curo/kite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
743 Commits 1 Branch 1 Tag
88a62da4c41d7ec8b72abc89bfdb22e37f8ec253
Commit Graph
294 Commits
Author SHA1 Message Date
curo1305andClaude Sonnet 4.6 c38c6b1c01 feat(07.1): session revocation on privilege change — CR-01/CR-02/CR-03 
- revoke_all_refresh_tokens: add skip_token_hash optional param (exclude
  current session while revoking others)
- change_password, enable_totp, disable_totp: call revoke with skip hash
  derived from refresh cookie; return sessions_revoked in response and
  write to audit log metadata_
- 3 new tests: test_{change_password,enable_totp,disable_totp}_revokes_other_sessions
  — all PASSED; 373 total passing, 0 regressions
- Frontend toasts: SettingsAccountTab + TotpEnrollment show
  "Other sessions have been terminated." when sessions_revoked > 0
- Companion fixes: rate_limiting get_client_ip refactor, deps/auth.py
  request.state.current_user, locustfile refresh-token task removal
- Version bump: 0.1.0 → 0.1.1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 12:47:16 +02:00
curo1305andClaude Sonnet 4.6 a3a97430a2 docs(07.1): create phase plan — 2 waves, CR-01..03 session revocation 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 12:27:24 +02:00
curo1305 a7ee4fbd23 docs(07.1): capture phase context 2026-06-05 11:23:07 +02:00
curo1305andClaude Sonnet 4.6 d86664d3f7 docs(phase-6): mark validation nyquist_compliant — 13/13 tests green 
Audited Phase 6 VALIDATION.md: confirmed all 10 automated tasks were already
implemented and passing. Updated statuses from pending→green, wave_0_complete
and nyquist_compliant set to true. 4 manual items (Docker/Locust/Scout) remain
pending as expected.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 11:10:15 +02:00
curo1305andClaude Sonnet 4.6 8629bc0854 docs(phase-7): add security threat verification — 12/12 CLOSED 
Formal Phase 7 SECURITY.md:
- T-07-01: api_key_enc excluded from GET /api/admin/ai-config (whitelist)
- T-07-02: HKDF domain separation confirmed (ai-provider-settings vs cloud-credentials)
- T-07-03: is_active atomic UPDATE, no read-then-write
- T-07-04: empty api_key normalised to "not-needed" before AsyncOpenAI
- T-07-05/07/09/11: accepted risks documented
- T-07-06/08/10/12: mitigations verified in implementation + tests
bandit: zero HIGH; npm audit: zero high/critical; threats_open: 0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 10:50:44 +02:00
curo1305andClaude Sonnet 4.6 e58cb1eb01 docs(07-uat): mark all 11 UAT tests pass — phase 07 complete 
Tests 8-11 verified:
- 8: classification_failed badge (status field fix + regression test)
- 9: Re-analyze button flow (code + Celery dispatch verified)
- 10: Celery retry exhaustion (max_retries=3, 30/90/270s backoff, _mark_classification_failed)
- 11: Non-admin 403 on PUT /api/admin/ai-config (get_current_admin dep)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 09:30:41 +02:00
curo1305 1f0808c303 docs(07-05): add plan summary — Tasks 1-3 complete, Task 4 human checkpoint pending 
- Backend GET/PUT /api/admin/ai-config + test-connection + load_provider_config_by_id
- Frontend getAiConfig/saveAiConfig/testAiConnection helpers + AdminAiConfigTab system section
- DocumentCard classification_failed badge + Re-analyze button
- 131 frontend tests pass, 369 backend tests pass
 2026-06-04 23:24:09 +02:00
curo1305 beb438f113 chore: merge executor worktree (worktree-agent-a707cbd4c3780710b) 2026-06-04 23:12:48 +02:00
curo1305andClaude Sonnet 4.6 0c1ae5284f docs(07-04): add plan summary — Celery retry harness + POST /classify re-queue complete 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 23:12:11 +02:00
curo1305andClaude Sonnet 4.6 888856aa8b docs(06): add code review report — 7 critical, 9 warning, 4 info findings 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 23:01:53 +02:00
curo1305 e0cd183a63 chore: merge executor worktree (wave3-recovery/07-03) 2026-06-04 19:17:50 +02:00
curo1305 5f72814f07 docs(07-03): complete plan summary — AnthropicProvider output_config + classifier ProviderConfig refactor 2026-06-04 19:16:43 +02:00
curo1305andClaude Sonnet 4.6 54521e2b99 docs(06-06): create plan SUMMARY — RUNBOOK.md + D-10 CVE gate passed 
Task 1: RUNBOOK.md (580 lines, 8 D-14 sections). Task 2: trivy scan exits 0
after patching OpenSSL CVE-2026-31789; Mesa/perl unfixable CVEs documented in
.trivyignore. Phase 6 plan 06-06 complete.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 19:13:45 +02:00
curo1305 60b621f424 chore: merge executor worktree (worktree-agent-afe278fe2f809d30b) 2026-06-04 19:04:52 +02:00
curo1305 00c154d61b docs(07-02): complete provider config + GenericOpenAIProvider + registry plan 
- ProviderConfig + PROVIDER_DEFAULTS + SUPPORTS_JSON_MODE in provider_config.py
- GenericOpenAIProvider with JSON-mode conditional + D-02 fallback
- OpenAIProvider singleton _client + smart truncation (D-07/D-13)
- Registry-based get_provider(config: ProviderConfig) — no if/elif chain
- MAX_AI_CHARS removed from openai_provider.py + classifier.py
- anthropic floor bumped to >=0.95.0 for Plan 03 output_config
- 6 Wave-2 xfail tests promoted; suite: 363 passed, 15 xfailed, 1 pre-existing failure
 2026-06-04 19:04:18 +02:00
curo1305andClaude Sonnet 4.6 582136c120 test(06): complete UAT - 8 passed, 0 issues 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 19:00:19 +02:00
curo1305 7986661333 docs(07-01): complete plan summary — system_settings DB + HKDF + Wave 0 stubs 
Tasks: 3/3 complete. Commits: 4febe2f, 4eb3177, 0fd6930.
