docs(security): reconcile SEC-6/7/8 status drift with verified code

[qnbs]

User description

Context

.github/SECURITY.md, docs/SECURITY-THREAT-MODEL.md, and TODO.md disagreed on the status of three Phase-3 security items, so external readers saw either phantom open gaps or phantom delivered controls. Each item was verified against the actual code (importers + wiring, not just file existence) before changing any status.

Findings & fixes

Item	Verified reality	Doc fix
SEC-7 plugin worker isolation	✅ Delivered + wired — workers/plugin.worker.ts used by pluginRegistry.ts + workerBusManager.ts; adversarial tests	.github/SECURITY.md ⬜ → ✅
SEC-8 voice WASM download UX	✅ Delivered + wired — VoiceModelDownloadModal used by VoiceSettingsSection	.github/SECURITY.md ⬜ → ✅
SEC-6 DuckDB OPFS encryption	🟡 Not truly delivered — services/duckdb/duckdbEncryption.ts + unit tests exist, but all 6 exported symbols have 0 production callers; not wired into the persistence path → analytics not encrypted at rest	Corrected the over-claim in TODO.md + threat-model checklist to "module exists, integration pending"; .github/SECURITY.md → 🟡 Partial

Marking SEC-6 "complete" would assert an at-rest security control that does not exist — the more dangerous direction of drift — so it is now truthfully represented everywhere.

Also ran scripts/sync-readme-metrics.mjs (recommended housekeeping): README i18n-key metric 2716 → 2726.

Verification

• Each status verified by repo-wide symbol/import grep (0 production refs for duckdbEncryption exports; confirmed importers for plugin worker + voice modal).
• Docs-only change.

🤖 Generated with Claude Code

---

CodeAnt-AI Description

Reconcile security status docs with what is actually shipped

What Changed

• Updated the security status pages to show SEC-7 plugin isolation and SEC-8 voice download UX as complete, matching the shipped code.
• Corrected SEC-6 DuckDB encryption to partial everywhere, since the encryption module exists but is not connected to the live data path and analytics are still unencrypted at rest.
• Kept the threat model, TODO list, and security overview in sync, and refreshed the README locale count.

Impact

✅ Clearer security status for readers
✅ Fewer false “open” security gaps
✅ Fewer false claims of encrypted analytics at rest

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
worldscript-studio	Ready	Preview, Comment	Jun 20, 2026 5:43am

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[qnbs]

@CodeAnt-AI review

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

Sequence Diagram

This diagram illustrates how analytics data currently flows to DuckDB storage without at-rest encryption and shows the intended, but not yet integrated, encryption module, matching the reconciled SEC-6 documentation in this PR.

sequenceDiagram
    participant User
    participant App
    participant Analytics
    participant DuckDBClient
    participant DuckDBEncryption
    participant OPFSStorage

    User->>App: Use features that generate analytics
    App->>Analytics: Record analytics event
    Analytics->>DuckDBClient: Append analytics data
    DuckDBClient->>OPFSStorage: Persist analytics data unencrypted

    opt Planned encryption integration SEC-6
        DuckDBClient->>DuckDBEncryption: Encrypt analytics payload before write
        DuckDBEncryption-->>DuckDBClient: Return encrypted data
    end

Loading

---

Generated by CodeAnt AI