docs/additional-documents/CRA-READINESS.md

# EU Cyber Resilience Act (CRA) Readiness

The Cyber Resilience Act (EU) 2024/2847 imposes cybersecurity requirements on
products with digital elements sold in the EU. This document maps mona-agent's
client architecture to the CRA's essential requirements and manufacturer
obligations.

## Product classification

mona-agent (this repository) is **open-source software** distributed free of
charge as the client for a cloud service. Under CRA Article 3, open-source
software developed outside a commercial activity is exempt; the commercial
**cloud service** (mona.expert) is the product with digital elements and the
obligations below are documented so operators can show readiness end-to-end.

## Essential requirements (Annex I) — how they are met

| CRA requirement | Implementation |
|---|---|
| Security by design & default | No inbound ports, least-privilege tools, secure defaults, no credentials on devices |
| No known exploitable vulnerabilities at release | Automated test suite, lint, dependency review; patched releases published on GitHub |
| Secure default configuration | Allowlist-based shell, workspace-confined file access, URL scheme validation |
| Protection against unauthorized access | Device key authentication (revocable per device), TLS 1.2+, AES-256-GCM encrypted keys |
| Data minimization | Only task text, tool results and device metrics leave the device; provider keys never reach devices |
| Resilience & availability | Self-healing agent loop, retry with backoff, stale-task expiry, metrics-driven health checks |
| Logging & monitoring | Complete audit trail (messages, brain steps, tool calls, tokens, cost, latency); live event stream |
| Secure updates | Versioned releases on GitHub; daemon restart applies updates; update notes in CHANGELOG |

## Manufacturer obligations — operational mapping

| CRA obligation | Where it happens |
|---|---|
| Vulnerability handling process | `SECURITY.md` (reporting, response targets, disclosure policy) + `security.txt` |
| Vulnerability reporting for components | Dependencies are audited; fixes released within the support window |
| SBOM (software bill of materials) | `docs/SBOM.md` — inventory of client components and versions |
| Support window & updates | Client follows semantic versioning with tagged releases; breaking changes documented in CHANGELOG |
| CE marking & technical documentation | Operator-side; this repository provides the technical documentation basis |

## Incident response & disclosure targets

- **Acknowledge** a valid report within 5 working days
- **Triage & reproduce** within 15 days
- **Fix or mitigate** within 90 days for high-severity issues
- **Disclose** publicly after a fix is available (coordinated disclosure)

See `SECURITY.md` at the repository root for the full policy and contact.