Created system_settings table (Alembic 0005), SystemSettings ORM, HKDF AI key
encryption (info=b"ai-provider-settings"), load_provider_config(), seed startup
hook, and 13 Wave 0 xfail stubs across 4 new test files.
 2026-06-04 18:51:12 +02:00
curo1305andClaude Sonnet 4.6 f9dfa3dd9b docs(06-04): add partial plan summary — Tasks 1 & 2 complete, Task 3 human checkpoint pending 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 18:32:10 +02:00
curo1305andClaude Sonnet 4.6 f98cab30e9 chore: merge executor worktree (06-05) — trusted-proxy rate limiting + per-account limiter 
Resolved merge conflicts:
- backend/main.py: keep both setup_logging (06-02) and account_limiter (06-05) imports
- backend/tests/test_rate_limiting.py: take 06-05 version (all 8 xfails promoted)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 18:31:46 +02:00
curo1305andClaude Sonnet 4.6 5c82a9840a docs(06-05): add plan summary — D-11/D-12 trusted-proxy IP + per-account limiter 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 18:28:30 +02:00
curo1305 339cb9b991 chore: merge executor worktree (06-02) — structured logging + Loki stack 2026-06-03 18:52:13 +02:00
curo1305 7c624b0b6b docs(06-02): complete structured logging + Loki stack plan summary 
- 3 tasks complete: structlog dependency, CorrelationIDMiddleware, Loki stack
- D-01: JSON logging with correlation IDs; X-Correlation-ID header on responses
- D-02: Loki+Promtail+Grafana in docker-compose; backend+celery-worker labelled
- D-03: no OpenTelemetry added
- 5 xfail stubs from 06-01 promoted to real assertions in test_logging.py
 2026-06-03 18:51:29 +02:00
curo1305 e498d884bb docs(06-03): complete load test plan summary — strategy A, direct upload, SLA listener 2026-06-03 18:49:09 +02:00
curo1305 3e3f980466 docs(06-01): complete Wave 0 Nyquist scaffold plan summary 
- 13 xfail stubs: 5 for D-01/D-02 (logging), 8 for D-11/D-12+A1 (rate limiting)
- load_tests package skeleton (D-04/D-05/D-06) excluded from pytest
- Package legitimacy decisions recorded (structlog + locust both approved)
- Full suite: 344 passed, 20 xfailed, 1 pre-existing failure, 0 regressions
 2026-06-03 18:39:21 +02:00
curo1305andClaude Sonnet 4.6 bdd784341f wip: phase 7 planning paused — ready to execute 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 18:34:49 +02:00
curo1305andClaude Sonnet 4.6 3df62506c9 docs(07): create phase plan — 5 plans, verification passed 
5 waves: system_settings DB + HKDF encryption (01), ProviderConfig +
GenericOpenAIProvider + singleton client fix (02), Anthropic output_config +
classifier wiring (03), Celery retry 30/90/270s + re-queue endpoint (04),
admin AI panel + DocumentCard badge + human checkpoint (05).

