docs(12.1-04): complete plan 04 summary and state updates
This commit is contained in:
curo1305
@@ -51,7 +51,7 @@ Before any phase is marked complete:
|
|||||||
**Goal:** Restore visible, truthful, metadata-only cloud browsing by repairing Nextcloud's adapter contract, applying one completeness/freshness contract across all providers, and aligning the shared frontend browser with normalized provider identities.
|
**Goal:** Restore visible, truthful, metadata-only cloud browsing by repairing Nextcloud's adapter contract, applying one completeness/freshness contract across all providers, and aligning the shared frontend browser with normalized provider identities.
|
||||||
**Requirements:** CONN-04, CLOUD-01, CACHE-01, SYNC-01
|
**Requirements:** CONN-04, CLOUD-01, CACHE-01, SYNC-01
|
||||||
**Depends on:** Phase 12
|
**Depends on:** Phase 12
|
||||||
**Plans:** 3/4 plans executed
|
**Plans:** 4/4 plans complete
|
||||||
**Execution waves:** Wave 1: 12.1-01; Wave 2: 12.1-02 after 01; Wave 3: 12.1-03 after 02; Wave 4: 12.1-04 after 01-03.
|
**Execution waves:** Wave 1: 12.1-01; Wave 2: 12.1-02 after 01; Wave 3: 12.1-03 after 02; Wave 4: 12.1-04 after 01-03.
|
||||||
|
|
||||||
Plans:
|
Plans:
|
||||||
@@ -59,10 +59,10 @@ Plans:
|
|||||||
- [x] 12.1-01-PLAN.md
|
- [x] 12.1-01-PLAN.md
|
||||||
- [x] 12.1-02-PLAN.md
|
- [x] 12.1-02-PLAN.md
|
||||||
- [x] 12.1-03-PLAN.md
|
- [x] 12.1-03-PLAN.md
|
||||||
- [ ] 12.1-04-PLAN.md
|
- [x] 12.1-04-PLAN.md
|
||||||
- [x] 12.1-01 (Wave 1) — Restore the shared four-provider adapter contract, secure Nextcloud URL/redirect handling, and metadata-only listing behavior.
|
- [x] 12.1-01 (Wave 1) — Restore the shared four-provider adapter contract, secure Nextcloud URL/redirect handling, and metadata-only listing behavior.
|
||||||
- [x] 12.1-02 (Wave 2; after 12.1-01) — Centralize complete/incomplete reconciliation so incomplete provider results cannot become fresh or delete cached metadata.
|
- [x] 12.1-02 (Wave 2; after 12.1-01) — Centralize complete/incomplete reconciliation so incomplete provider results cannot become fresh or delete cached metadata.
|
||||||
- [ ] 12.1-03 (Wave 3; after 12.1-02) — Align the shared browser and trees with `kind`, opaque `provider_item_id` routing, lineage-based breadcrumbs, and server freshness.
|
- [x] 12.1-03 (Wave 3; after 12.1-02) — Align the shared browser and trees with `kind`, opaque `provider_item_id` routing, lineage-based breadcrumbs, and server freshness.
|
||||||
- [ ] 12.1-04 (Wave 4; after 12.1-01 through 12.1-03) — Run sanitized two-mode live Nextcloud acceptance, rendered/security/secret gates, and phase closeout.
|
- [ ] 12.1-04 (Wave 4; after 12.1-01 through 12.1-03) — Run sanitized two-mode live Nextcloud acceptance, rendered/security/secret gates, and phase closeout.
