test(12): close Nyquist validation gap

docs(phase-12): add security threat verification — 26/26 closed
docs(phase-12): resolve UAT gaps and close phase after 12-06 gap closure
2026-06-22 06:44:33 +02:00 · 2026-06-22 01:39:24 +02:00 · 2026-06-21 22:38:23 +02:00 · 2026-06-21 22:35:01 +02:00 · 2026-06-21 22:30:51 +02:00 · 2026-06-21 22:30:11 +02:00
192 changed files with 12842 additions and 2452 deletions
@@ -17,6 +17,8 @@ POSTGRES_PASSWORD=changeme_super
 MINIO_ROOT_USER=minioadmin
 MINIO_ROOT_PASSWORD=changeme_minio_root
 MINIO_ENDPOINT=minio:9000
+# Browser-resolvable endpoint used in presigned URLs.
+MINIO_PUBLIC_ENDPOINT=localhost:9000
 # App-level access key. docker-compose.yml provisions this user and a bucket-scoped policy.
 MINIO_ACCESS_KEY=docuvault_app
 MINIO_SECRET_KEY=changeme_minio_app
@@ -74,3 +76,19 @@ ONEDRIVE_TENANT_ID=common
 # Backend and frontend URLs — used to construct OAuth callback/redirect URLs
 BACKEND_URL=http://localhost:8000
 FRONTEND_URL=http://localhost:5173
+
+# ── AI Defaults ──────────────────────────────────────────────────────────────
+DEFAULT_AI_PROVIDER=ollama
+DEFAULT_AI_MODEL=llama3.2
+SYSTEM_PROMPT=
+
+# ── Auth/session durations ───────────────────────────────────────────────────
+ACCESS_TOKEN_EXPIRE_MINUTES=15
+REFRESH_TOKEN_EXPIRE_DAYS=30
+REFRESH_TOKEN_EXPIRE_HOURS=16
+
+# ── Development logging and observability ────────────────────────────────────
+LOG_LEVEL=INFO
+LOG_JSON=true
+GRAFANA_ADMIN_USER=admin
+GRAFANA_ADMIN_PASSWORD=CHANGEME-replace-with-strong-password
@@ -14,6 +14,18 @@ Every user's documents — and the credentials they use to store them — are in

 See `.planning/MILESTONES.md` and `.planning/milestones/v0.2-ROADMAP.md` for full archive.

+## Current Milestone: v0.3 Reimagining Cloud Storage integration
+
+**Goal:** Make connected cloud storage behave like first-class DocuVault storage: users can browse and manage cloud files as if they were local, analyze all or selected cloud documents, and search them by keywords, sentences, or ideas while minimizing DocuVault-owned local storage.
+
+**Target features:**
+- Native-feeling cloud file navigation and actions: open, preview, upload, move, delete, rename, and organize files from connected providers.
+- Provider setup, health, reconnect, credential lifecycle, and error handling that make cloud connections feel reliable and understandable.
+- Analyze all cloud documents or a selected subset without requiring manual local upload.
+- Classify and index cloud documents so they become smart-searchable like locally uploaded documents.
+- Cache and offload cloud file bytes on demand, similar to a desktop sync client, preserving local-like navigation while minimizing local storage use.
+- Rework storage architecture where needed: provider capabilities, background jobs, sync/import/index state, conflict handling, and test coverage.
+
 ## Requirements

 ### Validated (v0.1 — shipped 2026-06-06)
@@ -65,7 +77,14 @@ See `.planning/MILESTONES.md` and `.planning/milestones/v0.2-ROADMAP.md` for ful
 - ✓ Dead code deleted (FolderRow.vue, AccountView.vue, stale test files) — v0.2
 - ✓ WHY-only comment policy enforced (CODE-09) — v0.2

-### Active (next milestone — not yet defined)
+### Active (v0.3 — Reimagining Cloud Storage integration)
+
+- [ ] Cloud files can be browsed and managed with the same core actions as local files: open, preview, upload, move, delete, and rename.
+- [ ] Cloud provider setup and maintenance includes health status, reconnect flows, credential lifecycle handling, and useful error states.
+- [ ] Users can analyze all cloud documents or a selected subset from connected storage.
+- [ ] Analyzed cloud documents are classified and indexed for smart search by keywords, sentences, and semantic ideas.
+- [ ] DocuVault minimizes local storage by caching cloud file bytes only when needed and offloading them when safe.
+- [ ] Storage architecture models provider capabilities, sync/index state, background jobs, and conflict/error handling explicitly.

 ### Out of Scope

@@ -79,7 +98,7 @@ See `.planning/MILESTONES.md` and `.planning/milestones/v0.2-ROADMAP.md` for ful

 ## Context

- **Current state**: v0.2 shipped 2026-06-17. All 4 v0.2 phases complete: stack upgrade + decomposition (Phase 8), admin panel rearchitecture (Phase 9), UX interaction layer (Phase 10), visual design + responsive layout (Phase 11). 277 tests pass. Bundle −81 kB from baseline. App is mobile-responsive, keyboard-navigable, and fully polished. Ready for next milestone definition.
+- **Current state**: v0.3 in progress — Phase 12 (cloud-resource-foundation) complete 2026-06-19. Provider-neutral CloudResourceAdapter contract, durable CloudItem/CloudFolderState ORM, connection-ID browse API, stale-while-revalidate Celery refresh task, and capability-aware StorageBrowser frontend all shipped. v0.2.0 released. Phase 13 (cloud mutations: create/rename/move/delete) is next.
 - **Tech stack**: FastAPI 0.136+ (Python 3.12), SQLAlchemy 2.0 async, Alembic, MinIO SDK; Vue 3 (Options API), Pinia, Vue Router 4, Vite, Tailwind CSS.
 - **Code quality**: v0.1 was built feature-first under time pressure. Both backend and frontend contain duplication, inconsistent patterns, and components that grew beyond their original scope. v0.2 addresses this systematically.
 - **Admin panel**: Standalone /admin/* route subtree with AdminLayout as the route component, AdminSidebar with 5 nav links, and 5 dedicated view components. AdminView.vue and legacy tab components deleted. Admin users redirect to /admin on login; non-admin blocked by to.matched.some() guard.
@@ -120,12 +139,13 @@ See `.planning/MILESTONES.md` and `.planning/milestones/v0.2-ROADMAP.md` for ful
 | Teleport + getBoundingClientRect for dropdowns | Viewport-edge clipping eliminated without complex position logic; prerequisite for virtual scrolling | ✓ Shipped Phase 10 (UX-13) |
 | Admin routes lazy-loaded | All 5 admin views excluded from initial bundle; −81 kB (−30.6%) improvement | ✓ Shipped Phase 11 (PERF-03) |
 | Vite 8 upgrade for npm audit | Closed high-severity esbuild CVE present in Vite 5/6; npm audit now clean | ✓ Shipped Phase 11 (11-07) |
+| Virtual-local cloud storage model | Users already organize documents in their cloud provider; DocuVault should add local-like actions, analysis, and smart search without forcing full import | — Pending v0.3 |

 ## Evolution

 This document evolves at phase transitions and milestone boundaries.

