curo/kite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
748 Commits 1 Branch 1 Tag
86a4fe084719370277a07de69adf179e12ce072d
Commit Graph
296 Commits
Author SHA1 Message Date
curo1305andClaude Sonnet 4.6 2fd7591eac docs(09): fix plan checker warnings — ORDER BY desc, closed tag, resolved marker 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 15:40:31 +02:00
curo1305andClaude Sonnet 4.6 ba30ada87a docs(09): create phase 9 plan — Admin Panel Rearchitecture 
5 plans across 4 waves covering ADMIN-08..12, CODE-06, CODE-09:

- 09-01 (W1): backend GET /api/admin/overview + 8 ADMIN-11 tests
- 09-02 (W1): AdminLayout + AdminSidebar + AdminOverviewView + getAdminOverview API
- 09-03 (W2): extract 4 admin tab components to standalone views
- 09-04 (W3): nested /admin route + to.matched.some guard + D-08/D-09/D-10 redirects + Tailwind safelist (sky+amber) + login redirect + delete AdminView/tabs
- 09-05 (W4): CODE-09 comment purge for Phase 9 + retroactive Phase 8 backend sub-packages + human UAT checkpoint

All locked decisions D-01..D-16 mapped to tasks; safelist corrected to include sky (OneDrive) and amber (audit badges) per RESEARCH.md Pattern 7.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 15:34:31 +02:00
curo1305andClaude Sonnet 4.6 373e009ed8 docs(09): research phase — admin panel rearchitecture 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 13:35:34 +02:00
curo1305 6721e60166 docs(09): capture phase context 2026-06-12 13:23:25 +02:00
curo1305andClaude Sonnet 4.6 a42f0ed623 test(08): UAT complete — 7/7 passed, phase 8 marked complete 
All 7 UAT tests passed (cold start, auth, documents, admin, cloud storage,
session revocation, Vite 6 build). Security gate: 0 threats open. Phase 8
transition complete — ROADMAP.md updated, PROJECT.md evolved with Phase 8
decisions, stale handoff deleted. Next: Phase 9 (Admin Panel Rearchitecture).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 11:28:56 +02:00
curo1305andClaude Sonnet 4.6 ee3d2d2d3d docs(phase-08): mark VALIDATION.md complete — Nyquist-compliant 9/9 
Audit confirmed all phase-8 requirements are COVERED:
- CR-01/02/03: session revocation tests promoted from stubs → 3 passing
- CODE-01/02/03: route regression — 58 passed, 4 xfailed
- CODE-04: frontend smoke — 136/136 passed
- CODE-08: single CloudConnectionOut definition confirmed
- PERF-01: npm packages verified

Full suite: 405 passed, 6 skipped, 7 xfailed (1 pre-existing env gap: no local python-docx)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 11:24:49 +02:00
curo1305andClaude Sonnet 4.6 cd4f372e46 docs(phase-08): add security threat verification — all 45 threats closed 
Register sourced from 8 PLAN.md threat_model blocks (register_authored_at_plan_time: true).
36 mitigate threats verified CLOSED by gsd-security-auditor. 9 accepted risks documented.
