> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase07-session07-hosted-guardrails-validation-and-documentation-closeout/security-compliance.md). # Security and Compliance Review **Session ID**: `phase07-session07-hosted-guardrails-validation-and-documentation-closeout` **Phase**: 07 - Hosted Services and Analytics Guardrails **Reviewed**: 2026-05-30 **Result**: PASS (with Phase 08 residual-risk carryforward) *** ## Scope This is the cumulative Phase 07 security and compliance review across the hosted configuration, hosted identity, hosted persistence, public replay, analytics, push, remote access, tunnel, and operator diagnostics surfaces delivered by Sessions 02-06, plus the Session 01 baseline. It reconciles the per-session security reports into one Phase 07 posture, confirms no blocklisted payload category leaks at any boundary, and records residual risks deferred to Phase 08. No new runtime code is introduced in this session. Findings below derive from the recorded gate evidence (see `implementation-notes.md`) and the Session 01-06 security reports. *** ## 1. Per-Surface Security Posture | Surface | Shipped state | Security posture | | -------------------------------------- | ------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Hosted configuration (S02) | Public/secret/deploy/reserved categories defined; diagnostics only | Browser config limited to publishable `VITE_` values; service-role keys, API tokens, zone ids, tunnel tokens, OAuth secrets are server-only/deploy-only and excluded from bundles, logs, health, diagnostics, docs examples. | | Hosted identity (S03) | Planned-state contracts + redacted diagnostics route | No active hosted auth shipped. Worker authority kept as one room-scoped bearer proof, not account identity/SSO/org membership/audit. | | Hosted persistence (S04) | Eligibility + requirement contracts; diagnostics unavailable state | No active database/bucket. Local/blocked/redacted/export-only categories defined; sensitive payloads rejected before any future transfer. | | Public replay (S04) | Disabled; redacted local share fragments only | No public hosting/indexing. Consent, caps, redaction, expiry, takedown, no-index documented as preconditions. | | Analytics (S05) | Disabled by default; consent-gated; self-hostable | Off unless config AND consent present. Payload scrubbing drops blocked categories and nested keys; no network side effects without consent. | | Push (S06) | Browser-notification/local-only; no backend | No push subscription/VAPID delivery shipped. Service worker sanitizes push fields and click targets to same-origin relative URLs. | | Remote access / tunnel (S06) | Unavailable / explicit-opt-in posture; no executor | No remote executor. Token handling, expiry, revocation, local auth, rate limits, Origin/CORS, audit documented as preconditions. | | Operator diagnostics (S02/S03/S04/S06) | Compact authenticated local routes + CLI loopback | Expose bounded posture/reason codes only; CLI enforces loopback before any request and fails closed with sanitized labels. | *** ## 2. Hosted-Payload Privacy and Blocklist Enforcement The Session 01 hosted-payload blocklist (prompts/transcripts, file/code content, command/terminal data, secrets/credentials, local paths/env detail, replay/export/archive/backup content, diagnostic/operational detail, cloud/hosted identifiers, media/historical intake) holds across every Phase 07 boundary. Enforcement evidence: * Secret scan PASS over 886 tracked text files (no secret/token/zone/tunnel value committed in source, tests, or docs). * Focused payload tests (S05 `hostedAnalytics.test.ts`, S06 `hostedOperationsDiagnostics.test.ts` / `orchestrationDiagnostics.test.js`) use synthetic probes and assert blocked categories are dropped or never echoed. * Diagnostics across server routes and CLI expose counts, status labels, timings, and sanitized ids only. * Synthetic leak probes for this closeout are recorded in `validation.md` (T010); no blocklisted category surfaced at any boundary. *** ## 3. External Data Transfer No Phase 07 surface performs mandatory external data transfer. All hosted surfaces (Supabase storage, Umami analytics, VAPID push, Cloudflare tunnel/remote, public replay hosting) are disabled-default, planned, or unavailable. Adapters (Discord/Telegram/generic webhook) remain outbound-only, optional, and best-effort, carrying formatter output only; generic-webhook `full` is explicit opt-in for reviewed internal systems and is not an analytics, public replay, or hosted-storage substitute. The full test suite passes credential-free, confirming no external transfer is required for core local workflows. *** ## 4. GDPR / Compliance Posture GDPR status: N/A for shipped Phase 07 surfaces. No personal data is collected, stored, or transmitted by default. Hosted accounts, hosted storage, and analytics are disabled-default or planned, so no controller/processor data flow is active. The identity, persistence, and analytics guardrails pre-define consent, minimization, retention, export, and deletion requirements as preconditions before any future personal-data processing can be enabled. Trusted unified erasure (right-to-erasure at release grade) is explicitly deferred to Phase 08 and is not claimed here. *** ## 5. Residual Risks (Phase 08 Carryforward) These risks remain open in `.spec_system/SECURITY-COMPLIANCE.md` and are carried forward, not closed, by Phase 07: | ID | Severity | Carryforward | | ------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | P06-S07-HOSTED-IDENTITY | Medium | Phase 07 advanced hosted identity to planned-state, disabled-default guardrail contracts with redacted diagnostics. Active hosted auth and its end-to-end validation remain Phase 08. | | P06-S07-ERASURE | Medium | Trusted unified erasure across Worker state, browser hints, logs, archives, exports, replay buffers, backups, spool state, workspace files, and future hosted data remains Phase 08. | | P06-S07-HOSTED-VALIDATION | Low | Production-hosted app and deployed Worker release smoke remain Phase 08; Phase 07 evidence is local, mocked, or same-origin only. | New Phase 07 residual notes (no new findings opened): activating any reserved-future variable (Supabase, Umami, VAPID, Cloudflare/tunnel, push, public replay) requires a scoped session adding consent, minimization, redaction, authorization, abuse controls, tests, and docs before it can be described as active. *** ## Conclusion Phase 07 security and compliance posture: PASS with residual risks. The hosted-services and analytics guardrails ship as disabled-default, planned, or unavailable states with bounded, redacted diagnostics. No blocklisted payload category leaks at any boundary (secret scan PASS over 892 staged files; synthetic probes clean). No personal data is collected by default, so GDPR status is N/A for shipped surfaces. Three pre-existing findings (hosted identity, trusted erasure, production-hosted validation) remain open as honest Phase 08 carryforward. Phase 07 makes no active hosted-auth, hosted-storage, analytics-capture, push-delivery, public-replay-hosting, remote-access, production-hosted, certification, or trusted-erasure claim. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase07-session07-hosted-guardrails-validation-and-documentation-closeout/security-compliance.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.