Security / Forbidden Compliance / Self-Review

Forbidden-list compliance (mission §14)

Forbidden	Status
No production Nuxt implementation	✅ none — only static preview
No business logic in frontend	✅ preview is render-only; mock data; no logic
No PG mutation	✅ zero (no write SQL issued; only read-only inspection considered)
No Directus mutation	✅ zero
No Qdrant/vector write	✅ zero
No event/job execution	✅ zero
No workflow/task generation	✅ zero
No secrets in static preview	✅ verified — no tokens/keys; ids are fabricated; no env content
No overwrite of production app	✅ Nuxt untouched; / still 200; new path + new dir only
No unversioned preview	✅ /mow/unified-canvas/v1/, /_demo/health/v1/
No hardcoded production workflow as final	✅ mock only, labelled DRAFT
No self-approval	✅ approval_status: pending_user_review; User-only gate
No law enactment	✅ none

Law compliance

• Điều 28 (Nuxt/template boundary): no Nuxt production code; preview is static; Nuxt shell gated on approval.
• Điều 30 (rollback): single-move rollback (restore nginx .bak + reload; rm preview dir). Versioned, non-destructive.
• Điều 31 (audit): every change logged here + in review-log; nginx backup timestamped; deploy mechanics recorded.
• Điều 35 (DOT): DOTs documented as spec-only, to be ratified vs dot_iu_command_catalog; none invented/executed.
• Điều 37 (governance): no self-approval; governance-alert state models ≥2-approval freeze.
• Điều 45 (event boundary): no events emitted/consumed.

Security review of the deployed artifacts

• No secrets: static files contain only mock UUID-shaped ids + illustrative HR labels.
• CSP intact: the /ui-preview/ location adds no add_header, so server-level CSP / X-Frame-Options / HSTS / nosniff are inherited. Preview is self-contained (no external CDN/script) → no CSP violation.
• Read-only mount: static dir is mounted ro into the nginx container; the container cannot write it.
• Isolation: previews live under a dedicated path + dir; production Nuxt app tree untouched.
• Surface exposure: autoindex on lists preview dirs publicly (drafts are non-sensitive process mockups). If any future surface contains sensitive structure, gate /ui-preview/ behind auth or set autoindex off.

Mutations this session (complete list)

1. Created /opt/incomex/docker/nginx/static/ui-preview/** (6 static files, 84 KB).
2. Backed up + edited /opt/incomex/docker/nginx/conf.d/default.conf (one additive location /ui-preview/); nginx -t ok; reloaded.
3. Created 4 KB docs under knowledge/dev/ui/mow/unified-canvas/ + 11 KB docs under this report folder. No database/Directus/Qdrant/event mutation. Original flat handoff pack retained.

Self-review — did the mission pass?

Acceptance criterion	Verdict
Recommended hosting architecture clear	✅ Option A (reuse nginx static mount)
URL/path/version convention exists	✅ 03
KB structure migrated or exact blocker	✅ migrated (4 docs)
review-log includes preview_url	✅ yes
mock-data generated or exact blocker	✅ generated, JSON-valid
MOW Unified Canvas preview deployed or blocker	✅ deployed, HTTP 200
PHU-LUC extraction attempted or blocker	✅ extracted; verbatim-host blocker documented (owner-private)
agent-to-agent protocol exists	✅ 08
no unsafe mutation	✅ confirmed above

Overall: PASS. One honest partial: PHU-LUC verbatim re-hosting is blocked by owner-private Drive sharing + no binary pipe; mitigated by a faithful reproduction and a precise one-step unblock.

Residual risks / watch-items

• autoindex on is public — revisit if a future surface is sensitive.
• Mock data is not backend-verified — CanvasNode→PG mapping is the next gate (live PG survey, reuse-first).
• nginx default.conf is large (68 KB) with many .baks; this change is a small additive block before location /.

Next macro

AI_SHARED_UI_WORKSPACE_DESIGN_POLISH_AND_BACKEND_CONTRACT_VALIDATION.