chore: move Windsurf workflow plans to .windsurf/plans/

- Moved 6 workflow plans from .windsurf/workflows/ to .windsurf/plans/
- Maintains git history with git mv
- Organizes plans in dedicated plans directory

.windsurf/plans/security-audit-plan.md

@@ -0,0 +1,206 @@
+---
+description: Security & Audit Workflow for AITBC Platform
+---
+
+# Security & Audit Workflow
+
+This workflow covers comprehensive security auditing and review for the AITBC platform.
+
+## Prerequisites
+
+- Access to all source code repositories
+- Documentation of system architecture
+- List of third-party dependencies
+- Smart contract source code
+- Circom circuit source code
+- Budget for third-party security audit (if applicable)
+
+## Steps
+
+### 1. Professional Third-Party Security Audit
+
+1. **Select security audit firm**
+   - Research reputable blockchain security firms
+   - Evaluate expertise in: smart contracts, ZK proofs, zero-knowledge systems
+   - Compare pricing and timelines
+   - Check references and past audits
+
+2. **Prepare audit scope**
+   - Define components to audit:
+     - Smart contracts (Solidity)
+     - ZK circuits (Circom)
+     - Coordinator API (Python/FastAPI)
+     - Blockchain node (Python)
+     - Wallet daemon (Python)
+   - Define audit timeline and deliverables
+   - Prepare architecture documentation
+   - Provide threat model documentation
+
+3. **Engage audit firm**
+   - Sign NDAs and contracts
+   - Provide access to code repositories
+   - Schedule kickoff meeting
+   - Define communication channels
+
+4. **Review audit findings**
+   - Receive audit report
+   - Categorize findings by severity (Critical, High, Medium, Low)
+   - Review each finding with engineering team
+   - Estimate remediation effort
+
+5. **Implement security fixes**
+   - Create issue tickets for each finding
+   - Prioritize Critical and High findings
+   - Implement fixes with proper testing
+   - Document remediation steps
+
+6. **Re-audit**
+   - Submit fixed code for re-audit
+   - Verify all findings are resolved
+   - Obtain final audit report
+   - Publish audit summary (if appropriate)
+
+### 2. Circom Circuit Security Review
+
+1. **Circuit code review**
+   - Review all Circom circuits in `apps/zk-circuits/`
+   - Check for common vulnerabilities:
+     - Arithmetic overflow/underflow
+     - Incorrect constraint definitions
+     - Side-channel attacks
+     - Privacy leaks
+   - Verify circuit correctness with test vectors
+
+2. **Constraint analysis**
+   - Analyze constraint complexity
+   - Check for unnecessary constraints
+   - Verify witness generation correctness
+   - Test circuit with edge cases
+
+3. **Proving system review**
+   - Review Groth16 proving key generation
+   - Verify trusted setup ceremony process
+   - Check verification key security
+   - Test proof generation and verification
+
+4. **Performance optimization**
+   - Analyze circuit size and proving time
+   - Optimize constraint count
+   - Implement circuit caching
+   - Benchmark proving performance
+
+### 3. ZK Proof Implementation Audit
+
+1. **API endpoint security**
+   - Review ZK proof endpoints in coordinator API
+   - Check input validation
+   - Verify proof verification logic
+   - Test with malicious inputs
+
+2. **Circuit integration review**
+   - Review integration of Circom circuits with Python
+   - Check witness generation security
+   - Verify proof serialization/deserialization
+   - Test proof verification pipeline
+
+3. **Privacy verification**
+   - Verify zero-knowledge properties
+   - Check that sensitive data is not leaked
+   - Test with privacy-sensitive scenarios
+   - Verify confidentiality guarantees
+
+4. **Error handling**
+   - Review error messages for information leaks
+   - Test error paths
+   - Verify graceful degradation
+   - Check logging sensitivity
+
+### 4. Token Economy and Attack Vector Review
+
+1. **Economic model analysis**
+   - Review token distribution and vesting
+   - Analyze incentive mechanisms
+   - Check for economic attack vectors:
+     - Pump and dump
+     - Front-running
+     - MEV extraction
+     - Sybil attacks
+
+2. **Smart contract economic security**
+   - Review staking mechanisms
+   - Check reward distribution logic
+   - Verify slashing conditions
+   - Analyze governance token economics
+
+3. **Market manipulation prevention**
+   - Review marketplace pricing mechanisms
+   - Check for oracle manipulation risks
+   - Verify liquidity protection
+   - Analyze arbitrage opportunities
+
+4. **Game theory analysis**
+   - Analyze Nash equilibria
+   - Check for dominant strategies
+   - Verify incentive alignment
+   - Test economic simulations
+
+### 5. Security Findings Documentation and Remediation
+
+1. **Create security findings document**
+   - Document: `docs/security/audit-findings.md`
+   - Structure by component and severity
+   - Include: description, impact, remediation, status
+   - Track remediation progress
+
+2. **Create remediation plan**
+   - Prioritize findings by severity
+   - Assign owners and timelines
+   - Create issue tickets
+   - Track progress in project management tool
+
+3. **Implement fixes**
+   - Fix Critical findings first
+   - Add comprehensive tests for fixes
+   - Perform regression testing
+   - Update documentation
+
+4. **Security hardening**
+   - Implement defense in depth
+   - Add additional security layers
+   - Improve monitoring and alerting
+   - Update security policies
+
+5. **Post-audit improvements**
+   - Update development practices
+   - Add security testing to CI/CD
+   - Implement security training
+   - Establish security review process
+
+## Verification
+
+- [ ] Third-party audit firm selected and engaged
+- [ ] Audit scope defined and documented
+- [ ] Circom circuits reviewed and optimized
+- [ ] ZK proof implementation audited
+- [ ] Token economy analyzed for attack vectors
+- [ ] Security findings documented
+- [ ] Critical and High findings remediated
+- [ ] Re-audit completed and findings resolved
+- [ ] Security hardening implemented
+- [ ] Security practices updated
+
+## Troubleshooting
+
+- **Audit firm unavailable**: Expand search to include more firms, consider remote audit firms
+- **Circuit review finds issues**: Consult Circom community, review best practices, consider circuit redesign
+- **Economic model vulnerabilities**: Consult economic experts, consider simulation testing, adjust incentives
+- **Remediation blocked**: Escalate to management, prioritize critical fixes, consider temporary mitigations
+
+## Related Files
+
+- `apps/zk-circuits/*.circom`
+- `apps/coordinator-api/src/app/routers/zk.py`
+- `contracts/`
+- `docs/security/audit-findings.md`
+- `docs/security/threat-model.md`
+- `docs/security/economic-analysis.md`