|
||||||
|
|
||||||
**Success Criteria:**
|
**Success Criteria:**
|
||||||
|
|||||||
+9
-8
@@ -4,30 +4,30 @@ milestone: v0.3
|
|||||||
milestone_name: Reimagining Cloud Storage integration
|
milestone_name: Reimagining Cloud Storage integration
|
||||||
current_phase: 12.1
|
current_phase: 12.1
|
||||||
current_phase_name: fix-nextcloud-root-listing-and-sync-visibility
|
current_phase_name: fix-nextcloud-root-listing-and-sync-visibility
|
||||||
status: executing
|
status: verifying
|
||||||
stopped_at: Completed Phase 12.1 Plan 03 — normalized cloud browser contract
|
stopped_at: Completed Phase 12.1 Plan 03 — normalized cloud browser contract
|
||||||
last_updated: "2026-06-22T06:54:15.993Z"
|
last_updated: "2026-06-22T07:48:17.177Z"
|
||||||
last_activity: 2026-06-22
|
last_activity: 2026-06-22
|
||||||
last_activity_desc: Phase 12.1 execution started
|
last_activity_desc: Phase 12.1 execution started
|
||||||
progress:
|
progress:
|
||||||
total_phases: 6
|
total_phases: 6
|
||||||
completed_phases: 1
|
completed_phases: 2
|
||||||
total_plans: 10
|
total_plans: 10
|
||||||
completed_plans: 9
|
completed_plans: 10
|
||||||
percent: 17
|
percent: 33
|
||||||
---
|
---
|
||||||
|
|
||||||
# Project State
|
# Project State
|
||||||
|
|
||||||
**Project:** DocuVault
|
**Project:** DocuVault
|
||||||
**Status:** Ready to execute
|
**Status:** Phase complete — ready for verification
|
||||||
**Last Updated:** 2026-06-22
|
**Last Updated:** 2026-06-22
|
||||||
|
|
||||||
## Current Position
|
## Current Position
|
||||||
|
|
||||||
Phase: 12.1 (fix-nextcloud-root-listing-and-sync-visibility) — EXECUTING
|
Phase: 12.1 (fix-nextcloud-root-listing-and-sync-visibility) — EXECUTING
|
||||||
Plan: 4 of 4
|
Plan: 4 of 4
|
||||||
Status: Ready to execute
|
Status: Phase complete — ready for verification
|
||||||
Last activity: 2026-06-22 — Phase 12.1 execution started
|
Last activity: 2026-06-22 — Phase 12.1 execution started
|
||||||
|
|
||||||
## Phase Status
|
## Phase Status
|
||||||
@@ -52,6 +52,7 @@ Last activity: 2026-06-22 — Phase 12.1 execution started
|
|||||||
| Phase 12.1 P01 | 823 | 4 tasks | 14 files |
|
| Phase 12.1 P01 | 823 | 4 tasks | 14 files |
|
||||||
| Phase 12.1 P02 | 2100 | 3 tasks | 13 files |
|
| Phase 12.1 P02 | 2100 | 3 tasks | 13 files |
|
||||||
| Phase 12.1 P03 | 677 | 4 tasks | 11 files |
|
| Phase 12.1 P03 | 677 | 4 tasks | 11 files |
|
||||||
|
| Phase 12.1 P04 | 15m | 4 tasks | 10 files |
|
||||||
|
|
||||||
## Accumulated Context
|
## Accumulated Context
|
||||||
|
|
||||||
@@ -95,7 +96,7 @@ _Updated at each phase transition._
|
|||||||
|
|
||||||
| Field | Value |
|
| Field | Value |
|
||||||
|---|---|
|
|---|---|
|
||||||
| Last session | 2026-06-22T06:54:15.988Z |
|
| Last session | 2026-06-22T07:48:17.172Z |
|
||||||
| Next action | Execute Phase 12.1 Plan 01 |
|
| Next action | Execute Phase 12.1 Plan 01 |
|
||||||
| Pending decisions | None |
|
| Pending decisions | None |
|
||||||
| Resume file | None |
|
| Resume file | None |
|
||||||
|
|||||||
+165
@@ -0,0 +1,165 @@
|
|||||||
|
---
|
||||||
|
phase: "12.1"
|
||||||
|
plan: "04"
|
||||||
|
subsystem: cloud-browse-live-verification
|
||||||
|
status: complete
|
||||||
|
tags:
|
||||||
|
- live-test
|
||||||
|
- nextcloud
|
||||||
|
- security-gates
|
||||||
|
- documentation
|
||||||
|
- phase-close
|
||||||
|
dependency_graph:
|
||||||
|
requires:
|
||||||
|
- "12.1-01"
|
||||||
|
- "12.1-02"
|
||||||
|
- "12.1-03"
|
||||||
|
provides:
|
||||||
|
- owner-confirmed-nextcloud-fixture
|
||||||
|
- live-smoke-exact-acceptance
|
||||||
|
- rendered-flow-integration-tests
|
||||||
|
- phase-12.1-close
|
||||||
|
affects:
|
||||||
|
- backend/tests/test_nextcloud_live.py
|
||||||
|
- backend/tests/fixtures/cloud/nextcloud_expected_root.json
|
||||||
|
- frontend/src/views/__tests__/CloudFolderRenderedFlow.test.js
|
||||||
|
- SECURITY.md
|
||||||
|
- README.md
|
||||||
|
- RUNBOOK.md
|
||||||
|
- CLAUDE.md
|
||||||
|
- backend/main.py
|
||||||
|
- frontend/package.json
|
||||||
|
tech_stack:
|
||||||
|
