FINBOT SECURITY UPDATE security-1 — SOURCE CHANGES COMPLETE; HOST ACTIVATION PENDING

What has actually been done
The delivered replay/mobile sources were hardened and tested locally. Twenty-one
security checks passed (20 replay/session/installer checks and1 mobile login
integration check). Browser JavaScript syntax checks passed. No Mac service,
network tunnel, credential registry, live trader or approved host session was
changed from this workspace. Do not interpret this package as a deployed audit
certificate. All findings below distinguish source controls from host checks.

Your setup AFTER this update is installed and activated
1. Your existing public HTTPS gateway remains the entry point for phone access.
   The private mobile dashboard listener stays127.0.0.1:8870; replay monitor stays
   127.0.0.1:8890. These loopback addresses do not change when the laptop travels.
   Public hostname routing is independent of the laptop's current external IP.
2. Public browser login requires HTTPS; inputs remain disabled until the secure
   page script runs. Form fallbacks use POST, preventing password-in-URL fallback.
   Every replay data/export/inquiry API now requires a validated in-memory
   session. Only the static login page is public. No cookie, localStorage token,
   browser URL token, anonymous history export or anonymous portfolio API.
3. Your existing local verifier checks username/password/TOTP, then a15second
   hold, then the independent Secret Password entered from the phone and checked
   by the host. Pending attempts expire at180seconds. No permissive verifier is
   supplied; your private verifier code/credentials do not need uploading here.
4. Authentication alone is insufficient: the exact returned host principal must
   be explicitly allowed for THIS FinBot service. An identity authenticated for
   another project is not automatically admitted. Configure --allowed-principal
   (repeatable) or mobile allowed_principals. With no policy, access is denied.
5. Device sessions are independent. Inactive dashboard sessions expire after
   15minutes (mobile idle default may follow existing configuration); approved
   logins require renewal after12hours. Passive background polls do not refresh
   inactivity. Explicit browser interaction marks activity. Logging out/revoking
   one device does not revoke others or touch the trading engine.
6. Server bounds:32 simultaneous connections,10second socket timeout,600requests
   per peer/minute; replay180protected reads per session/minute;2exports per
   session/minute;5login attempts per account/minute and30overall/minute.
   The fixed connection count is not a production capacity/load certification.
7. Replay MUST use the staged Docker boundary. No native unrestricted fallback.
   No external network, no host home/credential files, no live DB, no Docker
   socket, read-only root/staged inputs, dropped capabilities, no privilege
   escalation, non-root identity,2CPU/1GBmemory/64process bounds. Only reviewed
   replay code,3explicit data files and ONE chosen strategy Python file enter.
   Container image is pinned to its local immutable SHA256 image ID; runtime
   never pulls an image implicitly. Only isolated ledger output is writable.
   The1GB bound can terminate a large replay; that does not affect live trading.
8. Logs/databases are owner-only (0600); newly created private directories0700.
   Recognized inline credentials, credential-key fields, URL auth/query values
   and exact matching secret environment values are masked. Arbitrary unknown
   secrets in free prose cannot be guaranteed identifiable. Never include them
   in strategy messages. Previously leaked real credentials would require host
   review/rotation; this patch does not claim to erase old external copies.
9. Installer verifies the manifest and rejects extra/missing/modified files
   BEFORE copying, rejects symlink destinations/parents, backs up changed source
   with private permissions, and leaves run DBs/data/strategy config untouched.
   A preflight hash check rejects locally modified/unrecognized source BEFORE
   applying either patch; merge such host changes locally rather than overwrite
   proprietary integrations blindly. No private source upload is requested.
   Compare the ZIP hash published in chat BEFORE executing its installer: an
   embedded manifest alone cannot authenticate a completely replaced package.

