curo/kite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
623 Commits 1 Branch 1 Tag
e72506fc898825c743e3f41411ac91738ccbef66
Commit Graph
87 Commits
Author SHA1 Message Date
curo1305 7547e8ae97 docs(phase-11): update tracking after wave 0 2026-06-16 21:07:57 +02:00
curo1305 41d136fa1f docs(state): record phase 11 context session 2026-06-16 20:50:43 +02:00
curo1305andClaude Sonnet 4.6 ac95c1243f docs(phase-10): complete gap closure verification — 219 tests, all 6 UAT gaps closed 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-16 20:11:51 +02:00
curo1305andClaude Sonnet 4.6 4f6ee06f51 docs(10): mark Phase 10 complete — 15/15 truths verified, 211 tests pass 
All 12 plans executed. Gap-closure committed in 6b56763 (Escape modal close,
revoke/rename toasts, StorageBrowser picker tests). Code review critical findings
resolved (CR-01 prop mutation, CR-02 double-shortcut on modal). VERIFICATION.md
shows 15/15 verified. Known pre-existing: esbuild CVE-GHSA-gv7w requires Vite 8
upgrade (breaking) — filed for Phase 11 chore.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-16 10:19:59 +02:00
curo1305 01a0605831 docs(phase-10): update tracking after wave 4 complete (11/12 plans) 2026-06-16 08:29:09 +02:00
curo1305 a1885122a1 docs(phase-10): update tracking after wave 0 complete (5/12 plans) 2026-06-15 20:18:49 +02:00
curo1305 71118076a4 docs(state): record phase 10 context session 2026-06-14 21:53:38 +02:00
curo1305andClaude Sonnet 4.6 e6f5f2be3b test(phase-09): complete UAT — 9/9 tests passed; mark phase complete 
All 9 UAT items verified via live API + source inspection:
- GET /api/admin/overview live data (78 users, 8MB storage, 10 audit rows)
- Auth guard: 401 unauthenticated, 403 non-admin on all protected endpoints
- Admin login redirect (D-08) confirmed in LoginView.vue line 212
- Sidebar: 5 nav links, indigo Admin badge, no back-to-app link
- 4-stat-card overview + When/Event/Actor/Target/IP audit table
- 5 standalone admin views (Users, Quotas, AI, Audit) with no Pinia stores
- API key write-only invariant confirmed in AdminAiView.vue
- Color-coded audit badges (auth=blue, admin=amber, folder/share=purple)
- to.matched.some() guard covers all /admin/* child routes
- No sensitive fields (password_hash, credentials_enc) in any response

Phase 9 marked complete. STATE.md and PROJECT.md updated for Phase 10.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-13 11:32:19 +02:00
curo1305andClaude Sonnet 4.6 1b1cc5d566 docs(phase-09): update tracking after wave 1 — plans 09-01 + 09-02 complete 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 15:54:05 +02:00
curo1305 e5bed6e219 docs(state): record phase 9 context session 2026-06-12 13:23:29 +02:00
curo1305andClaude Sonnet 4.6 a42f0ed623 test(08): UAT complete — 7/7 passed, phase 8 marked complete 
All 7 UAT tests passed (cold start, auth, documents, admin, cloud storage,
session revocation, Vite 6 build). Security gate: 0 threats open. Phase 8
transition complete — ROADMAP.md updated, PROJECT.md evolved with Phase 8
decisions, stale handoff deleted. Next: Phase 9 (Admin Panel Rearchitecture).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 11:28:56 +02:00
curo1305andClaude Sonnet 4.6 6bda133c81 chore(08-08): PERF-01 packages + Vite 6 upgrade + pin requirements.txt 
- Upgraded vite 5.4.21 → 6.4.3 (fixes CVE-2026-39363, CVE-2026-39364)
- Upgraded @vitejs/plugin-vue 5.2.4 → 6.0.7 (Vite 6 peer dep)
- Installed @vueuse/core@14.3.0, @vueuse/integrations@14.3.0,
  sortablejs@1.15.7, @tailwindcss/forms@0.5.11,
  rollup-plugin-visualizer@7.0.1, @types/sortablejs@1.15.9
- Wired @tailwindcss/forms plugin in tailwind.config.js (VISUAL-02 ready)
- Pinned backend/requirements.txt to exact == versions per D-17 (32 packages)
- Frontend: 136/136 tests pass on Vite 6; 0 npm audit vulnerabilities
- Backend: 408 passed, 4 skipped, 7 xfailed (baseline 405+1)
- Phase 8 complete (8/8 plans)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-12 10:54:34 +02:00
curo1305 7e99b6ecc1 docs(08-07): add plan summary — CODE-04 CODE-08 frontend api decomposition complete 2026-06-10 18:45:56 +02:00
curo1305andClaude Sonnet 4.6 ccb8a0bb77 docs(phase-8): update tracking after wave 0 — plans 08-01 and 08-02 complete 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-08 16:28:35 +02:00
curo1305andClaude Sonnet 4.6 25e568973f docs(08): create phase 8 plan — 8 plans, 3 waves (stack upgrade + backend decomposition) 
Wave 0: CR-01/02/03 test stubs + api/schemas.py (CloudConnectionOut migration)
Wave 1: useToastStore stub + Phase 7.1 frontend completion
Wave 2 (parallel): api/admin/, api/documents/, api/auth/ package splits + client.js decomposition + PERF-01 deps