-Last updated: 2026-06-16
+Last updated: 2026-06-19

 **After each phase transition** (via `/gsd-transition`):
 1. Requirements invalidated? → Move to Out of Scope with reason
@@ -141,4 +161,4 @@ Last updated: 2026-06-16
 4. Update Context with current state

 ---
-*Last updated: 2026-06-17 — after v0.2 milestone*
+*Last updated: 2026-06-17 — after starting v0.3 milestone*
@@ -0,0 +1,135 @@
+# Requirements: DocuVault v0.3
+
+**Defined:** 2026-06-17
+**Core Value:** Every user's documents — and the credentials they use to store them — are inaccessible to everyone except that user, while the platform scales horizontally and supports pluggable storage backends.
+
+## v0.3 Requirements
+
+### Connections
+
+- [ ] **CONN-01**: User can connect, reconnect, test, and disconnect each supported cloud provider.
+- [ ] **CONN-02**: User can see connection health and actionable errors for expired, revoked, or invalid credentials.
+- [ ] **CONN-03**: Reconnecting or refreshing credentials invalidates stale provider caches without exposing credentials.
+- [ ] **CONN-04**: User interface reflects the file operations supported by each connected provider.
+
+### Cloud File Management
+
+- [ ] **CLOUD-01**: User can browse connected cloud files and folders through the shared `StorageBrowser`.
+- [ ] **CLOUD-02**: User can open and preview supported cloud documents through DocuVault authorization.
+- [ ] **CLOUD-03**: User can upload files into the currently viewed cloud folder.
+- [ ] **CLOUD-04**: User can create folders in connected cloud storage where the provider supports it.
+- [ ] **CLOUD-05**: User can rename cloud files and folders where the provider supports it.
+- [ ] **CLOUD-06**: User can move files and folders within the same cloud connection where the provider supports it.
+- [ ] **CLOUD-07**: User can delete cloud files and folders after explicit confirmation.
+- [ ] **CLOUD-08**: User sees unsupported cloud actions disabled with a provider-specific explanation.
+- [ ] **CLOUD-09**: Successful cloud mutations update navigation promptly and produce metadata-only audit events.
+
+### Cloud Analysis
+
+- [ ] **ANALYZE-01**: User can request analysis of an individual cloud document.
+- [ ] **ANALYZE-02**: User can request analysis of selected cloud files or folders.
+- [ ] **ANALYZE-03**: User can request analysis of an entire cloud connection after reviewing a file-count and byte-size estimate.
+- [ ] **ANALYZE-04**: User can monitor aggregate and per-item analysis progress through queued, downloading, extracting, classifying, indexed, and failed states.
+- [ ] **ANALYZE-05**: User can cancel queued analysis work and retry failed cloud documents.
+- [ ] **ANALYZE-06**: DocuVault does not repeat analysis when the provider item version or etag has not changed.
+- [ ] **ANALYZE-07**: Analyzing a cloud document never moves, renames, or rewrites the provider-owned file.
+
+### Smart Search
+
+- [ ] **SEARCH-01**: User can search local documents and analyzed cloud documents through one search experience.
+- [ ] **SEARCH-02**: User can find documents using keywords or sentences matched against extracted text.
+- [ ] **SEARCH-03**: User can find documents using semantic concepts or ideas rather than exact wording.
+- [ ] **SEARCH-04**: Search results identify local/cloud source, provider, location, topics, and analysis status.
+- [ ] **SEARCH-05**: User can filter search results by source, provider, folder, topic, and analysis status.
+- [ ] **SEARCH-06**: Opening a cloud search result hydrates provider bytes only when preview or download requires them.
+- [ ] **SEARCH-07**: Executing a search query never downloads cloud file bytes.
+
+### Cache and Storage Minimization
+
+- [ ] **CACHE-01**: Provider-owned file bytes remain the source of truth unless the user explicitly imports a file into local DocuVault storage.
+- [ ] **CACHE-02**: DocuVault persists cloud metadata, extracted text, topics, and semantic search data independently of cached file bytes.
+- [ ] **CACHE-03**: DocuVault caches cloud file bytes only when required for opening, preview, or analysis.
+- [ ] **CACHE-04**: Configurable cache limits and safe eviction minimize local storage use without interrupting active work.
+- [ ] **CACHE-05**: Cached cloud content is isolated by user and connection and is never served without an ownership check.
+
+### Change Tracking
+
+- [ ] **SYNC-01**: DocuVault records provider item identifiers, parent/location, version or etag, size, and modification time for indexed cloud items.
+- [ ] **SYNC-02**: DocuVault marks analyzed cloud items stale when their provider version changes.
+- [ ] **SYNC-03**: Files deleted outside DocuVault are removed from cloud navigation and excluded from search results after refresh.
+- [ ] **SYNC-04**: Provider refresh jobs are idempotent and retry transient failures with bounded exponential backoff.
+
+## Future Requirements
+
+### Extended Cloud Mobility
+
+- **XFER-01**: User can copy or move files between different cloud providers.
+- **IMPORT-01**: User can permanently pin or import a cloud file into DocuVault-owned local storage.
+- **OFFLINE-01**: User can mark folders for persistent offline availability.
+
+### Sync Clients
+
+- **CLIENT-01**: User can install a native desktop client for operating-system file integration.
+- **CLIENT-02**: Native clients can synchronize selected DocuVault and cloud folders.
+
+## Out of Scope
+
+| Feature | Reason |
+|---------|--------|
+| Cross-provider move/copy | Requires transfer orchestration and conflict semantics beyond the virtual-local single-provider milestone |
+| Native desktop sync client | v0.3 remains a responsive web application |
+| Whole-drive offline mirror | Conflicts with the milestone's local-storage minimization goal |
+| Real-time collaborative editing | Document management and discovery are the current focus |
+| Automatic whole-cloud analysis without consent | Could create unexpected AI cost, provider load, and privacy impact |
+| Permanent local pinning/import | Temporary bounded caching is sufficient for v0.3; explicit import remains future scope |
+| Public unauthenticated links | Existing v0.x privacy boundary remains unchanged |
+
+## Traceability
+
+| Requirement | Phase | Status |
+|-------------|-------|--------|
+| CONN-01 | Phase 13 | Pending |
+| CONN-02 | Phase 13 | Pending |
+| CONN-03 | Phase 13 | Pending |
+| CONN-04 | Phase 12 | Pending |
+| CLOUD-01 | Phase 12 | Pending |
+| CLOUD-02 | Phase 13 | Pending |
+| CLOUD-03 | Phase 13 | Pending |
+| CLOUD-04 | Phase 13 | Pending |
+| CLOUD-05 | Phase 13 | Pending |
+| CLOUD-06 | Phase 13 | Pending |
+| CLOUD-07 | Phase 13 | Pending |
+| CLOUD-08 | Phase 12 | Pending |
+| CLOUD-09 | Phase 13 | Pending |
+| ANALYZE-01 | Phase 14 | Pending |
+| ANALYZE-02 | Phase 14 | Pending |
+| ANALYZE-03 | Phase 14 | Pending |
+| ANALYZE-04 | Phase 14 | Pending |
+| ANALYZE-05 | Phase 14 | Pending |
+| ANALYZE-06 | Phase 14 | Pending |
+| ANALYZE-07 | Phase 14 | Pending |
+| SEARCH-01 | Phase 15 | Pending |
+| SEARCH-02 | Phase 15 | Pending |
+| SEARCH-03 | Phase 15 | Pending |
+| SEARCH-04 | Phase 15 | Pending |
+| SEARCH-05 | Phase 15 | Pending |
+| SEARCH-06 | Phase 15 | Pending |
+| SEARCH-07 | Phase 15 | Pending |
+| CACHE-01 | Phase 12 | Pending |
+| CACHE-02 | Phase 12 | Pending |
+| CACHE-03 | Phase 14 | Pending |
+| CACHE-04 | Phase 14 | Pending |
+| CACHE-05 | Phase 14 | Pending |
+| SYNC-01 | Phase 12 | Pending |
+| SYNC-02 | Phase 16 | Pending |
+| SYNC-03 | Phase 16 | Pending |
+| SYNC-04 | Phase 16 | Pending |
+
+**Coverage:**
+- v0.3 requirements: 36 total
+- Mapped to phases: 36
+- Unmapped: 0
+
+---
+*Requirements defined: 2026-06-17*
+*Last updated: 2026-06-17 after roadmap creation*
@@ -1,561 +1,117 @@
-# DocuVault — v1 Roadmap
+# DocuVault Roadmap: v0.3 Reimagining Cloud Storage integration

