> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/phases/phase_07/hosted_services_requirements_privacy_baseline.md).

# Phase 07 Hosted Services Requirements And Privacy Baseline

**Session ID**: `phase07-session01-hosted-services-requirements-and-privacy-baseline` **Status**: Baseline Complete **Created**: 2026-05-30 **Scope**: Cross-cutting requirements, privacy, variable inventory, and local-first hosted-service baseline

***

## Purpose

This artifact records the Phase 07 source-backed baseline for hosted services, analytics, public replay, push, remote access, operator diagnostics, and local-first fallback. It is a planning and documentation artifact only. It does not enable hosted auth, hosted storage, analytics capture, push delivery, public replay hosting, remote access, tunnels, production-hosted validation, or trusted erasure.

## Source Evidence

* Current PRD and UX PRD: `.spec_system/PRD/PRD.md`, `.spec_system/PRD/PRD_UX.md`, and `.spec_system/PRD/phase_07/PRD_phase_07.md`.
* Phase 06 closeout and security posture: `.spec_system/specs/phase06-session07-collaboration-isolation-and-mobile-validation-closeout/`, `.spec_system/SECURITY-COMPLIANCE.md`, and `.spec_system/CONSIDERATIONS.md`.
* Stable docs: `docs/hosted-services.md`, `docs/privacy-and-security.md`, `docs/environments.md`, `docs/deployment.md`, `docs/release.md`, `docs/ARCHITECTURE.md`, and `docs/api/README_api.md`.
* Package docs: `apps/server/README_server.md`, `apps/web/README_web.md`, `apps/warroom/README_warroom.md`, `apps/cli/README_cli.md`, `apps/hooks/README_hooks.md`, `apps/adapters/README_adapters.md`, and `packages/protocol/README_protocol.md`.
* Environment examples and config comments: `.env.local.example`, `apps/server/.env.example`, `apps/adapters/.env.example`, and `apps/warroom/wrangler.toml`.
* Source and tests reviewed by inventory scan: environment readers, LLM privacy helpers, backup script, logging helpers, War Room protocol/Worker/web tests, adapter privacy/config tests, export/archive tests, notification tests, replay tests, scan tests, unsupported route tests, and isolation diagnostics tests.

## Current Hosted-Service Posture

### Current Local-First Boundary

FactionOS is local-first by default. Core development and current shipped workflows do not require a hosted account, Supabase, Umami, PostHog, Cloudflare credentials, Discord, Telegram, generic webhooks, Anthropic, push, remote tunnels, hosted storage, public replay hosting, hosted diagnostics, or a production app host.

The current optional external-transfer paths are:

* Anthropic LLM provider calls, only when `ANTHROPIC_API_KEY` and `FACTIONOS_ALLOW_LLM_PROVIDER_TRANSFER=true` are both present.
* Cloudflare Worker War Room room relay, only when the browser is configured with a Worker URL and the operator has deployed or runs the optional Worker.
* Discord, Telegram, or generic webhook outbound adapters, only when the operator configures the destination credentials.
* Cloudflare Pages or GitHub Pages static public demo hosting, which serves synthetic demo data only.
* Draft media generation scripts for fal.ai or ElevenLabs, only when local provider credentials and explicit draft-generation commands are used.

### Phase 06 Security Carryforward

| Finding                     | Status for Phase 07                                                                                                                                                                                                                                                                                                                                                         |
| --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `P06-S07-HOSTED-IDENTITY`   | Open. Room-local Worker-issued bearer authority, participant metadata, expected revisions, idempotency keys, and hashed Durable Object metadata are not hosted account identity, SSO, organization membership, public collaboration safety, consent, revocation, or production auditability. Session 03 owns hosted identity guardrails.                                    |
| `P06-S07-ERASURE`           | Open. Browser leave/reset, local recovery, local exports, archive redaction, and diagnostics cleanup are not trusted unified erasure. Phase 08 owns one trusted erase/reset workflow across Worker state, browser hints, local archives, memory, settings, replay buffers, exports, diagnostics, logs, backups, valid spool state, workspace files, and future hosted data. |
| `P06-S07-HOSTED-VALIDATION` | Deferred. Phase 06 evidence is local browser, focused package, mocked or same-origin Worker, and repository gate evidence. It is not production-hosted app validation, deployed Worker release smoke, Cloudflare dashboard review, release-candidate certification, mobile certification, or WCAG certification.                                                            |

### Current GDPR And Privacy Posture

The cumulative security posture is `AT RISK` because hosted identity, production-hosted validation, and trusted unified erasure remain open. Current GDPR posture documents purposes for local browser state, exports, scans, orchestration diagnostics, backups, logs, and optional War Room room metadata, but deletion remains manual or narrow until Phase 08 erasure work.

