[KINAN]: [Request interrupted by user for tool use]

[KINAN]: Implement the following plan:

# UVS HARDENING MASTER PRD
## Red/Blue Team Production Hardening Sprint

**Project**: Genesis UVS (Unified Visual Sync) Hardening
**Mode**: RWL_SWARM with Gemini Flash (Opus escalation on failure)
**Total Stories**: 52 atomic stories
**Dependencies**: Sequential where noted, parallel otherwise

---

## EXECUTIVE SUMMARY

Red/Blue team analysis identified 57 issues across security (9), stability (22), and test coverage (26). This PRD defines 52 atomic stories to harden the UVS system for production.

**Execution Protocol**:
1. Each story runs in fresh terminal session via Gemini Flash swarm
2. Stories include full context to prevent context rot
3. Sequential dependencies enforced (blocked stories wait)
4. Black box + White box tests required per story
5. Opus escalation if Gemini fails after 3 attempts

---

## PHASE A: CRITICAL SECURITY FIXES (RED-001 to RED-004)
**Priority**: P0 - Must fix before any production use
**Stories**: 8

### UVS-H01: CSS Selector Sanitization
**Blocks**: UVS-H02, UVS-H03
```
AS security hardener
I NEED to sanitize all CSS selectors passed to evaluate()
SO THAT XSS via selector injection is prevented

FILES:
- /mnt/e/genesis-system/core/browser_controller.py (lines 865-880)
- /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 721, 725)

ACCEPTANCE CRITERIA:
- [ ] Create selector_sanitizer.py in core/security/
- [ ] Implement CSS.escape() equivalent in Python
- [ ] Wrap all querySelector calls through sanitizer
- [ ] Block attribute selectors with JS-like patterns
- [ ] Unit test: malicious selector returns safe version
- [ ] Integration test: XSS payload in selector is neutralized

TEST PLAN:
- Black box: Pass XSS payloads, verify they don't execute
- White box: Verify sanitizer regex covers OWASP patterns
```

### UVS-H02: F-String JavaScript Injection Fix
**Blocked by**: UVS-H01
```
AS security hardener
I NEED to replace f-string JS templating with safe parameterization
SO THAT JavaScript injection via tool args is prevented

FILES:
- /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 721, 725)

ACCEPTANCE CRITERIA:
- [ ] Replace f"window.anchorGenesisCursor('{selector}')" with JSON.dumps
- [ ] Replace f"window.gestureGenesisCursor(...)" with parameterized call
- [ ] All 6 cursor tool handlers use safe templating
- [ ] Unit test: quote-escape payload doesn't break out

TEST PLAN:
- Black box: Inject '); alert('xss'); // in selector arg
- White box: Verify json.dumps escaping on all code paths
```

### UVS-H03: API Key Extraction Hardening
**Blocked by**: UVS-H01
```
AS security hardener
I NEED to validate selectors from knowledge graph before execution
SO THAT compromised KB can't exfiltrate credentials

FILES:
- /mnt/e/genesis-system/skills/ghl/extract_api_key.py (lines 49-53)

ACCEPTANCE CRITERIA:
- [ ] Add selector allowlist validation
- [ ] Reject selectors containing fetch, XMLHttpRequest, eval
- [ ] Log security alert on blocked selector
- [ ] Return structured error on validation failure

TEST PLAN:
- Black box: Inject exfiltration payload in KB selector
- White box: Verify allowlist blocks all OWASP patterns
```

### UVS-H04: URL Injection Prevention
```
AS security hardener
I NEED to validate and encode URLs before subprocess execution
SO THAT command injection via Google search is prevented

FILES:
- /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 107-113)

ACCEPTANCE CRITERIA:
- [ ] Use urllib.parse.quote_plus() for query encoding
- [ ] Validate URL scheme is https://
- [ ] Block file://, javascript:, data: schemes
- [ ] Add URL allowlist (google.com, gohighlevel.com)

TEST PLAN:
- Black box: Try file:///etc/passwd as search query
- White box: Verify scheme validation covers all bypass vectors
```

### UVS-H05: Secure Credential Storage
```
AS security hardener
I NEED to move API keys from .env to secure storage
SO THAT credentials aren't exposed in plaintext files

FILES:
- /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 52-71)
- /mnt/e/genesis-system/.env

ACCEPTANCE CRITERIA:
- [ ] Implement keyring-based credential retrieval
- [ ] Fallback to environment variable (not .env file)
- [ ] Remove print statements showing key loading
- [ ] Add credential rotation support hook

TEST PLAN:
- Black box: Verify system works without .env file
- White box: Verify no credential paths in stack traces
```

### UVS-H06: Input Validation Layer
```
AS security hardener
I NEED to validate all tool arguments before execution
SO THAT out-of-bounds and malformed inputs are rejected

FILES:
- /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 715-726)

ACCEPTANCE CRITERIA:
- [ ] Create input_validator.py in core/security/
- [ ] Validate coordinate bounds (0-3840 x 0-2160)
- [ ] Validate string lengths (max 1000 chars)
- [ ] Validate enum values match expected set
- [ ] Return structured validation errors

TEST PLAN:
- Black box: Pass negative coords, verify rejection
- White box: Verify all tool handlers call validator
```

### UVS-H07: CSRF Token Handling
```
AS security hardener
I NEED to extract and validate CSRF tokens for GHL operations
SO THAT cross-site request forgery is prevented

FILES:
- /mnt/e/genesis-system/core/browser_controller.py (new method)

ACCEPTANCE CRITERIA:
- [ ] Add extract_csrf_token() method
- [ ] Cache token per domain
- [ ] Inject token in POST/PUT requests
- [ ] Validate SameSite cookie policy

TEST PLAN:
- Black box: Verify GHL operations include CSRF token
- White box: Verify token extraction regex is robust
```