threats_open: 0 — phase advancement unblocked.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 11:18:16 +02:00
curo1305andClaude Sonnet 4.6 ace8899211 test(08): complete UAT — 7/7 passed, all regression verified 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 11:07:24 +02:00
curo1305andClaude Sonnet 4.6 6bda133c81 chore(08-08): PERF-01 packages + Vite 6 upgrade + pin requirements.txt 
- Upgraded vite 5.4.21 → 6.4.3 (fixes CVE-2026-39363, CVE-2026-39364)
- Upgraded @vitejs/plugin-vue 5.2.4 → 6.0.7 (Vite 6 peer dep)
- Installed @vueuse/core@14.3.0, @vueuse/integrations@14.3.0,
  sortablejs@1.15.7, @tailwindcss/forms@0.5.11,
  rollup-plugin-visualizer@7.0.1, @types/sortablejs@1.15.9
- Wired @tailwindcss/forms plugin in tailwind.config.js (VISUAL-02 ready)
- Pinned backend/requirements.txt to exact == versions per D-17 (32 packages)
- Frontend: 136/136 tests pass on Vite 6; 0 npm audit vulnerabilities
- Backend: 408 passed, 4 skipped, 7 xfailed (baseline 405+1)
- Phase 8 complete (8/8 plans)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 10:54:34 +02:00
curo1305andClaude Sonnet 4.6 8828871ecd wip: phase-08 paused at plan 08/08 — wave 2 complete, 08-08 pending npm verification 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 10:34:41 +02:00
curo1305andClaude Sonnet 4.6 9a3ce6ef39 docs(08-04/05/06): add plan summaries — wave 2 backend decomposition complete 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 10:29:40 +02:00
curo1305 7e99b6ecc1 docs(08-07): add plan summary — CODE-04 CODE-08 frontend api decomposition complete 2026-06-10 18:45:56 +02:00
curo1305 aa1c5ee75e docs(08-03): complete plan 03 — useToastStore stub, CR wire-up, xfail promotion 
- SUMMARY.md created with test output, forward reference to Phase 10, and self-check
 2026-06-08 16:36:41 +02:00
curo1305 98dcf809b2 chore: merge executor worktree (worktree-agent-ad0b098c151ab9e3f) 2026-06-08 16:24:51 +02:00
curo1305andClaude Sonnet 4.6 c636ac956f docs(08-01): complete Wave 0 xfail stubs plan — 3 xpassed, CR-01/02/03 contracts locked 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-08 16:23:13 +02:00
curo1305 26c11aff4c docs(08-02): complete shared-schemas plan — schemas.py + cloud.py import switch 
- backend/api/schemas.py created with CloudConnectionOut (SEC-08 compliant)
- backend/api/cloud.py import switched from api.admin to api.schemas
- 51 cloud + admin tests pass; no behavior change
- Original admin.py definition preserved for plan 08-04 deletion
 2026-06-08 16:13:31 +02:00
curo1305andClaude Sonnet 4.6 25e568973f docs(08): create phase 8 plan — 8 plans, 3 waves (stack upgrade + backend decomposition) 
Wave 0: CR-01/02/03 test stubs + api/schemas.py (CloudConnectionOut migration)
Wave 1: useToastStore stub + Phase 7.1 frontend completion
Wave 2 (parallel): api/admin/, api/documents/, api/auth/ package splits + client.js decomposition + PERF-01 deps

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-08 14:59:27 +02:00
curo1305 c20a5d8913 docs(08): research phase — decomposition boundaries, CR status, Vite 6 migration 2026-06-07 11:01:54 +02:00
curo1305andClaude Sonnet 4.6 118f4ee850 docs(08): UI design contract — toast API contract + sessions-revoked interaction spec 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-07 10:50:39 +02:00
curo1305andClaude Sonnet 4.6 845b681b36 docs(08): UI design contract — useToastStore API and sessions-revoked spec 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-07 10:49:01 +02:00
curo1305 28e1e4aaf4 docs(08): capture phase context 2026-06-07 10:39:32 +02:00
curo1305andClaude Sonnet 4.6 fd05563ec6 test(07.4): complete UAT — 4 passed, 1 fixed (fgp concatenation collision) 
UAT found and resolved a concatenation collision in _compute_fgp (no separator
