docs: activation fixes, run-outcome reference, and security packet additions

docs/commercial/phi-handling.md

@@ -0,0 +1,81 @@
+# PHI handling in one page
+
+How OpenAdapt handles protected health information (PHI) and other regulated
+identifiers, end to end: what is scrubbed, what is deliberately retained and
+where, what a human reviews before anything leaves your boundary, and why the
+shareable receipt cannot carry PHI at all. Every mechanism below is inspectable
+open source; the deeper dossier is
+[Security and data handling](../guides/security-and-data-handling.md).
+
+## 1. Scrubbing on the persist and log paths
+
+PHI/PII scrubbing is provided by
+[openadapt-privacy](https://github.com/OpenAdaptAI/openadapt-privacy)
+(Presidio-backed named-entity recognition) through a single choke point in the
+engine:
+
+- The shareable `REPORT.md` passes every free-text field through the scrubber.
+- Persisted step and heal frames are routed through image redaction.
+- Drift-oracle console output is scrubbed before printing.
+- A regulated deployment pins `OPENADAPT_FLOW_SCRUB=on` and **fails closed**: a
+  missing scrubbing capability aborts the run instead of writing plaintext.
+- There is no silent plaintext: in the default mode without the privacy extra,
+  writing identity-like free text emits an explicit `PlaintextPHIWarning`.
+
+**The honest boundary.** The recorded identity evidence and the identity audit
+trail intentionally retain literal identifiers — scrubbing them would defeat
+the wrong-record check they exist to power. Those artifacts are governed as
+PHI-at-rest **inside your boundary** (filesystem controls, retention,
+full-disk encryption, opt-in AES-256-GCM sealing), and the published privacy
+map says so explicitly.
+
+## 2. The local review gate before any upload
+
+Nothing raw is uploaded. The only artifact lane to the hosted control plane is
+the sanitized-derivative pipeline, and it puts a human decision between your
+data and the wire:
+
+1. `openadapt flow sanitize` builds a **derivative** with a file inventory and
+   recorded transformations.
+2. `openadapt flow review-sanitized` presents the derivative for **operator
+   review** in a local viewer.
+3. `openadapt flow approve-sanitized` records the explicit approval; only then
+   can the derivative be pushed, and the control plane verifies the manifest,
+   review state, and exact archive SHA-256 before accepting a byte.
+
+Content the sanitizer cannot fully handle — databases, video, audio, nested
+archives, symlinks, unknown binaries — refuses the **entire** derivative
+rather than passing through. Sanitizer success is not treated as proof of
+de-identification: the operator review is the gate.
+
+## 3. The receipt: an allow-list, not a redaction
+
+The shareable run receipt is generated **additively from a closed allow-list,
+never redacted subtractively** from the rich operator report. Every field is a
+closed enum, a bounded count, a digest, or a strictly validated version
+string; an unknown key is refused rather than silently dropped.
+
+Structurally unrepresentable in a receipt: screenshots, OCR text, typed
+values, parameters, URLs, hostnames, coordinates, application name,
+organization name, user name, workflow name, step intents, and halt free text.
+The same principle governs the hosted attended-decision envelope (closed
+enums, bounded integers, booleans — no string field, no image) and the hosted
+break-report descriptor (hashed, coarse, no free text).
+
+## Where each artifact can live
+
+| Artifact | PHI posture | Boundary |
+|---|---|---|
+| Recording, bundle, `report.json`, identity evidence | Retains literal identifiers by design (audit + wrong-record check) | Stays inside your boundary; seal with AES-256-GCM for at-rest protection |
+| `REPORT.md` | Scrubbed free text; redacted frames under the regulated pin | Your boundary; review before any sharing |
+| Sanitized derivative | Operator-reviewed, transformation-manifested | May cross to the hosted control plane after explicit approval |
+| Run receipt | Allow-list only; PHI structurally unrepresentable | Shareable |
+| Hosted halt descriptor / decision envelope | Closed enums, counts, digests; no strings, no images | Hosted control plane |
+
+## Related pages
+
+- [Security packet](security-packet.md) — the reviewer summary.
+- [Subprocessors and hosted data retention](subprocessors.md)
+- [Fail-closed regulated execution](../concepts/regulated-execution.md)
+- Engine [PRIVACY.md](https://github.com/OpenAdaptAI/openadapt-flow/blob/main/docs/PRIVACY.md) —
+  the complete path-by-path PHI map.

