# GCS-SEC-001 - Security, Source Authority, and Evidence Integrity Contract

Spec ID      : GCS-SEC-001
Title        : Security, Source Authority, and Evidence Integrity
Version      : v1.0
Status       : Settled
Owner        : Phil
Approver     : Phil
Settled      : 2026-07-08
Depends on   : GCS-SYS-001, GCS-DATA-002, GCS-NAME-001
Supersedes   : -

## 1. Lawful Data Rule

GCS uses lawful public records only. The system must not ingest, request,
store, or rely on hacked, leaked, unlawfully obtained, fabricated-quote, or
conspiracy-prone sources.

## 2. Source Authority

| Tier | Meaning | Claim use |
| --- | --- | --- |
| Tier 1 | Primary filing or official series | Authoritative and assertable |
| Tier 2 | Structured secondary source | Usable with reconciliation |
| Tier 3 | Ambient news/timing | Timing or corroboration only |

Every asserted number traces to Tier 1 or is marked provisional.

## 3. Evidence Integrity

Future ingestion must store:

- Raw payload digest.
- Fetch timestamp.
- As-of timestamp.
- Source authority tier.
- Source URL or official source identifier.
- Normalization version.

Claims that depend on concordance must list the audited-independent bearings.

## 4. Secret Handling

No secrets may be committed. Secret-like values in examples use placeholders
only. Future credentials must be passed through environment variables documented
in `ops/local_variables.example` or through managed secret references.

## 5. Privacy Boundary

GCS does not perform personal surveillance, deanonymization of private persons,
or private behavioral tracking. Public officer, director, fund, issuer, filer,
recipient, and government records may be modeled only to the extent required by
the public record and source terms.

## 6. Validation

Positive verification: `python3 -m tools.check_contracts --check` confirms
that no obvious secret variables or undocumented `GCS_*` variables are present.

Negative verification: adding a committed secret-like `GCS_*` value or
undocumented source variable fails the env/documentation gate.