> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase19-session05-attention-and-permissions/security-compliance.md). # Security & Compliance Report **Session ID**: `phase19-session05-attention-and-permissions` **Package**: null **Reviewed**: 2026-06-26 **Result**: PASS ## Scope **Files reviewed** (session deliverables and validation repair): * `packages/protocol/src/orchestrationCommandCenter.ts` - command-center contracts and blocked payload guards * `packages/protocol/tests/orchestrationCommandCenter.test.ts` - protocol safety tests * `apps/server/src/lib/commandCenterValidation.ts` - decision request validation * `apps/server/src/lib/commandCenterAttentionAdapters.ts` - bounded id and audit helpers * `apps/server/src/managers/orchestrationCommandCenter.ts` - attention and permission state transitions * `apps/server/src/routes/commandCenter.ts` - command-center decision routes * `apps/server/src/routes/event.ts` - hook permission ingest promotion * `apps/server/src/routes/permission.ts` - legacy permission and plan adapters * `apps/server/src/server.ts` - route dependency wiring * `apps/server/src/ws/handlers.ts` - WebSocket permission and plan adapters * `apps/server/tests/commandCenterManager.test.ts` - manager coverage * `apps/server/tests/commandCenterRoutes.test.ts` - route and event coverage * `apps/server/tests/permission.test.ts` - legacy adapter coverage * `apps/server/tests/websocket.test.ts` - validation repair for paired command-center frames plus legacy responses * `apps/hooks/tests/hookPayloads.test.js` - bounded hook metadata coverage * `apps/web/src/lib/orchestrationApi.ts` - attention decision API helper * `apps/web/src/lib/commandCenterUi.ts` - attention UI normalization and redaction helpers * `apps/web/src/store/useGameStore.ts` - event reducers and in-flight cleanup * `apps/web/src/components/orchestration/AttentionWorkbench.tsx` - attention queue UI * `apps/web/src/components/orchestration/CommandCenterPanes.tsx` - pane integration * `apps/web/src/components/orchestration/OrchestrationShell.tsx` - decision handler wiring * `apps/web/src/components/orchestration/OrchestrationTabs.tsx` - tab prop wiring * `apps/web/src/components/orchestration/index.ts` - export path * `apps/web/tests/orchestrationApi.test.ts` - web API coverage * `apps/web/tests/commandCenterUi.test.ts` - web UI helper coverage * `apps/web/tests/commandCenterStore.test.ts` - reducer coverage * `apps/web/tests/OrchestrationPanel.test.tsx` - user-facing attention coverage * `docs/api/README_api.md` - API documentation * `apps/server/README_server.md` - server documentation * `apps/web/README_web.md` - web documentation **Review method**: Static analysis of session deliverables, diff inspection, secret scan, dependency-change inspection, and current test/typecheck evidence. **Review evidence**: * Command/check: `git diff --name-only HEAD` * Result: PASS - identified current session files, including validation repair `apps/server/tests/websocket.test.ts`. * Evidence: no unrelated package manifest or lockfile changes appeared in the session diff. * Command/check: `source "$NVM_DIR/nvm.sh" && nvm use 26.2.0 >/dev/null && npm run security:secrets` * Result: PASS - secret scanner passed. * Evidence: `Secret scan passed (1735 tracked text files checked).` * Command/check: `rg -n "(password|secret|token|api[_-]?key|Authorization|Bearer|process\.env|console\.log|exec\(|spawn\(|child_process|eval\(|dangerouslySetInnerHTML|innerHTML|raw[A-Z]|raw |prompt|terminal output|/private/project)" [session files]` * Result: PASS - reviewed hits were redaction code, tests with synthetic sensitive fixtures, documentation prohibitions, existing server startup logs, or route text extraction. * Evidence: no hardcoded credential, unsafe shell execution, unguarded HTML injection, or raw sensitive payload exposure was found in touched runtime paths. * Command/check: `git diff --name-only HEAD -- package.json package-lock.json apps/*/package.json packages/*/package.json public-website/package.json` * Result: PASS - no dependency manifest or lockfile changes. * Evidence: command produced no package dependency changes, so dependency audit is N/A for this session. * Command/check: `source "$NVM_DIR/nvm.sh" && nvm use 26.2.0 >/dev/null && npm test` * Result: PASS - full test suite passed. * Evidence: Vitest reported 222 passed files, 2732 passed tests, and 1 skipped file/test. ## Security Assessment ### Overall: PASS | Category | Status | Severity | Details | | ----------------------------- | ------ | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Injection (SQLi, CMDi, LDAPi) | PASS | -- | No DB layer, raw SQL, shell execution, or command spawning was introduced in session runtime paths. Decision inputs are schema-validated before manager mutation. | | Hardcoded Secrets | PASS | -- | `npm run security:secrets` passed; targeted `rg` hits were redaction logic, synthetic test fixtures, or documentation prohibitions. | | Sensitive Data Exposure | PASS | -- | Protocol, server, and web helpers reject or redact blocked raw payload fields; tests cover secrets, broad paths, prompts, and raw payload filtering. | | Insecure Dependencies | PASS | -- | No package manifests or lockfiles changed. | | Security Misconfiguration | PASS | -- | No bind host, auth, rate limit, CORS, hosted, Worker, remote, or executor defaults were loosened. | ### Security Findings No security findings. ## GDPR Compliance Assessment ### Overall: N/A *N/A because this session introduced no hosted personal-data collection, account lifecycle, third-party transfer, database persistence, or analytics behavior. Local command-center decision reasons and actor labels remain local operational metadata and are not transferred to hosted services.* **Categories reviewed**: Data Collection & Purpose, Consent Mechanism, Data Minimization, Right to Erasure, PII in Logs, Third-Party Data Transfers. ### Personal Data Inventory No personal data collected or processed in this session. ### GDPR Findings No GDPR findings. ## Recommendations None - session is compliant. ## Sign-Off * **Result**: PASS * **Reviewed by**: AI validation (validate) * **Date**: 2026-06-26 --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase19-session05-attention-and-permissions/security-compliance.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.