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-08 14:59:27 +02:00
curo1305 6f2dba8478 docs(state): record phase 8 context session 2026-06-07 10:39:50 +02:00
curo1305andClaude Sonnet 4.6 258b0006d6 docs: create milestone v0.2 roadmap (4 phases, 40 requirements) 
Phases 8–11: stack upgrade + backend decomposition, admin panel
rearchitecture, UX & interaction, visual design + responsive layout.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-07 09:50:52 +02:00
curo1305andClaude Sonnet 4.6 f7758776ec docs: define milestone v0.2 requirements (36 reqs, 6 categories) 
UI overhaul, codebase quality, admin panel rearchitecture, UX
improvements, responsive layout, and performance/stack updates.
Research: STACK.md, FEATURES.md, ARCHITECTURE.md, PITFALLS.md.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-07 09:22:40 +02:00
curo1305 537bbd83e6 docs(phase-07.4): mark phase complete — 2/2 plans, 4 FGP tests passing, v0.1.3 2026-06-06 22:17:42 +02:00
curo1305 8c817705b7 docs(phase-07.4): update tracking after wave 0 — plan 07.4-01 complete 2026-06-06 21:52:35 +02:00
curo1305andClaude Sonnet 4.6 22fcb53d9d docs(07.4): create phase plan — token fingerprinting / token binding 
2 plans (2 waves): Wave 0 xfail stubs for test_auth_fgp.py (4 FGP tests),
Wave 1 production implementation (_compute_fgp helper, create_access_token
fgp claim, get_current_user fgp validation, login/refresh call-site updates,
test promotion) + version bump to 0.1.3.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 21:44:21 +02:00
curo1305 50668cc916 docs(state): record phase 7.4 context session 2026-06-06 19:42:13 +02:00
curo1305andClaude Sonnet 4.6 169c2e7e29 docs(phase-07.3): mark complete — 3/3 plans, 9/9 tests, remember_me shipped 
Plan 03 human checkpoint passed. 07.3-03-SUMMARY.md written.
ROADMAP: 07.3-03 checked, progress table updated to 3/3 Complete 2026-06-06.
STATE: current_phase → 07.4, completed_phases → 12, completed_plans → 63.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 19:19:17 +02:00
curo1305andClaude Sonnet 4.6 1eb1d59c8d docs(phase-07.3): update tracking after wave 0 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 16:54:48 +02:00
curo1305andClaude Sonnet 4.6 4d0ada6d06 docs(phase-07.2): mark VERIFICATION.md passed — CR-02 gap resolved 
Gap (password_reset_confirm missing user_nbf write) was fixed during UAT
phase: request: Request param added + Redis write at auth.py:744-750.
VALIDATION.md: 84/84 tests, nyquist_compliant=true. VERIFICATION.md
updated from gaps_found → passed (9/9). STATE.md advanced to phase 07.3.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 12:37:59 +02:00
curo1305 646736d4d3 docs(phase-07.2): complete phase execution 2026-06-06 00:12:09 +02:00
curo1305andClaude Sonnet 4.6 b7994efd06 docs(07.3): create phase plan — ES256 algorithm upgrade 
3 plans (3 waves): Wave 0 xfail stubs, Wave 1 ES256 core + startup
rotation, Wave 2 remember-me TTL split + LoginView checkbox.
Verification passed (0 blockers, 1 minor doc warning fixed).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 19:07:25 +02:00
curo1305andClaude Sonnet 4.6 7ee87c001b docs(07.2): create phase plan — JTI claim + Redis NBF access-token revocation 
3 plans (Wave 0 test scaffolding, Wave 1 jti+NBF check, Wave 2 user_nbf
writes), VALIDATION.md, RESEARCH.md with resolved open questions.
Checker: 0 blockers, 1 warning resolved (RESEARCH.md open questions marked).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 18:56:49 +02:00
curo1305andClaude Sonnet 4.6 1fd7395893 docs(state): clean up HANDOFF.json and mark all v1.0 phases complete 
All 7 phases + sub-phases 6.1, 6.2, 7.1 complete as of 2026-06-05.
HANDOFF.json removed — no active handoff; STATE.md updated to reflect
v1.0 milestone done and next-action as "ready for next milestone."