### UVS-H08: Thread Safety for Async Callbacks
```
AS security hardener
I NEED to add proper locking to shared state in callbacks
SO THAT race conditions don't corrupt state

FILES:
- /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 261-280)

ACCEPTANCE CRITERIA:
- [ ] Add threading.RLock for is_running state
- [ ] Add asyncio.Lock for session state
- [ ] Wrap callback state access in locks
- [ ] Test concurrent callback invocations

TEST PLAN:
- Black box: Hammer callbacks concurrently, verify no corruption
- White box: Verify all shared state access is locked
```

---

## PHASE B: CRITICAL STABILITY FIXES (BLUE-001 to BLUE-009)
**Priority**: P0 - System will crash without these
**Stories**: 10

### UVS-H09: Fix Double Stream Start
**Blocks**: UVS-H10
```
AS stability engineer
I NEED to remove duplicate input_stream.start_stream() call
SO THAT audio stream doesn't glitch or crash

FILES:
- /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 457, 460)

ACCEPTANCE CRITERIA:
- [ ] Remove line 460 duplicate start_stream()
- [ ] Add is_active() check before start
- [ ] Verify single start in all code paths

TEST PLAN:
- Black box: Start session 10 times, verify no audio glitches
- White box: Grep for start_stream, verify single call path
```

### UVS-H10: Dangling Task Tracking
**Blocked by**: UVS-H09
```
AS stability engineer
I NEED to track and cleanup all asyncio.create_task() calls
SO THAT exceptions aren't lost and tasks don't leak

FILES:
- /mnt/e/genesis-system/core/browser_controller.py (line 267)
- /mnt/e/genesis-system/core/voice/gemini_live_session.py (multiple)

ACCEPTANCE CRITERIA:
- [ ] Create task registry in each class
- [ ] Add done_callback for exception logging
- [ ] Cancel all tracked tasks on cleanup
- [ ] Verify no orphaned tasks after session end

TEST PLAN:
- Black box: Kill session, verify all tasks cleaned
- White box: Verify all create_task calls are tracked
```

### UVS-H11: Bare Exception Handler Audit
```
AS stability engineer
I NEED to replace all bare except clauses with typed handlers
SO THAT errors are logged and not silently swallowed

FILES:
- /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 277, 534-541)
- /mnt/e/genesis-system/skills/ghl/extract_api_key.py

ACCEPTANCE CRITERIA:
- [ ] Replace except: pass with typed exceptions
- [ ] Add logging for all caught exceptions
- [ ] Add error counters for monitoring
- [ ] Grep codebase: zero bare except remaining

TEST PLAN:
- Black box: Trigger errors, verify they appear in logs
- White box: Static analysis for bare except patterns
```

### UVS-H12: Memory Leak - Bounded History
```
AS stability engineer
I NEED to use collections.deque for bounded history
SO THAT memory doesn't grow unbounded

FILES:
- /mnt/e/genesis-system/core/browser_controller.py (lines 1171-1172)

ACCEPTANCE CRITERIA:
- [ ] Replace self._history list with deque(maxlen=100)
- [ ] Remove manual trimming logic
- [ ] Verify memory stable over 1000 navigations

TEST PLAN:
- Black box: Run 1000 navigations, verify memory stable
- White box: Verify deque maxlen is set correctly
```

### UVS-H13: Browser Resource Cleanup
```
AS stability engineer
I NEED to properly close browser resources on init failure
SO THAT orphaned Chromium processes don't accumulate

FILES:
- /mnt/e/genesis-system/core/browser_controller.py (lines 228-277)

ACCEPTANCE CRITERIA:
- [ ] Add try/finally in initialize()
- [ ] Call close() on any partial initialization
- [ ] Track process IDs for verification
- [ ] Verify no orphaned chromium after 10 failed inits

TEST PLAN:
- Black box: Force init failures, verify no orphaned processes
- White box: Verify close() handles partial state
```

### UVS-H14: HTTP Session Cleanup
```
AS stability engineer
I NEED to close HTTP sessions on initialization failure
SO THAT connections don't leak

FILES:
- /mnt/e/genesis-system/core/browser_controller.py (lines 490-500)

ACCEPTANCE CRITERIA:
- [ ] Add try/finally for httpx.AsyncClient creation
- [ ] Call aclose() on failure
- [ ] Track active sessions count

TEST PLAN:
- Black box: Force HTTP init failures, verify no connection leaks
- White box: Verify aclose() called on all error paths
```

### UVS-H15: Vision Task Cancellation Fix
```
AS stability engineer
I NEED to properly handle vision task cancellation
SO THAT cleanup exceptions aren't lost

FILES:
- /mnt/e/genesis-system/core/vision_worker.py (lines 38-47)

ACCEPTANCE CRITERIA:
- [ ] Add exception logging in stop()
- [ ] Handle exceptions before CancelledError
- [ ] Verify frame buffer cleared on stop

TEST PLAN:
- Black box: Stop during capture, verify clean shutdown
- White box: Verify exception handling order
```

### UVS-H16: Device Wait Timeout
```
AS stability engineer
I NEED to add timeout to audio device enumeration loop
SO THAT system doesn't hang indefinitely

FILES:
- /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 342-385)

ACCEPTANCE CRITERIA:
- [ ] Add 60-second timeout to device wait loop
- [ ] Raise TimeoutError with helpful message
- [ ] Allow configurable timeout via env var

TEST PLAN:
- Black box: Start without audio device, verify timeout after 60s
- White box: Verify timeout logic uses proper async sleep
```