Phase 07 must not describe a hosted transfer, analytics capture, hosted storage write, public replay host, push payload, diagnostic upload, remote access path, or account-backed flow as active until the owning session adds the required consent, minimization, redaction, authorization, fallback, test, and documentation evidence.

## Variable Inventory

### Active Local Runtime

These values are consumed by current source or repo tooling and are local-first defaults. They must not become hosted-service requirements.

| Category              | Variables                                                                                                                                                                                                                                                                                                                                                                 | Current boundary                                                                                                                  |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| Server runtime        | `PORT`, `FACTIONOS_BIND_HOST`, `FACTIONOS_ALLOW_NON_LOOPBACK_BIND`, `FACTIONOS_MOCK`, `CORS_ORIGINS`, `FACTIONOS_WS_ALLOWED_ORIGINS`, `FACTIONOS_TRUST_PROXY`                                                                                                                                                                                                             | Local server startup, loopback/default origin posture, and mock mode.                                                             |
| Local auth            | `FACTIONOS_AUTH_TOKEN`, `VITE_FACTIONOS_AUTH_TOKEN`                                                                                                                                                                                                                                                                                                                       | Optional local bearer auth. The `VITE_` copy is browser-exposed and must be limited to local dev or reviewed private deployments. |
| Local state           | `FACTIONOS_HOME`, `FACTIONOS_LOGS_DIR`, `FACTIONOS_BACKUP_DIR`, `FACTIONOS_BACKUP_RETENTION_DAYS`                                                                                                                                                                                                                                                                         | Local files, logs, archives, and backups. These are sensitive local developer data, not hosted storage.                           |
| LLM provider transfer | `ANTHROPIC_API_KEY`, `FACTIONOS_ALLOW_LLM_PROVIDER_TRANSFER`, `FACTIONOS_LLM_TIMEOUT_MS`, `FACTIONOS_SCAN_ROOTS`, `FACTIONOS_AUTO_IMPROVE`                                                                                                                                                                                                                                | Provider transfer remains two-level opt-in; scan roots stay local and bounded.                                                    |
| CLI and hooks         | `FACTIONOS_SERVER_URL`, `FACTIONOS_SESSION_ID`, `FACTIONOS_TTY`, `FACTIONOS_FACTION`, `FACTIONOS_RESTRICTED`, `FACTIONOS_CLI`, `FACTIONOS_HOOKS_ROOT`, `CLAUDE_PLUGIN_ROOT`, `CLAUDE_CODE_MODEL`, `CURSOR_BIN`, `CURSOR_SESSION`, `OPENCODE_VERSION`, `FACTIONOS_HOOK_TIMEOUT_MS`, `FACTIONOS_DISABLE_LISTENER`, `FACTIONOS_MAX_SPOOL_BYTES`, `FACTIONOS_MAX_SPOOL_FILES` | Local hook setup, local diagnostics, bounded handler behavior, and provider detection hints.                                      |
| Adapters              | `FACTIONOS_WS_URL`, `FACTIONOS_ADAPTER_MIN_INTERVAL_MS`, `FACTIONOS_ADAPTER_SEVERITY`, `DISCORD_BOT_NAME`, `DISCORD_BOT_AVATAR_URL`, `TELEGRAM_CHAT_ID`, `TELEGRAM_THREAD_ID`, `FACTIONOS_WEBHOOK_PAYLOAD_SHAPE`, `FACTIONOS_WEBHOOK_USER_AGENT`, `FACTIONOS_WEBHOOK_TIMEOUT_MS`                                                                                          | Optional outbound adapter configuration. Compact payloads remain the default.                                                     |
| War Room local/test   | `VITE_FACTIONOS_WARROOM_WORKER_URL`, `FACTIONOS_RUN_WRANGLER_DEV`, `FACTIONOS_WARROOM_LOCAL_URL`, `FACTIONOS_WARROOM_LOCAL_HEALTH_URL`                                                                                                                                                                                                                                    | Optional browser-safe Worker URL defaults and local Wrangler test references. Blank keeps local-only War Room mode.               |
| Demo and E2E tooling  | `FACTIONOS_DEMO_PORT`, `FACTIONOS_DEMO_PREFIX`, `FACTIONOS_E2E_WEB_PORT`, `FACTIONOS_E2E_DEMO_PORT`, `FACTIONOS_E2E_SERVER_PORT`, `FACTIONOS_E2E_WEB_HOST`, `FACTIONOS_E2E_SERVER_HOST`                                                                                                                                                                                   | Local demo and browser-test port/host selection only.                                                                             |

