Phase 8 Slice F
Security, privacy, recovery, and operational readiness
This workspace distinguishes implemented automated controls from evidence that still requires human execution on one frozen release candidate. Automated coverage does not constitute production approval.
Automated protections
11
Manual gates open
3
Deferred
0
Production remains gated
Final domain headers, browser-local reset and deletion controls, quota-failure recovery, incident and rollback tabletop evidence, active production configuration, privacy-safe observability, accessibility evidence, and owner acceptance must be recorded against the immutable release candidate.
Security
SEC-001
Browser security headers
Current evidence: Next.js applies CSP, frame denial, MIME protection, referrer, permissions, opener/resource, HSTS, and cross-domain policy headers. Increment 4 adds Plausible to script/connect sources only when the production analytics flag and a validated plausible.io site script are both present.
Production requirement: Verify the final production-domain response headers after deployment.
SEC-002
Sanitized error boundaries
Current evidence: Route and global boundaries display generic recovery guidance and do not render stack traces, internal paths, secrets, or raw exception messages.
Production requirement: Exercise representative route and root failures on the accepted Post-UAT release candidate.
Privacy
PRV-001
Production-core network boundary
Current evidence: Regression scanning prohibits fetch, beacon, WebSocket, XMLHttpRequest, vendor analytics calls, session replay, and remote form actions outside approved integration paths. Increment 4 designates src/lib/analytics as the sole production analytics integration boundary while preserving the prohibition everywhere else.
Production requirement: Re-run the scan whenever a provider or outbound integration changes.
PRV-002
Browser-local veteran workspace
Current evidence: Calculator, scenarios, payments, reports, documents, service identity, accessibility evidence, and backups remain browser-local in the production core. Analytics receives only approved coarse action/public-content dimensions.
Production requirement: Manually confirm no Veteran workspace data appears in provider payloads, Vercel logs, public URLs, or unexpected network requests.
PRV-003
Retention and deletion
Current evidence: Retention and deletion responsibilities are documented for browser-local records, privacy-preserving analytics, performance observability, and historical testing records retained under accepted policy. Raw Knowledge Base search text has zero analytics retention.
Production requirement: Verify production provider/site deletion controls and representative browser-local deletion procedures before final Increment 4 acceptance.
PRV-004
Analytics data allowlist
Current evidence: Typed events, exact property allowlists, route templating, raw-query stripping, bounded attribution tokens, production-only transmission, and no-op failure behavior are validated in Increment 4 automated tests.
Production requirement: Capture and inspect representative real outgoing production-candidate payloads before provider activation/promotion.
Backup and recovery
BKP-001
Bounded import analysis
Current evidence: Imports enforce byte, depth, node-count, dangerous-key, package-field, schema, and SHA-256 checks before preview.
Production requirement: Test representative real exported packages on desktop and mobile browsers.
BKP-002
Verified safety copy
Current evidence: The pre-restore package must be written and read back before restore proceeds.
Production requirement: Download and inspect a safety copy from the accepted Post-UAT release candidate.
BKP-003
Atomic browser-local commit
Current evidence: Calculator and workspace writes are verified and both prior values are restored when either write fails.
Production requirement: Perform a quota/failure exercise in a controlled browser profile.
Operations
OPS-001
Incident response and rollback
Current evidence: Runbooks define triage, containment, evidence handling, rollback, communication, and post-incident review.
Production requirement: Conduct a tabletop exercise and record owner approval.
OPS-002
Production environment and release separation
Current evidence: Feature branches, develop, approved release branches, and main/production remain distinct. Only the governed production project and protected main path can become public production. Increment 4 analytics transmission additionally fails closed outside production.
Production requirement: Verify the active Vercel application project, analytics environment variables, production/preview separation, DNS, and the immutable release manifest.
OPS-003
Privacy-safe observability
Current evidence: The approved architecture permits sanitized traffic/product events, organization-level campaign attribution, bounded technical-failure categories, and aggregate real-user performance while prohibiting benefit facts, raw search text, document/report contents, identifiers, session replay, and persistent VMC analytics identities.
Production requirement: Verify final Plausible and Vercel Speed Insights configuration, inspect representative payloads, and record owner approval before production analytics activation.
Supply chain
SUP-001
Reproducible dependency installation
Current evidence: CI uses npm ci against the committed lockfile and runs a high-severity production dependency audit.
Production requirement: Review any audit exception through a documented risk acceptance.
SUP-002
Automated dependency review
Current evidence: Dependabot is configured for weekly npm and GitHub Actions updates with bounded pull-request volume.
Production requirement: Review and merge updates only after complete CI and preview validation.
Related release controls
Use the final release workspace for candidate-bound owner acceptance, the system inventory for route recovery, and the accessibility workspaces for human assistive-technology evidence.