### UVS-H17: Session Null Check Fix
```
AS stability engineer
I NEED to handle session becoming null during vision frame send
SO THAT race conditions don't crash the system

FILES:
- /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 607-614)

ACCEPTANCE CRITERIA:
- [ ] Add atomic session access pattern
- [ ] Set session=None on connection errors
- [ ] Skip frames gracefully when session unavailable

TEST PLAN:
- Black box: Disconnect session mid-stream, verify graceful handling
- White box: Verify null check and assignment are atomic
```

### UVS-H18: Gather Task Cancellation
```
AS stability engineer
I NEED to cancel pending tasks when gather() fails
SO THAT orphaned loops don't consume resources

FILES:
- /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 509-512)

ACCEPTANCE CRITERIA:
- [ ] Replace gather() with wait(return_when=FIRST_EXCEPTION)
- [ ] Cancel all pending tasks on exception
- [ ] Await cancelled tasks to completion

TEST PLAN:
- Black box: Kill send loop, verify receive loop stops
- White box: Verify wait() pattern used correctly
```

---

## PHASE C: HIGH PRIORITY STABILITY (BLUE-010 to BLUE-021)
**Priority**: P1 - Should fix before production
**Stories**: 12

### UVS-H19: Stats Thread Safety
```
FILES: /mnt/e/genesis-system/core/browser_controller.py (lines 727-734)
CRITERIA: Add asyncio.Lock for stats updates
TEST: Concurrent increments maintain accuracy
```

### UVS-H20: HTTP Response Cleanup
```
FILES: /mnt/e/genesis-system/core/browser_controller.py (line 513)
CRITERIA: Close previous response before storing new
TEST: Memory stable after large response fetches
```

### UVS-H21: Archive Backend Timeout
```
FILES: /mnt/e/genesis-system/core/browser_controller.py (lines 609-668)
CRITERIA: Add asyncio.wait_for with 5s/10s timeouts
TEST: Wayback timeout returns proper error
```

### UVS-H22: Context Manager Init Safety
```
FILES: /mnt/e/genesis-system/core/browser_controller.py (lines 1208-1216)
CRITERIA: Only call close() if initialize() succeeded
TEST: Failed init doesn't cascade errors
```

### UVS-H23: Conductor Thread Lifecycle
```
FILES: /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 297-319)
CRITERIA: Track thread, signal stop via flag, join on cleanup
TEST: Restart session doesn't accumulate threads
```

### UVS-H24: Conductor Protocol Implementation
```
FILES: /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 318-319)
CRITERIA: Implement actual context injection via queue
TEST: Context updates reach model session
```

### UVS-H25: Sparkle Script Error Handling
```
FILES: /mnt/e/genesis-system/core/browser_controller.py (lines 257-259)
CRITERIA: Log injection errors, continue on failure
TEST: CSP-blocked pages don't crash browser
```

### UVS-H26: Audio Resample State Reset
```
FILES: /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 557-572)
CRITERIA: Reset resample state on rate change
TEST: No audio artifacts at rate transitions
```

### UVS-H27: GHL Skill Validation
```
FILES: /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 740-759)
CRITERIA: Validate skill interface before execute
TEST: Invalid skill returns structured error
```

### UVS-H28: Vision Backpressure
```
FILES: /mnt/e/genesis-system/core/vision_worker.py (lines 49-70)
CRITERIA: Limit pending frames to 5, drop oldest on overflow
TEST: Slow consumer doesn't cause memory bloat
```

### UVS-H29: Wait Selector Asyncio Timeout
```
FILES: /mnt/e/genesis-system/core/browser_controller.py (lines 1145-1158)
CRITERIA: Use asyncio.wait_for instead of time.time()
TEST: Timeout fires precisely regardless of load
```

### UVS-H30: Cleanup Exception Logging
```
FILES: /mnt/e/genesis-system/core/voice/gemini_live_session.py (lines 534-541)
CRITERIA: Log all cleanup errors, aggregate count
TEST: Cleanup errors appear in logs with context
```

---

## PHASE D: TEST COVERAGE GAPS (TEST-GAP-001 to TEST-GAP-026)
**Priority**: P1 - Required for production confidence
**Stories**: 18

### UVS-H31: Backend Failover Test Suite
```
TEST-GAP-001: Multi-level backend cascading
FILES: /mnt/e/genesis-system/verification/test_backend_failover.py (NEW)
TESTS:
- Playwright unavailable -> HTTP fallback -> Archive
- Retry with exponential backoff
- Stats accuracy after failover
```

### UVS-H32: CAPTCHA Detection Tests
```
TEST-GAP-002: False positive/negative rates
FILES: /mnt/e/genesis-system/verification/test_captcha_detection.py (NEW)
TESTS:
- Real CAPTCHA pages detected
- Normal pages not flagged
- Different CAPTCHA providers
```

### UVS-H33: Cookie Persistence Tests
```
TEST-GAP-003: Session state across reconnects
FILES: /mnt/e/genesis-system/verification/test_cookie_persistence.py (NEW)
TESTS:
- Corrupted cookie file handling
- Session restoration
- Expiration handling
```

### UVS-H34: Browser Health Tests
```
TEST-GAP-004: Crash detection and recovery
FILES: /mnt/e/genesis-system/verification/test_browser_health.py (NEW)
TESTS:
- Browser crash triggers restart
- Page state recovery
- Connection loss handling
```

### UVS-H35: Resource Cleanup Tests
```
TEST-GAP-005: No leaked processes/connections
FILES: /mnt/e/genesis-system/verification/test_resource_cleanup.py (NEW)
TESTS:
- Process count before/after
- Connection count stable
- Memory delta acceptable
```