Public routing and browser policy
Supported replay hosts include localhost, the existing sotality.com and
qzotic-gateway.sotality.com names, valid .trycloudflare.com names, and additional
explicit --public-host names. No source-IP/geographic restriction is imposed.
An unconfigured hostname gets PUBLIC_HOST_NOT_CONFIGURED; supply its exact
hostname rather than disabling authentication. Request Origin is not used as
an account authorization check. CSP constrains scripts/connections to this
application; default frame-ancestors self means cross-origin iframe embedding
needs a separately reviewed frame policy. Top-level mobile browsing is supported.
Session tokens remain browser-memory-only. Python immutable/runtime copies of
passwords cannot be promised physically scrubbed from every RAM/swap location.

Install (on the Mac, from this extracted package)
First compare the ZIP SHA256 against the value delivered in chat. Then:
  python3 -I install_security.py --verify-only
  python3 -I install_security.py --mobile-target /ABSOLUTE/EXISTING/MOBILE_CLIENT_FOLDER
Replay target defaults to:
  /Users/bpa/Desktop/ForesixaQuant/FinBot_Century_Gauntlet/
Use --replay-target if the active replay source lives elsewhere. Mobile source
location must be the actual existing folder containing server.py/gated_client.py;
we do not guess its active installation. Omitting --mobile-target means mobile
hardening is explicitly NOT applied. The installer writes security_install_report.json.
Installing source does not restart anything. Restart only affected dashboard/
replay processes to activate it; those processes' RAM login sessions then need
fresh login. Independent trading/gateway processes need not be stopped.

Replay monitor activation
Use your existing trusted verifier module and exact approved principal:
  python3 gauntlet.py --monitor-only --gate-provider YOUR_LOCAL_VERIFIER \
    --allowed-principal YOUR_EXACT_HOST_PRINCIPAL
For another public hostname add --public-host example.yourdomain.com. Preserve
any existing --db argument so attempt141 and its earlier records remain intact.

Mobile activation
  python3 server.py --gate-provider YOUR_LOCAL_VERIFIER \
    --allowed-principal YOUR_EXACT_HOST_PRINCIPAL
An existing mobile config may instead supply allowed_principals as a list.
No private passwords or API tokens are command-line arguments in these examples.

Replay containment activation (requires host Docker)
Docker was NOT available in the verification workspace. No container run was
faked. The operator must build/approve an image locally. Pin an approved Python
base by digest, for example (replace the placeholder with a VERIFIED real digest):
  docker build -f Dockerfile.replay \
    --build-arg PYTHON_BASE=python:3.11-slim@sha256:YOUR_APPROVED_REAL_DIGEST \
    -t finbot-replay:security-1 .
Then bind the locally built image and actual credential-free strategy file:
  python3 -I enable_isolated_replay.py --image finbot-replay:security-1 \
    --strategy-file /ABSOLUTE/PATH/TO/YOUR_REPLAY_STRATEGY.py
The selected strategy must expose decide(context) and capital_floor(context).
Additional private dependency files are not broadly mounted; they require an
explicit staging review. No host home or whole project mount is provided.
After a real container smoke test confirms the policy, use the original run
command plus --gate-provider and --allowed-principal. Missing runtime/config
causes an explicit block; no silent return to unisolated execution occurs.
Historical dataset and strategy coverage gaps remain separate from security.

Checks required before calling the HOST fully secured
- Run verify_host.py locally and against the actual public monitor URL: all
  sensitive routes must deny unauthenticated access. Redirects require separate
  gateway review; they are not automatically counted as proof of protection.
- Complete the actual existing MFA/Secret Password flow through the public HTTPS
  route and confirm logout/session renewal on one device does not interrupt others.
- Verify Docker runtime, container network/filesystem/credential denial and its
  trusted-image provenance on the actual host; these were not executable here.
- Verify the private verifier's TOTP anti-replay/time window, password hashing,
  account recovery and allowed-principal mapping. No private source was inspected.
- Verify public TLS/tunnel configuration, gateway rate controls, no alternate
  unprotected route and no public direct listener. Application checks do not
  prove all external routing rules.
- Verify FileVault, backup encryption, OS updates and OS account permissions.
  host_security_inventory.py provides read-only metadata without reading secrets.

Nothing here claims all risks eliminated or current Mac production certified.
The source-side fixes are complete for the reviewed findings; host activation
and the checks above remain OPEN until actual results establish them.
