SDLC — development, testing and release of the RAIN RNG (GLI-19 App. B.8.3; UKGC RTS security 8.25/8.29/8.31/8.33 — ISO/IEC 27001:2022)

1. Environments

• Development / test: this repository, local machines; every test uses in-memory or temp-dir stores (store: memory, mkdtemp) and ephemeral keys (key.source = "ephemeral"). No production secret or data is used in tests (RTS 8.33).
• Production: the operator's deployment of @rain/rng-node (Docker image built from a tagged commit, packages/rng-node/docker/Dockerfile) with a durable store (file WAL or Postgres) and a real operator key. Test-only switches are refused in production (RAIN_CRASH_AT, RAIN_KAT_FAULT → refuse to start when NODE_ENV=production). Logical separation is therefore enforced by code; physical separation (separate hosts/accounts) is an operator control (HOSTING-HA-DR.md).

2. Secure coding standard (what the code actually follows)

• Zero third-party dependencies on the certified path (@rain/rng-core has none; rng-session depends only on rng-core; rng-node adds ws, optional pg/ethers outside the randomness path) — minimises supply-chain exposure; package-lock.json pins everything else.
• TypeScript strict; explicit input validation on every public function (assertHex32, range checks with RangeError); constant-time considerations are not required (no secret-dependent branching on the generation path beyond HMAC internals, which are standard).
• Published references for every primitive with KATs in the unit tests and at runtime (selftest.ts).
• No Math.random, no time-based seeds, no fallbacks: randomBytes32() throws without a CSPRNG.
• Comments describe intent at module and function level; the fairness formulae are stated verbatim in code and docs.

3. Test methodology (all executable from the repository)

4. Release

PUBLISHING.md: version bump across workspaces, npm test && npm run test:live, vendor-sync --check, clean tree, tag sdk-vX.Y.Z, publish in dependency order, provenance attestation recommended. Add for certified releases: regenerate lab/FINGERPRINTS.json, run lab:verify-build twice, attach the manifest to the tag.

5. Gaps, honestly

CI configuration is now in the repository (.github/workflows/ci.yml: build, typecheck, unit incl. KATs/crash/selftest/e2e, Python mirror, lab:verify-build fingerprint-drift check, dependency review, npm audit) together with .github/CODEOWNERS (two maintainer teams on every path — placeholder handles) and docs/GOVERNANCE.md (branch protection: 2 approvals, required checks, signed tags). Not yet exercised on GitHub and branch protection not yet applied — the repo is single-maintainer today, so the second review is a stated policy, not an enforced control, until a second maintainer exists. External security items (pen-test, crypto review, contract audit) — cadence and status in SECURITY-PROGRAM.md: none contracted yet. These remain [TO ESTABLISH] in CHANGE-CONTROL.md and docs/LAB-READINESS.md.