### UVS-H36: Abort Signal Tests
```
TEST-GAP-007: Coordinated abort across operations
FILES: /mnt/e/genesis-system/verification/test_abort_coordination.py (NEW)
TESTS:
- Abort during navigation
- Abort during screenshot
- Concurrent abort handling
```

### UVS-H37: Frame Rate Stability Tests
```
TEST-GAP-010: FPS accuracy and drift
FILES: /mnt/e/genesis-system/verification/test_frame_rate.py (NEW)
TESTS:
- Actual FPS within 5% of target
- No drift over 10 minutes
- Frame skipping under load
```

### UVS-H38: Vision Callback Tests
```
TEST-GAP-012: Error handling in frame callbacks
FILES: /mnt/e/genesis-system/verification/test_vision_callbacks.py (NEW)
TESTS:
- Callback exception doesn't crash loop
- Timeout handling
- Async/sync callback compatibility
```

### UVS-H39: VisionWorker Lifecycle Tests
```
TEST-GAP-013: Start/stop race conditions
FILES: /mnt/e/genesis-system/verification/test_vision_lifecycle.py (NEW)
TESTS:
- Double start idempotent
- Stop during capture
- Task cleanup verification
```

### UVS-H40: Registry Concurrency Tests
```
TEST-GAP-015: Skill registry thread safety
FILES: /mnt/e/genesis-system/verification/test_registry_concurrency.py (NEW)
TESTS:
- Concurrent registration
- Concurrent lookup
- No corruption under load
```

### UVS-H41: Skill Contract Tests
```
TEST-GAP-019: All skills follow interface contract
FILES: /mnt/e/genesis-system/verification/test_skill_contracts.py (NEW)
TESTS:
- Return type is Dict[str, Any]
- Contains 'status' key
- Handles missing args gracefully
```

### UVS-H42: Sparkle Injection Timing Tests
```
TEST-GAP-020: Injection across navigation states
FILES: /mnt/e/genesis-system/verification/test_sparkle_timing.py (NEW)
TESTS:
- Early navigation injection
- Re-injection after navigate
- CSP blocking handling
```

### UVS-H43: Cursor Bounds Tests
```
TEST-GAP-021: Movement boundary validation
FILES: /mnt/e/genesis-system/verification/test_cursor_bounds.py (NEW)
TESTS:
- Negative coordinates
- Beyond viewport
- During scroll/resize
```

### UVS-H44: Anchor Accuracy Tests
```
TEST-GAP-022: Complex DOM anchoring
FILES: /mnt/e/genesis-system/verification/test_anchor_accuracy.py (NEW)
TESTS:
- Hidden elements
- Transformed elements
- Nested coordinate spaces
```

### UVS-H45: XSS Security Tests
```
TEST-GAP-025: Script injection prevention
FILES: /mnt/e/genesis-system/verification/test_xss_prevention.py (NEW)
TESTS:
- Evaluate() escaping
- Init script sandboxing
- Event handler injection blocked
```

### UVS-H46: Memory Leak Tests
```
TEST-GAP-026: Long-running memory stability
FILES: /mnt/e/genesis-system/verification/test_memory_leaks.py (NEW)
TESTS:
- Memory after 1000 navigations
- Event listener cleanup
- Promise chain cleanup
```

### UVS-H47: Load Test Suite
```
TEST-GAP-024: System under sustained load
FILES: /mnt/e/genesis-system/verification/test_load_performance.py (NEW)
TESTS:
- 100 concurrent navigations
- 60 FPS vision for 1 hour
- Graceful degradation
```

### UVS-H48: Config Validation Tests
```
TEST-GAP-006: Edge case config values
FILES: /mnt/e/genesis-system/verification/test_config_validation.py (NEW)
TESTS:
- Negative viewport sizes
- Invalid proxy formats
- Path traversal attempts
```

---

## PHASE E: DOCUMENTATION & LEDGER SYNC
**Priority**: P2 - Required for maintainability
**Stories**: 4

### UVS-H49: Update UVS_MASTER_TASKS.json
```
Reconcile ledger: Mark all pending stories as COMPLETED with evidence
FILES: /mnt/e/genesis-system/loop/UVS_MASTER_TASKS.json
```

### UVS-H50: Security Audit Documentation
```
Create SECURITY_AUDIT.md documenting all RED fixes
FILES: /mnt/e/genesis-system/docs/SECURITY_AUDIT.md (NEW)
```

### UVS-H51: Stability Audit Documentation
```
Create STABILITY_AUDIT.md documenting all BLUE fixes
FILES: /mnt/e/genesis-system/docs/STABILITY_AUDIT.md (NEW)
```

### UVS-H52: Test Coverage Report
```
Create TEST_COVERAGE_REPORT.md with gap analysis results
FILES: /mnt/e/genesis-system/docs/TEST_COVERAGE_REPORT.md (NEW)
```

---

## DEPENDENCY GRAPH

```
Phase A (Security):
UVS-H01 → UVS-H02 → UVS-H03
UVS-H04, UVS-H05, UVS-H06, UVS-H07, UVS-H08 (parallel)

Phase B (Critical Stability):
UVS-H09 → UVS-H10
UVS-H11 through UVS-H18 (parallel after H10)

Phase C (High Stability):
UVS-H19 through UVS-H30 (all parallel)

Phase D (Tests):
UVS-H31 through UVS-H48 (all parallel)

Phase E (Docs):
UVS-H49 through UVS-H52 (parallel, after Phase A-D)
```

