curo/kite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
744 Commits 1 Branch 1 Tag
6784d3bdb7597191914ae7e27e68ae641a2a52b3
Commit Graph
100 Commits
Author SHA1 Message Date
curo1305 f2411de85e docs(13-02): complete red frontend test plan for cloud queue, health, and preview 2026-06-22 18:16:47 +02:00
curo1305 451d30208c docs(13-01): complete red contract suite plan 2026-06-22 18:03:09 +02:00
curo1305 f01bb181c1 docs(state): record phase 13 context session 2026-06-22 15:46:17 +02:00
curo1305 aa1d626187 docs(12.1-04): complete plan 04 summary and state updates 2026-06-22 09:48:33 +02:00
curo1305 9ef7f81b3f docs(12.1-03): complete plan 03 summary and state updates 2026-06-22 08:55:02 +02:00
curo1305 792a25fad7 docs(12.1-02): complete plan 02 summary and state updates 2026-06-22 08:38:18 +02:00
curo1305 a6e8a597e7 docs(12.1-01): complete Plan 01 summary and state updates 2026-06-22 08:20:06 +02:00
curo1305 8e5d7a1900 docs(phase-12): complete phase execution 2026-06-19 06:05:03 +02:00
curo1305 71ba0293a5 docs(phase-12): update tracking after wave 1 2026-06-18 22:39:35 +02:00
curo1305 11b91775b6 docs(12): create phase plan 2026-06-18 22:30:07 +02:00
curo1305 a323276e37 docs: create milestone v0.3 roadmap (5 phases) 2026-06-17 23:27:21 +02:00
curo1305 0e56c85349 docs: start milestone v0.3 Reimagining Cloud Storage integration 2026-06-17 23:16:21 +02:00
curo1305andClaude Sonnet 4.6 475e519158 chore: archive v0.2 milestone files 
Archive v0.2 (UI Overhaul and Optimization) to milestones/:
- milestones/v0.2-ROADMAP.md — full phase archive (Phases 8–11, 33 plans)
- milestones/v0.2-REQUIREMENTS.md — all 40 requirements marked complete
- milestones/v0.2-MILESTONE-AUDIT.md — audit artifact (passed, 40/40)
- MILESTONES.md — new living milestone index
- RETROSPECTIVE.md — new living retrospective with v0.2 section
- PROJECT.md — full evolution review: v0.2 requirements moved to Validated, 5 new Key Decisions added
- STATE.md — updated to milestone-complete status
- ROADMAP.md — v0.2 phases collapsed into <details> with progress table updated

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-17 14:26:19 +02:00
curo1305 7547e8ae97 docs(phase-11): update tracking after wave 0 2026-06-16 21:07:57 +02:00
curo1305 41d136fa1f docs(state): record phase 11 context session 2026-06-16 20:50:43 +02:00
curo1305andClaude Sonnet 4.6 ac95c1243f docs(phase-10): complete gap closure verification — 219 tests, all 6 UAT gaps closed 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-16 20:11:51 +02:00
curo1305andClaude Sonnet 4.6 4f6ee06f51 docs(10): mark Phase 10 complete — 15/15 truths verified, 211 tests pass 
All 12 plans executed. Gap-closure committed in 6b56763 (Escape modal close,
revoke/rename toasts, StorageBrowser picker tests). Code review critical findings
resolved (CR-01 prop mutation, CR-02 double-shortcut on modal). VERIFICATION.md
shows 15/15 verified. Known pre-existing: esbuild CVE-GHSA-gv7w requires Vite 8
upgrade (breaking) — filed for Phase 11 chore.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-16 10:19:59 +02:00
curo1305 01a0605831 docs(phase-10): update tracking after wave 4 complete (11/12 plans) 2026-06-16 08:29:09 +02:00
curo1305 a1885122a1 docs(phase-10): update tracking after wave 0 complete (5/12 plans) 2026-06-15 20:18:49 +02:00
curo1305 71118076a4 docs(state): record phase 10 context session 2026-06-14 21:53:38 +02:00
curo1305andClaude Sonnet 4.6 e6f5f2be3b test(phase-09): complete UAT — 9/9 tests passed; mark phase complete 
All 9 UAT items verified via live API + source inspection:
- GET /api/admin/overview live data (78 users, 8MB storage, 10 audit rows)
- Auth guard: 401 unauthenticated, 403 non-admin on all protected endpoints
- Admin login redirect (D-08) confirmed in LoginView.vue line 212
- Sidebar: 5 nav links, indigo Admin badge, no back-to-app link
- 4-stat-card overview + When/Event/Actor/Target/IP audit table
- 5 standalone admin views (Users, Quotas, AI, Audit) with no Pinia stores
- API key write-only invariant confirmed in AdminAiView.vue
- Color-coded audit badges (auth=blue, admin=amber, folder/share=purple)
- to.matched.some() guard covers all /admin/* child routes
- No sensitive fields (password_hash, credentials_enc) in any response