docs/commercial/security-packet.md

@@ -4,7 +4,10 @@ The honest current state of OpenAdapt's security posture, written for a
 security or vendor-risk reviewer. Deeper technical detail:
 [Security and data handling](../guides/security-and-data-handling.md) and the
 reviewer-oriented
-[Security and deployment review](../guides/security-review.md). Nothing on
+[Security and deployment review](../guides/security-review.md). Companion
+pages: [Subprocessors and hosted data retention](subprocessors.md),
+[Vulnerability disclosure](vulnerability-disclosure.md), and
+[PHI handling in one page](phi-handling.md). Nothing on
 this page is a compliance determination.
 
 ## Architecture in one paragraph
@@ -49,7 +52,8 @@ append-only, hash-chained audit log.
 | SOC 2 | **Not attested.** OpenAdapt does not hold a SOC 2 report and does not claim certification. Request the current security-controls packet for implementation evidence and remaining gaps. |
 | HIPAA / BAA | No standing BAA offering. Deployments that touch PHI use a customer-controlled boundary; BAA and counsel review are engagement-specific. |
 | Penetration test | Request current status directly; do not infer from documentation. |
-| Vulnerability disclosure | Coordinated disclosure via private GitHub advisories, acknowledgment target within 5 business days (engine `SECURITY.md`). |
+| Vulnerability disclosure | Coordinated disclosure: private GitHub advisories for the open-source packages, `hello@openadapt.ai` for hosted surfaces; acknowledgment target within 5 business days. Full channel and scope: [vulnerability disclosure](vulnerability-disclosure.md). |
+| Subprocessors | Hosted surfaces only; current provider list and roles: [subprocessors and hosted data retention](subprocessors.md). Local and on-prem deployments use none at run time. |
 | Supply chain | GitHub Actions pinned by commit SHA; Dependabot; public Desktop releases ship `SHA256SUMS`, a CycloneDX SBOM, and build-provenance attestations. Windows/Linux installers are currently unsigned and macOS is ad-hoc signed; verify checksums and provenance. |
 
 If a security questionnaire needs a signed answer on any row, request the
@@ -80,6 +84,31 @@ Sensitive live observations never route into the shared managed boundary; a
 recording that was sanitized for upload does not make runtime data sanitized,
 and the documentation says so explicitly rather than implying otherwise.
 
+What crosses each boundary, per shape:
+
+```mermaid
+flowchart TB
+    subgraph localb [Fully local / air-gapped on-prem]
+        LE[Engine + recorder + verifier] --> LT[Target application]
+    end
+    subgraph byocb [Customer-controlled runner / BYOC]
+        BE[Runner in customer VM or cloud account] --> BT[Target application]
+    end
+    subgraph hostedb [Hosted control plane]
+        HC[Accounts, workflow versions,<br/>run history, billing]
+    end
+    subgraph managedb [Managed browser runner]
+        MR[Public-HTTPS,<br/>non-regulated targets only]
+    end
+    localb -. "nothing at run time;<br/>signed updates on operator-pulled media" .-> hostedb
+    byocb -. "declared results, evidence permitted by the<br/>deployment data boundary, minimized control metadata;<br/>raw frames and PHI/PII stay inside" .-> hostedb
+    hostedb -. "bounded authorization<br/>and control metadata" .-> byocb
+    hostedb --- MR
+```
+
+The PHI-specific narrative — scrubbing, the operator review gate, and the
+allow-list receipt — is one page: [PHI handling](phi-handling.md).
+
 ## What we will not claim
 