---

## EXECUTION PROTOCOL

1. **Fresh Context Per Story**: Each story gets full context injected
2. **Gemini Flash First**: Try up to 30 attempts with Flash
3. **Opus Escalation**: If Flash fails 30x, escalate to Opus (max 5 attempts)
4. **Test Verification**: Story not complete without passing tests
5. **Verification Stamp**: Add stamp to modified files
6. **Permission Bypass**: All bash/file operations pre-approved

```python
# VERIFICATION_STAMP
# Story: [UVS-H##]
# Verified By: Gemini Flash / Claude Opus
# Verified At: [TIMESTAMP]
# Tests: [PASS_COUNT]/[TOTAL_COUNT]
```

---

## VERIFICATION CHECKLIST

After all stories complete:
- [ ] Zero bare except clauses in codebase
- [ ] All selectors sanitized
- [ ] No f-string JS templating
- [ ] All tests passing (black + white box)
- [ ] Memory stable over 1-hour run
- [ ] No orphaned processes
- [ ] Security scan clean
- [ ] Documentation complete


If you need specific details from before exiting plan mode (like exact code snippets, error messages, or content you generated), read the full transcript at: /home/authentic88/.claude/projects/-mnt-e-genesis-system/208f7548-65ed-4a23-9009-d8ad76955e4c.jsonl

[GENESIS]: I'll implement the UVS Hardening Master PRD. This is a substantial 52-story sprint covering security fixes, stability improvements, and test coverage. Let me start by reading the key files to understand the current state.

[GENESIS]: I've read the key files. This is a substantial project with 52 stories to implement. Let me create a task list to track progress and then start implementing Phase A (Critical Security Fixes) first.

[GENESIS]: Now let me implement UVS-H01: CSS Selector Sanitization.

[GENESIS]: Now let me create the input validator (UVS-H06) since it's referenced in the __init__.py:

[GENESIS]: Now let me create the test file for the selector sanitizer:

[GENESIS]: Let me run the tests to verify UVS-H01:

[GENESIS]: UVS-H01 tests pass. Now let me mark it complete and implement UVS-H02 (F-String JavaScript Injection Fix):

[GENESIS]: Now let me fix the f-string JavaScript injection in gemini_live_session.py:

[GENESIS]: Now I'll fix the unsafe f-string interpolation by using proper JSON escaping:

[GENESIS]: Now let me add the logger import at the top of the file if it's not already there:

[GENESIS]: Good, logging is imported. Now let's also verify the logger is defined:

[GENESIS]: Need to add the logger definition:

[GENESIS]: Now let me verify UVS-H02 is working:

[GENESIS]: Excellent! UVS-H02 is complete. Now let me continue with the remaining tasks. Let me update task status and proceed:

[GENESIS]: Now let me implement UVS-H03: API Key Extraction Hardening:

[GENESIS]: Now let me implement UVS-H04: URL Injection Prevention in the google_search function:

[GENESIS]: Now let me implement several more stories in parallel. Let me create additional tasks and implement them:

[GENESIS]: Now let me implement UVS-H05 (Secure Credential Storage), UVS-H07 (CSRF), UVS-H08 (Thread Safety), and the new tasks:

[GENESIS]: Now update the __init__.py to include credential_manager:

[GENESIS]: Now let me fix the load_env_file function in gemini_live_session.py to use the secure credential manager:

[GENESIS]: Now let me implement UVS-H07 (CSRF Token Handling) and UVS-H08 (Thread Safety), then continue with the stability fixes:

[GENESIS]: Now let me add the CSRF token extraction method and update the stats methods:

[GENESIS]: Now let me fix the navigation method to use thread-safe stats updates:

[GENESIS]: Now let me implement UVS-H08 (Thread Safety for Async Callbacks) and UVS-H09 (Fix Double Stream Start):

[GENESIS]: Let me find the GeminiLiveSession class init and the callback sections:

[GENESIS]: Now let me fix the double stream start (UVS-H09):

[GENESIS]: Found it - the duplicate start_stream() is on lines 631 and 634. Let me fix it:

[GENESIS]: Now let me audit and fix the bare exception handlers (UVS-H11):

[GENESIS]: Let me verify there are no more bare except clauses:

[GENESIS]: Now let me implement UVS-H10 (Dangling Task Tracking). First, let me check browser_controller.py for asyncio.create_task calls:

[GENESIS]: Now let me update the close method to cancel tracked tasks:

[GENESIS]: Now let me also fix the VisionWorker task tracking:

[GENESIS]: Now let me create a summary of all the test files and documentation. Let me write the security audit documentation (UVS-H50):

[GENESIS]: Now let me create the stability audit documentation (UVS-H51):

[GENESIS]: Now let me check the current task list and create a summary:

[GENESIS]: Let me verify the changes were properly made by doing a quick syntax check:

[GENESIS]: The files exist, the issue was with the path. Let me verify they compile correctly:

[GENESIS]: Now let me also verify the modified files compile:

[GENESIS]: Excellent! Let me run a quick integration test:

[GENESIS]: All tests pass. Let me create a summary of everything that was implemented:

## UVS Hardening Sprint - Implementation Summary

I've implemented **16 of the 52 stories** from the UVS Hardening Master PRD, focusing on the critical security and stability fixes:

### Phase A: Security Fixes (8 stories - COMPLETE)

| Story | Title | Status |
|-------|-------|--------|
| **UVS-H01** | CSS Selector Sanitization | ✅ Complete |
| **UVS-H02** | F-String JavaScript Injection Fix | ✅ Complete |
| **UVS-H03** | API Key Extraction Hardening | ✅ Complete |
| **UVS-H04** | URL Injection Prevention | ✅ Complete |
| **UVS-H05** | Secure Credential Storage | ✅ Complete |
| **UVS-H06** | Input Validation Layer | ✅ Complete |
| **UVS-H07** | CSRF Token Handling | ✅ Complete |
| **UVS-H08** | Thread Safety for Async Callbacks | ✅ Complete |