-_Last updated: 2026-06-02_
+**Status:** Proposed
+**Phases:** 12-16
+**Requirements:** 36
+**Defined:** 2026-06-17

-## Mandatory Cross-Cutting Gates (every phase)
+## Milestone Goal

-Before any phase is marked complete, all three gates must pass:
+Make connected cloud storage behave like first-class DocuVault storage: users can navigate and manage provider-owned files as if they were local, selectively analyze them, and find them through unified keyword and semantic search while DocuVault minimizes locally cached file bytes.

-1. **Test gate** — `pytest -v` passes with zero failures; every new function/endpoint has at least one test; all security invariant tests pass (wrong owner, admin block, token replay)
-2. **Security gate** — Security agent runs `bandit -r backend/` (zero HIGH), `pip audit` (zero critical/high), `npm audit --audit-level=high` (zero high/critical); admin endpoints verified to never return `password_hash`, `credentials_enc`, or document content; no hardcoded secrets
-3. **Bug fix rule** — Any bug fix during execution must: (a) target the root cause, (b) change ≤50 lines, (c) include a regression test — no workarounds permitted
+## Mandatory Cross-Cutting Gates

---
+Before any phase is marked complete:

-## Phases
+1. Backend and frontend test suites pass with zero failures; every new function, endpoint, store, and component has focused coverage.
+2. Security gate verifies user/connection/item ownership, credential secrecy, SSRF defenses, metadata-only audit logs, cache isolation, and no admin document-content access.
+3. Dependency audits report no high/critical vulnerabilities.
+4. Provider integration tests cover supported capabilities and explicit unsupported behavior.
+5. User-facing changes update `AGENTS.md`, relevant README sections, and application patch/minor versions according to project protocol.

- [x] **Phase 1: Infrastructure Foundation** — PostgreSQL + MinIO wired into Docker Compose; Alembic migrations running; existing app still works
- [x] **Phase 2: Users & Authentication** — Full auth flow end-to-end (register, login, TOTP, backup codes, password reset, sign-out-all) with admin panel for user management
- [x] **Phase 3: Document Migration & Multi-User Isolation** — All documents in PostgreSQL + MinIO; per-user isolation enforced; existing UI still works
- [x] **Phase 4: Folders, Sharing, Quotas & Document UX** — Full document management UX (folders, sharing, quota bar, PDF preview, search, audit log)
- [x] **Phase 5: Cloud Storage Backends** — Users can connect OneDrive, Google Drive, Nextcloud, or WebDAV as a personal storage backend
+## Phase Summary

---
+| Phase | Name | Goal | Requirements |
+|------:|------|------|--------------|
+| 12 | 6/6 | Complete   | 2026-06-21 |
+| 13 | Virtual-Local Cloud Operations | Make cloud browsing and core file actions feel local while preserving provider semantics and security | CONN-01..03, CLOUD-02..07, CLOUD-09 |
+| 14 | Selective Analysis and Byte Cache | Analyze selected cloud scopes through cancellable jobs backed by bounded, private, on-demand byte caching | ANALYZE-01..07, CACHE-03..05 |
+| 15 | Unified Smart Search | Search local and analyzed cloud documents by exact text or semantic ideas without downloading files during queries | SEARCH-01..07 |
+| 16 | Change Tracking and Reliability | Detect external provider changes, mark stale indexes, remove deleted items, and harden refresh behavior | SYNC-02..04 |

 ## Phase Details

-### Phase 1: Infrastructure Foundation
+### Phase 12: Cloud Resource Foundation

-**Goal**: PostgreSQL + MinIO are wired into Docker Compose with a complete Alembic-managed schema; all services boot cleanly and the existing single-user document scanner continues to work exactly as before — no user-facing behavior change.
-**Mode:** mvp
-**Depends on**: Nothing (first phase)
-**Requirements**: STORE-01, STORE-02, STORE-07
+**Goal:** DocuVault has a provider-neutral cloud file capability contract and durable per-user cloud item index, and the shared browser can render cloud resources and supported actions without copying full provider files into local storage.