All 18 decisions D-01..D-18 covered. Plan checker passed after 1 revision
round (4 blockers fixed: D-02/D-14 coverage, D-11 Vitest tests, Plan 05
files_modified).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 18:25:00 +02:00
curo1305andClaude Sonnet 4.6 6c8e0d8bde docs(07): research phase — Anthropic output_config, client singleton pattern, Celery retry, system_settings design 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-02 20:41:03 +02:00
curo1305andClaude Sonnet 4.6 70c09f6cd4 docs(06): create phase 6 plan — performance & production hardening 
6 plans across 4 waves covering structlog/Loki observability, Locust
load testing, multi-stage Dockerfile hardening, trusted-proxy rate
limiting, and RUNBOOK.md. Verification passed (0 blockers).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-02 20:35:03 +02:00
curo1305 b8d128ee5e docs(07): capture phase context 2026-06-02 20:24:08 +02:00
curo1305 ad237dbaf1 docs(06): research phase — structlog, Locust, container hardening, per-account rate limiting 2026-06-02 16:34:02 +02:00
curo1305andClaude Sonnet 4.6 eaa3399ec0 docs: add shared module map to CLAUDE.md, SECURITY.md, planning artifacts 
- CLAUDE.md: add Code Standards section with backend and frontend shared
  module maps, component architecture rules, duplication checklist, and
  no-dead-code enforcement rule
- SECURITY.md: Phase 02 + 03 security audit results (all threats CLOSED)
- .planning: update milestone audit, config, and add plan/UAT files for
  phases 01, 02-06, and 06.2-05

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-02 16:10:59 +02:00
curo1305andClaude Sonnet 4.6 bd17b4b22f docs(06.2): mark phase 6.2 complete — all gates passed 
UAT complete (7/7 re-tests passed or skipped with reason), security gate
passed (threats_open: 0), 344 backend tests passing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-01 21:09:04 +02:00
curo1305andClaude Sonnet 4.6 52e54b859a docs(phase-04): update validation strategy — 1 gap resolved, suite green 
Audit 2026-06-01: test_daily_export_download was returning 404 because
the mock_backend failed the isinstance(backend, MinIOBackend) check.
Fixed. 87 passed, 4 xfailed, 0 failed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-01 18:14:59 +02:00
curo1305 bfcc09958c docs(phase-04): add security threat verification — 41/41 threats closed 2026-06-01 18:05:49 +02:00
curo1305andClaude Sonnet 4.6 a3f9e701d8 docs(phase-03): update validation strategy — 4 gaps resolved, STORE-06 promoted from manual-only 
Validation audit 2026-06-01: fix UUID format mismatch resolved 3 PARTIAL tests
(test_confirm_endpoint, test_quota_increment_atomic, test_quota_exceeded_response)
and promoted test_delete_decrements_quota (STORE-06) from manual-only to green.
Suite now 53 passed, 0 failed. Phase 3 fully Nyquist-compliant.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-01 15:43:07 +02:00
curo1305 908bd9d4e3 docs(phase-03): add security threat verification — 27/27 threats closed 2026-06-01 15:30:52 +02:00
curo1305andClaude Sonnet 4.6 a89ed65be9 docs(phase-02): update validation strategy with plan 06 coverage 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-01 15:17:29 +02:00
curo1305andClaude Sonnet 4.6 da526cb727 docs(02): add security threat verification — 43/43 threats closed 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-01 14:55:15 +02:00
curo1305 cd3d1d528c docs(06.2): add code review fix report 2026-06-01 14:38:59 +02:00
curo1305 8601a02189 docs(02): update verification report after plan 06 gap closure — 2 security blockers flagged 2026-06-01 14:37:23 +02:00
curo1305 a6c227cc7e merge(06.2): integrate code review fixes from gsd-reviewfix/06.2-2490 2026-06-01 14:37:21 +02:00
curo1305 1433273328 docs(06.2): update review status after fixes — all 15 CR/WR findings resolved 2026-06-01 14:33:41 +02:00
curo1305 fdb18300d9 docs(02): add code review report for plan 06 gap closure 2026-06-01 14:31:21 +02:00
curo1305 7e549b6312 docs(02-06): complete UAT gap closure plan summary 
- SUMMARY.md for plan 02-06 (5 UAT gaps closed)
- Backend fix verified; frontend auth layout, admin guard, Account tab, QR code implemented
 2026-05-31 20:41:36 +02:00
curo1305 97314ce486 docs(06.2): add code review report 2026-05-31 20:38:59 +02:00
curo1305 579c8366e9 docs(06.2): update phase verification report after plan-05 gap closure 2026-05-31 20:30:43 +02:00
curo1305 b2488c91c8 docs(02): add root causes from diagnosis 2026-05-31 20:28:57 +02:00
curo1305 52d6efb8a2 docs(06.2): add code review report 2026-05-31 20:23:32 +02:00
curo1305andClaude Sonnet 4.6 33697f2713 test(02): complete UAT — 10 passed, 6 issues, 2 blocked 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-31 20:21:16 +02:00
curo1305 8cc46a8d8d docs(phase-06.2): resolve UAT gaps after 06.2-05 gap closure 2026-05-31 20:16:43 +02:00