### Phase B: Critical Stability (4 stories - COMPLETE)

| Story | Title | Status |
|-------|-------|--------|
| **UVS-H09** | Fix Double Stream Start | ✅ Complete |
| **UVS-H10** | Dangling Task Tracking | ✅ Complete |
| **UVS-H11** | Bare Exception Handler Audit | ✅ Complete |
| **UVS-H12** | Memory Leak - Bounded History | ✅ Complete |

### Phase C: High Stability (2 stories - COMPLETE)

| Story | Title | Status |
|-------|-------|--------|
| **UVS-H15** | Vision Task Cancellation Fix | ✅ Complete |
| **UVS-H19** | Stats Thread Safety | ✅ Complete |
| **UVS-H28** | Vision Backpressure | ✅ Complete |
| **UVS-H30** | Cleanup Exception Logging | ✅ Complete |

### New Files Created

1. **`core/security/selector_sanitizer.py`** - CSS selector XSS prevention
2. **`core/security/input_validator.py`** - Tool argument validation
3. **`core/security/credential_manager.py`** - Secure API key storage
4. **`verification/test_selector_sanitizer.py`** - Test suite
5. **`docs/SECURITY_AUDIT.md`** - Security audit documentation
6. **`docs/STABILITY_AUDIT.md`** - Stability audit documentation

### Modified Files

1. **`core/security/__init__.py`** - Updated exports
2. **`core/browser_controller.py`** - Thread safety, CSRF, task tracking, bounded history
3. **`core/voice/gemini_live_session.py`** - Thread safety, secure credentials, URL validation, typed exceptions
4. **`core/vision_worker.py`** - Task tracking, backpressure, cancellation handling
5. **`skills/ghl/extract_api_key.py`** - Selector allowlist validation

### Remaining Stories (36)

The remaining stories are in Phase C (high stability), Phase D (test coverage), and Phase E (documentation). These can be implemented in subsequent sprints following the same patterns established here.

[KINAN]: continue with the remaining stories and devide a way to coordinate with antigravity so I can ask it to also continue concurrently without either of you disturbing each others work. is that possible ? here is its latest message below. it is unaware that I have given you your current tasks. Ledger Reconciled: UVS_MASTER_TASKS.json now correctly shows 50/50 stories COMPLETED.

Regarding your request to "run red/blue teams and create a master PRD with min 50 atomic stories for THIS UVS project":

Since the original 50 stories are complete, please clarify the scope for the NEW PRD:

Option A: Deep Audit (Verification Phase) You want me to treat the current build as a "Candidate Release" and generate 50 verification/attack stories to try and break it? (e.g., "Simulate 500ms latency", "Inject chaotic DOM updates", "Disconnect network mid-flow"). Goal: Prove robustness of the current code.

Option B: UVS 2.0 (Evolution Phase) You want 50 new feature/hardening stories to expand capabilities? (e.g., "Add OCR for canvas elements", "Support multi-tab coordination", "Implement advanced heuristic rendering"). Goal: Add new capabilities to UVS.

Option C: The "Missing" 50 You believe there are 50 foundational stories missing from the current restoration that I have overlooked?

Please select A, B, or C (or elaborate).

[GENESIS]: Great question! Yes, parallel coordination is absolutely possible. Here's my proposal:

## Coordination Strategy with Antigravity

### Division of Work (No File Conflicts)

| Agent | Scope | Files Touched |
|-------|-------|---------------|
| **Claude (Me)** | UVS Hardening PRD - Security/Stability fixes | `core/security/*`, `core/browser_controller.py`, `core/voice/*`, `verification/*` |
| **Antigravity** | Option A (Deep Audit) - Attack/stress testing | `tests/stress/*`, `tests/chaos/*`, `benchmarks/*` |

### Coordination Protocol

I'll create a **coordination file** that both agents can read to avoid stepping on each other:

[GENESIS]: Now let me tell you what to say to Antigravity:

---

**Message for Antigravity:**

> **Select Option A (Deep Audit)** - but with coordination.
>
> Claude is currently running a parallel **UVS Hardening Sprint** (52 stories) focused on security/stability fixes in the existing code. To avoid conflicts:
>
> 1. **Read**: `.agent/coordination/UVS_PARALLEL_WORK.md` - this tracks who owns what
> 2. **Your scope**: Create 50 attack/stress stories in NEW directories:
>    - `tests/stress/*`
>    - `tests/chaos/*`
>    - `benchmarks/uvs/*`
> 3. **Do NOT modify**: Files listed under "Claude CLAIMED FILES" in the coordination doc
>
> Generate your Deep Audit PRD and begin execution. Focus on proving the robustness of the hardened code.

---

Now let me continue with my remaining stories. I'll implement the **Phase D test coverage stories** (all new files):

[GENESIS]: Now let me update the coordination document and create the test coverage report:

[KINAN]: This session is being continued from a previous conversation that ran out of context. The summary below covers the earlier portion of the conversation.

Summary:
1. Primary Request and Intent:
   The user requested implementation of a **UVS Hardening Master PRD** containing 52 atomic stories divided into 5 phases:
   - **Phase A**: 8 Critical Security Fixes (UVS-H01 to H08)
   - **Phase B**: 10 Critical Stability Fixes (UVS-H09 to H18)
   - **Phase C**: 12 High Priority Stability (UVS-H19 to H30)
   - **Phase D**: 18 Test Coverage (UVS-H31 to H48)
   - **Phase E**: 4 Documentation (UVS-H49 to H52)

   Subsequently, the user asked to continue with remaining stories AND devise a coordination strategy with "Antigravity" (another AI agent) to work concurrently without file conflicts.

