 curo1305
|
3ca57dcd0c
|
fix(12-05): bump version to 0.2.1 and update docs for migration-gated startup
- backend/main.py, frontend/package.json: version 0.2.0 → 0.2.1
- CLAUDE.md, AGENTS.md: current state updated to reflect gap-closure
- README.md: startup instructions note migrate runs automatically; update migration commands
- RUNBOOK.md: startup diagram includes migrate service; migration gate explanation
- SECURITY.md: Phase 12 gap-closure threat register and security gate evidence
|
2026-06-20 10:49:21 +02:00 |
|
|
curo1305
|
fccb9c6394
|
security(12-04): add Phase 12 security gate evidence and cloud ops runbook
- SECURITY.md: Phase 12 threat register (T-12-01 through T-12-SC) with
evidence for all 8 threat IDs; bandit/npm audit gate results;
accepted risks for pip-audit tooling gap and DISABLED connection behavior
- RUNBOOK.md: Phase 12 cloud operations section covering connection
management, browse refresh lifecycle, item metadata queries,
stuck-refresh recovery, and security operation notes
|
2026-06-19 01:52:49 +02:00 |
|
|
curo1305andClaude Sonnet 4.6
|
cd4f372e46
|
docs(phase-08): add security threat verification — all 45 threats closed
Register sourced from 8 PLAN.md threat_model blocks (register_authored_at_plan_time: true).
36 mitigate threats verified CLOSED by gsd-security-auditor. 9 accepted risks documented.
threats_open: 0 — phase advancement unblocked.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-06-12 11:18:16 +02:00 |
|
|
curo1305andClaude Sonnet 4.6
|
95c6db5c42
|
security(07.2): add SECURITY.md audit — JTI claim + Redis NBF revocation
9/9 threats CLOSED; 11/11 Phase 7.2 tests PASSED; bandit 0 HIGH; full
391-test suite green. Documents gap closure for CR-02 (password_reset_confirm
user_nbf write). HS256→ES256 deferred to Phase 7.3.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-06-06 00:33:31 +02:00 |
|
|
curo1305andClaude Sonnet 4.6
|
8629bc0854
|
docs(phase-7): add security threat verification — 12/12 CLOSED
Formal Phase 7 SECURITY.md:
- T-07-01: api_key_enc excluded from GET /api/admin/ai-config (whitelist)
- T-07-02: HKDF domain separation confirmed (ai-provider-settings vs cloud-credentials)
- T-07-03: is_active atomic UPDATE, no read-then-write
- T-07-04: empty api_key normalised to "not-needed" before AsyncOpenAI
- T-07-05/07/09/11: accepted risks documented
- T-07-06/08/10/12: mitigations verified in implementation + tests
bandit: zero HIGH; npm audit: zero high/critical; threats_open: 0
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-06-05 10:50:44 +02:00 |
|
|
curo1305andClaude Sonnet 4.6
|
eaa3399ec0
|
docs: add shared module map to CLAUDE.md, SECURITY.md, planning artifacts
- CLAUDE.md: add Code Standards section with backend and frontend shared
module maps, component architecture rules, duplication checklist, and
no-dead-code enforcement rule
- SECURITY.md: Phase 02 + 03 security audit results (all threats CLOSED)
- .planning: update milestone audit, config, and add plan/UAT files for
phases 01, 02-06, and 06.2-05
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-06-02 16:10:59 +02:00 |
|