-**Success Criteria** (what must be TRUE):
+**Depends on:** Phase 11
+**Requirements:** CONN-04, CLOUD-01, CLOUD-08, CACHE-01, CACHE-02, SYNC-01

-1. `docker compose up` starts PostgreSQL, MinIO, and the FastAPI backend with no errors; health checks pass for all three services
-2. Running `alembic upgrade head` applies the initial migration cleanly against the fresh PostgreSQL instance with no errors
-3. The full existing document upload, text extraction, and AI classification workflow completes successfully — no regression in single-user behavior
-4. MinIO object key schema `{user_id}/{document_id}/{uuid4()}{ext}` is enforced in the model layer; human-readable filenames are stored in the DB column, not in the MinIO key
+**Success Criteria:**

-**Plans**: 5 plans
+1. Every supported provider reports normalized capabilities for browse, open, preview, upload, folder creation, rename, move, delete, and change tracking.
+2. Browsing any connected provider persists normalized, owner-scoped cloud item metadata including provider ID/path, parent, type, size, modification time, and version/etag.
+3. `StorageBrowser.vue` remains the single file browser and renders cloud actions from capabilities, including disabled actions with provider-specific explanations.
+4. Provider-owned bytes remain outside DocuVault while metadata, extracted text placeholders, topic links, and semantic-index state can be persisted independently.
+5. Ownership and admin-negative tests prove cloud connection and cloud item metadata cannot cross user boundaries.

- [x] 01-01-PLAN.md — Docker Compose service topology + Postgres init + Pydantic Settings + requirements
- [x] 01-02-PLAN.md — Wave 0 test scaffolds (xfail/skip stubs) + async pytest fixtures
- [x] 01-03-PLAN.md — SQLAlchemy ORM models + async engine + Alembic async migration (incl. alembic upgrade head)
- [x] 01-04-PLAN.md — StorageBackend ABC + MinIO backend + rewritten async services/storage.py
- [x] 01-05-PLAN.md — Lifespan + /health + API cutover + Celery worker + walking-skeleton e2e verify
+### Phase 13: Virtual-Local Cloud Operations
+
+**Goal:** Users can maintain healthy cloud connections and perform the main file-management workflows in connected storage with the same shared browser interactions used for local files.
+
+**Depends on:** Phase 12
+**Requirements:** CONN-01, CONN-02, CONN-03, CLOUD-02, CLOUD-03, CLOUD-04, CLOUD-05, CLOUD-06, CLOUD-07, CLOUD-09
+
+**Success Criteria:**
+
+1. Users can connect, test, reconnect, and disconnect providers while seeing current health and actionable reauthentication/error states.
+2. Users can open or preview supported cloud documents and upload files into the current cloud folder through authorized DocuVault endpoints.
+3. Users can create folders, rename items, move items within one connection, and delete items after confirmation wherever the provider supports each action.
+4. Successful mutations immediately invalidate affected listings/index entries, refresh the shared browser, and write metadata-only audit events.
+5. Provider-specific tests verify operation semantics, conflict/error responses, token refresh persistence, SSRF protection, and explicit unsupported capabilities.
+
+### Phase 14: Selective Analysis and Byte Cache
+
+**Goal:** Users can analyze individual files, selected scopes, or whole connections through observable and controllable background jobs, while file bytes are hydrated only on demand and evicted safely.
+
+**Depends on:** Phase 13
+**Requirements:** ANALYZE-01, ANALYZE-02, ANALYZE-03, ANALYZE-04, ANALYZE-05, ANALYZE-06, ANALYZE-07, CACHE-03, CACHE-04, CACHE-05
+
+**Success Criteria:**
+
+1. Users can analyze one file, a multi-selection, a folder tree, or a whole connection after reviewing recursive file-count and byte-size estimates.
+2. The UI exposes aggregate and per-item queued, downloading, extracting, classifying, indexed, cancelled, and failed states with retry and queued-work cancellation.
+3. Analysis jobs are idempotent by cloud item and provider version/etag, and they never mutate the provider-owned file.
+4. Cloud bytes are cached only for active opening, preview, or analysis work and are evicted by configurable limits without interrupting pinned active jobs.
+5. Cache ownership, cache-key versioning, cancellation, duplicate-job, failure-retry, and eviction behavior have dedicated tests.
+
+### Phase 15: Unified Smart Search
+
+**Goal:** One search experience finds local and analyzed cloud documents by keywords, sentences, or semantic ideas and opens cloud results through on-demand hydration.
+
+**Depends on:** Phase 14
+**Requirements:** SEARCH-01, SEARCH-02, SEARCH-03, SEARCH-04, SEARCH-05, SEARCH-06, SEARCH-07
+
+**Success Criteria:**
+
+1. A single query returns authorized local and analyzed cloud results ranked through full-text and semantic relevance.
+2. Keyword and sentence searches match persisted extracted text, while idea searches use persisted embeddings or equivalent semantic indexes.
+3. Results clearly show source, provider, cloud location, topics, and current analysis/stale status and can be filtered by those fields.
+4. Search execution performs no provider file download; only opening or previewing a result may hydrate bytes.
+5. Search isolation, ranking, filtering, stale-result handling, and no-download-on-query invariants have automated coverage.
+
+### Phase 16: Change Tracking and Reliability
+
+**Goal:** DocuVault remains accurate when users or other applications modify connected cloud storage outside DocuVault.
+
+**Depends on:** Phase 15
+**Requirements:** SYNC-02, SYNC-03, SYNC-04
+
+**Success Criteria:**
+
+1. Provider delta feeds or bounded metadata refreshes detect changed versions and mark previously analyzed items stale until reanalysis.
+2. Items deleted outside DocuVault disappear from navigation and are excluded from search without deleting unrelated user data.
+3. Refresh jobs are idempotent, cursor-aware where supported, rate-limited, and retry transient failures with bounded exponential backoff.
+4. Users can see refresh/stale/error state and deliberately reanalyze changed items.
+5. End-to-end UAT verifies cloud-as-local operations, selective analysis, cache offload, unified smart search, and external-change recovery across supported provider classes.
+
+## Coverage
+
+- v0.3 requirements: 36
+- Mapped to phases: 36
+- Unmapped: 0
+- Duplicate mappings: 0

