SeedPass/docs/security_readiness_checklist.md

SeedPass Security Readiness Checklist

Status legend: Not Started, In Progress, Blocked, Done

#	Area	Status	Owner	Evidence / Link
1	Threat model (attacker profiles, trust boundaries, assumptions)	Done	Security / Core	docs/threat_model.md (provisional approvals recorded 2026-02-25)
2	Crypto and key management review	Done	Security / Core	docs/crypto_key_management_review.md, src/tests/test_kdf_modes.py, src/tests/test_export_plaintext_policy.py
3	Secret handling and local data exposure hardening	Done	Core	docs/secret_handling_local_exposure_review.md, src/tests/test_memory_protection.py, src/tests/test_clipboard_utils.py, src/tests/test_fingerprint_encryption.py, src/tests/test_api_new_endpoints.py, src/tests/test_bip85_derivation_path.py
4	Backup and restore integrity validation	In Progress	Core / QA	src/tests/test_account_roundtrip_restore.py, src/tests/test_portable_backup.py
5	Nostr sync security and resilience validation	In Progress	Core / QA	src/tests/test_nostr_real.py, src/tests/test_nostr_index_size.py, src/tests/test_nostr_resilience_failure_modes.py
6	Auth, lock/unlock, and access-control hardening	Done	Core	docs/auth_lock_unlock_access_review.md, src/tests/test_api_new_endpoints.py, src/tests/test_vault_lock_flag.py, src/tests/test_inactivity_lock.py, src/tests/test_unlock_sync.py
7	Testing gates and quality thresholds	In Progress	QA	scripts/check_critical_coverage.py, scripts/tui2_coverage_gate.sh, CI workflows
8	Supply chain and release integrity	In Progress	DevOps	docs/supply_chain_release_integrity.md, docs/release_verification_runbook.md, docs/release_protection_policy.md, .github/workflows/release-integrity.yml, scripts/release_integrity.py, src/tests/test_release_integrity_utils.py
9	Operational readiness and incident runbooks	In Progress	Security / Ops	docs/operational_runbooks.md, docs/agent-handoffs/incidents/2026-02-15-relay-health-preflight-job.md
10	External audit and staged production rollout	In Progress	Maintainers	docs/staged_rollout_runbook.md

Exit Criteria Per Item

1. Threat model:

   • Assets, trust boundaries, and attacker capabilities documented.
   • Explicit assumptions and non-goals documented.
   • Top risks prioritized with mitigations and owners.

2. Crypto and key management:

   • Primitive/parameter review completed.
   • Nonce/key lifecycle reviewed.
   • Negative tests for corruption/tampering/wrong key path.

3. Secret handling:

   • No secret leakage in logs/temp files/exports by default.
   • Clipboard, memory lifetime, and file permission checks documented.

4. Backup/restore:

   • Seed-only recovery and encrypted export/import validated.
   • Corruption and checksum mismatch behavior validated.

5. Nostr:

   • Real-relay publish/retrieve/restore tested.
   • Failure modes (delay/outage/stale state) tested.

6. Auth/access:

   • Lock/unlock/timeout/quick unlock behavior reviewed with tests.

7. Testing gates:

   • Critical module coverage gates enforced.
   • Network and stress tests are opt-in and documented.

8. Supply chain:

   • Locked dependencies, CVE review process, signed artifacts/checksums.

9. Operational:

   • Incident playbooks and recovery drills documented.

10. External validation:

• Independent audit completed.
• Critical findings resolved before broad production use.

Agent Autonomy Control Track (15-Item Plan)

Status legend: Not Started, In Progress, Implemented, Validated

#	Control	Status	Evidence
1	Native non-interactive auth brokers	Implemented	src/seedpass/core/auth_broker.py, src/seedpass/cli/agent.py (--auth-broker flows)
2	Fine-grained RBAC per profile	In Progress	agent_policy.json rule model (operations, kinds, label_regex, path_regex, fields) in src/seedpass/cli/agent.py
3	Short-lived scoped tokens	Implemented	agent token-issue/list/revoke, token TTL/use constraints in src/seedpass/cli/agent.py
4	One-time secret leases	Implemented	agent get --lease-only, agent lease-consume/list/revoke
5	Policy-enforced redaction	Implemented	safe_output_default and redaction fields in policy + agent output paths
6	Auditable event log	Implemented	~/.seedpass/agent_audit.log chained records, agent audit-verify
7	Approval gates	Implemented	agent approval-issue/list/revoke; enforced for export/reveal high-risk actions
8	Secret-class isolation	Implemented	agent high-risk-factor-set/unlock/status/lock, partition migration/store modules
9	Agent identities	Implemented	agent identity-create/list/revoke; token identity binding
10	Safer automation primitives	Implemented	agent job-run, job profiles, signed cron/systemd/API templates
11	Recovery hardening	Implemented	agent recovery-split/recover/drill/drill-list
12	Conflict-safe sync primitives	Implemented	deterministic merge + tombstones in src/seedpass/core/sync_conflict.py
13	Policy as code	Implemented	agent policy-lint/review/apply + docs/policy_as_code.md
14	Deterministic export controls	Implemented	policy-filtered export manifests + agent export-check/export-manifest-verify
15	Security posture tooling	Implemented	agent posture-check/posture-remediate with runtime config checks

Notes:

• Implemented indicates feature availability in CLI/API paths and tests.
• Validated should be used after broader integration soak + external security review.

How To Use

1. Update each row with current status and owner.
2. Attach concrete evidence links (PRs, test files, docs, reports).
3. Treat Done as requiring evidence for all exit criteria.