add astra draft

docs/SECURITY.md

@@ -0,0 +1,33 @@
+# Security and operations (development MVP)
+
+This is not security-audited or ready for unattended child-safety enforcement. Start with test profiles and nonessential apps. Keep the native Apple safety baseline and a guardian recovery path.
+
+## Deployment
+
+The server accepts one household's bootstrap administration token, generated randomly with at least 32 characters. The browser exchanges it for a 12-hour HttpOnly, SameSite=Strict session cookie. HTTPS origins produce Secure cookies. Changing `APC_ADMIN_TOKEN` invalidates old browser sessions on the next request. Never commit `.env`, device tokens, pairing/configuration codes, backups, signing credentials or real child profiles.
+
+Use a trusted HTTPS reverse proxy. Bind the upstream privately, keep the configured browser Origin exact, and add connection/rate limits and a **32 KiB request-body cap at the proxy, including chunked requests**. The app checks declared Content-Length; it is not a streaming-body firewall. Add TLS/HSTS and proxy access controls appropriate to the deployment. No CORS exceptions or wildcard origins are configured. Do not directly expose the raw development service to the public internet.
+
+The supplied Compose service is non-root, read-only except for its named data volume and temporary directory, drops capabilities and binds to loopback. Its Docker build/runtime still needs verification on the target host. Python dependencies are exact versions from the implementation environment; perform dependency vulnerability scanning and update/retest them before deployment. There is no automatic update mechanism.
+
+## Credential and client boundaries
+
+Parent administration credentials never belong on a child's phone. Device credentials authorize only the paired child's API operations. Codes and device tokens are hashed in SQLite; parent session hashes are keyed by the admin secret. Pairing and configuration codes use high-entropy random values rather than guessable short PINs.
+
+The native app stores credentials in a device-only Keychain item. App Group state holds policy, app-selection tokens, quota observations and monitor configuration, not API credentials. Redirects are refused by the native HTTP client and plain LAN HTTP is not enabled. An existing pairing anchors the server origin; re-pairing needs a new code from that same server.
+
+The threat model assumes an unmodified signed app and normal device sandboxing. A jailbroken phone, compromised parent/server, stolen bearer token, forged native status report, calculator-assisted solution, or OS scheduling failure is not solved by this MVP. Parent status is explicitly last-reported, not independent proof of enforcement.
+
+## Data and retention
+
+The server stores child display names, overrides, device labels, hashed credentials, policy revisions, generated arithmetic questions/solutions, correctness counts, awarded credit and limited device status. It does not upload application tokens, app names, URLs, browsing history, per-app usage reports, health data, or Apple account credentials. There are no analytics/advertising SDKs.
+
+SQLite is not encrypted by the application. Protect the host, filesystem permissions and backups, and use encrypted disks/backups where appropriate. No automatic retention/deletion UI is implemented. A production version needs explicit family export/deletion and retention policies before taking real users' data. Do not infer regulatory compliance from this document.
+
+## Persistence and recovery
+
+Schema version 1 is initialized in `store.py`. Future schema changes require a real versioned migration; do not silently edit an existing schema in place. Refuse to run older code against a newer database. Back up with SQLite's backup API or while the service is stopped; copying only the live `.sqlite3` file can miss WAL data.
+
+Revoking API access does not remove restrictions from an offline phone. Same-server re-pairing is supported with a new parent-issued code after revocation. Complete server loss/migration, child removal, and factory-reset/Keychain lifecycle still need a designed recovery flow. Before testing, verify that the guardian can revoke Family Controls authorization/remove the experimental app through Apple's supported controls. Never select essential communication or the task app itself.
+
+Cached policy continues locally when the backend is unavailable. Monitor registration failures deliberately keep selected apps shielded, but missing callbacks can still cause incorrect behavior. The application is not a tamper-proof replacement for MDM or all native Screen Time settings.