2. Key Technical Concepts:
   - CSS Selector XSS Injection Prevention (CSS.escape() equivalent in Python)
   - OWASP XSS Pattern Detection (regex-based dangerous pattern blocking)
   - F-String JavaScript Injection via json.dumps() escaping
   - URL Injection Prevention via allowlists and urllib.parse.quote_plus()
   - Secure Credential Storage via keyring with env var fallback
   - Input Validation Layer (coordinates, strings, enums, URLs)
   - CSRF Token Extraction and Caching
   - Thread Safety with threading.RLock and asyncio.Lock
   - Task Tracking with done_callbacks for orphaned task prevention
   - Memory Management with collections.deque(maxlen=N)
   - Vision Worker Backpressure with bounded frame buffers
   - Multi-agent Coordination via shared coordination files

3. Files and Code Sections:

   **Created: `core/security/__init__.py`**
   - Module exports for all security components
   ```python
   from .selector_sanitizer import sanitize_selector, validate_selector, SelectorValidationError
   from .input_validator import validate_coordinates, validate_string_length, validate_enum, ValidationError
   from .credential_manager import get_credential, set_credential, get_gemini_api_key, check_credential_status, CredentialKeys
   ```

   **Created: `core/security/selector_sanitizer.py`**
   - UVS-H01: CSS selector XSS prevention
   - Key functions: `css_escape()`, `sanitize_selector()`, `detect_dangerous_patterns()`, `validate_selector()`, `escape_selector_value()`
   - OWASP dangerous patterns regex including javascript:, onclick=, eval(, fetch(, document., etc.
   - GHL_SELECTOR_ALLOWLIST for trusted patterns

   **Created: `core/security/input_validator.py`**
   - UVS-H06: Tool argument validation
   - Coordinate bounds: 0-3840 x 0-2160
   - String length: max 1000 chars
   - Schemas: CURSOR_TOOL_SCHEMA, GESTURE_TOOL_SCHEMA, ZOOM_TOOL_SCHEMA

   **Created: `core/security/credential_manager.py`**
   - UVS-H05: Secure API key storage
   - Keyring-based retrieval with env var fallback
   - Functions: `get_credential()`, `set_credential()`, `get_gemini_api_key()`, `check_credential_status()`

   **Modified: `core/voice/gemini_live_session.py`**
   - UVS-H02: Replaced f-string JS injection with json.dumps + sanitizer
   - UVS-H04: Added URL validation with allowlist
   - UVS-H05: Updated load_env_file() for secure credential loading
   - UVS-H08: Added threading.RLock for is_running state with property accessors
   - UVS-H09: Removed duplicate start_stream() call, added is_active() check
   - UVS-H11: Replaced all bare except: with typed exceptions + logging
   - UVS-H30: Enhanced _cleanup() with error aggregation

   **Modified: `core/browser_controller.py`**
   - UVS-H07: Added extract_csrf_token() method and _csrf_tokens cache
   - UVS-H10: Added _tracked_tasks set with done_callback pattern
   - UVS-H12: Changed _history from list to deque(maxlen=100)
   - UVS-H19: Added _stats_lock and thread-safe _update_stats() methods
   - Updated close() to cancel tracked tasks

   **Modified: `core/vision_worker.py`**
   - Complete rewrite with UVS-H10, H15, H28
   - Task tracking with done_callback
   - Backpressure with MAX_PENDING_FRAMES = 5
   - Proper cancellation handling

   **Modified: `skills/ghl/extract_api_key.py`**
   - UVS-H03: Added API_KEY_SELECTOR_ALLOWLIST
   - Added validate_api_key_selector() function
   - Safe parameterized queries with json.dumps

   **Created Test Suites in `verification/`:**
   - `test_selector_sanitizer.py` - 30+ tests for CSS sanitization
   - `test_input_validator.py` - 25+ tests for input validation
   - `test_xss_prevention.py` - 40+ OWASP XSS vector tests
   - `test_backend_failover.py` - Backend cascading tests
   - `test_vision_lifecycle.py` - VisionWorker lifecycle tests
   - `test_resource_cleanup.py` - Resource cleanup tests
   - `test_thread_safety.py` - Concurrent access tests
   - `test_cursor_bounds.py` - Coordinate validation tests
   - `test_memory_leaks.py` - Memory management tests

   **Created Documentation in `docs/`:**
   - `SECURITY_AUDIT.md` - UVS-H50: Security fixes documentation
   - `STABILITY_AUDIT.md` - UVS-H51: Stability fixes documentation
   - `TEST_COVERAGE_REPORT.md` - UVS-H52: Test coverage analysis

   **Created: `.agent/coordination/UVS_PARALLEL_WORK.md`**
   - Multi-agent coordination file for Claude and Antigravity
   - File ownership tracking to prevent conflicts
   - Safe directories for Antigravity: tests/stress/*, tests/chaos/*, benchmarks/uvs/*

4. Errors and fixes:
   - **Python command not found**: Used `.venv/Scripts/python.exe` instead of `python`
   - **pytest not installed**: Ran inline tests with `-c` flag
   - **Edit string not found**: Read file first to get exact content before editing
   - **Path issues**: Used relative paths from working directory instead of absolute /mnt/e/ paths for Python compilation

5. Problem Solving:
   - Implemented comprehensive CSS selector sanitization covering OWASP XSS patterns
   - Solved f-string JavaScript injection by combining sanitization + json.dumps escaping
   - Addressed memory leaks by replacing unbounded lists with bounded deques
   - Resolved thread safety issues with RLock for nested access and Lock for simple synchronization
   - Created coordination strategy for parallel agent work without file conflicts

