> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase04-session06-public-demo-media-parity-and-offline-loading/security-compliance.md).

# Security Compliance

**Session ID**: `phase04-session06-public-demo-media-parity-and-offline-loading` **Package**: cross-cutting **Review Started**: 2026-05-29 21:07 **Last Updated**: 2026-05-29 21:29

***

## Scope

This review covers public-demo media inventory checks, catalog or standalone exception mapping, service-worker cache policy, manifest references, standalone-boundary enforcement, docs updates, and browser validation.

## Privacy And Secret Handling

* Repository checks must report repository-relative paths only.
* Reports must redact absolute local paths, provider tokens, raw provider payloads, account IDs, and secret-like strings.
* Public-demo docs must not include raw prompts, credentials, local transcripts, local account identifiers, or broad absolute paths.

## Media Provenance And Quarantine

* `EXAMPLES/` remains quarantined and reference-only.
* Public-demo runtime media must be explicit, local, synthetic, and repository-relative.
* Conditional public-demo speech, music, showcase, portrait, and icon records must carry blocker context until source, rights, attribution, metadata, accessibility, privacy, loudness, duration, and release gates are complete.

## Cache And Offline Boundary

* Service-worker shell cache entries must be explicit and same-origin.
* Background music remains lazy-loaded and excluded from precache unless a documented budget exception is approved.
* Runtime CDN caching must stay limited to known public browser dependencies.
* No local APIs, workspace packages, hooks, LLM endpoints, server state, replay data, or War Room federation may be cached or imported by `public-demo/`.

## Initial Findings

No critical issues found during setup. Baseline media gates pass. Existing conditional metadata and non-release warnings remain expected Phase 04 backlog, not release approval.

## Final Review

No critical security or privacy issues found.

* `npm run media:demo:check` rejects unsafe paths, `EXAMPLES/` references, workspace imports, local endpoints, remote repository media URLs, stale cache entries, and lazy media precache drift.
* `npm run security:secrets` passed.
* Touched text files passed ASCII and LF scans.
* Public-demo current speech, music, showcase, portraits, and install icons remain conditional records with blockers; only approved battlefield runtime records are release-ready.
* Background music remains lazy-loaded and excluded from service-worker precache.
* No provider secrets, account IDs, raw provider payloads, raw prompts, broad absolute paths, local transcripts, or quarantined `EXAMPLES/` excerpts were added.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase04-session06-public-demo-media-parity-and-offline-loading/security-compliance.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.