> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/phases/phase_07/phase07_requirement_routing_matrix.md). # Phase 07 Requirement Routing Matrix **Session ID**: `phase07-session01-hosted-services-requirements-and-privacy-baseline` **Status**: Matrix Complete **Created**: 2026-05-30 **Scope**: Hosted-service requirement ownership across Phase 07 Sessions 02-07 and Phase 08 deferrals *** ## Purpose This matrix assigns hosted configuration, hosted identity, hosted persistence, public replay, analytics, push, remote access, diagnostics, documentation, and validation requirements to the smallest owning Phase 07 session or to Phase 08 when the work is release hardening, trusted erasure, certification, or legacy decommission. ## Routing Summary | Owner | Surface | Primary responsibility | | ---------- | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | Session 01 | Requirements and privacy baseline | Source-backed baseline, variable inventory, payload blocklist, and routing. | | Session 02 | Hosted configuration and client exposure | Public-client, server-only secret, deploy-only, reserved, disabled-default, diagnostics, and local fallback boundaries. | | Session 03 | Hosted identity and authorization | Account lifecycle, consent, session expiry, revocation, role/audit requirements, and Worker authority non-overclaim. | | Session 04 | Hosted persistence and public replay | Hosted storage eligibility, Supabase/RLS requirements, public replay consent, retention, export, deletion, takedown, and sensitive-payload rejection. | | Session 05 | Analytics consent and payload controls | Disabled-default analytics, consent, taxonomy, scrubbing, opt-out, self-hosting, and payload tests. | | Session 06 | Push, remote access, tunnel, and diagnostics | Web Push/VAPID requirements, remote access/tunnel guardrails, compact hosted-service diagnostics, and unavailable states. | | Session 07 | Validation and documentation closeout | End-to-end guardrail validation, docs sync, security posture, and Phase 08 handoff. | | Phase 08 | Release hardening and legacy decommission | Trusted unified erasure, production-hosted validation, release readiness, mobile/WCAG certification, and decommission gates. | ## Requirement Matrix | ID | Requirement | Owner | Evidence or acceptance | | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | P07-R001 | Maintain the source-backed hosted services, privacy, local-first, variable, and payload baseline. | Session 01 | Baseline, routing matrix, and hosted payload blocklist exist in `.spec_system/PRD/phase_07/`. | | P07-R002 | Categorize hosted-related variables as active local, public-client, server-only secret, deploy-only secret, reserved future, or blocked. | Session 02 | Config docs and tests or diagnostics prove browser config never includes service-role keys, API tokens, zone ids, tunnel tokens, provider secrets, or raw OAuth secrets. | | P07-R003 | Preserve local-only fallback when Supabase, Umami, VAPID, Cloudflare credentials, Worker URL, tunnel token, provider credentials, analytics, push, public replay hosting, or remote access are absent. | Sessions 02, 05, 06, 07 | Local server, web, hooks, CLI, adapters, Worker fallback, and public demo checks remain credential-free unless a scoped test deliberately configures an optional surface. | | P07-R004 | Add or refine hosted config parsing, validation, diagnostics, and docs where current behavior is ambiguous. | Session 02 | Diagnostics expose posture only and never raw values. Source changes include focused tests. | | P07-R005 | Keep publishable browser values documented, revocable, and non-secret. | Session 02 | `VITE_` values and future publishable Supabase/Umami/VAPID metadata are documented as browser-visible, not secret-safe. | | P07-R006 | Keep server-only secrets and deploy credentials out of browser config, logs, health responses, diagnostics, replay, exports, archives, and docs examples. | Sessions 02, 06, 07 | Secret scan and docs checks pass; diagnostics use bounded status labels. | | P07-R007 | Define hosted account lifecycle requirements for sign-in, session expiry, logout, revocation, consent, local-only fallback, and account deletion/export handoff. | Session 03 | Identity guardrail spec and docs exist; no release-ready hosted auth claim is made. | | P07-R008 | Define authorization boundaries for account data, War Room participation, hosted storage, analytics preferences, public replay, push, remote access, and operator diagnostics. | Session 03 | Protocol/server/web/docs scaffolding, where added, keeps unsupported/planned states explicit and tested. | | P07-R009 | Specify hosted-auth requirements for PKCE, JWKS, token validation, minimal OAuth scopes, role mapping, audit, abuse controls, and end-to-end validation. | Session 03 | Requirements are documented before any OAuth or account UI becomes active. | | P07-R010 | Prevent Worker room-local authority from being described as hosted identity, SSO, organization membership, public collaboration safety, or production audit proof. | Session 03 | Docs/tests preserve authority as one room-scoped bearer proof only. | | P07-R011 | Define hosted persistence eligibility and local-only, blocked, redacted, or user-export-only data categories. | Session 04 | Hosted persistence boundary spec aligns with payload blocklist and local export/replay/archive/backup behavior. | | P07-R012 | Specify Supabase or future storage requirements for server mediation, RLS or authorization tests, migrations, bucket policy, retention, deletion, export, abuse controls, and audit tests before storage is active. | Session 04 | No database schema or bucket is described as active without matching source and tests. | | P07-R013 | Define public replay hosting requirements for consent, payload caps, replay redaction, expiration, takedown, no-index posture, abuse controls, and local-only fallback. | Session 04 | Current replay-share URL fragments remain local/redacted until public hosting is scoped and validated. | | P07-R014 | Preserve existing local export, replay-share, archive, scan, media draft, backup, adapter, and War Room redaction boundaries. | Sessions 04, 05, 06, 07 | Regression tests or docs checks confirm sensitive categories stay local or redacted. | | P07-R015 | Define analytics provider, enabled state, consent, opt-out, self-hosting, replaceability, event taxonomy, payload