added: []
|
||||||
|
patterns:
|
||||||
|
- opt-in pytest marker (live_nextcloud) excluded from ordinary CI
|
||||||
|
- owner_confirmed flag in fixture guards exact-acceptance gate (T-12.1-19)
|
||||||
|
- rendered-flow test mounts real StorageBrowser and BreadcrumbBar with only API/router stubbed
|
||||||
|
key_files:
|
||||||
|
created:
|
||||||
|
- backend/tests/fixtures/cloud/nextcloud_expected_root.json
|
||||||
|
- frontend/src/views/__tests__/CloudFolderRenderedFlow.test.js
|
||||||
|
modified:
|
||||||
|
- backend/tests/test_nextcloud_live.py
|
||||||
|
- .planning/phases/12.1-fix-nextcloud-root-listing-and-sync-visibility/12.1-VALIDATION.md
|
||||||
|
- SECURITY.md
|
||||||
|
- README.md
|
||||||
|
- RUNBOOK.md
|
||||||
|
- CLAUDE.md
|
||||||
|
- backend/main.py
|
||||||
|
- frontend/package.json
|
||||||
|
decisions:
|
||||||
|
- "owner_confirmed: true in fixture is the gate for exact-name acceptance — no inferred confirmation from live output"
|
||||||
|
- "Rendered-flow test mounts real StorageBrowser/BreadcrumbBar; only API/router stubbed (not UI components)"
|
||||||
|
- "Unexpected live provider names withheld from all artifacts, logs, and responses (T-12.1-20)"
|
||||||
|
- "Phase 13 mutations and Phase 14 byte cache are explicit exclusions from Phase 12.1 scope"
|
||||||
|
metrics:
|
||||||
|
duration: "~15 minutes (Tasks 2-4, continuation after Task 1 checkpoint)"
|
||||||
|
completed_date: "2026-06-22"
|
||||||
|
tasks_total: 4
|
||||||
|
tasks_completed: 4
|
||||||
|
files_created: 2
|
||||||
|
files_modified: 8
|
||||||
|
commits: 4
|
||||||
|
tests_added: 8
|
||||||
|
---
|
||||||
|
|
||||||
|
# Phase 12.1 Plan 04: Live Smoke, Exact Acceptance, and Phase Close Summary
|
||||||
|
|
||||||
|
Owner-confirmed Nextcloud root manifest fixture created, exact-acceptance test enabled, rendered-flow integration tests added, and Phase 12.1 closed with full validation, security, documentation, versioning, and push protocol.
|
||||||
|
|
||||||
|
## What Was Built
|
||||||
|
|
||||||
|
### Task 1 (prior session, commit 779b050)
|
||||||
|
Opt-in read-only live Nextcloud smoke test suite (`backend/tests/test_nextcloud_live.py`) with `live_nextcloud` marker excluded from ordinary CI via `pytest.ini`. Three tests: adapter metadata, sanitized root diagnostic, and connection-ID end-to-end browse as designated user.
|
||||||
|
|
||||||
|
### Task 2 (commit 1ec5158)
|
||||||
|
Owner reconciled the 3 previously unmatched fixture names. Created `backend/tests/fixtures/cloud/nextcloud_expected_root.json` with `owner_confirmed: true` — 10 items (4 folders, 6 files) with confirmed names and kinds. Added `test_nextcloud_expected_root_manifest` test enforcing exact set equality and exact kind equality against the fixture (T-12.1-19 gate).
|
||||||
|
|
||||||
|
### Task 3 (commit 6d294ea)
|
||||||
|
Added `CloudFolderRenderedFlow.test.js` — 7 integration tests mounting the real CloudFolderView with the real StorageBrowser and BreadcrumbBar (only API/router stubbed). Covers: mixed root render, opaque-reference folder navigation, breadcrumb lineage back-navigation, warning freshness with cached rows visible, fresh state, and XSS prevention. All security and regression gates ran and passed.
|
||||||
|
|
||||||
|
### Task 4 (commit 46b7ea6)
|
||||||
|
Version bumped 0.2.5 → 0.2.6 in `backend/main.py` and `frontend/package.json`. Docs updated: CLAUDE.md current state, README.md Phase 12.1 corrections and live smoke variables, RUNBOOK.md live smoke invocation and warning semantics table, SECURITY.md Phase 12.1 Plan 04 threat table and gate evidence. All gates re-verified. Atomic commit and push complete.
|
||||||
|
|
||||||
|
## Deviations from Plan
|
||||||
|
|
||||||
|
None — plan executed exactly as written after the checkpoint resolution.
|
||||||
|
|
||||||
|
The `package-lock.json` version update was skipped because the file is gitignored in this project (confirmed by `git add` rejecting it with `.gitignore` hint). Both tracked files (`backend/main.py`, `frontend/package.json`) were bumped.
