# STEWARD Security and Privacy Release Checklist

**Default result:** Not Run  
**Use:** Hermes must copy this checklist into the built release, record `Passed`, `Failed`, `Blocked`, `Unsupported` or `Not Applicable` for every item, and link runtime evidence from the acceptance ledger. A checked box without evidence is not a pass.

## Data purpose and classification

- [ ] The release defaults to Private Administrator OS and accepts only public, synthetic or administrator-owned nonsensitive data.
- [ ] PHI and individual patient, claim, employee, applicant, practitioner, incident, contract, bid, credential, secret and security-vulnerability records are rejected before persistence or forwarding.
- [ ] Institution-approved aggregate data requires a separately named partition, purpose, owner, approval, retention rule and expiry.
- [ ] Unknown classification, authority, ownership, destination or de-identification fails closed for consequential transitions.
- [ ] Sensitive-identifier detection runs on client and server, is tested negatively, and is described as imperfect rather than de-identification.
- [ ] No real Discover interview, raw quiz answers or raw Hermes `SOUL.md` are stored.

## Authentication, sessions and browser boundary

- [ ] First run creates a user-chosen credential; no universal or documented default password ships.
- [ ] The password verifier uses a reviewed memory-hard scheme and plaintext credentials never persist.
- [ ] Sessions use opaque rotating identifiers, `HttpOnly`, `SameSite=Strict`, expiry and revocation.
- [ ] State-changing requests enforce CSRF and strict Origin/Host checks.
- [ ] Request-size and rate limits are applied before expensive parsing, retrieval or inference.
- [ ] The server binds to loopback by default and rejects accidental external binding.
- [ ] Security headers include a restrictive CSP, frame denial, MIME protection and referrer suppression.
- [ ] Direct API tests cannot bypass role, partition, EDENA, CHART, active-hat or permission checks shown in the UI.

## Secrets and configuration

- [ ] Provider keys, session/application secrets and credentials remain server-side.
- [ ] `.env.example` contains names and safe comments only; the populated file is excluded from source control, backups where inappropriate and user exports.
- [ ] Source, built assets, browser storage, URLs, logs, errors, evidence, diagnostics, exports and ZIP contents pass the secret scan.
- [ ] Errors and diagnostics redact credentials, raw upstream bodies, raw Soul and prohibited content.
- [ ] Configuration files and data directories have documented least-privilege permissions or ACLs on every claimed OS.

## Storage, migration, import and recovery

- [ ] SQLite foreign keys, transactions, revisions and forward-only migration checksums are enabled and tested.
- [ ] Modified applied migrations, incompatible schema versions and failed migrations block unsafe startup.
- [ ] A verified backup is created before compatibility-changing migration or restore.
- [ ] Import validates size, closed schema, unsafe keys, IDs, relationships, partitions, checksums and policy before an atomic commit.
- [ ] Restore validates in a temporary location and rolls back without corrupting the current database.
- [ ] Starter restore is idempotent and never overwrites adopted or real records.
- [ ] Complete local deletion revokes sessions, closes stores and distinguishes application removal, user data, backups, logs and external Hermes data.

## Hermes, Soul, models and memory

- [ ] Hermes capabilities are discovered through a real authenticated check; Connected never comes from a timer or assumption.
- [ ] The browser never communicates directly with a secret-bearing provider endpoint.
- [ ] Hermes owns and loads its Soul; STEWARD displays only a safe loaded/unavailable status.
- [ ] Raw Soul content is absent from repeated prompts, STEWARD storage, logs, diagnostics, exports and evidence.
- [ ] External-provider use requires explicit context consent and sends only the minimum approved derived context.
- [ ] Production has no canned-response, fake-citation, simulated-tool or test-double fallback.
- [ ] Structured memory defaults Off/session-only, uses per-item consent and supports view, edit, forget, delete and export.
- [ ] Deleted, expired or denied memory is excluded from future prompt assembly and analytics.

## Retrieval and untrusted content

- [ ] Citations render only after real retrieval and validation of the final URL or identifier and provenance metadata.
- [ ] Each citation maps to a specific supported claim and exposes partial, contradictory or unresolved support.
- [ ] Retrieved pages, uploads and tool results remain untrusted data and cannot change policy, permissions, agents, destinations or authorization.
- [ ] Unsafe schemes, redirects, local-network destinations and malformed identifiers are rejected according to the documented policy.
- [ ] When retrieval is unavailable, the interface remains useful and produces no synthetic citation.

## Agents, tools and consequential actions

- [ ] All ten agents install as `PERM-P0 Disabled`; disabled selection causes no inference, retrieval, session, tool or background call.
- [ ] Every bounded run records objective, owner, data, sources, tools, destinations, time/cost limits, human gates, expiry, kill and fallback.
- [ ] Agent ceilings are server-enforced; no agent self-approves, expands scope, recursively delegates or survives expiry/Pause/Kill.
- [ ] AGT-10 remains on a separate control path and cannot approve itself, another agent or the release.
- [ ] Connectors, schedules, shares and external actions remain Off until separately authorized for one exact action and destination.
- [ ] Clinical, employment, legal, financial, purchasing, publication, messaging, scheduling, security and institutional decisions remain with named humans and official systems.

## Logging, telemetry and receipts

- [ ] Logs and receipts contain minimum metadata, hashes and results rather than sensitive message/record bodies.
- [ ] No third-party analytics, remote font/script, crash upload or telemetry is enabled by default.
- [ ] Retention, expiry, correction, purge and deletion apply consistently to logs, temporary retrieval bodies and audit artifacts.
- [ ] Security events preserve useful evidence without retaining the prohibited content that triggered them.
- [ ] Exported diagnostics and QA evidence pass redaction and secret scans.

## Supply chain, package and platform claims

- [ ] Dependencies are locked, reviewed for license and vulnerability status and represented in an SBOM/dependency record.
- [ ] The production build and clean install reproduce from the packaged lockfile without undocumented edits.
- [ ] The release manifest and SHA-256 checksums match every shipped file; the ZIP has one safe root, no traversal, duplicate entries or symlinks.
- [ ] macOS, Windows or Linux appears as Supported only after its complete clean-machine suite passes for the exact release.
- [ ] Update, failed-update rollback, application-only uninstall and full uninstall pass on every claimed supported OS.
- [ ] Known security/privacy limitations and every failed, blocked, unsupported or untested critical criterion appear in the final handoff.

## Institutional edition boundary

- [ ] Institutional enforcement is enabled only through an approved managed configuration with real access control, audit, policy ownership and authorization routes.
- [ ] Institutional Red classifications block execution until the required approval and policy evidence exists.
- [ ] A personal installation never claims institutional approval, clinical validation, legal authorization, compliance, certification or production safety.
- [ ] Institutional policy takes precedence over user preference and the application reports conflicts without silently weakening the stricter rule.

## Release sign-off

| Field | Value |
|---|---|
| Application version and SHA-256 | Not Run |
| Checklist completed UTC | Not Run |
| Security/privacy test evidence bundle | Not Run |
| Release owner | Not Run |
| Independent reviewer | Not Run |
| Unresolved critical items | Not Run |
| Readiness decision | Not operational |

Do not replace `Not operational` until the acceptance ledger and final handoff prove the applicable higher gate.