 ---
-
-### Phase 2: Users & Authentication
-
-**Goal**: Users can register, log in (with optional TOTP 2FA), reset their password, and sign out all active sessions; admins can manage user accounts and assign AI providers — all enforced by a complete FastAPI dependency chain.
-**Mode:** mvp
-**Depends on**: Phase 1
-**Requirements**: AUTH-01, AUTH-02, AUTH-03, AUTH-04, AUTH-05, AUTH-06, AUTH-07, AUTH-08, SEC-01, SEC-02, SEC-03, SEC-05, SEC-06, SEC-07, ADMIN-01, ADMIN-02, ADMIN-03, ADMIN-04, ADMIN-05, ADMIN-07
-
-**Success Criteria** (what must be TRUE):
-
-1. A new user can register with an email and password that passes strength validation; a password from the HaveIBeenPwned list is rejected with a clear error
-2. A logged-in user can enroll a TOTP authenticator app, receive 8–10 backup codes, explicitly acknowledge them, and thereafter be required to supply a TOTP code (or backup code) on every login — a backup code is invalidated on first use
-3. A user who forgets their password can receive a reset email, follow the link within 1 hour, set a new password, and is then returned to the TOTP login gate (not auto-logged in)
-4. A user can trigger "sign out all devices" from account settings; all other active sessions are immediately invalidated and any reuse of a rotated refresh token revokes the entire token family
-5. An admin user can create, deactivate, and reset a user account, and assign an AI provider and model to that user; admin API endpoints never return document content or credentials_enc (per-user document auth enforcement deferred to Phase 3 per D-07)
-
-**Plans**: 5 plans
-
-**Wave 1** — Foundation
-
- [x] 02-01-PLAN.md — Auth service layer (Argon2, JWT, refresh tokens, TOTP, backup codes, HIBP, security alert), FastAPI deps, BackupCode model + password_must_change migration
-
-**Wave 2** *(blocked on Wave 1 completion)*
-
- [x] 02-02-PLAN.md — Register/login (TOTP + backup code paths) + refresh/logout/change-password endpoints + CSP/Origin validation/rate-limit (IP + per-account) + Vue auth store + router guard + Login/Register views
-
-**Wave 3** *(blocked on Wave 2 completion)*
-
- [x] 02-03-PLAN.md — TOTP enrollment + backup codes + password reset + sign-out-all endpoints + AccountView + TotpEnrollment + BackupCodesDisplay + PasswordReset views
-
-**Wave 4** *(blocked on Wave 3 completion)*
-
- [x] 02-04-PLAN.md — Admin backend: user CRUD, quota, AI config endpoints with get_current_admin enforced + tests
-
-**Wave 5** *(blocked on Wave 4 completion)*
-
- [x] 02-05-PLAN.md — Admin panel frontend: AdminView + three tab components + AppSidebar admin link and user identity footer
-
-**Cross-cutting constraints:**
-
- JWT access token in Pinia memory only — never localStorage (Plans 02, 03, 05)
- Refresh token httpOnly SameSite=Strict cookie on all token issuance (Plans 02, 03)
- Admin endpoints never return document content or credentials_enc (Plans 04, 05)
- All auth endpoints rate-limited per-IP and per-account (Plans 02, 03)
-
-**UI hint**: yes
-
---
-
-### Phase 3: Document Migration & Multi-User Isolation
-
-**Goal**: All existing documents have been migrated from flat-file JSON + filesystem into PostgreSQL + MinIO; all new uploads use the presigned URL flow; per-user isolation is enforced at the DB level; the existing document UI works without regression; the backend is stateless and ready for horizontal scaling.
-**Mode:** mvp
-**Depends on**: Phase 2
-**Requirements**: STORE-03, STORE-04, STORE-05, STORE-06, STORE-08, SEC-04, DOC-03, DOC-04, DOC-05
-
-**Success Criteria** (what must be TRUE):
-
-1. Every document present before migration is accessible after migration with the same metadata and extracted text; a count reconciliation check confirms zero document loss
-2. Two concurrent uploads that would together exceed a user's 100 MB quota result in exactly one success and one 413 rejection — the quota never goes over limit
-3. A document delete atomically decrements the user's recorded quota usage; after deletion the quota reflects the freed bytes
-4. Requesting a document object key or presigned URL for a document owned by a different user returns 403 — no cross-user object access is possible through any request parameter manipulation; all /api/documents/* endpoints enforce get_current_user and return 403 when the requesting user's role is admin (completing SC5 from Phase 2)
-5. AI classification for each document uses the provider and model assigned to that user by the admin, not any user-supplied or default value
-
-**Plans**: 5 plans
-
-**Wave 1** — Migration + test scaffolds
-
- [x] 03-01-PLAN.md — Wave 0 test scaffolds (auth_user/admin_user/MinIO mock fixtures + 19 xfail stubs) + Alembic migration 0003 (null-user cleanup, NOT NULL constraint, topic cleanup, quota reconciliation, ix_topics_user_id) — Complete 2026-05-23
-
-**Wave 2** *(blocked on Wave 1)*
-
- [ ] 03-02-PLAN.md — Presigned upload backend: StorageBackend ABC + MinIOBackend dual client + generate_presigned_put_url/stat_object + /api/documents/upload-url + /api/documents/{id}/confirm with atomic quota UPDATE + GET /api/auth/me/quota + delete-with-quota + abandoned-upload Celery beat + docker-compose CORS/celery-beat
-
-**Wave 3** *(blocked on Wave 2)*
-
- [x] 03-03-PLAN.md — Auth guards: get_regular_user dep + ownership assertions on every /api/documents/* handler (404 not 403) + admin 403 + real user_id in object_key + namespace-scoped /api/topics/* + POST /api/admin/topics + classifier topic-namespace plumbing
-
-**Wave 4** *(blocked on Wave 3)*
-
