docs(security): publish the security dossier, standards assessment, proposal and remedy ultraplan (#295)

## Change and reason

Publishes the security and integrity dossier for this repository: a
static review of the request surface, a standards assessment, an
adversarial exercise, a delivery plan, and the institutional case for
acting on any of it. **Documentation only — no source file, route, test
or configuration default is changed.**

Today a prospective user cannot find out what this system protects and
what it does not. `SECURITY.md` is a policy document (how to report a
vulnerability), not a model of what is being protected. This PR supplies
the model, with file-and-line evidence for every claim, and states
plainly what the review could not do.

Findings, in one line each: the *code surface* is unusually well
defended (twelve controls recorded as sound, several better than
commercial products), while four absences — **no identity, no audit
trail, no encryption at rest, no classification model** — account for
every serious finding. Three of those absences are *required* HIPAA
implementation specifications (unique user identification,
authentication, audit controls), not addressable ones.

### What is added

| File | Contents |
| --- | --- |
| `docs/security/recon-report.md` | 17 findings (`SEC-01`…`SEC-17`),
each with the file, line and reproducing command; the 12 existing
controls recorded as sound so later work does not disturb them; GDPR
article-by-article; HIPAA specification-by-specification; all 33 TOP
SECRET (Tier 3) baseline behaviours classified as **application**,
**inherited from the environment**, or **no software expression**; a
20-command evidence log; and an explicit list of what was not run |
| `docs/security/colour-teams.md` | CyBOK-referenced
white/red/blue/purple/green/gold exercise: 12 red scenarios with
preconditions, a detection matrix (8 of 10 red scenarios would be
*invisible* today), and the four conflicts between teams with how each
resolves |
| `docs/security/ultraplan-secure-private.md` | The engineering plan: 8
workstreams (`W0`–`W8`), 18 revertible PRs, each with files, ledger
events, acceptance tests, clauses closed and friction cost; plus the
four-rung capability ladder |
| `docs/proposals/security-and-integrity-programme.md` | The case for
acting, written for the people who carry institutional risk (research
office, DPO, research integrity, IT security, KEC partner) rather than
the ones who run the pipeline |
| `docs/proposals/security-and-integrity-ultraplan.md` | The remedy
schedule: 20 remedies keyed to the findings, 9 independently fundable
packages, 3 signable gates that state **what may and may not be
claimed** at each, a 12-question partner answer pack, and the decisions
needed to start |
| `docs/security/README.md` | Index and reading order, split into a
decision path and an implementation path |
| `SECURITY.md` | A short pointer section to the dossier |
| `.gitignore` | Publishes `docs/security/` and `docs/proposals/` under
the existing documentation allowlist (`docs/*` is ignored by default) |

### The governing rule

Every proposed remedy is **eliminate → substitute → notify**, with no
control that pushes work onto the user: zero added user actions across
the whole programme, and at most two one-off decisions per study.
Confirmation dialogs, per-session passwords and per-export
classification dropdowns are explicitly rejected on human-factors
grounds in favour of substitutes.

### Honesty constraints applied throughout

- No rung of the ladder above R1 is claimed. TOP SECRET is stated as an
*accreditation of a system inside an accredited environment*, not a
property of an application.
- "GDPR compliant", "HIPAA compliant" and "TOP SECRET ready" are named
as claims that would be false today.
- The dossier states that a green CI run is not a claim that a finding
is resolved.

Related work left out: see **Scope**.

## Validation

**No tests were run, because nothing executable changed.** This PR adds
five Markdown files, creates two directories, and adds 15 lines to
`SECURITY.md`.

What I did run, and the result:

```
$ git diff --stat origin/main..HEAD
 .gitignore                                         |   4 +-
 SECURITY.md                                        |  15 +
 docs/proposals/security-and-integrity-programme.md | 343 ++++++++
 docs/proposals/security-and-integrity-ultraplan.md | 644 ++++++++++++++
 docs/security/README.md                            |  56 ++
 docs/security/colour-teams.md                      | 289 ++++++++
 docs/security/recon-report.md                      | 979 +++++++++++++++++++++
 docs/security/ultraplan-secure-private.md          | 739 ++++++++++++++++
 8 files changed, 3068 insertions(+), 1 deletion(-)

$ git diff --name-only origin/main..HEAD | grep -v -E '^(docs/(security|proposals)/|SECURITY.md|.gitignore)'
(none — docs only)

# internal Markdown link check over every added file
$ python3 <link checker over docs/security/*.md docs/proposals/*.md>
broken links: 0

# Markdown table column-count check over every added file
tables ok

# every file:line citation in the added documents resolves to a real line
$ python3 <citation checker over 58 unique cited paths>
all in range, except four citations that name routes in other route files
(see note below)
```

