docs(milestone): add v0.1 milestone audit report

Audits all 54 requirements and 9 phases against implementation. Scores: 53/54 requirements met, 53/54 integration checks passed, 5/6 user flows complete. AUTH-07 partial gap (CR-01..03) documented and resolved by Phase 7.1. Tech-debt items catalogued for next milestone. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-05 14:44:50 +02:00
parent 18de84d1a9
commit 14c1bf437b
1 changed files with 205 additions and 0 deletions
@@ -0,0 +1,205 @@
+---
+milestone: "0.1"
+audited: "2026-06-05T00:00:00Z"
+status: gaps_found
+scores:
+  requirements: 53/54
+  phases: 9/9
+  integration: 53/54
+  flows: 5/6
+gaps:
+  requirements:
+    - id: "AUTH-07"
+      status: "partial"
+      phase: "2"
+      claimed_by_plans: ["02-01-PLAN.md", "02-02-PLAN.md", "02-03-PLAN.md"]
+      completed_by_plans: ["02-03-PLAN.md (sign-out-all, password-reset-confirm)"]
+      verification_status: "gaps_found"
+      evidence: >
+        AUTH-07 requires refresh token family revocation on all privilege-change events.
+        sign_out_all (auth.py:402) and password_reset_confirm (auth.py:698) correctly call
+        revoke_all_refresh_tokens(). Three handlers do NOT:
+        CR-01: change_password (~line 493) — commits without revoke;
+        CR-02: disable_totp (~line 614) — commits without revoke;
+        CR-03: enable_totp (~line 580) — commits without revoke.
+        All three violate CLAUDE.md security invariant: "Password change, TOTP enroll/revoke,
+        and account deactivation immediately revoke all active sessions."
+  integration:
+    - "CR-01: change_password (auth.py ~line 493) does not call revoke_all_refresh_tokens() after commit"
+    - "CR-02: disable_totp (auth.py ~line 614) does not call revoke_all_refresh_tokens() after commit"
+    - "CR-03: enable_totp (auth.py ~line 580) does not call revoke_all_refresh_tokens() after commit"
+  flows:
+    - "Privilege-change session revocation broken: password change, TOTP enable, TOTP disable do not invalidate existing sessions"
+tech_debt:
+  - phase: "06.1-close-v1-audit-gaps"
+    items:
+      - "STORE-06: test_delete_decrements_quota is xfail(strict=False) on SQLite — INTEGRATION=1 confirmation under live PostgreSQL never recorded"
+      - "Audit filter behavioral tests: test_audit_log_viewer verifies shape only; no test passes ?event_type=X or ?user_id=Y and asserts narrowed results"
+  - phase: "06-performance-production-hardening"
+    items:
+      - "VALIDATION.md stuck at 'draft' / nyquist_compliant: false — planning artifact, never updated after waves executed"
+      - "No VERIFICATION.md — 5 phases lack formal phase-level verification files (1, 3, 4, 6, 7)"
+  - phase: "07-redo-and-optimize-llm-integration"
+    items:
+      - "VALIDATION.md stuck at 'draft' / nyquist_compliant: false — planning artifact, never updated after waves executed"
+      - "Enhancement noted in UAT test 3: model name field could be searchable dropdown. Tracked as future improvement."