### Active Server-Only Or Secret Values

These values are secret-bearing or can authorize external transfer. They must never be copied into browser config, stable docs as raw values, logs, test artifacts, diagnostics, replay, exports, archives, public demo assets, or Worker payloads.

| Variables                                                                                                   | Boundary                                                                                                    |
| ----------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| `FACTIONOS_AUTH_TOKEN`                                                                                      | Local bearer secret for HTTP and WebSocket access.                                                          |
| `ANTHROPIC_API_KEY`                                                                                         | Optional provider secret; not sufficient for transfer without `FACTIONOS_ALLOW_LLM_PROVIDER_TRANSFER=true`. |
| `DISCORD_WEBHOOK_URL`, `TELEGRAM_BOT_TOKEN`, `FACTIONOS_WEBHOOK_URL`, `FACTIONOS_WEBHOOK_AUTH_HEADER_VALUE` | Adapter secrets or secret-bearing endpoints for outbound-only bridges.                                      |
| `ELEVENLABS_API_KEY`, `FAL_KEY`                                                                             | Draft-generation provider secrets; current runtime must not depend on them.                                 |
| `SUPABASE_SECRET_KEY`, `SUPABASE_SERVICE_ROLE_KEY`, `UMAMI_API_KEY`, `VAPID_PRIVATE_KEY`                    | Reserved future hosted/server-side secrets; not consumed by current runtime.                                |

### Public-Client Or Browser-Visible Values

Browser-visible values can identify projects, sites, or origins even when they are not secrets. They require documentation, revocation posture, and local-only fallback before use.

| Variables                                                                                                                                                                                                       | Boundary                                                                                                                                    |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| `VITE_FACTIONOS_AUTH_TOKEN`                                                                                                                                                                                     | Browser-exposed copy of the optional local bearer token. Do not use as a hosted secret.                                                     |
| `VITE_FACTIONOS_WARROOM_WORKER_URL`                                                                                                                                                                             | Browser-safe optional Worker origin only. Blank means local-only War Room mode.                                                             |
| `VITE_SUPABASE_URL`, `VITE_SUPABASE_PUBLISHABLE_KEY`, `SUPABASE_URL`, `SUPABASE_PUBLISHABLE_KEY`, `SUPABASE_ANON_KEY`                                                                                           | Reserved future hosted identity/storage client config. Not proof of active Supabase runtime.                                                |
| `UMAMI_HOST_URL`, `UMAMI_WEBSITE_ID`, `FACTIONOS_ANALYTICS_PROVIDER`, `FACTIONOS_ANALYTICS_ENABLED`                                                                                                             | Reserved future analytics config. Analytics remains disabled/not wired until Session 05 adds consent, taxonomy, scrubbing, tests, and docs. |
| `VAPID_PUBLIC_KEY`, `VAPID_SUBJECT`                                                                                                                                                                             | Reserved future push metadata; no push backend is shipped.                                                                                  |
| `CLOUDFLARE_WARROOM_WORKER_URL`, `CLOUDFLARE_WARROOM_HEALTH_URL`, `CLOUDFLARE_WARROOM_CUSTOM_DOMAIN`, `CLOUDFLARE_WARROOM_CUSTOM_URL`, `CLOUDFLARE_WARROOM_CUSTOM_HEALTH_URL`, `CLOUDFLARE_PAGES_CUSTOM_DOMAIN` | Public operational URLs/domains. They are deploy references, not hosted identity/storage/analytics config.                                  |

### Deploy-Only Or Operations Values

These values are for deployment, Cloudflare dashboard/API operation, or tunnel experiments. Core local workflows must not require them.

| Variables                                                                                                                                                                     | Boundary                                                                                                                                   |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| `CLOUDFLARE_ACCOUNT_ID`, `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ZONE_ID`                                                                                                         | Cloudflare deployment and dashboard/API operation. Do not expose to browser config, logs, health responses, docs examples, or diagnostics. |
| `CLOUDFLARE_PAGES_PROJECT_NAME`, `CLOUDFLARE_PAGES_CUSTOM_DOMAIN`                                                                                                             | Public demo deployment references.                                                                                                         |
| `CLOUDFLARE_TUNNEL_TOKEN`                                                                                                                                                     | Reserved tunnel secret; remote access remains Session 06 guardrail scope only.                                                             |
| `CLOUDFLARE_WARROOM_WORKER_URL`, `CLOUDFLARE_WARROOM_HEALTH_URL`, `CLOUDFLARE_WARROOM_CUSTOM_DOMAIN`, `CLOUDFLARE_WARROOM_CUSTOM_URL`, `CLOUDFLARE_WARROOM_CUSTOM_HEALTH_URL` | Deployment validation references for the optional Worker. They must not make Worker use mandatory for local dev.                           |
| `WAR_ROOMS`                                                                                                                                                                   | Cloudflare Durable Object binding, not a user-set local secret.                                                                            |