**Environment, and therefore what is *not* claimed:** no Julia, R, bun,
DuckDB, `yq` or `ijson-jcs` binary is available in the review
environment, and the checkout was a **shallow clone (1 commit)**.
Consequently:

- no test suite, benchmark or proof check was executed here;
- no live HTTP request was sent to a running server — all exploit paths
in the dossier are reasoned from source and are labelled as such until
tests exist (`ultraplan W7` turns them into tests);
- **no Git-history secret scan was performed** (shallow clone).
`.github/workflows/secret-scanner.yml` scans full history in CI; the
dossier asserts that design, not its result;
- no dependency advisory audit of the Julia, R or npm trees was
performed.

The four citation notes, stated rather than hidden: `report.jl:119`,
`config.jl:631`, `cladistics.jl:321` and `evidence.jl:696` are cited in
the deletion-route inventory and refer to route files of those names
under `src/server/routes/`; the checker resolved them to same-named
files elsewhere in the tree. They are correct in context and should be
read as `src/server/routes/<name>`.

The dossier's own §0.3 and §10 record these limits, and §9 gives the 20
commands that reproduce every finding.

## Scope

- **No code, no routes, no tests, no config defaults, no lockfiles.**
The plan in `ultraplan-secure-private.md` is explicitly not applied.
- **No scientific or statistical change.** The invariant adopted for the
whole programme is that the same inputs produce byte-identical outputs;
nothing in this PR touches that code.
- **No claim of certification, accreditation or compliance**, and no
attempt to bring higher-classification government guidance into the
repository. The Tier 3 material is obtained through an organisation's
own security team, with the NCSC consulted where there is a business
need.
- **Deliberately left for the owner as decisions**, not silently chosen:
the target rung for the next release, the DPIA owner, the classification
vocabulary (UK GSC versus an institution profile), the programme's
outward name, and the wording of the author affiliations in the
proposal. These are listed as questions in both `docs/proposals`
documents.
- **Signed commits:** this branch's commits are unsigned. I cannot sign
in this environment. Upstream requires Verified commits for merge (see
`notes/commit-signing.md`), so the branch will need the owner's signing
step before merge; the content is unaffected.
- `.gitignore` changes only the documentation allowlist, adding two
`!docs/.../` lines and updating the adjacent comment. No build output,
vendored file or generated artefact is included.

## Contribution checks

- [x] I followed [CONTRIBUTING.md](../CONTRIBUTING.md).
- [x] This branch starts at current upstream main and contains no merges
from fork main. Rebased onto `8a71af8` (the current `main` tip) with
`git rebase --onto origin/main d6e8671` after `main` was rewritten by
#293; `git rev-list --left-right --count origin/main...HEAD` reports `0
3`.
- [ ] CI has run and passes. — CI has to run against this
documentation-only change; no Julia test result is claimed by me.
- [x] Existing licensing, citation and acknowledgement text is
unchanged. `LICENSE`, `CITATION.cff` and the existing SPDX headers are
untouched; the five new documents carry `CC-BY-SA-4.0` headers matching
`docs/statistics/` and `docs/schemas/`.

---

*Read `docs/security/README.md` first. If a finding here is wrong, the
command that proves it wrong belongs in the same PR as the correction.*

---------

Co-authored-by: Arena Agent <agent@arena.ai>
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

Author: 3 people

.gitignore

@@ -248,12 +248,14 @@ vignettes/*.pdf
 .Renviron
 
 ## Documentation kept local except published release, cladistics, format, maintenance,
-## statistics, and schema notes
+## statistics, schema notes, the published security dossier, and accepted proposals
 docs/*
 !docs/release-notes/
 !docs/cladistics/
 !docs/format-migration.md
 !docs/maintenance/
+!docs/proposals/
+!docs/security/
 !docs/statistics/
 !docs/schemas/
 

