Phase 8 Slice F
This workspace distinguishes implemented automated controls from evidence that still requires human execution on one frozen release candidate. Automated coverage does not constitute production approval.
Automated protections
11
Manual gates open
3
Deferred
0
Final domain headers, local reset and UAT deletion, quota-failure recovery, incident tabletop, Vercel environment separation, privacy-safe observability, accessibility evidence, and owner acceptance must be recorded against the immutable Slice G candidate.
SEC-001
Current evidence: Next.js applies CSP, frame denial, MIME protection, referrer, permissions, opener/resource, HSTS, and cross-domain policy headers.
Production requirement: Verify the final production-domain response headers after deployment.
SEC-002
Current evidence: Route and global boundaries display generic recovery guidance and do not render stack traces, internal paths, secrets, or raw exception messages.
Production requirement: Exercise representative route and root failures on the frozen candidate.
SEC-003
Current evidence: UAT administrative APIs retain same-origin JSON validation, database-backed roles, server-only secrets, and audit records.
Production requirement: Complete the UAT Phase 1B external activation runbook before tester use.
PRV-001
Current evidence: Regression scanning prohibits fetch, beacon, WebSocket, XMLHttpRequest, analytics, session replay, and remote form actions outside approved UAT/server integration paths.
Production requirement: Re-run the scan whenever an integration or analytics provider is proposed.
PRV-002
Current evidence: Calculator, scenarios, payments, reports, service identity, accessibility evidence, and backups remain browser-local in the production core.
Production requirement: Manually confirm no veteran data appears in Vercel logs, URLs, or UAT records.
PRV-003
Current evidence: Retention and deletion responsibilities are documented for local records and the separate UAT infrastructure.
Production requirement: Execute local reset, UAT account deletion, audit-retention, and secret-rotation procedures against the frozen candidate.
BKP-001
Current evidence: Imports enforce byte, depth, node-count, dangerous-key, package-field, schema, and SHA-256 checks before preview.
Production requirement: Test representative real exported packages on desktop and mobile browsers.
BKP-002
Current evidence: The pre-restore package must be written and read back before restore proceeds.
Production requirement: Download and inspect a safety copy from the frozen candidate.
BKP-003
Current evidence: Calculator and workspace writes are verified and both prior values are restored when either write fails.
Production requirement: Perform a quota/failure exercise in a controlled browser profile.
OPS-001
Current evidence: Runbooks define triage, containment, evidence handling, rollback, communication, and post-incident review.
Production requirement: Conduct a tabletop exercise and record owner approval.
OPS-002
Current evidence: Production, develop previews, frozen UAT branches, UAT database/auth, and release manifests remain distinct.
Production requirement: Verify Vercel projects, environment variables, DNS, and the immutable release manifest.
OPS-003
Current evidence: Operational policy permits availability and sanitized technical errors but prohibits benefit facts, document text, identifiers, reports, and backups.
Production requirement: Approve the final provider/configuration or explicitly launch without client telemetry.
SUP-001
Current evidence: CI uses npm ci against the committed lockfile and runs a high-severity production dependency audit.
Production requirement: Review any audit exception through a documented risk acceptance.
SUP-002
Current evidence: Dependabot is configured for weekly npm and GitHub Actions updates with bounded pull-request volume.
Production requirement: Review and merge updates only after complete CI and preview validation.
Use the final release workspace for candidate-bound owner acceptance, the system inventory for route recovery, and the accessibility workspaces for human assistive-technology evidence.