reports: threats without controls, controls without guidance, critical assets without response, broken routes.
+1. Run `pnpm run coverage:security-map` and treat the lists as the work queue.
+2. Map one framework per PR (`feat/security-map-<framework>`). Steward review for security semantics.
+   Wallet Security is the first expansion. Next implied gaps: Physical Security, then Treasury Operations.
+3. Add the missing component, surface, control, or guidance edge. Cross-links appear because two
+   frameworks share a node, not because overview pages mention each other.
+4. Sourced incidents in dedicated evidence PRs.
 5. Schema migrations before changing stable IDs or enum meanings.
+

docs/data/security-map/edges/wallet-security.json

@@ -0,0 +1,229 @@
+{
+  "edges": [
+    {
+      "source": "component-hardware-wallet",
+      "target": "surface-transaction-signing",
+      "type": "exposes"
+    },
+    {
+      "source": "component-software-wallet",
+      "target": "surface-transaction-signing",
+      "type": "exposes"
+    },
+    {
+      "source": "component-software-wallet",
+      "target": "surface-token-approvals",
+      "type": "exposes"
+    },
+    {
+      "source": "component-seed-backup",
+      "target": "surface-seed-custody",
+      "type": "exposes"
+    },
+    {
+      "source": "component-signers",
+      "target": "component-hardware-wallet",
+      "type": "depends-on"
+    },
+    {
+      "source": "component-multisig",
+      "target": "component-hardware-wallet",
+      "type": "depends-on"
+    },
+    {
+      "source": "component-software-wallet",
+      "target": "component-frontend",
+      "type": "depends-on"
+    },
+    {
+      "source": "threat-blind-signing",
+      "target": "surface-transaction-signing",
+      "type": "targets"
+    },
+    {
+      "source": "threat-blind-signing",
+      "target": "asset-signer-keys",
+      "type": "targets"
+    },
+    {
+      "source": "threat-blind-signing",
+      "target": "asset-user-funds",
+      "type": "targets"
+    },
+    {
+      "source": "threat-blind-signing",
+      "target": "asset-treasury-funds",
+      "type": "targets"
+    },
+    {
+      "source": "threat-seed-phrase-compromise",
+      "target": "surface-seed-custody",
+      "type": "targets"
+    },
+    {
+      "source": "threat-seed-phrase-compromise",
+      "target": "asset-seed-secrets",
+      "type": "targets"
+    },
+    {
+      "source": "threat-seed-phrase-compromise",
+      "target": "asset-signer-keys",
+      "type": "targets"
+    },
+    {
+      "source": "threat-unlimited-token-approval",
+      "target": "surface-token-approvals",
+      "type": "targets"
+    },
+    {
+      "source": "threat-unlimited-token-approval",
+      "target": "asset-user-funds",
+      "type": "targets"
+    },
+    {
+      "source": "threat-duress-coercion",
+      "target": "asset-seed-secrets",
+      "type": "targets"
+    },
+    {
+      "source": "threat-duress-coercion",
+      "target": "surface-seed-custody",
+      "type": "targets"
+    },
+    {
+      "source": "control-simulate-before-sign",
+      "target": "threat-blind-signing",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-independent-tx-verification",
+      "target": "threat-blind-signing",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-signer-isolation",
+      "target": "threat-blind-signing",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-cold-wallet-separation",
+      "target": "threat-blind-signing",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-offline-seed-custody",
+      "target": "threat-seed-phrase-compromise",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-offline-seed-custody",
+      "target": "threat-duress-coercion",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-limited-token-approvals",
+      "target": "threat-unlimited-token-approval",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-cold-wallet-separation",
+      "target": "asset-signer-keys",
+      "type": "protects"
+    },
+    {
+      "source": "control-cold-wallet-separation",
+      "target": "component-hardware-wallet",
+      "type": "protects"
+    },
+    {
+      "source": "control-offline-seed-custody",
+      "target": "asset-seed-secrets",
+      "type": "protects"
+    },
+    {
+      "source": "control-offline-seed-custody",
+      "target": "surface-seed-custody",
+      "type": "protects"
+    },
+    {
+      "source": "control-simulate-before-sign",
+      "target": "surface-transaction-signing",
+      "type": "protects"
+    },
+    {
+      "source": "control-limited-token-approvals",
+      "target": "surface-token-approvals",
+      "type": "protects"
+    },
+    {
+      "source": "control-signer-isolation",
+      "target": "component-hardware-wallet",
+      "type": "protects"
+    },
+    {
+      "source": "control-independent-tx-verification",
+      "target": "surface-transaction-signing",
+      "type": "protects"
+    },
+    {
+      "source": "control-signer-isolation",
+      "target": "guidance-cold-vs-hot",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-cold-wallet-separation",
+      "target": "guidance-cold-vs-hot",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-offline-seed-custody",
+      "target": "guidance-seed-phrase-management",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-simulate-before-sign",
+      "target": "guidance-signing-verification",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-independent-tx-verification",
+      "target": "guidance-signing-verification",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-limited-token-approvals",
+      "target": "guidance-smart-contract-interaction",
+      "type": "documented-by"
+    },
+    {
+      "source": "threat-blind-signing",
+      "target": "guidance-signing-verification",
+      "type": "documented-by"
+    },
+    {
+      "source": "threat-seed-phrase-compromise",
+      "target": "guidance-seed-phrase-management",
+      "type": "documented-by"
+    },
+    {
+      "source": "threat-unlimited-token-approval",
+      "target": "guidance-smart-contract-interaction",
+      "type": "documented-by"
+    },
+    {
+      "source": "component-hardware-wallet",
+      "target": "guidance-cold-vs-hot",
+      "type": "documented-by"
+    },
+    {
+      "source": "asset-seed-secrets",
+      "target": "guidance-seed-phrase-management",
+      "type": "documented-by"
+    },
+    {
+      "source": "component-software-wallet",
+      "target": "guidance-wallet-security",
+      "type": "documented-by"
+    }
+  ]
+}