### Reserved Future Values

These placeholders are documentation and planning anchors only unless a later Phase 07 session wires source, tests, consent, redaction, fallback, and docs.

* Supabase hosted identity/storage: `SUPABASE_URL`, `SUPABASE_PUBLISHABLE_KEY`, `SUPABASE_ANON_KEY`, `SUPABASE_SECRET_KEY`, `SUPABASE_SERVICE_ROLE_KEY`, `VITE_SUPABASE_URL`, `VITE_SUPABASE_PUBLISHABLE_KEY`.
* Umami analytics: `FACTIONOS_ANALYTICS_PROVIDER`, `FACTIONOS_ANALYTICS_ENABLED`, `UMAMI_HOST_URL`, `UMAMI_WEBSITE_ID`, `UMAMI_API_KEY`.
* Web Push: `VAPID_PUBLIC_KEY`, `VAPID_PRIVATE_KEY`, `VAPID_SUBJECT`.
* Remote access/tunnel: `CLOUDFLARE_TUNNEL_TOKEN`.

### Blocked From Browser Config, Logs, And Public Docs

The following values or value classes are blocked from browser bundles, runtime logs, health responses, diagnostics, replay/share fragments, archives, exports, public demo code, stable docs, and generated artifacts unless a future session creates an explicitly redacted representation:

* Service-role keys, API keys, provider keys, webhook URLs, bot tokens, bearer values, auth header values, cookies, OAuth client secrets, tunnel tokens, VAPID private keys, and raw authority tokens.
* Cloudflare account ids, zone ids, API tokens, request headers, client IPs, raw Worker request bodies, room payloads, and deployment probe dumps.
* Raw Supabase service-role, secret, JWT, RLS, storage bucket, OAuth callback, and account lifecycle values.

## Hosted Surface Baselines

### Hosted Configuration

* Public-client config is limited to documented, publishable, revocable values that can safely be bundled into browser code. It must not include service-role keys, API tokens, account ids, zone ids, tunnel tokens, provider secrets, webhook secrets, raw OAuth secrets, or raw authority tokens.
* Server-only secrets stay on the local/server side and must not be mirrored into `VITE_` values unless a later session explicitly proves that the value is browser-safe and non-secret.
* Deploy-only credentials are for CI/CD, Cloudflare dashboard/API operations, or manual deploy commands. They must not be prerequisites for local server, web, hooks, CLI, adapters, public demo, or local tests.
* Reserved variables are not runtime evidence. A value present in `.env.local.example` is not proof that source consumes it or that a hosted feature is active.

### Hosted Identity

* Hosted identity is not shipped. Future identity work must define account lifecycle, sign-in, logout, session expiry, revocation, consent, role mapping, authorization, audit, abuse controls, and local-only fallback.
* Worker room-local authority remains one room-scoped bearer proof. It is not hosted identity, SSO, organization membership, public collaboration safety, production audit proof, analytics consent, account ownership, or trusted erasure.
* Raw account tokens and raw Worker authority tokens must never be stored in localStorage, replay buffers, exports, archives, diagnostics, logs, Worker payloads, or public docs.

### Hosted Persistence And Public Replay

* Hosted persistence is not active. Session 04 owns any future storage eligibility, server mediation, RLS or authorization rules, migrations, bucket policy, retention, export, deletion, audit, and abuse controls.
* Public replay hosting is not active. Current replay sharing remains local URL-fragment sharing with redaction and payload caps.
* Local exports, session archives, backups, memory findings, scans, media drafts, and Worker room data are not hosted-safe or public-safe by default.

### Analytics

* Analytics is not wired and remains disabled by default. Session 05 owns provider selection, consent, opt-out, self-hosting posture, event taxonomy, payload scrubbing, replaceability, and tests.
* Umami is the selected future default provider, but PostHog remains historical service-discovery context only.
* Analytics payloads must never include blocked sensitive categories.

