> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase15-session02-security-and-privacy-vault/tasks.md). # Task Checklist **Session ID**: `phase15-session02-security-and-privacy-vault` **Total Tasks**: 22 **Estimated Duration**: 3-4 hours **Created**: 2026-06-01 *** ## Legend * `[x]` = Completed * `[ ]` = Pending * `[P]` = Parallelizable (can run with other \[P] tasks) * `[S1502]` = Session reference (15=phase number, 02=session number) * `TNNN` = Task ID *** ## Progress Summary | Category | Total | Done | Remaining | | -------------- | ------ | ------ | --------- | | Setup | 3 | 3 | 0 | | Foundation | 6 | 6 | 0 | | Implementation | 9 | 9 | 0 | | Testing | 4 | 4 | 0 | | **Total** | **22** | **22** | **0** | *** ## Setup (3 tasks) Initial configuration and environment preparation. * [x] T001 \[S1502] Verify public website prerequisites, package scripts, existing route constants, and absent `/security` page before implementation (`public-website/package.json`) * [x] T002 \[S1502] Review current security posture, no-claim boundaries, analytics guardrails, and privacy docs for source-backed copy constraints (`.spec_system/SECURITY-COMPLIANCE.md`) * [x] T003 \[S1502] Review existing homepage/product/features/how-it-works security, CTA, metadata, and layout patterns for route composition (`public-website/src/components/marketing/SecurityBoundary.astro`) *** ## Foundation (6 tasks) Core structures and base implementations. * [x] T004 \[S1502] Define typed security route metadata, tone unions, link keys, lifecycle rows, local data categories, optional boundary cards, guardrail groups, analytics posture, FAQ entries, and CTA content with types matching declared contract; exhaustive enum handling (`public-website/src/data/security.ts`) * [x] T005 \[S1502] Verify existing security path/canonical constants and add typed FAQ structured data support if the route emits FAQ JSON-LD (`public-website/src/data/site.ts`) * [x] T006 \[S1502] \[P] Create main security vault component for trust manifesto, local lifecycle, data-stays-local list, optional boundaries, redaction, consent, telemetry, analytics, and CTA sections with mobile-safe wrapping and no color-only semantics (`public-website/src/components/marketing/SecurityVault.astro`) * [x] T007 \[S1502] \[P] Create accessible static security FAQ component with semantic headings, supporting links, and platform-appropriate focusable link treatment (`public-website/src/components/marketing/SecurityFaq.astro`) * [x] T008 \[S1502] Add security route link helpers for product, how-it-works, demo, docs, and legal/FAQ handoffs without implying hosted accounts, analytics, or legal review completion (`public-website/src/data/security.ts`) * [x] T009 \[S1502] Confirm Security remains reachable from primary, mobile, and footer navigation and refine descriptions only where copy is stale (`public-website/src/data/navigation.ts`) *** ## Implementation (9 tasks) Main feature implementation. * [x] T010 \[S1502] Implement `/security` route with BaseLayout, Shell, canonical metadata, structured data if appropriate, hero copy, security vault sections, FAQ, and static-site boundary copy (`public-website/src/pages/security.astro`) * [x] T011 \[S1502] Populate trust manifesto and local-only lifecycle content covering hook event, local ingest, local cockpit, optional transfer, and cleanup boundaries (`public-website/src/data/security.ts`) * [x] T012 \[S1502] Populate data-stays-local categories for prompts, file paths, terminal output, local event snapshots, credentials, replay data, demo payloads, and user-provided code (`public-website/src/data/security.ts`) * [x] T013 \[S1502] Populate optional integration boundary content for War Room, outbound adapters, future hosted services, public demo, and docs while avoiding hosted identity and production-validation claims (`public-website/src/data/security.ts`) * [x] T014 \[S1502] Populate redaction, consent, passive Settings status, telemetry block, and analytics posture content with duplicate no-collect language for sensitive payload classes (`public-website/src/data/security.ts`) * [x] T015 \[S1502] Populate security FAQ entries that answer trust, analytics, integration, erasure, credentials, demo/docs, and legal/privacy questions without becoming legal policy or certification copy (`public-website/src/data/security.ts`) * [x] T016 \[S1502] Wire internal product/how-it-works links and external demo/docs CTAs with accessible names, external affordances, and no runtime fetch or tracking behavior (`public-website/src/components/marketing/SecurityVault.astro`) * [x] T017 \[S1502] Finalize responsive scoped CSS for hero, lifecycle rows, local-data cards, optional-boundary panels, guardrail groups, analytics callouts, FAQ rows, and CTA layouts with stable dimensions and no text overlap (`public-website/src/components/marketing/SecurityVault.astro`) * [x] T018 \[S1502] Review all security route copy against open findings and remove hosted identity, trusted erasure, certification, production-hosted validation, real executor, remote execution, inbound command, broad media readiness, and active analytics overclaims (`public-website/src/pages/security.astro`) *** ## Testing (4 tasks) Verification and quality assurance. * [x] T019 \[S1502] Run package typecheck and resolve any Astro or TypeScript errors (`public-website/package.json`) * [x] T020 \[S1502] Run static website build and verify built `/security` output includes expected metadata, FAQ content, route links, external demo/docs links, and no-claim boundary copy (`public-website/dist/security/index.html`) * [x] T021 \[S1502] Manually smoke desktop, tablet, 360px mobile, keyboard focus, reduced-motion posture, dense section wrapping, FAQ readability, CTA rows, and navigation reachability (`public-website/src/pages/security.astro`) * [x] T022 \[S1502] Validate ASCII encoding, Unix LF line endings, absence of analytics/tracker/form/runtime-fetch code, and security no-claim copy guardrails (`public-website/src/data/security.ts`) *** ## Completion Checklist Before marking session complete: * [x] All tasks marked `[x]` * [x] All tests passing * [x] All files ASCII-encoded * [x] implementation-notes.md updated * [x] Ready for the validate workflow step *** ## Next Steps Run the implement workflow step to begin AI-led implementation. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase15-session02-security-and-privacy-vault/tasks.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.