curo/kite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
795 Commits 1 Branch 1 Tag
fd76d06b3a1b1a32ee554ceeba6f7dd420cc7edf
Commit Graph
400 Commits
Author SHA1 Message Date
curo1305andClaude Sonnet 4.6 1eb1d59c8d docs(phase-07.3): update tracking after wave 0 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 16:54:48 +02:00
curo1305 b1e3d0bc73 docs(07.3-01): add plan execution SUMMARY.md 
- Documents 9 xfail stubs created + test_settings_has_jwt_config extension
- Records test counts: 372 passed / 1 failed / 9 xfailed
- Includes promotion plan mapping each stub to its Plan 02/03 task
- Confirms no production code was modified in this Wave 0 plan
 2026-06-06 16:51:40 +02:00
curo1305andClaude Sonnet 4.6 4d0ada6d06 docs(phase-07.2): mark VERIFICATION.md passed — CR-02 gap resolved 
Gap (password_reset_confirm missing user_nbf write) was fixed during UAT
phase: request: Request param added + Redis write at auth.py:744-750.
VALIDATION.md: 84/84 tests, nyquist_compliant=true. VERIFICATION.md
updated from gaps_found → passed (9/9). STATE.md advanced to phase 07.3.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 12:37:59 +02:00
curo1305andClaude Sonnet 4.6 2265aaaba4 docs(phase-07.2): mark VALIDATION.md complete — nyquist_compliant: true 
Audited post-execution state: all 11 tasks (9 original + CR-02 gap fix +
activate anti-pattern guard) have green automated tests. 84/84 passing.
Zero xfail stubs remaining. Sign-off approved.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 11:54:57 +02:00
curo1305andClaude Sonnet 4.6 b8e0e3adec test(07.2): complete automated UAT — 7/7 pass 
All Phase 7.2 behaviors verified end-to-end against the running app:
- JTI UUID claim present in every issued access token
- Token rejected (Session invalidated) after password change
- Refresh cookie survives password change (skip_token_hash)
- Token rejected after enable-TOTP and disable-TOTP
- Token rejected after admin deactivation
- Reactivation does NOT write user_nbf (no spurious revocation)

Findings recorded in UAT.md:
- Workers must be restarted after Phase 7.2 deploy (--workers 2 does not hot-reload)
- D-02 same-second edge case confirmed benign in real usage
- Deactivation fires is_active check before user_nbf in same-second scenarios (belt-and-suspenders)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-06 11:47:59 +02:00
curo1305 646736d4d3 docs(phase-07.2): complete phase execution 2026-06-06 00:12:09 +02:00
curo1305 8e4e199062 docs(07.2): add phase verification report 2026-06-06 00:11:44 +02:00
curo1305 7e23a3ed0e docs(07.2): add code review report 2026-06-06 00:07:51 +02:00
curo1305 a20d27123d docs(07.2): update tracking after Wave 2 — plan 07.2-03 complete 2026-06-06 00:04:58 +02:00
curo1305 d3588ba055 docs(07.2-03): complete Wave 2 plan — user_nbf write sites in all 4 security-event handlers SUMMARY 2026-06-06 00:04:45 +02:00
curo1305 2665a5085d docs(07.2): update tracking after Wave 1 — plan 07.2-02 complete 2026-06-05 19:21:48 +02:00
curo1305 61199752b5 docs(07.2-02): complete Wave 1 plan — jti claim + user_nbf NBF check SUMMARY 
- jti UUID claim in create_access_token (D-01)
- user_nbf Redis NBF check in get_current_user with fail-open + re-raise guard (D-02, D-03, D-04, T-7.2-02)
- 4 Wave 0 xfail stubs promoted to PASS; 29 tests passing in target suites
 2026-06-05 19:20:42 +02:00
curo1305 a80b632ac8 docs(07.2): update tracking after Wave 0 — plan 07.2-01 complete 2026-06-05 19:12:41 +02:00
curo1305 8d44018f40 chore: merge executor worktree (worktree-agent-a2f182fa26b9780c8) — Wave 0 plan 07.2-01 2026-06-05 19:11:20 +02:00
curo1305 f0ba9e6d8e docs(07.2-01): complete Wave 0 test scaffolding plan — SUMMARY 
- FakeRedis mounted on test_auth_deps and admin_client fixtures
- 9 xfail(strict=False) stubs covering all Phase 7.2 behaviors
- 73 baseline tests pass, zero regressions
 2026-06-05 19:10:03 +02:00
curo1305andClaude Sonnet 4.6 b7994efd06 docs(07.3): create phase plan — ES256 algorithm upgrade 
3 plans (3 waves): Wave 0 xfail stubs, Wave 1 ES256 core + startup
rotation, Wave 2 remember-me TTL split + LoginView checkbox.