### Push, Remote Access, Tunnel, And Diagnostics

* Browser notifications are local-only and opt-in. No push backend is shipped.
* Future Web Push requires VAPID exposure rules, subscription consent, unsubscribe behavior, retention, payload minimization, and a reviewed backend.
* Remote access and Cloudflare Tunnel workflows are not shipped. Future remote access requires explicit opt-in, token expiration, revocation, local auth, Origin/CORS controls, rate limiting, audit, abuse controls, and unavailable states.
* Hosted readiness diagnostics may expose compact posture only: present/absent, enabled/disabled, valid/invalid, unavailable, timeout, rate-limited, and docs paths. They must not expose raw credentials, account ids, zone ids, tunnel tokens, local paths, room payloads, prompts, commands, logs, backups, exports, replay buffers, or request bodies.

## Required Local-First Checks

Every later Phase 07 session must preserve these checks before marking a hosted-adjacent task complete:

| Check                | Requirement                                                                                                                                                                                    |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Disablement          | The feature stays off when variables are blank, malformed, absent, or explicitly disabled.                                                                                                     |
| Local fallback       | Core local workflows remain usable without hosted accounts, hosted storage, analytics, Worker URL, Cloudflare credentials, push, VAPID, tunnels, provider keys, adapters, or production hosts. |
| Consent              | User/operator intent is required before hosted transfer, analytics capture, push subscription, remote access, public replay, or hosted diagnostics.                                            |
| Minimization         | Payloads include only fields needed for the documented purpose.                                                                                                                                |
| Redaction            | Blocked categories are rejected, dropped, or replaced with stable placeholders before transfer.                                                                                                |
| Authorization        | Access checks happen at the closest boundary to protected data, not only in UI copy.                                                                                                           |
| Duplicate prevention | Mutating hosted or hosted-adjacent actions guard duplicate clicks, retries, stale revisions, and replayed idempotency keys.                                                                    |
| Re-entry freshness   | Reconnect, settings changes, token expiry, account revocation, Worker URL changes, and logout clear or revalidate stale state.                                                                 |
| Failure visibility   | Missing credentials, denied consent, invalid config, network timeout, rate limit, malformed response, unsupported route, and unavailable service states are visible and bounded.               |
| Error boundaries     | External-facing errors expose stable codes and safe messages only. No stacks, raw request bodies, secrets, internal paths, provider dumps, or account identifiers.                             |
| Documentation        | Docs explain shipped versus planned behavior, data sent, disablement, local-only behavior, tests, and remaining risks.                                                                         |
| Validation evidence  | Tests or documented checks match the changed surface. Documentation-only sessions still need consistency, ASCII/LF, path/link, and whitespace validation.                                      |

## Phase 08 Deferrals

* Trusted unified erasure across local state, browser state, Worker state, archives, memory, settings, replay, exports, diagnostics, logs, backups, valid spool entries, workspace files, and future hosted data.
* Production-hosted app validation, deployed Worker release smoke, Cloudflare dashboard review, release-candidate smoke, release hardening, and final deployment certification.
* Mobile certification and WCAG certification beyond scoped local browser evidence.
* Legacy decommission for `EXAMPLES/`, archived findings, generated drafts, `docs/PROGRESS.md`, and other evidence-only historical inputs.
* Real file, git, terminal, Docker, remote, Worker, or hosted executors.

## Session Handoff

| Next owner | Must use this baseline for                                                                                                                                    |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Session 02 | Hosted config category map, public/secret/deploy/reserved separation, browser-visible value rules, diagnostics without raw values, and local fallback checks. |
| Session 03 | Hosted identity lifecycle, authorization, consent, revocation, role, audit, and Worker authority non-overclaim.                                               |
| Session 04 | Hosted persistence eligibility, public replay hosting limits, Supabase/RLS/storage requirements, retention, export, deletion, and local artifact protection.  |
| Session 05 | Disabled-default analytics, Umami/self-hosting posture, consent, taxonomy, payload minimization, opt-out, and sensitive payload tests.                        |
| Session 06 | Push/VAPID, remote access/tunnel, operator diagnostics, compact posture reporting, and unavailable/opt-in states.                                             |
| Session 07 | End-to-end consistency, security posture, docs sync, quality gates, secret scan, residual risks, and Phase 08 handoff.                                        |
| Phase 08   | Trusted unified erasure, production-hosted validation, release hardening, certification, and legacy decommission.                                             |

No later session may treat this file as evidence that hosted identity, hosted storage, analytics, push, public replay hosting, remote access, hosted diagnostics, production-hosted validation, or trusted erasure is shipped.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/phases/phase_07/hosted_services_requirements_privacy_baseline.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.