between user_agent and accept_lang). Fix committed in c77b97b. All 5 FGP tests
pass. Full suite: 401 passed, 6 skipped, 7 xfailed, 1 pre-existing failure
(test_extract_docx — missing docx module, unrelated to this phase).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 23:04:17 +02:00
curo1305andClaude Sonnet 4.6 de622e8004 docs(phase-07.4): mark VALIDATION.md complete — 7/7 tasks green, nyquist_compliant: true 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 22:48:59 +02:00
curo1305andClaude Sonnet 4.6 52c56b5416 docs(phase-07.4): add security threat verification — 5/5 threats closed 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 22:30:57 +02:00
curo1305 3414571091 docs(07.4): add verification report — 8/8 must-haves confirmed 2026-06-06 22:27:55 +02:00
curo1305 ab4b6052a7 docs(07.4): add code review report — 3 critical, 3 warning, 2 info 2026-06-06 22:23:41 +02:00
curo1305 5d95fcd686 docs(07.4-02): complete token fingerprinting plan — _compute_fgp + fgp validation + 4 FGP tests passing 2026-06-06 22:15:14 +02:00
curo1305 bbd7a11935 docs(07.4-01): complete Wave 0 xfail stub plan — 4 FGP stubs, SUMMARY.md 
- SUMMARY.md: plan metadata, task commit hash, self-check passed
- backend/tests/test_auth_fgp.py committed in 7833edb
 2026-06-06 21:50:27 +02:00
curo1305andClaude Sonnet 4.6 22fcb53d9d docs(07.4): create phase plan — token fingerprinting / token binding 
2 plans (2 waves): Wave 0 xfail stubs for test_auth_fgp.py (4 FGP tests),
Wave 1 production implementation (_compute_fgp helper, create_access_token
fgp claim, get_current_user fgp validation, login/refresh call-site updates,
test promotion) + version bump to 0.1.3.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 21:44:21 +02:00
curo1305andClaude Sonnet 4.6 de0f3fb7c3 docs(07.4): create phase plan — 2 plans, Wave 0 xfail stubs + Wave 1 fgp implementation 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 20:22:29 +02:00
curo1305 78316b6ed7 docs(07.4): capture phase context 2026-06-06 19:42:08 +02:00
curo1305andClaude Sonnet 4.6 169c2e7e29 docs(phase-07.3): mark complete — 3/3 plans, 9/9 tests, remember_me shipped 
Plan 03 human checkpoint passed. 07.3-03-SUMMARY.md written.
ROADMAP: 07.3-03 checked, progress table updated to 3/3 Complete 2026-06-06.
STATE: current_phase → 07.4, completed_phases → 12, completed_plans → 63.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 19:19:17 +02:00
curo1305 e7e3f527a5 docs(07.3-02): complete plan 02 SUMMARY — ES256 core upgrade + startup rotation 
6 tests promoted from xfail to passing (ES256-01..05 + CFG-01); 3 remain xfail for Plan 03
 2026-06-06 17:05:31 +02:00
curo1305 b1e3d0bc73 docs(07.3-01): add plan execution SUMMARY.md 
- Documents 9 xfail stubs created + test_settings_has_jwt_config extension
- Records test counts: 372 passed / 1 failed / 9 xfailed
- Includes promotion plan mapping each stub to its Plan 02/03 task
- Confirms no production code was modified in this Wave 0 plan
 2026-06-06 16:51:40 +02:00
curo1305andClaude Sonnet 4.6 4d0ada6d06 docs(phase-07.2): mark VERIFICATION.md passed — CR-02 gap resolved 
Gap (password_reset_confirm missing user_nbf write) was fixed during UAT
phase: request: Request param added + Redis write at auth.py:744-750.
VALIDATION.md: 84/84 tests, nyquist_compliant=true. VERIFICATION.md
updated from gaps_found → passed (9/9). STATE.md advanced to phase 07.3.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 12:37:59 +02:00
curo1305andClaude Sonnet 4.6 2265aaaba4 docs(phase-07.2): mark VALIDATION.md complete — nyquist_compliant: true 
Audited post-execution state: all 11 tasks (9 original + CR-02 gap fix +
activate anti-pattern guard) have green automated tests. 84/84 passing.