 - Architecture documentation is not a HIPAA, PHIPA, SOC 2, or other

docs/commercial/subprocessors.md

@@ -0,0 +1,93 @@
+# Subprocessors and hosted data retention
+
+This page lists the third-party service providers the **hosted** OpenAdapt
+surfaces use, and the current hosted retention and deletion behavior. It is
+informational documentation for a vendor-risk reviewer, not a contractual
+subprocessor notice; request the current signed artifact for anything a
+contract must reference.
+
+**Scope.** Fully local and on-prem deployments use none of these providers at
+run time: a healthy local replay makes zero outbound calls, and the no-egress
+posture is operator-verifiable. This page describes the hosted control plane
+(`app.openadapt.ai`), the managed browser runner, and the public web
+properties.
+
+## Service providers in use
+
+As read from the hosted control plane's deployment configuration:
+
+| Provider | Role | What it can process |
+|---|---|---|
+| Netlify | Hosting for the `app.openadapt.ai` control plane | Application traffic to the control plane: account and session data in transit, and the metadata/digest surfaces described in the [security packet](security-packet.md). |
+| Supabase | Database, authentication, and object storage for the control plane | Accounts, organizations, workflow versions, run metadata, sanitized artifact derivatives, retention/erasure receipts. |
+| Modal | Compute for the managed browser runner | Managed browser execution for explicitly initiated, public-HTTPS, non-regulated workloads only — not a lane for PHI/PII. |
+| Stripe | Payments and billing | Payment and subscription data. Card data is entered on Stripe's surfaces, not OpenAdapt's. |
+| Resend | Transactional email (organization invites, purchase alerts) | Recipient email addresses and the fixed-template message content. Purchase alerts carry purchase metadata only, never workflow evidence. |
+| GitHub | Source hosting, CI, release distribution | Public source, build artifacts, and CI logs. No customer workload data. |
+| PostHog | Product analytics on the public web properties and control plane (when enabled) | Usage events on OpenAdapt's own pages. Not wired into the local engine or run path. |
+| GlitchTip | Error monitoring for the control plane (when enabled) | Control-plane error reports. |
+| Google Analytics | Web analytics on the public website and docs | Page-view analytics on public pages only. |
+
+The local engine has no telemetry, analytics, license check, or update ping in
+the run path; analytics providers above apply to OpenAdapt's own hosted pages,
+not to your workflows.
+
+## Hosted retention and deletion
+
+The hosted service applies a **versioned, explicitly configured retention
+policy** — there is no implicit retention duration. The policy names its
+version and sets explicit windows for recordings, reports, and run metadata
+(run metadata is never retained shorter than reports), plus a backup recovery
+window and a maximum restore-drill age.
+
+Current behavior:
+
+- **Scheduled deletion is fail-closed.** Destructive scheduled retention
+  refuses to run without a recent receipt proving a complete database **and**
+  private object storage restore into an isolated scratch environment.
+- **Legal holds pause eligible deletion** for the held organization.
+- **Tenant erasure is organization-scoped** and produces an append-only,
+  PHI/PII-free receipt with identifiers, counts, and digests — never deleted
+  payloads.
+- The public [readiness endpoint](https://app.openadapt.ai/api/health/ready)
+  reports the configured retention component separately from the
+  destructive-operation gate.
+
+The concrete day windows are deployment configuration, reviewed with the
+policy version; request the current policy version and its windows directly
+rather than citing this page.
+
+## Data-flow summary
+
+What crosses each boundary, by deployment shape (full narrative:
+[Security packet](security-packet.md) and
+[deployment boundaries](deployment-boundaries.md)):
+
+```mermaid
+flowchart TB
+    subgraph local [Fully local / on-prem]
+        L1[Recorder + engine + verifier] --> L2[Your target app]
+    end
+    subgraph byoc [Customer-controlled runner / BYOC]
+        B1[Runner in your VM or cloud] --> B2[Your target app]
+    end
+    subgraph hosted [Hosted control plane]
+        H1[Accounts, versions, run history, billing]
+    end
+    local -. "nothing at run time" .-> hosted
+    byoc -. "declared results + bounded control metadata;<br/>raw frames and PHI/PII stay inside" .-> hosted
+    hosted -. "bounded authorization and<br/>control metadata" .-> byoc
+    hosted --> P[(Supabase)]
+    hosted --> N[(Netlify)]
+    hosted --> S[(Stripe)]
+    hosted --> M[(Modal:<br/>managed browser runner,<br/>non-regulated only)]
+    hosted --> R[(Resend)]
+```
+
+## Related pages
+
+- [Security packet](security-packet.md) — posture summary for reviewers.
+- [Vulnerability disclosure](vulnerability-disclosure.md) — how to report.
+- [PHI handling](phi-handling.md) — the end-to-end PHI narrative.
+- [Security and data handling](../guides/security-and-data-handling.md) — the
+  full technical dossier, including hosted retention detail.

