> For the complete documentation index, see [llms.txt](https://ai-os-and-trend-finder.gitbook.io/ai-os-and-trend-finder-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ai-os-and-trend-finder.gitbook.io/ai-os-and-trend-finder-docs/.spec_system/archive/sessions/phase24-session09-end-to-end-validation-release-hardening/security-compliance.md). # Security Compliance **Session ID**: `phase24-session09-end-to-end-validation-release-hardening` **Review Date**: 2026-06-08 **Status**: PASS *** ## Scope Session 09 re-reviewed Phase 24 Trend Finder closeout boundaries for: * Source-local public entity identity. * Promoted, pinned, sponsored, and ad-like placement handling. * Evidence asset manifest, bridge, and static Brief export safety. * Source Setup reviewed target fields and credential handling. * Spend labels for exact, estimated, unavailable, and not-applicable source states. ## Source Documents Reviewed * `docs/sources/source-compliance-arxiv.md` * `docs/sources/source-compliance-github.md` * `docs/sources/source-compliance-hackernews.md` * `docs/sources/source-compliance-producthunt.md` * `docs/sources/source-compliance-reddit.md` * `docs/sources/source-compliance-youtube.md` * `docs/sources/source-compliance-rss-news.md` * `docs/sources/source-compliance-google-trends-demand.md` * `docs/sources/apify-source-onboarding.md` ## Closeout Findings | Area | Finding | Evidence | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Entity identity | PASS: source-local entities are derived from reviewed public source fields such as public repository names, subreddit/community labels, Product Hunt slugs, YouTube channel labels, model IDs, and publisher names. Private profile, email, author, Dataset, Actor, and account identifiers remain excluded. | `scripts/extensions/trend-finder/sources/apify-normalizers.ts`, `scripts/extensions/trend-finder/sources/__tests__/apify-normalizers.test.ts` | | Placement flags | PASS: pinned, stickied, promoted, sponsored, and ad-like rows are normalized as excluded placements and do not satisfy source-local baselines. Down-weighted rows remain explicit and are not counted as organic. | `scripts/extensions/trend-finder/source-local-signals.ts`, `scripts/extensions/trend-finder/__tests__/source-local-signals.test.ts` | | Evidence assets | PASS: browser payloads expose only asset status, fallback labels, compliance doc paths, and protected bridge URLs. Available assets require manifest entries; unsafe references fail closed and static Brief copies only report-local assets. | `scripts/extensions/trend-finder/evidence-assets.ts`, `scripts/lib/trend-finder-asset-bridge.ts`, `scripts/extensions/trend-finder/static-brief-export.ts` | | Source Setup targets | PASS: editable fields come from reviewed source declarations. Unreviewed sources, private/local URLs, placeholder Actor IDs, invalid Product Hunt dates, and credential-shaped values are rejected or surfaced as safe warning labels. | `scripts/extensions/trend-finder/sources/apify-source-config.ts`, `scripts/extensions/trend-finder/sources/source-setup.ts`, `scripts/extensions/trend-finder/sources/__tests__/source-setup.test.ts` | | Spend labels | PASS: source spend summaries expose bounded provider states, actual/estimated/max charge amounts, public source labels, item counts, and safe reasons only. Raw runner IDs, Dataset IDs, billing payloads, and credentials remain outside browser/static output. | `scripts/extensions/trend-finder/spend-accounting.ts`, `scripts/extensions/trend-finder/__tests__/spend-accounting.test.ts`, `src/extensions/trend-finder/engine-replay-model.ts` | | Static Brief | PASS: report projection rejects private fields before write, filters unsafe links, excludes local triage notes, and emits deterministic browser-safe HTML for fixed input and timestamp. | `scripts/extensions/trend-finder/static-brief-export.ts`, `tests/e2e/trend-finder-static-brief.spec.ts` | | Runtime artifacts | PASS: generated cache, assets, scheduler state/logs, static Brief output, live data, test output, and Playwright artifacts are ignored and checked through git metadata only. | `scripts/check-private-runtime-artifacts.sh`, `.gitignore` | ## Residual Constraints * Direct Product Hunt, GitHub, Reddit, arXiv, or YouTube API adapters remain deferred unless their compliance docs are re-reviewed and direct-adapter rate-limit and field-exclusion tests are added. * Product Hunt direct API use still requires non-commercial scope confirmation or Product Hunt permission. * Google Trends Demand remains metric-only and must not become browser evidence without a separate source model and compliance review. * YouTube direct API work must re-review quota, deletion, thumbnail/media, transcript, comment, and authorized-data restrictions before collection. ## Verification * `bash scripts/check-private-runtime-artifacts.sh` passed after adding Phase 24 private artifact examples. * Focused source-local, source setup, evidence asset, spend, static export, Engine Replay, and release-hardening browser tests passed during implementation. ## Result No new source compliance blocker was found for the Session 09 release-hardening closeout. The current implementation remains within the documented Phase 24 public-metadata, browser-safe-summary, and private-runtime-artifact boundaries. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ai-os-and-trend-finder.gitbook.io/ai-os-and-trend-finder-docs/.spec_system/archive/sessions/phase24-session09-end-to-end-validation-release-hardening/security-compliance.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.