# Security Policy

`mgf-fed-web` is a federation sibling of [`mgf-common`](https://codeberg.org/magogi-admin/mgf-common).
It is a **local, single-user web GUI** — a thin FastAPI + Jinja front-end that composes
and displays the `fed-resources/generated/` state produced by the `mgf-fedres` spine. It
is operator-run on a maintainer's own machine (binds `127.0.0.1`, no auth, not a
deployed multi-user service), it is **read-only on project state**, and it handles **no
credentials**. Its security surface is therefore limited to **how it parses the local
`fed-resources/` JSON/NDJSON** (delegated to the spine's version-aware reader) and the
one narrow write it performs — delivering **non-operative feedback**.

The defining posture, inherited from the spine, is **fail-closed + honest-absence**: an
unreadable file, malformed JSON, or an unknown `schema_version`/`v` renders the explicit
`UNREADABLE` / `UNKNOWN` state with the action that fixes it — never a guess, never a
stale view shown as current.

## Implementation status

This repo is at the **skeleton** stage — the FastAPI app (routes, templates, the
feedback-delivery path) is **not yet built (M2+)**. The notes below describe the designed
posture the M2+ implementation MUST hold; they will be re-evidenced against real code in
the conformance ledger as the app lands.

## A note on parsing, the filesystem, and feedback delivery

- **Deserialization is safe by construction:** all `fed-resources/` payloads are read
  through `mgf-fedres` (stdlib `json` only — no `pickle`, `yaml.load`, or `eval`) and
  schema-validated before anything is displayed.
- **Read-only on project state:** the dashboard composes + displays `generated/`; it never
  hand-edits it. `generated/` integrity is anchored by the spine's per-file `sha256`
  manifest, so tampering surfaces as `TAMPERED` rather than passing silently. The `live/`
  channel is ephemeral, gitignored, and never gated.
- **Feedback is non-operative:** the only write is producing + delivering a `feedback.json`
  into a target project's `feedback/` inbox (local mode: into the sibling tree,
  uncommitted). It **never auto-commits** into a governed repo; acting on feedback happens
  project-side.
- **Local binding:** the console binds loopback (`127.0.0.1`) and is single-user; it
  exposes no public network surface.

## Supported versions

In the 0.x window, **only the latest MINOR receives fixes** (per
[SemVer 0.x](https://semver.org/#spec-item-4) and rule **AP-03**). Fixes ship as the next
PATCH on the latest MINOR.

| Version | Supported |
|---------|-----------|
| `0.1.x` | ✅ — latest MINOR (pre-alpha / skeleton) |
| `< 0.1` | ❌ — pre-publish development |

## Reporting a vulnerability

**Please do not open a public issue or pull request** until we have had a chance to
respond. Email the maintainer (see the Codeberg profile for `magogi-admin`) with a
description, reproduction, and impact.