Verification passed (0 blockers, 1 minor doc warning fixed).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 19:07:25 +02:00
curo1305andClaude Sonnet 4.6 7ee87c001b docs(07.2): create phase plan — JTI claim + Redis NBF access-token revocation 
3 plans (Wave 0 test scaffolding, Wave 1 jti+NBF check, Wave 2 user_nbf
writes), VALIDATION.md, RESEARCH.md with resolved open questions.
Checker: 0 blockers, 1 warning resolved (RESEARCH.md open questions marked).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 18:56:49 +02:00
curo1305andClaude Sonnet 4.6 e9b2d88ba0 docs(07.3): research phase — ES256 algorithm upgrade, startup rotation, remember-me TTL 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 15:00:08 +02:00
curo1305andClaude Sonnet 4.6 35ff0d52fa docs(07.2): research phase — JTI claim + Redis access-token revocation 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 14:57:11 +02:00
curo1305andClaude Sonnet 4.6 14c1bf437b docs(milestone): add v0.1 milestone audit report 
Audits all 54 requirements and 9 phases against implementation.
Scores: 53/54 requirements met, 53/54 integration checks passed,
5/6 user flows complete. AUTH-07 partial gap (CR-01..03) documented
and resolved by Phase 7.1. Tech-debt items catalogued for next milestone.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 14:44:50 +02:00
curo1305andClaude Sonnet 4.6 18de84d1a9 docs(phase-06): add pattern map and code review fix report 
06-PATTERNS.md: maps 12 new/modified files to closest codebase analogs
for Phase 6 (Performance & Production Hardening).
06-REVIEW-FIX.md: records all 16 review findings (7 critical + 9 warning)
fixed in iteration 1 on 2026-06-04.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 14:44:38 +02:00
curo1305andClaude Sonnet 4.6 1fd7395893 docs(state): clean up HANDOFF.json and mark all v1.0 phases complete 
All 7 phases + sub-phases 6.1, 6.2, 7.1 complete as of 2026-06-05.
HANDOFF.json removed — no active handoff; STATE.md updated to reflect
v1.0 milestone done and next-action as "ready for next milestone."

