> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase04-session03-draft-asset-generation-and-source-capture/security-compliance.md). # Security And Compliance **Session ID**: `phase04-session03-draft-asset-generation-and-source-capture` **Package**: Cross-cutting **Started**: 2026-05-29 19:25 **Last Updated**: 2026-05-29 21:24 *** ## Security Scope This session creates draft-generation briefs, local provider command surfaces, manifest records, catalog fixtures, and docs. It does not promote generated media to runtime paths, service-worker caches, release docs, or public-demo runtime media. ## Checklists ### Provider Secrets * [x] Provider variable names come from `.env.local.example`. * [x] Credential checks must report presence only. * [x] No provider API key values, account IDs, OAuth IDs, raw request payloads, or response payloads may be committed. * [x] Provider prompts and command bodies stay redacted in tracked docs and run summaries. ### Quarantine Boundary * [x] `EXAMPLES/` remains ignored and reference-only. * [x] No `EXAMPLES/` files may be copied, transformed, uploaded, used as direct generation input, or referenced as runtime media. * [x] Historical rows may appear only as matrix IDs, standards, blockers, or rejection rationale. ### No Runtime Promotion * [x] Raw generated outputs stay under `tmp/media-generation/phase04-session03/`. * [x] Tracked manifest paths must be repository-relative or explicitly rooted in ignored staging. * [x] Generated-reference, planned, deferred, rejected, and unknown records need release blockers. * [x] No public-demo cache, app runtime import, or release-ready catalog record may treat drafts as approved media. ### Deferrals * [x] Missing credentials, unclear cost, rights uncertainty, unsupported output, or unclear product use must produce explicit deferred or rejected records. * [x] Optional video remains deferred unless a concrete approved use exists. * [x] Provider-backed generation is optional; dry-run must work without secrets. *** ## Task Log ### Task T021 - Privacy and quarantine audit **Started**: 2026-05-29 21:18 **Completed**: 2026-05-29 21:24 **Duration**: 6 minutes **Notes**: * Ran `npm run security:secrets`; secret scan passed across tracked text files. * Scanned changed tracked areas for provider credential assignments, secret-like key patterns, broad local paths, raw provider payload markers, and tracked staging output. * `scripts/generate-media-drafts.mjs` contains only redaction regexes for provider variable assignments, not secret values. * `EXAMPLES/` references in changed files are quarantine policy text or deny rules only; no runtime import, copy, direct provider input, or public-demo promotion was added. * `tmp/media-generation/phase04-session03/` remains ignored, and no staged raw output is tracked. **Files Changed**: * `.spec_system/specs/phase04-session03-draft-asset-generation-and-source-capture/security-compliance.md` - Added audit evidence. **BQC Fixes**: * Error information boundaries: Secret and path scans avoid local env files and record only pass/fail evidence. *** ### Task T003 - Create implementation and security evidence placeholders **Started**: 2026-05-29 19:25 **Completed**: 2026-05-29 19:25 **Duration**: 1 minute **Notes**: * Added the security evidence placeholder with provider-secret, quarantine, no-runtime-promotion, and deferral checklists. * Kept the evidence file ASCII-only and free of secret values. **Files Changed**: * `.spec_system/specs/phase04-session03-draft-asset-generation-and-source-capture/security-compliance.md` - Added session security checklist. **BQC Fixes**: * Error information boundaries: Security evidence documents what must be redacted before provider commands or manifest records are added. *** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase04-session03-draft-asset-generation-and-source-capture/security-compliance.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.