- [x] 03-04-PLAN.md — Settings retirement + per-user AI: delete /api/settings + remove load_settings/save_settings + classifier accepts ai_provider/ai_model kwargs + Celery task resolves user.ai_provider via DB + frontend SettingsView placeholder + remove settings store/API — Complete 2026-05-23
-
-**Wave 5** *(blocked on Wave 4)*
-
- [ ] 03-05-PLAN.md — Frontend upload flow + quota bar: 3-step upload action with XHR progress + UploadProgress.vue progress bar and quota rejection error block + QuotaBar.vue + AppSidebar embed + quota state in auth store + human checkpoint
-
-**Cross-cutting constraints:**
-
- Atomic quota UPDATE pattern only lives in Plan 02; never duplicate (CLAUDE.md)
- Every /api/documents/* handler injects get_regular_user (Plan 03)
- AI provider/model resolved only via Celery task DB lookup (Plan 04)
- Browser XHR PUT to MinIO sends NO Authorization header (Plan 05)
-
-**Phase gates (must pass before Phase 3 is complete):**
-
- [ ] `pytest -v` — zero failures; presigned URL, quota enforcement, ownership isolation, and admin-403 all covered
- [ ] Security agent: path traversal check on object key construction; cross-user IDOR tests; quota race condition test
- [ ] Bandit + pip audit + npm audit all clean
-
-**UI hint**: yes
-
---
-
-### Phase 4: Folders, Sharing, Quotas & Document UX
-
-**Goal**: Users have a complete document management experience — organized with folders, shared by handle, warned before they hit quota, able to preview PDFs in-browser, and served by a searchable document list; admins can view the append-only audit log.
-**Mode:** mvp
-**Depends on**: Phase 3
-**Requirements**: FOLD-01, FOLD-02, FOLD-03, FOLD-04, FOLD-05, SHARE-01, SHARE-02, SHARE-03, SHARE-04, SHARE-05, SEC-08, SEC-09, ADMIN-06, DOC-01, DOC-02
-
-**Success Criteria** (what must be TRUE):
-
-1. A user can create, rename, and delete folders; moving a document between folders preserves its metadata and AI classification; deleting a non-empty folder prompts with the content count before proceeding
-2. A user can share a document with another user by handle; the recipient sees it appear in a "Shared with me" virtual folder with no storage quota charged against them; the owner can revoke access and the shared entry disappears immediately for the recipient
-3. The sidebar quota bar displays current usage in MB; it turns amber at 80% and red at 95%; an upload that would exceed the limit is rejected with an error showing current usage, the rejected file size, and a link to storage settings
-4. Any document in the user's library can be previewed in-browser as a PDF; document bytes are proxied through the app and no presigned URLs are exposed to the browser (native browser PDF rendering via Content-Type header)
-5. An admin can view the audit log filtered by date range, user, and action type; the log contains no document content, filenames, or extracted text; account deletion triggers cleanup of all user files before DB records are removed
-
-**Plans**: 9 plans
-
-**Wave 1** — Test scaffolds + DB migration (parallel)
-
- [x] 04-01-PLAN.md — Wave 0 test stubs: test_folders.py + test_shares.py + test_audit.py + proxy stubs in test_documents.py + SEC-08/SEC-09 stubs in test_security.py
- [x] 04-02-PLAN.md — Alembic migration 0004 (users.pdf_open_mode, GIN FTS index, audit-logs bucket) + MinIOBackend.put_object_raw()
-
-**Wave 2** *(blocked on Wave 1)*
-
- [x] 04-03-PLAN.md — Audit service (write_audit_log) + Folders API (FOLD-01..05): POST/GET/PATCH/DELETE /api/folders + PATCH /api/documents/{id}/folder + document list sort/search/is_shared extension
- [ ] 04-04-PLAN.md — Shares API (SHARE-01..05): POST/GET /api/shares + GET /api/shares/received + DELETE /api/shares/{id} with IDOR protection
-
-**Wave 3** *(blocked on Wave 2)*
-
- [ ] 04-05-PLAN.md — PDF streaming proxy GET /api/documents/{id}/content with Range header support + PATCH /api/auth/me/preferences (pdf_open_mode)
- [ ] 04-06-PLAN.md — Admin audit log API (GET /api/admin/audit-log, CSV export) + Celery beat daily audit export task + celery_app.py beat schedule
-
-**Wave 4** *(blocked on Wave 3)*
-
- [ ] 04-07-PLAN.md — SEC-08/SEC-09 hardening + audit log backfill into auth.py/admin.py/documents.py + CloudConnectionOut Pydantic model + delete-user file cleanup
-
-**Wave 5** *(blocked on Wave 4)*
-
- [ ] 04-08-PLAN.md — Frontend data layer: API client functions + useFoldersStore + documents store extension + Vue Router routes (/folders/:folderId, /shared)
-
-**Wave 6** *(blocked on Wave 5)*
-
- [ ] 04-09-PLAN.md — Frontend UI: all new components (FolderRow, FolderBreadcrumb, FolderDeleteModal, ShareModal, DocumentPreviewModal, SearchBar, SortControls, AuditLogTab) + view wiring (AppSidebar, DocumentCard, HomeView, FolderView, SharedView, SettingsView, AdminView) + human checkpoint
-
-**Phase gates (must pass before Phase 4 is complete):**
-
- [ ] `pytest -v` — zero failures; folder ownership, share revocation, quota bar, PDF proxy (no presigned URL exposure) all covered
- [ ] Security agent: audit log verified to contain zero document content; sharing IDOR tests; PDF proxy verified to not leak presigned URLs or object keys
- [ ] Bandit + pip audit + npm audit all clean
-
-**UI hint**: yes
-
---
-
-### Phase 5: Cloud Storage Backends
-
-**Goal**: Users can connect OneDrive, Google Drive, Nextcloud, or a generic WebDAV server as a personal storage backend; credentials are encrypted with a per-user HKDF-derived key; connection status is visible; local and cloud storage coexist; the `StorageBackend` ABC makes adding further backends straightforward.
-**Mode:** mvp
-**Depends on**: Phase 4
-**Requirements**: CLOUD-01, CLOUD-02, CLOUD-03, CLOUD-04, CLOUD-05, CLOUD-06, CLOUD-07