minimization, and local-only fallback. | Session 05 | Analytics remains disabled by default unless both configuration and consent requirements are satisfied. | | P07-R016 | Validate analytics payloads never include blocked sensitive categories. | Session 05 | Payload tests cover prompts, file contents, command bodies, terminal output, transcripts, tokens, broad paths, exports, replay buffers, scan payloads, media drafts, diagnostics, logs, backups, and quarantined historical content. | | P07-R017 | Define push subscription consent, VAPID key exposure, backend routing, unsubscribe, retention, payload minimization, and visible local fallback. | Session 06 | Push remains browser-notification/local-only or unavailable until a reviewed backend exists. | | P07-R018 | Define Cloudflare Tunnel or future remote access requirements for explicit opt-in, token handling, expiration, revocation, local auth, rate limits, Origin/CORS, audit, unsupported states, and abuse controls. | Session 06 | Remote access and tunnels remain unavailable or explicitly opt-in; no remote executor is shipped. | | P07-R019 | Define compact operator diagnostics for hosted readiness without exposing credentials, account ids, zone ids, tunnel tokens, local paths, prompts, commands, room payloads, logs, or backups. | Session 06 | CLI/server/web diagnostics expose posture, not raw values or local payloads. | | P07-R020 | Validate Phase 07 changes across focused protocol, server, web, Worker, CLI, docs, browser, formatting, lint, typecheck, test, secret scan, ASCII/LF, whitespace, and hosted-payload privacy checks as applicable. | Session 07 | Validation report records commands, outcomes, evidence paths, residual risks, and skipped test rationale if source did not change. | | P07-R021 | Sync master PRD, UX PRD, phase PRD, architecture, API, privacy, hosted-services, deployment, environments, release, package README, and runbook docs. | Session 07 | Stable docs distinguish shipped, planned, disabled, unavailable, deferred, and evidence-only states. | | P07-R022 | Record security-compliance posture for hosted identity, config, storage, analytics, push, remote access, diagnostics, and external transfer. | Session 07 | Cumulative security posture is updated without closing Phase 08 risks prematurely. | | P07-R023 | Keep trusted unified erasure outside Phase 07 shipped claims. | Phase 08 | Phase 07 may define handoff requirements only; release-grade erasure remains Phase 08. | | P07-R024 | Keep production-hosted app validation and release candidate smoke outside Phase 07 shipped claims unless a later PRD explicitly changes scope. | Phase 08 | Local and mocked evidence remains labeled as local; deployed app/Worker release smoke remains Phase 08. | | P07-R025 | Keep mobile certification, WCAG certification, release hardening, and legacy decommission outside Phase 07 shipped claims. | Phase 08 | Release docs and PRD keep certification/decommission gates deferred. | ## Cross-Session Rules * No Phase 07 session may make hosted services required for core local server, web, hooks, CLI, adapters, Worker tests, public demo, local replay, export, archive, backup, or diagnostics workflows. * Source changes that affect shared contracts start in `packages/protocol` before server, web, Worker, CLI, hooks, or adapters consume them. * Source changes that alter persisted data, storage behavior, or database behavior must include the matching schema artifact and local verification in the same session. * Browser-exposed config is limited to publishable, documented, revocable values. Browser-safe does not mean public-safe or secret-safe. * Secret-bearing or authorization-sensitive hosted operations should be server-mediated by default when later sessions introduce runtime behavior. * Diagnostics, health responses, errors, logs, tests, validation notes, and docs must expose bounded posture and reason codes, not raw credentials, request bodies, room payloads, local paths, prompts, commands, transcripts, replay buffers, exports, scans, media drafts, logs, or backups. * Disabled-default and unavailable states must have visible user/operator behavior. Blank panels, silent failures, and implied hosted capability are not acceptable closeout evidence. * Raw historical `EXAMPLES/`, probe dumps, OAuth values, token values, copied media, and sensitive local paths remain evidence-only and must not be copied into stable docs or runtime artifacts. ## Phase 08 Deferrals | Deferral | Reason | | ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Trusted unified erasure | Must cover Worker state, browser hints, local archives, memory, settings, replay buffers, exports, diagnostics, logs, backups, valid spool state, workspace files, and future hosted data. | | Production-hosted validation | Local, mocked, and same-origin Worker browser evidence does not prove deployed app, deployed Worker, Cloudflare dashboard, release-candidate, or production account behavior. | | Release hardening | Requires release gates, final docs sync, security review, and version/deploy posture beyond Phase 07 guardrails. | | Mobile and WCAG certification | Existing browser evidence is scoped local validation, not formal certification. | | Legacy decommission | `EXAMPLES/`, `docs/PROGRESS.md`, archived findings, generated drafts, and other historical inputs require Phase 08 decommission gates. | | Real file/git/terminal/Docker/remote/Worker/hosted executors | Require a separate threat model, consent, authorization, audit, rollback, redaction, rate limiting, tests, and docs before any execution ships. | ## Traceability Notes * Session 01 proves routing and baseline completeness only. It does not prove source behavior for hosted configuration, identity, persistence, analytics, push, remote access, or diagnostics. * Sessions 02 through 06 own source changes, focused tests, and package docs for their scoped surfaces when implementation is required. * Session 07 owns cross-session validation and docs/security closeout after Sessions 02 through 06 complete. * Phase 08 remains the only owner for trusted unified erasure, production-hosted validation, release hardening, certification, and legacy decommission unless a later PRD explicitly moves that scope. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/phases/phase_07/phase07_requirement_routing_matrix.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.