feat: Add OWASP Threat Model Library parity

schema/2.0/modules/cyclonedx-blueprint-2.0.schema.json

@@ -307,6 +307,10 @@
         "ordinalVersion": {
           "$ref": "cyclonedx-common-2.0.schema.json#/$defs/ordinalVersion"
         },
+        "frozen": {
+          "type": "boolean",
+          "description": "Whether the blueprint is frozen and must be versioned before modification."
+        },
         "lifecycles": {
           "$ref": "cyclonedx-common-2.0.schema.json#/$defs/lifecycles"
         },
@@ -397,6 +401,12 @@
         }
       }
     },
+    "inScope": {
+      "type": "boolean",
+      "title": "In Scope",
+      "description": "Whether this element is within the scope of the model.",
+      "default": true
+    },
     "asset": {
       "type": "object",
       "title": "Asset",
@@ -512,6 +522,9 @@
           "title": "Description",
           "description": "Description of the asset's role and purpose."
         },
+        "inScope": {
+          "$ref": "#/$defs/inScope"
+        },
         "zone": {
           "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
           "description": "Reference using bom-link or bom-ref to the zone containing this asset."
@@ -644,6 +657,9 @@
           "title": "Description",
           "description": "Purpose and contents of the store."
         },
+        "inScope": {
+          "$ref": "#/$defs/inScope"
+        },
         "type": {
           "title": "Type",
           "description": "The type of data store. Use the custom option for technologies not covered by the enumeration.",
@@ -834,6 +850,9 @@
           "title": "Record Count",
           "description": "Approximate number of records."
         },
+        "inScope": {
+          "$ref": "#/$defs/inScope"
+        },
         "owners": {
           "type": "array",
           "title": "Owners",
@@ -1087,6 +1106,9 @@
           },
           "description": "Constraints or limitations of this zone."
         },
+        "inScope": {
+          "$ref": "#/$defs/inScope"
+        },
         "properties": {
           "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
         }
@@ -1175,6 +1197,9 @@
         "sessionManagement": {
           "$ref": "#/$defs/sessionManagement"
         },
+        "inScope": {
+          "$ref": "#/$defs/inScope"
+        },
         "properties": {
           "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
         }
@@ -1434,6 +1459,9 @@
           "title": "Description",
           "description": "Detailed description of what flows and why."
         },
+        "inScope": {
+          "$ref": "#/$defs/inScope"
+        },
         "type": {
           "title": "Type",
           "description": "The type of flow. Use the custom option for types not covered by the enumeration.",
@@ -1600,6 +1628,9 @@
           "title": "Description",
           "description": "A narrative describing this actor's role within the modelled system, distinct from the party's identity-level description. Use to record context-specific framing such as why this actor is in scope or how it interacts with the assets in this blueprint."
         },
+        "inScope": {
+          "$ref": "#/$defs/inScope"
+        },
         "permissions": {
           "type": "array",
           "title": "Permissions",

schema/2.0/modules/cyclonedx-threat-2.0.schema.json

@@ -439,6 +439,11 @@
           "title": "Description",
           "description": "A description of the threat scenario."
         },
+        "event": {
+          "type": "string",
+          "title": "Event",
+          "description": "The event that realizes or triggers the threat in this scenario."
+        },
         "threats": {
           "type": "array",
           "title": "Threats",

tools/src/test/resources/2.0/valid-blueprint-conceptual-2.0.json

@@ -14,6 +14,7 @@
       ],
       "metadata": {
         "timestamp": "2026-06-05T12:05:00Z",
+        "frozen": false,
         "authors": [
           {
             "roles": [
@@ -36,6 +37,7 @@
           "bom-ref": "cap-membership",
           "type": "subsystem",
           "name": "Membership",
+          "inScope": false,
           "description": "The capability concerned with enrolling and identifying members."
         },
         {
@@ -48,6 +50,7 @@
           "bom-ref": "cap-lending",
           "type": "subsystem",
           "name": "Lending",
+          "inScope": true,
           "description": "The capability concerned with loans, due dates, and returns."
         }
       ],

tools/src/test/resources/2.0/valid-blueprint-data-flow-2.0.json

@@ -93,6 +93,7 @@
             }
           },
           "description": "A retail banking customer initiating a transfer.",
+          "inScope": false,
           "zone": "zone-internet",
           "permissions": [
             "initiate-transfer"
@@ -104,6 +105,7 @@
           "bom-ref": "asset-portal",
           "type": "service",
           "name": "Web portal",
+          "inScope": true,
           "zone": "zone-dmz"
         },
         {
@@ -142,6 +144,7 @@
           "bom-ref": "df-login",
           "name": "Login and transfer request",
           "type": "data",
+          "inScope": true,
           "source": "act-customer",
           "destination": "asset-portal",
           "synchronous": true,

tools/src/test/resources/2.0/valid-blueprint-deployment-2.0.json

@@ -85,6 +85,7 @@
           "bom-ref": "ds-postgres",
           "name": "Managed PostgreSQL",
           "type": "relational",
+          "inScope": true,
           "environment": "production",
           "zone": "zone-prod",
           "location": "east region"

tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json

@@ -23,6 +23,7 @@
         "inherentRisk": {
           "likelihood": {
             "level": "high",
+            "score": 4,
             "probability": 0.7,
             "timeframe": "P1Y",
             "factors": [
@@ -34,6 +35,7 @@
           },
           "impact": {
             "level": "major",
+            "score": 4,
             "polarity": "harm",
             "categories": [ "bias", "discrimination", "human-rights", { "name": "brand-trust" } ],
             "factors": [
@@ -48,7 +50,7 @@
             },
             "description": "Potential regulatory action and harm to affected applicants."
           },
-          "score": { "level": "high", "score": 8, "methodology": "owasp-risk-rating" },
+          "score": { "level": "high", "score": 16, "methodology": "qualitative-matrix" },
           "detectability": { "score": 6, "description": "Bias surfaces only in aggregate metrics, so individual decisions are hard to flag." },
           "confidence": 0.6,
           "rationale": "Based on offline fairness metrics."

tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json

@@ -67,6 +67,7 @@
           "espionage"
         ],
         "intent": "targeted",
+        "event": "An actor obtains and uses an operator credential.",
         "accessLevel": "external",
         "attackVector": {
           "type": "network",