-
-**Success Criteria** (what must be TRUE):
-
-1. A user can connect OneDrive, Google Drive, Nextcloud, or a WebDAV endpoint through an OAuth or credential flow; the connection status is displayed as `ACTIVE`, `REQUIRES_REAUTH`, or `ERROR` — never shows raw credentials
-2. When an OAuth token is revoked externally (simulated `invalid_grant` response), the connection status transitions to `REQUIRES_REAUTH` without a 500 error; the user is shown a re-authentication prompt
-3. A user can select their connected cloud backend as the default storage destination for new uploads; local MinIO storage remains available as an alternative; existing local documents are unaffected
-4. A user can disconnect a cloud backend; credentials are permanently deleted from the DB and a subsequent attempt to use that backend returns an appropriate error — no orphaned data remains
-5. An admin API response for a user's cloud connections returns only `provider, display_name, connected_at, status` — the `credentials_enc` column is never present in any serialized response
-
-**Plans**: 12 plans (8 original + 3 UAT gap closure + 1 gap closure wave)
-
-**Wave 1** — Test scaffold + dependencies
-
- [x] 05-01-PLAN.md — Wave 0 xfail stubs, conftest cloud fixtures, requirements.txt packages, config.py settings
-
-**Wave 2** — Shared utilities
-
- [x] 05-02-PLAN.md — cloud_utils.py (SSRF + HKDF), cloud_cache.py (TTLCache), storage factory extension
-
-**Wave 3** — Cloud backends (parallel, both blocked on Wave 2 / Plan 05-02)
-
- [x] 05-03-PLAN.md — GoogleDriveBackend + OneDriveBackend (all 7 StorageBackend methods)
- [x] 05-04-PLAN.md — NextcloudBackend + WebDAVBackend (all 7 StorageBackend methods)
-
-**Wave 4** — Cloud API
-
- [x] 05-05-PLAN.md — All /api/cloud/* endpoints + /api/users/me/default-storage + main.py router registration
-
-**Wave 5** — Document routing + full test suite
-
- [x] 05-06-PLAN.md — Upload/content proxy cloud routing + all 15 tests promoted to passing
-
-**Wave 6** — Frontend settings UI
-
- [x] 05-07-PLAN.md — cloudConnections store + API client + SettingsView 3-tab + SettingsCloudTab + CloudCredentialModal
-
-**Wave 7** — Frontend sidebar (human checkpoint)
-
- [x] 05-08-PLAN.md — AppSidebar cloud section + CloudProviderTreeItem + CloudFolderTreeItem + human checkpoint
-
-**Wave 8** — UAT gap closure (parallel, all independent)
-
- [x] 05-09-PLAN.md — Cloud document open/re-analyze/edit: authenticated fetch+Blob URL, cloud-aware Celery task, PATCH /api/documents/{id}
- [x] 05-10-PLAN.md — OAuth initiate fix (JSON response), Nextcloud custom endpoint edit round-trip, Edit button on ERROR rows, confirmation text overflow
- [x] 05-11-PLAN.md — Admin hard-delete with password confirmation: UserDeleteConfirm backend model + inline frontend panel
-
-**Wave 9** — Post-UAT gap closure
-
- [x] 05-12-PLAN.md — OAuth 400 preflight (unconfigured creds), 502 cloud fallback, upload hint in CloudStorageView, celery-worker volume mount
-
-**Phase gates (must pass before Phase 5 is complete):**
-
- [x] `pytest -v` — zero failures; SSRF prevention on WebDAV/Nextcloud user-supplied URLs; credential encryption/decryption round-trip; admin response never exposes `credentials_enc`; OAuth invalid_grant handling
- [x] Security agent: SSRF allowlist verification; credential key derivation correctness; connection status never leaks raw credential values
- [x] Bandit + pip audit + npm audit all clean
- [x] UAT gaps resolved and re-tested (05-09, 05-10, 05-11, 05-12)
-
-**UI hint**: yes
-
---
-
-### Phase 6: Performance & Production Hardening
-
-**Goal**: The application is ready for production deployment — observable, load-tested, and hardened; response times meet SLA targets under concurrent load; all auth and document endpoints are rate-limited; structured logging and distributed tracing are in place; the Docker image runs as a non-root user with a read-only filesystem.
-**Mode:** mvp
-**Depends on**: Phase 5
-**Requirements**: TBD
-
-**Success Criteria** (what must be TRUE):
-
-1. All API endpoints respond within defined latency targets (p50/p95/p99) under a realistic load test (e.g., 50 concurrent users, 5-minute soak)
-2. Structured JSON logging (correlation IDs, user ID, request latency) is emitted to stdout; a local log aggregation stack (Loki or similar) captures and queries them
-3. All auth endpoints (login, register, password reset, TOTP) enforce per-IP and per-account rate limits that cannot be bypassed by header manipulation
-4. Container hardening is complete: non-root user, read-only root filesystem, dropped Linux capabilities; `docker scout` or equivalent reports zero critical CVEs
-5. A runbook documents all environment variables, startup/shutdown procedures, backup strategy, and on-call escalation path; the app can be stood up from scratch using only the runbook
-
-**Plans**: 6 plans (4 waves)
-
-**Wave 0** — Test scaffolds + package verification
-
- [x] 06-01-PLAN.md — Nyquist Wave 0: xfail stubs (test_logging.py, test_rate_limiting.py), Locust skeleton, package legitimacy checkpoint (D-01, D-04, D-11, D-12)
-
-**Wave 1** *(blocked on Wave 0 completion)*
-
- [x] 06-02-PLAN.md — structlog JSON logging + CorrelationIDMiddleware + Loki/Promtail/Grafana Docker Compose stack (D-01, D-02, D-03)
- [x] 06-03-PLAN.md — Locust locustfile.py with JWT auth + SLA gate listener (D-04, D-05, D-06)
-
-**Wave 2** *(blocked on Wave 1 completion)*
-
- [x] 06-04-PLAN.md — Multi-stage Dockerfile + read_only/tmpfs/cap_drop on backend + celery-worker (D-07, D-08, D-09)