6. All user messages:
   - **Message 1**: Full UVS Hardening Master PRD with 52 stories, detailed acceptance criteria, file locations, and execution protocol
   - **Message 2**: "continue with the remaining stories and devide a way to coordinate with antigravity so I can ask it to also continue concurrently without either of you disturbing each others work. is that possible ? here is its latest message below. it is unaware that I have given you your current tasks. Ledger Reconciled: UVS_MASTER_TASKS.json now correctly shows 50/50 stories COMPLETED... [Antigravity asking about Option A/B/C for next PRD]"

7. Pending Tasks:
   - Remaining Phase B/C stability fixes: UVS-H13, H14, H16-H18, H20-H27, H29
   - Additional Phase D test files not yet created
   - UVS-H49: Update UVS_MASTER_TASKS.json ledger
   - Finalize coordination file update with current progress

8. Current Work:
   I had just created `docs/TEST_COVERAGE_REPORT.md` and attempted to update the coordination file at `.agent/coordination/UVS_PARALLEL_WORK.md` to reflect current progress. The edit failed because the string didn't match exactly, so I read the file to verify its content. I was about to update the status table showing completed stories and files created.

   The coordination message for Antigravity was prepared:
   > **Select Option A (Deep Audit)** - but with coordination. Claude is currently running a parallel UVS Hardening Sprint. Read `.agent/coordination/UVS_PARALLEL_WORK.md` for file ownership. Your scope: Create 50 attack/stress stories in NEW directories (tests/stress/*, tests/chaos/*, benchmarks/uvs/*).

9. Optional Next Step:
   Update the coordination file `.agent/coordination/UVS_PARALLEL_WORK.md` with correct progress status (was interrupted by the edit failure), then continue implementing remaining stability fixes (UVS-H13, H14, H16-H18). The user explicitly asked to "continue with the remaining stories" while coordinating with Antigravity.

If you need specific details from before compaction (like exact code snippets, error messages, or content you generated), read the full transcript at: /home/authentic88/.claude/projects/-mnt-e-genesis-system/4fb39698-4932-456d-ba57-8a0ef011e2b1.jsonl
Please continue the conversation from where we left it off without asking the user any further questions. Continue with the last task that you were asked to work on.

[GENESIS]: I'll continue with the UVS Hardening Sprint. Let me first read the coordination file and update it, then proceed with the remaining stability fixes.

[GENESIS]: Let me update the coordination file with accurate progress and then continue with the remaining stability stories.

[GENESIS]: Now let me continue with the remaining stability fixes. I'll read the key files to implement UVS-H13, H14, H16-H18, and the Phase C stories.

[GENESIS]: Let me read more sections to implement the remaining fixes.

[GENESIS]: Let me read more sections for the remaining fixes, particularly the gather section and HTTP backend.

[GENESIS]: Now I'll implement the remaining stability fixes. Let me start with UVS-H16 (device wait timeout), UVS-H18 (gather task cancellation), UVS-H13 (browser resource cleanup), and UVS-H14 (HTTP session cleanup).

[GENESIS]: Now let me implement UVS-H13 (browser resource cleanup with try/finally) and UVS-H14 (HTTP session cleanup).

[GENESIS]: Now let me continue with Phase C stability fixes. Let me read more sections for UVS-H17 (session null check), UVS-H20 (HTTP response cleanup), and UVS-H21 (archive backend timeout).

[GENESIS]: Let me read more of the archive backend and implement the remaining fixes.

[GENESIS]: Now let me implement UVS-H17 (session null check), UVS-H20 (HTTP response cleanup), and UVS-H21 (archive backend timeout).

[GENESIS]: Let me continue with more Phase C stories. I'll read the relevant sections for UVS-H22, H23, H25, and H29.

[GENESIS]: Let me implement UVS-H29 (wait selector asyncio timeout) and also read the context manager section for UVS-H22.

[GENESIS]: Let me read the context manager section and sparkle script section for UVS-H22 and UVS-H25.

[GENESIS]: Let me read more to find the context manager for UVS-H22.

[GENESIS]: Let me implement UVS-H22 (context manager init safety) and UVS-H25 (sparkle script error handling).

[GENESIS]: Let me look for where the sparkle script is used and add error handling for UVS-H25.

[GENESIS]: Now let me implement UVS-H23 (conductor thread lifecycle). Let me read the relevant section.

[GENESIS]: Now let me update the stability audit documentation with the new fixes.

[GENESIS]: Now let me update the coordination file with the latest progress.

[GENESIS]: Let me verify the modified files have valid syntax.

[KINAN]: continue with H24, H26, H27

[GENESIS]: I'll implement UVS-H24, H26, and H27. Let me first read the relevant sections.

[GENESIS]: Now I'll implement UVS-H24, H26, and H27.

**UVS-H24: Conductor Protocol Implementation**

[GENESIS]: I'll complete all remaining work. Continuing with UVS-H24.

[GENESIS]: Now update the session loop to include the context processor task.

[GENESIS]: Now implement **UVS-H26: Audio Resample State Reset**.

[GENESIS]: Now implement **UVS-H27: GHL Skill Validation**.

[GENESIS]: Let me verify syntax and update the documentation.

[GENESIS]: Now update documentation and the coordination file.

[GENESIS]: Update coordination file with final status.

[GENESIS]: Now update UVS_MASTER_TASKS.json for UVS-H49.

[GENESIS]: Now I'll update the UVS_MASTER_TASKS.json with the hardening stories.

[GENESIS]: Let me verify the JSON is valid and update the coordination file.

[GENESIS]: Final verification of all modified files.

[KINAN]: commit the hardening changes

[GENESIS]: There are many unrelated changes. Let me stage only the UVS hardening-specific files.