SECURITY.md

@@ -42,3 +42,18 @@ A green workflow is not a claim that all security findings are resolved.
 Missing tools, inaccessible GitHub alert APIs, absent fleet report-backs and
 unverified K9 L3 signatures must remain visible as missing or inapplicable
 evidence.
+
+## Security dossier
+
+`docs/security/` holds a full static review of the request surface, the data
+handling, and the deployment assumptions: findings with file-and-line
+evidence, a mapping against GDPR, the HIPAA Security Rule and the UK
+Government Security Classifications TOP SECRET (Tier 3) baseline behaviours, a
+CyBOK-referenced colour-team exercise, and a phased plan
+(`docs/security/ultraplan-secure-private.md`) with a zero-friction rule: each exposure is
+eliminated, substituted or notified, never pushed back onto the user as an extra
+step.
+
+Start at [`docs/security/README.md`](docs/security/README.md). The dossier is a
+gap analysis and a plan. It is explicitly not an accreditation, and it does not
+claim that any control it describes has been implemented.

docs/proposals/security-and-integrity-programme.md

@@ -0,0 +1,56 @@
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
+<!-- SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> -->
+
+# Security dossier
+
+A read-first set for anyone who has to decide whether this tool may hold data
+belonging to other people, and what it would take for it to hold the most
+sensitive material in the country.
+
+| Document | Answers |
+| --- | --- |
+| [`recon-report.md`](recon-report.md) | What the system is, what protects it today, what does not, and how that scores against GDPR, the HIPAA Security Rule, and the UK TOP SECRET (Tier 3) baseline behaviours. Every finding cites a file and line, and every absence claim has the grep that proves it. |
+| [`colour-teams.md`](colour-teams.md) | The CyBOK-referenced colour-team exercise: white (governance), red (adversary), blue (detection), purple (validation), green (build/crypto), gold (human/insider) — including where the teams disagree and how each conflict resolves. |
+| [`../proposals/security-and-integrity-programme.md`](../proposals/security-and-integrity-programme.md) | The case for doing any of this at all, written for the people who carry institutional risk rather than the ones who run the pipeline: research office, DPO, research integrity, IT security, and an industry or KEC partner doing due diligence. |
+| [`../proposals/security-and-integrity-ultraplan.md`](../proposals/security-and-integrity-ultraplan.md) | The remedy schedule for the same programme: twenty remedies keyed to the findings, nine independently fundable packages, three gates that state what may and may not be claimed at each, a partner answer pack, and the signature points an assessor will ask for. |
+| [`ultraplan-secure-private.md`](ultraplan-secure-private.md) | The plan to close the gaps, ordered by rung on a capability ladder, under a hard **zero-friction** rule (eliminate, substitute, or notify — never "ask the user to be careful"). Each workstream names its files, its ledger events, its acceptance tests and its PR decomposition. |
+
+## Read in this order
+
+If you are deciding whether to fund or deploy any of this, start at
+[the proposal](../proposals/security-and-integrity-programme.md), then
+[the remedy ultraplan](../proposals/security-and-integrity-ultraplan.md) §3
+(what may and may not be claimed) and §4 (the partner answer pack).
+
+If you are implementing or reviewing it:
+
+1. `recon-report.md` §1 (executive summary) and §5 (standards matrices).
+2. `colour-teams.md` §7 (conflicts) and §8 (heat map) — this is the argument for
+   the plan's ordering.
+3. `ultraplan-secure-private.md` §1 (the four rules) and §5 (PR order).
+4. `../proposals/security-and-integrity-ultraplan.md` §1 (the remedy register)
+   and §2 (the packages), for who owns each harm.
+5. `recon-report.md` §9 to re-run the evidence yourself.
+
+## The three sentences that matter
+
+1. The scientific code is well built; the **architecture** has no identity, no
+   audit, no encryption and no classification, and every serious finding follows
+   from one of those four.
+2. **TOP SECRET is an accreditation of a system, not a property of an
+   application.** The achievable statement today is a *rung* on a ladder, not a
+   classification.
+3. The first PR (`ultraplan-secure-private.md` W1) removes six live attack paths with security
+   headers, size caps and refusals, adds no user friction, and does not touch a
+   single line of analysis code.
+
+## Provenance of this dossier
+
+Written against `main` at `d6e8671`. The review was **static**: no Julia, R or
+bun runtime was available, the clone is shallow, and no request was sent to a
+running server. `recon-report.md` §0.3 lists what that means for each claim, and
+§10 lists what is explicitly *not* claimed. Do not cite this dossier as a
+penetration test, an accreditation, or a clean bill of health.
+
+Corrections are welcome as ordinary pull requests: if a finding is wrong, the
+grep that proves it wrong belongs in the same commit.