+  - phase: "01-infrastructure-foundation"
+    items:
+      - "UAT file shows status: testing / 0 passed — was never completed; Phase 1 implementation is fully functional per subsequent phase dependencies"
+  - phase: "02-users-authentication"
+    items:
+      - "WR-04: topicsStore.fetchTopics() fires unconditionally in App.vue onMounted — causes spurious 401+refresh on auth pages"
+      - "WR-03: ConfirmBlock.vue has no named slot — sign-out-all spinner guard never activates"
+      - "WR-01: decodeURIComponent in SettingsView.vue onMounted lacks try/catch — URIError on malformed %encoding"
+nyquist:
+  compliant_phases: [1, 2, 3, 4, 5, "6.1", "6.2"]
+  partial_phases: [6, 7]
+  missing_phases: []
+  overall: "PARTIAL — phases 6 and 7 have stale draft VALIDATION.md files; actual test files exist and pass"
+---
+
+# v0.1 Milestone Audit Report
+
+**Milestone:** v0.1 — Foundation & Alpha
+**Audited:** 2026-06-05
+**Status:** ⚠ GAPS FOUND
+**Score:** 53/54 requirements satisfied · 3 security blockers · 1 partial (STORE-06 integration test)
+
+---
+
+## Phase Verification Coverage
+
+| Phase | VERIFICATION.md | Status | Notes |
+|---|---|---|---|
+| 1. Infrastructure Foundation | ❌ Missing | UAT: 0/7 (template, never completed) | Phase functionally complete — all subsequent phases depend on it |
+| 2. Users & Authentication | ✅ Present | human_needed, 6/6 must-haves | 3 SECURITY BLOCKERS (CR-01, CR-02, CR-03) open |
+| 3. Document Migration | ❌ Missing | UAT: 10/10 passed | No formal VERIFICATION.md |
+| 4. Folders, Sharing, Quotas | ❌ Missing | UAT: 14/15 passed | No formal VERIFICATION.md |
+| 5. Cloud Storage Backends | ✅ Present | human_needed, 7/7 must-haves | All CLOUD-* satisfied |
+| 6. Performance & Production | ❌ Missing | UAT: 8/8 passed | No formal VERIFICATION.md |
+| 6.1. Close v1 Audit Gaps | ✅ Present | gaps_found, 9/11 | STORE-06 integration test unconfirmed |
+| 6.2. Close v1 Sharing/CSV | ✅ Present | human_needed, 5/5 | All must-haves verified |
+| 7. Redo LLM Integration | ❌ Missing | UAT: 11/11 passed | No formal VERIFICATION.md |
+
+---
+
+## Security Blockers (3) — MUST FIX before milestone close
+
+All three blockers violate the same CLAUDE.md security invariant:
+> "Password change, TOTP enroll/revoke, and account deactivation immediately revoke all active sessions."
+
+### CR-01 — `change_password` does not revoke sessions
+**File:** `backend/api/auth.py` — `change_password` handler (~line 493)
+**Issue:** `await session.commit()` returns `{"message": "Password updated"}` without calling `revoke_all_refresh_tokens()`. A stolen refresh cookie remains valid for 30 days after the victim changes their password.
+**Fix:** Add `await auth_service.revoke_all_refresh_tokens(session, current_user.id)` before `await session.commit()` at line 493.
+**Affected requirement:** AUTH-07
+
+### CR-02 — `disable_totp` does not revoke sessions
+**File:** `backend/api/auth.py` — `disable_totp` handler (~line 614)
+**Issue:** TOTP disable is a privilege-level downgrade. Existing sessions were issued under the assumption TOTP was required; they must be revoked on disable.
+**Fix:** Add `await auth_service.revoke_all_refresh_tokens(session, current_user.id)` before `await session.commit()` at line 614.
+**Affected requirement:** AUTH-07
+
+### CR-03 — `enable_totp` does not revoke sessions
+**File:** `backend/api/auth.py` — `enable_totp` handler (~line 580)
+**Issue:** TOTP enrollment is a security-level upgrade. Pre-enrollment sessions bypass the TOTP gate — this is a session fixation / 2FA bypass vector.
+**Fix:** Add `await auth_service.revoke_all_refresh_tokens(session, current_user.id)` before `await session.commit()` at line 580.