Phase 9 marked complete. STATE.md and PROJECT.md updated for Phase 10.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-13 11:32:19 +02:00
curo1305andClaude Sonnet 4.6 1b1cc5d566 docs(phase-09): update tracking after wave 1 — plans 09-01 + 09-02 complete 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 15:54:05 +02:00
curo1305 e5bed6e219 docs(state): record phase 9 context session 2026-06-12 13:23:29 +02:00
curo1305andClaude Sonnet 4.6 a42f0ed623 test(08): UAT complete — 7/7 passed, phase 8 marked complete 
All 7 UAT tests passed (cold start, auth, documents, admin, cloud storage,
session revocation, Vite 6 build). Security gate: 0 threats open. Phase 8
transition complete — ROADMAP.md updated, PROJECT.md evolved with Phase 8
decisions, stale handoff deleted. Next: Phase 9 (Admin Panel Rearchitecture).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 11:28:56 +02:00
curo1305andClaude Sonnet 4.6 6bda133c81 chore(08-08): PERF-01 packages + Vite 6 upgrade + pin requirements.txt 
- Upgraded vite 5.4.21 → 6.4.3 (fixes CVE-2026-39363, CVE-2026-39364)
- Upgraded @vitejs/plugin-vue 5.2.4 → 6.0.7 (Vite 6 peer dep)
- Installed @vueuse/core@14.3.0, @vueuse/integrations@14.3.0,
  sortablejs@1.15.7, @tailwindcss/forms@0.5.11,
  rollup-plugin-visualizer@7.0.1, @types/sortablejs@1.15.9
- Wired @tailwindcss/forms plugin in tailwind.config.js (VISUAL-02 ready)
- Pinned backend/requirements.txt to exact == versions per D-17 (32 packages)
- Frontend: 136/136 tests pass on Vite 6; 0 npm audit vulnerabilities
- Backend: 408 passed, 4 skipped, 7 xfailed (baseline 405+1)
- Phase 8 complete (8/8 plans)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 10:54:34 +02:00
curo1305 7e99b6ecc1 docs(08-07): add plan summary — CODE-04 CODE-08 frontend api decomposition complete 2026-06-10 18:45:56 +02:00
curo1305andClaude Sonnet 4.6 ccb8a0bb77 docs(phase-8): update tracking after wave 0 — plans 08-01 and 08-02 complete 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-08 16:28:35 +02:00
curo1305andClaude Sonnet 4.6 25e568973f docs(08): create phase 8 plan — 8 plans, 3 waves (stack upgrade + backend decomposition) 
Wave 0: CR-01/02/03 test stubs + api/schemas.py (CloudConnectionOut migration)
Wave 1: useToastStore stub + Phase 7.1 frontend completion
Wave 2 (parallel): api/admin/, api/documents/, api/auth/ package splits + client.js decomposition + PERF-01 deps

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-08 14:59:27 +02:00
curo1305 6f2dba8478 docs(state): record phase 8 context session 2026-06-07 10:39:50 +02:00
curo1305andClaude Sonnet 4.6 258b0006d6 docs: create milestone v0.2 roadmap (4 phases, 40 requirements) 
Phases 8–11: stack upgrade + backend decomposition, admin panel
rearchitecture, UX & interaction, visual design + responsive layout.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-07 09:50:52 +02:00
curo1305andClaude Sonnet 4.6 f7758776ec docs: define milestone v0.2 requirements (36 reqs, 6 categories) 
UI overhaul, codebase quality, admin panel rearchitecture, UX
improvements, responsive layout, and performance/stack updates.
Research: STACK.md, FEATURES.md, ARCHITECTURE.md, PITFALLS.md.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-07 09:22:40 +02:00
curo1305 537bbd83e6 docs(phase-07.4): mark phase complete — 2/2 plans, 4 FGP tests passing, v0.1.3 2026-06-06 22:17:42 +02:00
curo1305 8c817705b7 docs(phase-07.4): update tracking after wave 0 — plan 07.4-01 complete 2026-06-06 21:52:35 +02:00
curo1305andClaude Sonnet 4.6 22fcb53d9d docs(07.4): create phase plan — token fingerprinting / token binding 
2 plans (2 waves): Wave 0 xfail stubs for test_auth_fgp.py (4 FGP tests),
Wave 1 production implementation (_compute_fgp helper, create_access_token
fgp claim, get_current_user fgp validation, login/refresh call-site updates,
test promotion) + version bump to 0.1.3.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 21:44:21 +02:00
curo1305 50668cc916 docs(state): record phase 7.4 context session 2026-06-06 19:42:13 +02:00
curo1305andClaude Sonnet 4.6 169c2e7e29 docs(phase-07.3): mark complete — 3/3 plans, 9/9 tests, remember_me shipped 
Plan 03 human checkpoint passed. 07.3-03-SUMMARY.md written.
ROADMAP: 07.3-03 checked, progress table updated to 3/3 Complete 2026-06-06.
STATE: current_phase → 07.4, completed_phases → 12, completed_plans → 63.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 19:19:17 +02:00
curo1305andClaude Sonnet 4.6 1eb1d59c8d docs(phase-07.3): update tracking after wave 0 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 16:54:48 +02:00
curo1305andClaude Sonnet 4.6 4d0ada6d06 docs(phase-07.2): mark VERIFICATION.md passed — CR-02 gap resolved 
Gap (password_reset_confirm missing user_nbf write) was fixed during UAT
phase: request: Request param added + Redis write at auth.py:744-750.
VALIDATION.md: 84/84 tests, nyquist_compliant=true. VERIFICATION.md
updated from gaps_found → passed (9/9). STATE.md advanced to phase 07.3.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 12:37:59 +02:00
curo1305 646736d4d3 docs(phase-07.2): complete phase execution 2026-06-06 00:12:09 +02:00
curo1305andClaude Sonnet 4.6 b7994efd06 docs(07.3): create phase plan — ES256 algorithm upgrade 
3 plans (3 waves): Wave 0 xfail stubs, Wave 1 ES256 core + startup
rotation, Wave 2 remember-me TTL split + LoginView checkbox.
Verification passed (0 blockers, 1 minor doc warning fixed).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 19:07:25 +02:00
curo1305andClaude Sonnet 4.6 7ee87c001b docs(07.2): create phase plan — JTI claim + Redis NBF access-token revocation 
3 plans (Wave 0 test scaffolding, Wave 1 jti+NBF check, Wave 2 user_nbf
writes), VALIDATION.md, RESEARCH.md with resolved open questions.
Checker: 0 blockers, 1 warning resolved (RESEARCH.md open questions marked).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 18:56:49 +02:00
curo1305andClaude Sonnet 4.6 1fd7395893 docs(state): clean up HANDOFF.json and mark all v1.0 phases complete 
All 7 phases + sub-phases 6.1, 6.2, 7.1 complete as of 2026-06-05.
HANDOFF.json removed — no active handoff; STATE.md updated to reflect
v1.0 milestone done and next-action as "ready for next milestone."

