Security, Audit & Hardening Index

This directory documents the security architecture, deterministic static application security testing (SAST), PR audit reports, agent permission boundaries, and AI data policies for the Personal Lifecycle Tracker system.

Security Documentation Map

Document	Purpose	Standard / Tool	Status
`pr-audit.md`	PR Security Review & Automated Gating	OWASP Top 10, Auth Boundaries	`VERIFIED`
`deterministic-scan.md`	Deterministic Static Analysis & CVE Audit	Semgrep, Bandit, npm audit, Trufflehog	`0 HIGH / 0 CRITICAL`
`agent-extension-security.md`	Agent Pack, MCP & Hook Security Analysis	Agent Plugins 1.0, Least Privilege	`COMPLIANT`
`ai-tool-data-policy.md`	AI Tool Usage & Enterprise Data Governance	Human-in-the-Loop, Zero-Leakage Policy	`ENFORCED`

Automated Security Principles

Zero Unauthenticated Access: All lifecycle items and group endpoints require valid cryptographically signed JWT bearer tokens. Passwords are salted with bcrypt (work factor 12).
Deterministic SAST in CI: Static analysis runs before test execution. Any high or critical findings block pipeline advancement.
Agent Sandboxing & Containment: Headless AI coding agents operate within strict directory boundaries and must pass pre-tool execution guardrails (com.google.antigravity/hooks/pre-tool-guardrail.sh) before mutating files or running shell commands.
Keyless Cloud Authentication: GitHub Actions authenticates with AWS via OpenID Connect (OIDC) roles (id-token: write), eliminating permanent AWS access keys.