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 14:44:31 +02:00
curo1305 77135df803 docs(07.3): capture phase context 2026-06-05 14:42:05 +02:00
curo1305 50b9ffc1f1 docs(state): record phase 7.2 context session 2026-06-05 14:37:55 +02:00
curo1305 8c29af7f90 docs(07.2): capture phase context 2026-06-05 14:37:50 +02:00
curo1305andClaude Sonnet 4.6 c9fe69db3a docs(phase-07.1): add Nyquist VALIDATION.md — nyquist_compliant: true 
All 6 tasks covered: 3 backend integration tests (pytest, green) + 3 frontend
unit tests (vitest, green). 0 manual-only. Gap audit resolved 3/3 missing gaps.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 12:54:19 +02:00
curo1305andClaude Sonnet 4.6 89375e6d93 docs(phase-07): mark VALIDATION.md complete — 10/11 tests green, nyquist_compliant 
All 11 test functions confirmed present and implemented. 10 pass in unit
mode; test_load_provider_config is correctly gated behind INTEGRATION=1
(requires PostgreSQL) — not a gap, test is fully implemented.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 12:50:07 +02:00
curo1305andClaude Sonnet 4.6 c38c6b1c01 feat(07.1): session revocation on privilege change — CR-01/CR-02/CR-03 
- revoke_all_refresh_tokens: add skip_token_hash optional param (exclude
  current session while revoking others)
- change_password, enable_totp, disable_totp: call revoke with skip hash
  derived from refresh cookie; return sessions_revoked in response and
  write to audit log metadata_
- 3 new tests: test_{change_password,enable_totp,disable_totp}_revokes_other_sessions
  — all PASSED; 373 total passing, 0 regressions
- Frontend toasts: SettingsAccountTab + TotpEnrollment show
  "Other sessions have been terminated." when sessions_revoked > 0
- Companion fixes: rate_limiting get_client_ip refactor, deps/auth.py
  request.state.current_user, locustfile refresh-token task removal
- Version bump: 0.1.0 → 0.1.1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 12:47:16 +02:00
curo1305andClaude Sonnet 4.6 8d060a5da4 docs(state): mark Phase 7.1 planned — ready to execute 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 12:32:12 +02:00
curo1305andClaude Sonnet 4.6 a3a97430a2 docs(07.1): create phase plan — 2 waves, CR-01..03 session revocation 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 12:27:24 +02:00
curo1305 3f0e2ab44c docs(state): record phase 7.1 context session 2026-06-05 11:23:16 +02:00
curo1305 a7ee4fbd23 docs(07.1): capture phase context 2026-06-05 11:23:07 +02:00
curo1305andClaude Sonnet 4.6 d86664d3f7 docs(phase-6): mark validation nyquist_compliant — 13/13 tests green 
Audited Phase 6 VALIDATION.md: confirmed all 10 automated tasks were already
implemented and passing. Updated statuses from pending→green, wave_0_complete
and nyquist_compliant set to true. 4 manual items (Docker/Locust/Scout) remain
pending as expected.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 11:10:15 +02:00
curo1305andClaude Sonnet 4.6 8629bc0854 docs(phase-7): add security threat verification — 12/12 CLOSED 
Formal Phase 7 SECURITY.md:
- T-07-01: api_key_enc excluded from GET /api/admin/ai-config (whitelist)
- T-07-02: HKDF domain separation confirmed (ai-provider-settings vs cloud-credentials)
- T-07-03: is_active atomic UPDATE, no read-then-write
- T-07-04: empty api_key normalised to "not-needed" before AsyncOpenAI
- T-07-05/07/09/11: accepted risks documented
- T-07-06/08/10/12: mitigations verified in implementation + tests
bandit: zero HIGH; npm audit: zero high/critical; threats_open: 0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 10:50:44 +02:00
curo1305andClaude Sonnet 4.6 1a625ec365 docs(state): mark Phase 7 complete — v1.0 milestone done 
All 7 phases complete. Phase 7 gates:
- pytest: 347 passed / 1 pre-existing failure (test_extract_docx)
- bandit: zero HIGH findings
- npm audit: 2 moderate dev-only (esbuild/vite) — zero high/critical
- UAT: 11/11 passed (07-UAT.md)