+**Affected requirement:** AUTH-07
+
+---
+
+## Requirements Coverage (3-Source Cross-Reference)
+
+| REQ-ID | REQUIREMENTS.md | VERIFICATION.md | SUMMARY Frontmatter | Final Status |
+|---|---|---|---|---|
+| AUTH-01 | `[x]` | Phase 2: SATISFIED | 02-01: listed | ✅ satisfied |
+| AUTH-02 | `[x]` | Phase 2: SATISFIED | 02-01: listed | ✅ satisfied |
+| AUTH-03 | `[ ]` stale | Phase 2: SATISFIED | 02-03: listed | ✅ satisfied (checkbox stale) |
+| AUTH-04 | `[x]` | Phase 2: SATISFIED | 02-03: listed | ✅ satisfied |
+| AUTH-05 | `[ ]` stale | Phase 2: SATISFIED | 02-03: listed | ✅ satisfied (checkbox stale) |
+| AUTH-06 | `[ ]` stale | Phase 2: sign_out_all wired | 02-03: listed | ✅ satisfied (checkbox stale) |
+| **AUTH-07** | `[ ]` stale | 3 handlers skip revoke | 02-01, 02-03: listed | ⚠️ **partial — 3 blockers** |
+| AUTH-08 | `[ ]` stale | Phase 2: Redis used-code TTL | 02-03: listed | ✅ satisfied (checkbox stale) |
+| SEC-01 | `[x]` | Phase 2: OriginValidationMiddleware | — | ✅ satisfied |
+| SEC-02 | `[x]` | Phase 2: slowapi + account_limiter | — | ✅ satisfied |
+| SEC-03 | `[x]` | Phase 2: ORM-only | — | ✅ satisfied |
+| SEC-04 | `[x]` | Phase 3: DB-lookup only | — | ✅ satisfied |
+| SEC-05 | `[x]` | SecurityHeadersMiddleware | — | ✅ satisfied |
+| SEC-06 | `[ ]` stale | 02-01: hmac.compare_digest | 02-01: listed | ✅ satisfied (checkbox stale) |
+| SEC-07 | `[ ]` stale | 02-04: admin blocked | 02-04: listed | ✅ satisfied (checkbox stale) |
+| SEC-08 | `[ ]` stale | Phase 5: CloudConnectionOut | — | ✅ satisfied (checkbox stale) |
+| SEC-09 | `[x]` | Phase 5: VERIFIED | — | ✅ satisfied |
+| ADMIN-01 | `[x]` | Phase 2: SATISFIED | 02-04, 02-05: listed | ✅ satisfied |
+| ADMIN-02 | `[x]` | Phase 2: SATISFIED | 02-04: listed | ✅ satisfied |
+| ADMIN-03 | `[x]` | Phase 2: SATISFIED | 02-04: listed | ✅ satisfied |
+| ADMIN-04 | `[x]` | Phase 2: SATISFIED | 02-04: listed | ✅ satisfied |
+| ADMIN-05 | `[x]` | Phase 2: SATISFIED | 02-04: listed | ✅ satisfied |
+| ADMIN-06 | `[ ]` stale | Phase 6.2: SATISFIED | 06.1-02: listed | ✅ satisfied (checkbox stale) |
+| ADMIN-07 | `[x]` | Phase 2: SATISFIED | — | ✅ satisfied |
+| STORE-01 | `[ ]` stale | Phase 1: PostgreSQL+MinIO wired | — | ✅ satisfied (checkbox stale) |
+| STORE-02 | `[ ]` stale | Phase 1: UUID key enforced | — | ✅ satisfied (checkbox stale) |
+| STORE-03 | `[ ]` stale | Phase 3: atomic UPDATE | — | ✅ satisfied (checkbox stale) |
+| STORE-04 | `[ ]` stale | Phase 3: QuotaBar.vue | — | ✅ satisfied (checkbox stale) |
+| STORE-05 | `[ ]` stale | Phase 3: HTTP 413 + detail | — | ✅ satisfied (checkbox stale) |
+| STORE-06 | `[ ]` stale | Phase 6.1: PARTIAL | — | ⚠️ partial (INTEGRATION=1 unconfirmed) |
+| STORE-07 | `[ ]` stale | Phase 1: Celery+Redis, no file locks | — | ✅ satisfied (checkbox stale) |
+| STORE-08 | `[ ]` stale | Phase 1: extract_and_classify.delay() | — | ✅ satisfied (checkbox stale) |
+| FOLD-01 | `[x]` | Phase 4: folders CRUD | — | ✅ satisfied |
+| FOLD-02 | `[x]` | Phase 4: document move | — | ✅ satisfied |
