> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase02-session07-product-surface-validation-and-documentation-closeout/security-compliance.md).

# Security And Privacy Closeout

**Session ID**: `phase02-session07-product-surface-validation-and-documentation-closeout` **Date**: 2026-05-29 **Result**: PASS with known later-phase release risks

***

## Scope

This closeout covers Phase 02 browser-facing surfaces:

* app cockpit desktop/mobile browser validation
* public demo desktop/mobile browser validation
* browser localStorage settings and replay posture
* session export and scan-root UX documentation posture
* public demo synthetic-data and service-worker boundaries
* stable docs, README files, PRD, UX PRD, and gap matrix language

It does not certify production hosted deployment, hosted auth, hosted storage, analytics, public replay hosting, push delivery, web-to-Worker federation, or a trusted local erasure workflow.

## Evidence Reviewed

| Evidence                              | Result                                                                                                                              |
| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| App Playwright desktop/mobile         | Passed: 5 passed, 1 expected mobile skip for desktop-only overlay path                                                              |
| Public demo Playwright desktop/mobile | Passed: 8 passed, 2 expected mobile skips for desktop-only overlay and service-worker paths                                         |
| Public demo offline reload            | Passed after one online visit on the path-prefixed `/factionos/` local server                                                       |
| Browser guards                        | Passed for app/demo guarded paths: no unexpected page errors, console errors, failed local requests, or failed local asset requests |
| Screenshot review                     | Passed after fixing a public demo mobile header overlap                                                                             |
| Stable docs review                    | Updated shipped, deferred, excluded, and evidence-only language                                                                     |

## Local-First Boundary

Core Phase 02 workflows remain local-first. The app cockpit runs against the local server and browser state. The public demo runs from static files with synthetic data and CDN browser dependencies. No Session 07 change adds a hosted account, hosted storage, hosted analytics, production database, push backend, or hosted replay requirement.

## Redaction And Sensitive Data

Session 07 docs and reports summarize command names and posture conclusions only. They do not copy raw prompts, command bodies, provider errors, token-like values, OAuth IDs, probe output, sensitive local paths, or raw browser logs.

The existing Phase 01 redaction boundaries remain the current contract:

* replay-share payloads are shape-filtered and redacted before URL-fragment encoding
* exports preserve CSV/JSON shape while redacting prompt, path, command, token, URL, terminal, and transcript-sensitive values
* archives apply archive-boundary redaction before local JSONL persistence
* LLM provider transfer requires explicit key plus transfer flag and uses local fallback otherwise
* scan-root failures avoid broad absolute-path leakage in shared surfaces

## Browser Storage

The app uses browser localStorage for bounded settings and replay state. Reset settings remains a browser-preference reset only and is not a trusted erasure workflow for replay buffers, local archives, memory findings, PID/workspace files, or filesystem data.

The public demo service worker cache version is `factionos-demo-v7`. It caches only static demo shell files, approved demo assets, and allowed CDN runtime responses. It does not cache real hooks, prompts, local server data, replay uploads, account data, or War Room room state.

## Public Demo Boundary

The public demo remains a standalone no-build static artifact. It uses synthetic heroes, missions, notices, scrolls, achievements, local demo media, and a path-prefixed service-worker scope. It does not import workspace packages, read real hooks, connect to the local server, call LLM endpoints, open the app plan workpad, persist server state, host replay data, or federate through War Room.

## War Room And Hosted Services

The Worker backend remains a separate optional surface. The current web panel is a stub and full web-to-Worker federation is deferred to Phase 05. Hosted auth, hosted storage, analytics, public replay hosting, and broader production deployment validation remain later-phase work.

## Findings

| Severity | Finding                                                                       | Status                                                                                    |
| -------- | ----------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
| Medium   | Public demo mobile header badge overlapped top controls in screenshot review. | Fixed in `public-demo/index.html`; public demo e2e reran and passed.                      |
| Low      | Public demo shell changed while service worker precaches `index.html`.        | Fixed by bumping `CACHE_VERSION` to `factionos-demo-v7`; offline reload reran and passed. |

## Remaining Release Risks

* Route-specific authorization and schemas still need extension for future route families.
* Generic webhook full mode, hosted analytics, federation, and future hosted replay need destination-specific data policies and redaction review.
* Local retention and unified erasure controls remain Phase 08 release-hardening work.
* Production hosted browser validation is not part of Phase 02 closeout.
* Full WCAG certification is not claimed by this session.

## Conclusion

Session 07 preserves the Phase 02 local-first privacy posture and fixes the one observed mobile visual overlap before closeout. No new security blocker remains for running the `validate` workflow step.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase02-session07-product-surface-validation-and-documentation-closeout/security-compliance.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.