Stale HANDOFF.json removed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 10:44:24 +02:00
curo1305andClaude Sonnet 4.6 e58cb1eb01 docs(07-uat): mark all 11 UAT tests pass — phase 07 complete 
Tests 8-11 verified:
- 8: classification_failed badge (status field fix + regression test)
- 9: Re-analyze button flow (code + Celery dispatch verified)
- 10: Celery retry exhaustion (max_retries=3, 30/90/270s backoff, _mark_classification_failed)
- 11: Non-admin 403 on PUT /api/admin/ai-config (get_current_admin dep)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 09:30:41 +02:00
curo1305 1f0808c303 docs(07-05): add plan summary — Tasks 1-3 complete, Task 4 human checkpoint pending 
- Backend GET/PUT /api/admin/ai-config + test-connection + load_provider_config_by_id
- Frontend getAiConfig/saveAiConfig/testAiConnection helpers + AdminAiConfigTab system section
- DocumentCard classification_failed badge + Re-analyze button
- 131 frontend tests pass, 369 backend tests pass
 2026-06-04 23:24:09 +02:00
curo1305andClaude Sonnet 4.6 ee4df4537d docs(phase-7): update tracking after wave 4 — plan 07-04 complete 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 23:14:08 +02:00
curo1305 beb438f113 chore: merge executor worktree (worktree-agent-a707cbd4c3780710b) 2026-06-04 23:12:48 +02:00
curo1305andClaude Sonnet 4.6 0c1ae5284f docs(07-04): add plan summary — Celery retry harness + POST /classify re-queue complete 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 23:12:11 +02:00
curo1305andClaude Sonnet 4.6 888856aa8b docs(06): add code review report — 7 critical, 9 warning, 4 info findings 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 23:01:53 +02:00
curo1305andClaude Sonnet 4.6 b8b0840729 docs(phase-7): update tracking after wave 3 — plan 07-03 complete 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 19:19:03 +02:00
curo1305 e0cd183a63 chore: merge executor worktree (wave3-recovery/07-03) 2026-06-04 19:17:50 +02:00
curo1305 5f72814f07 docs(07-03): complete plan summary — AnthropicProvider output_config + classifier ProviderConfig refactor 2026-06-04 19:16:43 +02:00
curo1305andClaude Sonnet 4.6 420fecdacd docs(phase-6): update tracking after wave 3 — plan 06-06 complete, Phase 6 done 
All 6 Phase 6 plans complete. Phase 6 status updated to Complete in STATE.md
and ROADMAP.md (plans 06-04, 06-05, 06-06 checked). UAT passed (06-UAT.md),
D-10 CVE gate passed (trivy exit 0), D-14 RUNBOOK.md in place.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 19:14:22 +02:00
curo1305andClaude Sonnet 4.6 54521e2b99 docs(06-06): create plan SUMMARY — RUNBOOK.md + D-10 CVE gate passed 
Task 1: RUNBOOK.md (580 lines, 8 D-14 sections). Task 2: trivy scan exits 0
after patching OpenSSL CVE-2026-31789; Mesa/perl unfixable CVEs documented in
.trivyignore. Phase 6 plan 06-06 complete.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 19:13:45 +02:00
curo1305andClaude Sonnet 4.6 ea8df02491 docs(phase-7): update tracking after wave 2 — plan 07-02 complete 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 19:06:07 +02:00
curo1305 60b621f424 chore: merge executor worktree (worktree-agent-afe278fe2f809d30b) 2026-06-04 19:04:52 +02:00
curo1305 00c154d61b docs(07-02): complete provider config + GenericOpenAIProvider + registry plan 
- ProviderConfig + PROVIDER_DEFAULTS + SUPPORTS_JSON_MODE in provider_config.py
- GenericOpenAIProvider with JSON-mode conditional + D-02 fallback
- OpenAIProvider singleton _client + smart truncation (D-07/D-13)
- Registry-based get_provider(config: ProviderConfig) — no if/elif chain
- MAX_AI_CHARS removed from openai_provider.py + classifier.py
- anthropic floor bumped to >=0.95.0 for Plan 03 output_config
- 6 Wave-2 xfail tests promoted; suite: 363 passed, 15 xfailed, 1 pre-existing failure
 2026-06-04 19:04:18 +02:00
curo1305andClaude Sonnet 4.6 582136c120 test(06): complete UAT - 8 passed, 0 issues 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 19:00:19 +02:00