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 14:44:31 +02:00
curo1305 50b9ffc1f1 docs(state): record phase 7.2 context session 2026-06-05 14:37:55 +02:00
curo1305andClaude Sonnet 4.6 c38c6b1c01 feat(07.1): session revocation on privilege change — CR-01/CR-02/CR-03 
- revoke_all_refresh_tokens: add skip_token_hash optional param (exclude
  current session while revoking others)
- change_password, enable_totp, disable_totp: call revoke with skip hash
  derived from refresh cookie; return sessions_revoked in response and
  write to audit log metadata_
- 3 new tests: test_{change_password,enable_totp,disable_totp}_revokes_other_sessions
  — all PASSED; 373 total passing, 0 regressions
- Frontend toasts: SettingsAccountTab + TotpEnrollment show
  "Other sessions have been terminated." when sessions_revoked > 0
- Companion fixes: rate_limiting get_client_ip refactor, deps/auth.py
  request.state.current_user, locustfile refresh-token task removal
- Version bump: 0.1.0 → 0.1.1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 12:47:16 +02:00
curo1305andClaude Sonnet 4.6 8d060a5da4 docs(state): mark Phase 7.1 planned — ready to execute 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 12:32:12 +02:00
curo1305 3f0e2ab44c docs(state): record phase 7.1 context session 2026-06-05 11:23:16 +02:00
curo1305andClaude Sonnet 4.6 1a625ec365 docs(state): mark Phase 7 complete — v1.0 milestone done 
All 7 phases complete. Phase 7 gates:
- pytest: 347 passed / 1 pre-existing failure (test_extract_docx)
- bandit: zero HIGH findings
- npm audit: 2 moderate dev-only (esbuild/vite) — zero high/critical
- UAT: 11/11 passed (07-UAT.md)

Stale HANDOFF.json removed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 10:44:24 +02:00
curo1305andClaude Sonnet 4.6 420fecdacd docs(phase-6): update tracking after wave 3 — plan 06-06 complete, Phase 6 done 
All 6 Phase 6 plans complete. Phase 6 status updated to Complete in STATE.md
and ROADMAP.md (plans 06-04, 06-05, 06-06 checked). UAT passed (06-UAT.md),
D-10 CVE gate passed (trivy exit 0), D-14 RUNBOOK.md in place.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 19:14:22 +02:00
curo1305andClaude Sonnet 4.6 651713fa7a docs(phase-7): update tracking after wave 1 — plan 07-01 complete 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 18:53:25 +02:00
curo1305andClaude Sonnet 4.6 3df62506c9 docs(07): create phase plan — 5 plans, verification passed 
5 waves: system_settings DB + HKDF encryption (01), ProviderConfig +
GenericOpenAIProvider + singleton client fix (02), Anthropic output_config +
classifier wiring (03), Celery retry 30/90/270s + re-queue endpoint (04),
admin AI panel + DocumentCard badge + human checkpoint (05).