|
||||||
|
|
||||||
|
## Security Evidence
|
||||||
|
|
||||||
|
| Gate | Result |
|
||||||
|
|------|--------|
|
||||||
|
| Bandit HIGH findings | 0 (10 LOW, all pre-existing) |
|
||||||
|
| npm audit high/critical | 0 vulnerabilities |
|
||||||
|
| Gitleaks new findings | 0 in Phase 12.1 files (3 pre-existing in May 2026 commits) |
|
||||||
|
| Git tracked .env files | None (only .env.example) |
|
||||||
|
| Docker Compose config | Resolves all required variables cleanly |
|
||||||
|
| Credentials in output | None — `_assert_no_secrets_in_string` asserts on every live test |
|
||||||
|
| Provider mutation/download | None — method guard + adapter method absence assertion |
|
||||||
|
| Admin/foreign-user IDOR | Blocked — 403/404 confirmed by live test |
|
||||||
|
|
||||||
|
## Test Results
|
||||||
|
|
||||||
|
| Suite | Result |
|
||||||
|
|-------|--------|
|
||||||
|
| Backend focused cloud tests | 236 pass |
|
||||||
|
| Backend full suite | 595 pass (1 pre-existing failure: test_extract_docx, unrelated) |
|
||||||
|
| Frontend full suite | 376 pass (7 new from CloudFolderRenderedFlow.test.js) |
|
||||||
|
| Frontend build | Clean |
|
||||||
|
| Live smoke (opt-in) | Skipped in CI — requires NEXTCLOUD_URL/USER/APP_PASSWORD |
|
||||||
|
|
||||||
|
## Threat Coverage
|
||||||
|
|
||||||
|
All Phase 12.1 Plan 04 threats closed:
|
||||||
|
|
||||||
|
| Threat ID | Threat | Status |
|
||||||
|
|-----------|--------|--------|
|
||||||
|
| T-12.1-16 | Credentials/URL leak through pytest | CLOSED |
|
||||||
|
| T-12.1-17 | Live smoke mutates/downloads data | CLOSED |
|
||||||
|
| T-12.1-18 | Live connection crosses user/admin boundary | CLOSED |
|
||||||
|
| T-12.1-19 | Count-only test accepts wrong root | CLOSED |
|
||||||
|
| T-12.1-20 | Unexpected provider names persisted | CLOSED |
|
||||||
|
| T-12.1-SC | Supply-chain / committed-secret regression | CLOSED |
|
||||||
|
|
||||||
|
## Phase 12.1 Phase Close
|
||||||
|
|
||||||
|
All four plans of Phase 12.1 are complete:
|
||||||
|
|
||||||
|
| Plan | Description | Commit(s) |
|
||||||
|
|------|-------------|-----------|
|
||||||
|
| 12.1-01 | Restore shared adapter contract | Prior commits |
|
||||||
|
| 12.1-02 | Truthful freshness gate | Prior commits |
|
||||||
|
| 12.1-03 | Normalized cloud browser contract | 7bb046a, dc3e172 |
|
||||||
|
| 12.1-04 | Live smoke, exact acceptance, phase close | 779b050, 1ec5158, 6d294ea, 46b7ea6 |
|
||||||
|
|
||||||
|
Phase 12.1 objectives achieved:
|
||||||
|
- Nextcloud root listing visible through DocuVault
|
||||||
|
- Owner-confirmed exact manifest in tracked fixture
|
||||||
|
- All four providers pass one contract suite
|
||||||
|
- `complete=False` cannot produce `fresh` or advance `last_refreshed_at`
|
||||||
|
- Frontend normalized to `kind` and `provider_item_id`
|
||||||
|
- Credentials and provider data remain private
|
||||||
|
- Phase 13 mutations and Phase 14 byte caching are explicit exclusions
|
||||||
|
|
||||||
|
## Known Stubs
|
||||||
|
|
||||||
|
None — all live test fixtures use confirmed names. No placeholder text or empty data flows to UI rendering.
|
||||||
|
|
||||||
|
## Threat Flags
|
||||||
|
|
||||||
|
None — no new network endpoints, auth paths, or schema changes introduced in Plan 04.
|
||||||
|
|
||||||
|
## Self-Check: PASSED
|
||||||
|
|
||||||
|
Files created:
|
||||||
|
- [x] `backend/tests/fixtures/cloud/nextcloud_expected_root.json` — exists
|
||||||
|
- [x] `frontend/src/views/__tests__/CloudFolderRenderedFlow.test.js` — exists
|
||||||
|
|
||||||
|
Commits:
|
||||||
|
- [x] `1ec5158` — owner-confirmed expected root manifest
|
||||||
|
- [x] `6d294ea` — rendered-flow integration tests and security gate evidence
|
||||||
|
- [x] `46b7ea6` — verify live cloud browse integration (docs/version/push)
|
||||||
|
- [x] `779b050` — prior session Task 1 live smoke scaffold
|
||||||
Reference in New Issue
Block a user