[0x5t4l1n]

Model properties used in threat conditions are hard to discover, and --describe Controls previously failed. Add Controls to the existing description registry so the command lists control fields, their descriptions, and defaults using the same mechanism as element classes.

Move the six control definitions covered by the guide into their Pydantic field descriptions: checksInputBounds, validatesInput, sanitizesInput, usesStrongSessionIdentifiers, authenticatesSource, and authorizesSource. Keep the guide focused on how properties drive findings, a runnable example, and how sourceFiles is used by --stale. Link to --describe Controls from the README and guide.

Validation:

• Full suite on Linux (Python 3.14): pytest -q — 254 passed.
• CLI regression coverage for Controls, combined Server Controls, and unknown class errors.
• Manually checked python tm.py --describe Controls on Windows (Python 3.11).
• Black check for the changed model and new tests; git diff --check passed.
• Windows full suite: 250 passed, with four diagram fixture failures caused by Windows/Linux path separators.

Closes #28.

[izar]

I like the idea of a file explaining the properties and threats mechanism, as it will make it easier for LLMs to work with pytm, but I question having Controls explained there rather than added to the current --describe mechanism.

[izar]

Please add Controls description to the existing mechanism.

[0x5t4l1n]

Added Controls to the existing --describe mechanism in c2ba4af and moved the guide's six control definitions into their field descriptions. Updated the docs and added CLI regression tests. All 254 tests pass on Linux.