Zero xfail stubs remaining. Sign-off approved.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 11:54:57 +02:00
curo1305andClaude Sonnet 4.6 b8e0e3adec test(07.2): complete automated UAT — 7/7 pass 
All Phase 7.2 behaviors verified end-to-end against the running app:
- JTI UUID claim present in every issued access token
- Token rejected (Session invalidated) after password change
- Refresh cookie survives password change (skip_token_hash)
- Token rejected after enable-TOTP and disable-TOTP
- Token rejected after admin deactivation
- Reactivation does NOT write user_nbf (no spurious revocation)

Findings recorded in UAT.md:
- Workers must be restarted after Phase 7.2 deploy (--workers 2 does not hot-reload)
- D-02 same-second edge case confirmed benign in real usage
- Deactivation fires is_active check before user_nbf in same-second scenarios (belt-and-suspenders)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 11:47:59 +02:00
curo1305 8e4e199062 docs(07.2): add phase verification report 2026-06-06 00:11:44 +02:00
curo1305 7e23a3ed0e docs(07.2): add code review report 2026-06-06 00:07:51 +02:00
curo1305 d3588ba055 docs(07.2-03): complete Wave 2 plan — user_nbf write sites in all 4 security-event handlers SUMMARY 2026-06-06 00:04:45 +02:00
curo1305 61199752b5 docs(07.2-02): complete Wave 1 plan — jti claim + user_nbf NBF check SUMMARY 
- jti UUID claim in create_access_token (D-01)
- user_nbf Redis NBF check in get_current_user with fail-open + re-raise guard (D-02, D-03, D-04, T-7.2-02)
- 4 Wave 0 xfail stubs promoted to PASS; 29 tests passing in target suites
 2026-06-05 19:20:42 +02:00
curo1305 8d44018f40 chore: merge executor worktree (worktree-agent-a2f182fa26b9780c8) — Wave 0 plan 07.2-01 2026-06-05 19:11:20 +02:00
curo1305 f0ba9e6d8e docs(07.2-01): complete Wave 0 test scaffolding plan — SUMMARY 
- FakeRedis mounted on test_auth_deps and admin_client fixtures
- 9 xfail(strict=False) stubs covering all Phase 7.2 behaviors
- 73 baseline tests pass, zero regressions
 2026-06-05 19:10:03 +02:00
curo1305andClaude Sonnet 4.6 b7994efd06 docs(07.3): create phase plan — ES256 algorithm upgrade 
3 plans (3 waves): Wave 0 xfail stubs, Wave 1 ES256 core + startup
rotation, Wave 2 remember-me TTL split + LoginView checkbox.
Verification passed (0 blockers, 1 minor doc warning fixed).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 19:07:25 +02:00
curo1305andClaude Sonnet 4.6 7ee87c001b docs(07.2): create phase plan — JTI claim + Redis NBF access-token revocation 
3 plans (Wave 0 test scaffolding, Wave 1 jti+NBF check, Wave 2 user_nbf
writes), VALIDATION.md, RESEARCH.md with resolved open questions.
Checker: 0 blockers, 1 warning resolved (RESEARCH.md open questions marked).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 18:56:49 +02:00
curo1305andClaude Sonnet 4.6 e9b2d88ba0 docs(07.3): research phase — ES256 algorithm upgrade, startup rotation, remember-me TTL 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 15:00:08 +02:00
curo1305andClaude Sonnet 4.6 35ff0d52fa docs(07.2): research phase — JTI claim + Redis access-token revocation 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 14:57:11 +02:00
curo1305andClaude Sonnet 4.6 18de84d1a9 docs(phase-06): add pattern map and code review fix report 
06-PATTERNS.md: maps 12 new/modified files to closest codebase analogs
for Phase 6 (Performance & Production Hardening).
06-REVIEW-FIX.md: records all 16 review findings (7 critical + 9 warning)
fixed in iteration 1 on 2026-06-04.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 14:44:38 +02:00
curo1305 77135df803 docs(07.3): capture phase context 2026-06-05 14:42:05 +02:00
curo1305 8c29af7f90 docs(07.2): capture phase context 2026-06-05 14:37:50 +02:00