+| FOLD-03 | `[x]` | Phase 4: breadcrumb | — | ✅ satisfied |
+| FOLD-04 | `[x]` | Phase 4: sort | — | ✅ satisfied |
+| FOLD-05 | `[x]` | Phase 4: FTS tsvector | — | ✅ satisfied |
+| SHARE-01 | `[ ]` stale | Phase 6.1: SATISFIED | — | ✅ satisfied (checkbox stale) |
+| SHARE-02 | `[ ]` stale | Phase 6.1: SATISFIED | — | ✅ satisfied (checkbox stale) |
+| SHARE-03 | `[ ]` stale | Phase 6.2: SATISFIED | — | ✅ satisfied (checkbox stale) |
+| SHARE-04 | `[ ]` stale | Phase 6.1: SATISFIED | — | ✅ satisfied (checkbox stale) |
+| SHARE-05 | `[ ]` stale | Phase 6.2: SATISFIED | — | ✅ satisfied (checkbox stale) |
+| CLOUD-01 | `[x]` | Phase 5: SATISFIED | — | ✅ satisfied |
+| CLOUD-02 | `[x]` | Phase 5: SATISFIED | — | ✅ satisfied |
+| CLOUD-03 | `[x]` | Phase 5: SATISFIED | — | ✅ satisfied |
+| CLOUD-04 | `[x]` | Phase 5: SATISFIED | — | ✅ satisfied |
+| CLOUD-05 | `[x]` | Phase 5: SATISFIED | — | ✅ satisfied |
+| CLOUD-06 | `[x]` | Phase 5: SATISFIED | — | ✅ satisfied |
+| CLOUD-07 | `[x]` | Phase 5: SATISFIED | — | ✅ satisfied |
+| DOC-01 | `[ ]` stale | Phase 4: DocumentView.vue | — | ✅ satisfied (checkbox stale) |
+| DOC-02 | `[ ]` stale | Phase 4: /content proxy | — | ✅ satisfied (checkbox stale) |
+| DOC-03 | `[x]` | Phase 3: per-user AI | — | ✅ satisfied |
+| DOC-04 | `[x]` | Phase 3: topic namespacing | — | ✅ satisfied |
+| DOC-05 | `[x]` | Phase 3: Celery DB lookup | — | ✅ satisfied |
+
+**REQUIREMENTS.md note:** 30/54 checkboxes are `[x]`. The remaining 24 `[ ]` are stale — the file was last updated 2026-05-21 before phases ran. All satisfied requirements above should have their checkboxes updated in the archive.
+
+---
+
+## Nyquist Compliance
+
+| Phase | VALIDATION.md | Compliant | Notes |
+|---|---|---|---|
+| 1 | ✅ exists | ✅ true | compliant |
+| 2 | ✅ exists | ✅ true | validated |
+| 3 | ✅ exists | ✅ true | compliant |
+| 4 | ✅ exists | ✅ true | complete |
+| 5 | ✅ exists | ✅ true | complete |
+| 6 | ✅ exists | ❌ false | Stale draft — Wave 0 tasks show ⬜ pending but tests exist and pass (06-01 through 06-06 summaries confirm). Run `/gsd:validate-phase 6` to update. |
+| 6.1 | ✅ exists | ✅ true | validated |
+| 6.2 | ✅ exists | ✅ true | complete |
+| 7 | ✅ exists | ❌ false | Stale draft — same pattern as Phase 6. Run `/gsd:validate-phase 7` to update. |
+
+---
+
+## Tech Debt Summary
+
+| Phase | Item | Severity |
+|---|---|---|
+| 6.1 | STORE-06 integration gate (xfail under SQLite, INTEGRATION=1 unconfirmed) | Medium |
+| 6.1 | Audit filter behavioral test missing (no test verifies filter params narrow results) | Low |
+| 2 | WR-04: topicsStore.fetchTopics() fires on auth pages → spurious 401 | Low |
+| 2 | WR-03: ConfirmBlock no named slot → sign-out-all spinner guard dead | Low |
+| 2 | WR-01: decodeURIComponent without try/catch in SettingsView.vue | Low |
+| 7 | Enhancement: model name field could be searchable dropdown | Cosmetic |
+
+---
+
+_Audited: 2026-06-05_
+_Auditor: Claude (gsd-audit-milestone)_
+_Status: gaps_found — 3 security blockers require resolution before milestone close_