All 18 decisions D-01..D-18 covered. Plan checker passed after 1 revision
round (4 blockers fixed: D-02/D-14 coverage, D-11 Vitest tests, Plan 05
files_modified).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 18:25:00 +02:00
curo1305andClaude Sonnet 4.6 70c09f6cd4 docs(06): create phase 6 plan — performance & production hardening 
6 plans across 4 waves covering structlog/Loki observability, Locust
load testing, multi-stage Dockerfile hardening, trusted-proxy rate
limiting, and RUNBOOK.md. Verification passed (0 blockers).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-02 20:35:03 +02:00
curo1305 b7503cdff4 docs(state): record phase 7 context session 2026-06-02 20:24:12 +02:00
curo1305andClaude Sonnet 4.6 bd17b4b22f docs(06.2): mark phase 6.2 complete — all gates passed 
UAT complete (7/7 re-tests passed or skipped with reason), security gate
passed (threats_open: 0), 344 backend tests passing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-01 21:09:04 +02:00
curo1305 c3c7030e91 docs(phase-06.2): update tracking after wave 3 — all 5 plans complete 2026-05-31 20:16:08 +02:00
curo1305 abb964531f docs(phase-06.2): update tracking after wave 2 — plan 06.2-04 complete 2026-05-31 15:24:44 +02:00
curo1305andClaude Sonnet 4.6 708fd7fad0 docs(phase-6.2): record planning complete — 4 plans verified, state updated 
- ROADMAP.md: progress table → Planned; wave annotations already added by planner
- STATE.md: phase 6.2 row → Planned (4 plans, 3 waves); session note added
- 06.2-03-PLAN.md: remove incorrect SHARE-03/SHARE-05 from requirements field
- 06.2-RESEARCH.md: mark Open Questions section as RESOLVED
- 06.2-UI-SPEC.md: add to version control (was untracked)

Verification: 0 blockers, 2 cosmetic warnings fixed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-31 11:41:32 +02:00
curo1305andClaude Sonnet 4.6 7be48266ae docs(06.2): capture phase context + fix admin user creation 500 
- Phase 6.2 CONTEXT.md: cloud-delete propagation, SHARE-03/05, audit
  log CSV export fix, daily export UI, user handle display
- Fix: admin create_user missing session.flush() before write_audit_log
  caused FK violation on PostgreSQL (silent on SQLite)
- Regression test: test_create_user_writes_audit_log in test_admin_api.py

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-31 11:00:45 +02:00
curo1305andClaude Sonnet 4.6 1e4654aad5 docs(phase-6.1): update tracking after wave 1 — both plans complete 
11 tests passing (7 shares + 4 audit), 309 total, 0 failures.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-30 23:18:04 +02:00
curo1305andClaude Sonnet 4.6 12dd692f00 docs(05): mark phase 5 complete — 12/12 plans done, all UAT gaps resolved 
Update STATE.md and ROADMAP.md to reflect plan 05-12 completion and Phase 5
as fully complete. All UAT gaps (OneDrive 500 → 400, cloud stream 500 → 502,
upload hint) resolved. 293 tests passing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-30 17:56:18 +02:00
curo1305 7691477c6d docs(05): mark Phase 5 complete — all 8 plans executed, security gates passed, human checkpoint approved 
- ROADMAP.md: all 05-01..05-08 plans marked [x], phase gates [x], Progress Table row updated to Complete 2026-05-29
- STATE.md: status→complete, completed_phases→5, percent→100, session continuity entry added
 2026-05-29 09:16:45 +02:00
curo1305 ec0c69fb4e docs(05-07): complete cloud storage frontend UI plan — SUMMARY and STATE 
- useCloudConnectionsStore, 3-tab SettingsView, SettingsCloudTab, CloudCredentialModal
- 61 Vitest tests passing, Vite build exits 0
- Fixed pre-existing build failure (top-level await) via build.target=esnext
 2026-05-29 08:18:48 +02:00
curo1305 c44e861271 docs(05-06): complete cloud upload/test integration plan — SUMMARY and STATE 
- Create 05-06-SUMMARY.md: documents.py cloud extension + 20 passing cloud tests
- Update STATE.md: plan 5→6 of 8, session notes, next action → 05-07
- Update ROADMAP.md: mark 05-06 as complete [x]
 2026-05-29 07:58:03 +02:00
curo1305 be6ff5a71f docs(05-05): complete cloud API endpoints plan — SUMMARY and STATE 
- Created 05-05-SUMMARY.md: cloud.py (7 endpoints), main.py (router registration), admin.py (SEC-09 cleanup)
- Updated STATE.md: plan advanced to 5/8, session log updated, decisions recorded
- Updated ROADMAP.md: 05-03, 05-04, 05-05 marked complete
- Updated REQUIREMENTS.md: SEC-09 marked complete (cloud credential purge on account deletion)
 2026-05-29 07:34:22 +02:00