Capstone templates¶
These are blank forms. Copy, don’t edit. Put the copy in your
work folder, which git ignores, and fill that in. The
templates stay blank so the next git pull never overwrites your work.
Every template uses the same headings as its Helix Tickets example. Helix is the wrong product with the right shape. Copy its structure, never its names.
| Template | Save as | Milestone | Start in | Helix example |
|---|---|---|---|---|
| Threat model | work/threat-model.md |
Artifact A | Module 1 | example |
| ATT&CK coverage | work/attack-coverage.md |
Artifact D | Module 8 | example |
| Replay fixtures | work/fixtures/<rule>.fire.jsonl + .quiet.jsonl |
Artifact D | Module 11 | example |
| Incident report | work/incident-report.md |
Artifact E | Modules 10–11 | example |
| Containment runbook | work/containment-runbook.md |
Artifact F | Module 11 | example |
| Purple-team report | work/purple-report.md |
Artifact G | Module 9 | example |
| Agent run | work/agent-run.json |
Artifact H | Module 12 | — |
| Architecture review | work/architecture-review.md |
Artifact I | Module 13 | example |
| Security decision record | work/security-decision-record.md |
Artifact I | Module 13 | example |