docs/commercial/vulnerability-disclosure.md

@@ -0,0 +1,56 @@
+# Vulnerability disclosure
+
+OpenAdapt is deployed next to sensitive systems. Security reports are taken
+seriously and handled through coordinated disclosure. Please do not open a
+public issue, discussion, or pull request containing vulnerability details.
+
+## Where to report
+
+| Component | Channel |
+|---|---|
+| Open-source engine and packages (`openadapt-flow`, `openadapt-capture`, `openadapt-privacy`, and the other public repositories) | GitHub's private advisory channel on the affected repository: **Security tab → Advisories → Report a vulnerability** (for the engine: [report directly](https://github.com/OpenAdaptAI/openadapt-flow/security/advisories/new)). |
+| Hosted control plane (`app.openadapt.ai`), managed runner, hosted recorder | Email **hello@openadapt.ai** with "Security" in the subject. |
+
+If you cannot use the private GitHub channel, open a public issue that contains
+**no details** and asks a maintainer to open a private channel with you.
+
+## What to include
+
+The affected route, component, or repository; the impact; reproduction steps;
+and any suggested remediation. Do **not** include live customer payloads,
+credentials, screenshots, or other sensitive evidence in the first message —
+an appropriate transfer channel will be arranged if needed.
+
+## What to expect
+
+- Acknowledgment target: within **5 business days**.
+- Affected versions are confirmed and the reporter is kept informed of the
+  remediation plan.
+- Reporters who want recognition are credited after a fix is released.
+- Fixes ship forward on the latest released version; there is no
+  long-term-support branch at this stage.
+
+## Scope
+
+Explicitly in scope for the hosted surfaces: tenant-isolation failures,
+authentication or MFA bypasses, secret exposure, artifact-admission bypasses,
+managed-runner escape or egress failures, cross-organization access,
+billing-entitlement bypasses, and deployment supply-chain findings.
+
+Engine-specific scope notes:
+
+- The compiled bundle and `report.json` intentionally retain literal
+  identifiers (for the identity check and audit trail) behind a documented
+  boundary. A report that these are exposed **outside** that boundary is in
+  scope.
+- Identity crops sent to the on-prem VLM appliance are deliberately not
+  scrubbed; the control is on-prem-only plus no-retention. Reports of
+  retention or off-prem transmission are in scope.
+- Supply chain: GitHub Actions are pinned by commit SHA and dependencies flow
+  through Dependabot; reports of a pinning gap are welcome.
+
+## Related pages
+
+- [Security packet](security-packet.md)
+- [Security and data handling](../guides/security-and-data-handling.md)
+- Engine [SECURITY.md](https://github.com/OpenAdaptAI/openadapt-flow/blob/main/SECURITY.md)