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 14:44:31 +02:00
curo1305 50b9ffc1f1 docs(state): record phase 7.2 context session 2026-06-05 14:37:55 +02:00
curo1305andClaude Sonnet 4.6 c38c6b1c01 feat(07.1): session revocation on privilege change — CR-01/CR-02/CR-03 
- revoke_all_refresh_tokens: add skip_token_hash optional param (exclude
  current session while revoking others)
- change_password, enable_totp, disable_totp: call revoke with skip hash
  derived from refresh cookie; return sessions_revoked in response and
  write to audit log metadata_
- 3 new tests: test_{change_password,enable_totp,disable_totp}_revokes_other_sessions
  — all PASSED; 373 total passing, 0 regressions
- Frontend toasts: SettingsAccountTab + TotpEnrollment show
  "Other sessions have been terminated." when sessions_revoked > 0
- Companion fixes: rate_limiting get_client_ip refactor, deps/auth.py
  request.state.current_user, locustfile refresh-token task removal
- Version bump: 0.1.0 → 0.1.1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 12:47:16 +02:00
curo1305andClaude Sonnet 4.6 8d060a5da4 docs(state): mark Phase 7.1 planned — ready to execute 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 12:32:12 +02:00
curo1305 3f0e2ab44c docs(state): record phase 7.1 context session 2026-06-05 11:23:16 +02:00
curo1305andClaude Sonnet 4.6 1a625ec365 docs(state): mark Phase 7 complete — v1.0 milestone done 
All 7 phases complete. Phase 7 gates:
- pytest: 347 passed / 1 pre-existing failure (test_extract_docx)
- bandit: zero HIGH findings
- npm audit: 2 moderate dev-only (esbuild/vite) — zero high/critical
- UAT: 11/11 passed (07-UAT.md)

Stale HANDOFF.json removed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 10:44:24 +02:00
curo1305andClaude Sonnet 4.6 420fecdacd docs(phase-6): update tracking after wave 3 — plan 06-06 complete, Phase 6 done 
All 6 Phase 6 plans complete. Phase 6 status updated to Complete in STATE.md
and ROADMAP.md (plans 06-04, 06-05, 06-06 checked). UAT passed (06-UAT.md),
D-10 CVE gate passed (trivy exit 0), D-14 RUNBOOK.md in place.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 19:14:22 +02:00
curo1305andClaude Sonnet 4.6 651713fa7a docs(phase-7): update tracking after wave 1 — plan 07-01 complete 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 18:53:25 +02:00
curo1305andClaude Sonnet 4.6 3df62506c9 docs(07): create phase plan — 5 plans, verification passed 
5 waves: system_settings DB + HKDF encryption (01), ProviderConfig +
GenericOpenAIProvider + singleton client fix (02), Anthropic output_config +
classifier wiring (03), Celery retry 30/90/270s + re-queue endpoint (04),
admin AI panel + DocumentCard badge + human checkpoint (05).

All 18 decisions D-01..D-18 covered. Plan checker passed after 1 revision
round (4 blockers fixed: D-02/D-14 coverage, D-11 Vitest tests, Plan 05
files_modified).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 18:25:00 +02:00