> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase04-session07-media-accessibility-privacy-and-performance-gates/security-compliance.md). # Security Compliance **Session ID**: `phase04-session07-media-accessibility-privacy-and-performance-gates` **Package**: cross-cutting **Started**: 2026-05-29 21:44 **Last Updated**: 2026-05-29 22:17 *** ## Review Scope * Media accessibility gate coverage. * Media privacy and sensitive-output redaction. * Metadata, rights, attribution, fallback, lazy-loading, and performance-budget blockers. * Public-demo cache, offline, and standalone boundary policy. * `EXAMPLES/` quarantine enforcement. *** ## Initial Findings * No provider credentials are required for this session. * `EXAMPLES/` remains quarantined and must not be imported, copied, transformed, cached, or used as generation input. * Approved media must avoid raw prompts, provider prompts, tokens, command bodies, broad local paths, raw request bodies, and `EXAMPLES/` excerpts in checker output, docs, and browser validation notes. *** ## Task T003 Artifact Baseline * Implementation notes were created before application-code changes. * This compliance file will be updated as release-gate, browser, docs, and validation work lands. * Security review will focus on deterministic local checks, explicit input schemas, redacted issue details, nonzero failure exits, browser failure visibility, and quarantine-preserving docs. *** ## Session 07 Gate Review * `npm run media:gates:check -- --json` passed after docs and browser evidence updates. * Gate output is redacted for secret-like strings and broad absolute paths. * Draft manifest policy remains non-runtime, provider secrets are not tracked, and raw provider payloads are not tracked. * Public-demo music remains lazy-loaded and excluded from `SHELL_ASSETS`. * Public-demo cache version is aligned at `factionos-demo-v9`. * `EXAMPLES/` remains documented as quarantined reference-only intake. *** ## Final Compliance Validation * `npm run security:secrets` passed. * `npm run media:gates:check` passed. * `npm test` passed. * `npm run test:e2e -- tests/e2e/app.e2e.ts tests/e2e/public-demo.e2e.ts` passed. * `npm run format:check`, `npm run lint`, `npm run typecheck`, and `git diff --check` passed. * ASCII and LF checks over changed files passed. * `git diff --check` passed. * Direct runtime import quarantine check found no `EXAMPLES/` import, export, require, or `new URL` references. *** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase04-session07-media-accessibility-privacy-and-performance-gates/security-compliance.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.