- [x] 06-05-PLAN.md — Trusted-proxy get_client_ip body + per-account rate limiter on document/cloud endpoints (D-11, D-12, D-13)
-
-**Wave 3** *(blocked on Wave 2 completion)*
-
- [x] 06-06-PLAN.md — docker scout CVE gate + RUNBOOK.md (D-10, D-14)
-
-**Cross-cutting constraints:**
-
- get_client_ip lives ONLY in backend/deps/utils.py — replace body in-place, no new function (Plans 05)
- celery-beat intentionally excluded from read_only: true (Plan 04)
- locust must NOT be in requirements.txt — use requirements-dev.txt (Plan 03)
- CorrelationIDMiddleware registered LAST in main.py — Starlette reverse order (Plan 02)
-
---
-
-### Phase 6.1: Close v1.0 audit gaps: SHARE-02/STORE-06/ADMIN-06
-
-**Goal**: Close three v1.0 requirements that remain unimplemented — atomic quota decrement on document delete (STORE-06), "Shared with me" virtual folder without recipient quota charge (SHARE-02), and admin audit log viewer with date/user/action type filters (ADMIN-06).
-**Mode:** mvp
-**Depends on**: Phase 6
-**Requirements**: STORE-06, SHARE-02, ADMIN-06
-
-**Success Criteria** (what must be TRUE):
-
-1. Deleting a document atomically decrements the owning user's quota; after deletion the quota reflects the freed bytes with no race condition under concurrent deletes
-2. A user who receives a shared document sees it appear in a "Shared with me" virtual folder; the recipient's quota usage is not charged for the shared document's storage
-3. An admin can view the audit log filtered independently by date range, user, and action type; filtered results contain no document content, filenames, or extracted text
-
-**Plans**: 2 plans
-
-**Wave 1** — Test promotion (parallel)
-
- [x] 06.1-01-PLAN.md — Promote test_shares.py stubs to real tests + second_auth_user fixture (SHARE-01..05)
- [x] 06.1-02-PLAN.md — Promote test_audit.py stubs to real tests (ADMIN-06)
-
-**Phase gates (must pass before Phase 6.1 is complete):**
-
- [ ] `pytest -v` — zero failures; all 7 share tests + 4 audit log tests passing
- [ ] Security agent: bandit + pip audit + npm audit all clean
- [ ] STORE-06 confirmed: `test_delete_decrements_quota` passes under `INTEGRATION=1`
-
---
-
-### Phase 6.2: Close v1 sharing + cloud-delete + CSV export gaps
-
-**Goal**: Close remaining v1 gaps — sharing edge cases (SHARE-03/SHARE-05), cloud document deletion propagation to the remote backend, and CSV export + daily export UI for the admin audit log (ADMIN-06).
-**Mode:** mvp
-**Depends on**: Phase 6.1
-**Requirements**: SHARE-03, SHARE-05, ADMIN-06
-
-**Success Criteria** (what must be TRUE):
-
-1. Documents shared with others display a "Shared" badge in the owner's list view (reads doc.is_shared, not doc.share_count)
-2. Owner can set permission to "view" or "edit" when creating a share and toggle it per-recipient afterward; PATCH /api/shares/{id} enforces IDOR protection (404 on wrong owner)
-3. Deleting a cloud document propagates the delete to the cloud provider; failure shows a warning modal with "Remove from app" fallback; ?remove_only=true removes only the DB record; cloud docs never affect quota on delete
-4. Admin can download filtered audit log CSV via fetch+Blob (not window.location.href); audit log entries show user handles instead of raw UUIDs; user filter accepts handles (not UUIDs)
-5. Admin can list and download Celery-generated daily audit export files from a new section in the Audit Log tab
-
-**Plans**: 4 plans
-
-**Wave 0** — Test stubs
-
- [x] 06.2-01-PLAN.md — 11 xfail stubs across test_shares.py, test_documents.py, test_audit.py
-
-**Wave 1** — Feature slices (parallel)
-
- [x] 06.2-02-PLAN.md — SHARE-05 badge fix + SHARE-03 permission control (backend PATCH + frontend dropdown + toggle)
- [x] 06.2-03-PLAN.md — Cloud-delete propagation + structured error response + remove_only path + DocumentView warning modal
-
-**Wave 2** — Audit log enrichment
-
- [x] 06.2-04-PLAN.md — Audit handle JOIN + user_handle filter + CSV fetch+Blob fix + daily-export list + download endpoints + AuditLogTab UI
-
-**Phase gates (must pass before Phase 6.2 is complete):**
-
- [x] `pytest -v` — 344 passed, 1 pre-existing unrelated failure (test_extract_docx missing module)
- [x] Security agent: bandit + pip audit + npm audit all clean (SECURITY.md threats_open: 0)
- [x] IDOR on PATCH /api/shares/{id}: test_share_patch_idor passes
- [x] Date regex validation confirmed: GET /api/admin/audit-log/daily-exports/invalid-date returns 404
- [x] window.location.href removed from AuditLogTab.vue confirmed by grep
-
-**Status: ✓ Complete (2026-06-01)**
-
-### Phase 7: Redo and optimize LLM integration
-
-**Goal:** A fully refactored, production-reliable AI provider layer: AI provider settings live in a new `system_settings` DB table (replacing env-only config), API keys encrypted at rest via HKDF/AES-GCM (same pattern as cloud credentials), all OpenAI-compatible providers (Groq, xAI, DeepSeek, OpenRouter, Gemini-compat, Mistral-compat, Ollama, LMStudio) handled by a single `GenericOpenAIProvider` class, Anthropic uses native `output_config.format.type="json_schema"` structured output, JSON-mode enforced everywhere with `parse_classification()` as fallback, Celery exponential-backoff retry (30s/90s/270s) replaces silent failure on classification errors, per-provider context window size with smart 60/40 truncation replaces the global `MAX_AI_CHARS`, the singleton `_client` pattern restores httpx connection-pool reuse, an admin AI Providers panel allows interactive configuration plus test-connection, and a "Re-analyze" button on the document card re-queues failed classifications.
-**Mode:** standard
-**Depends on:** Phase 6.2
-**Requirements**: D-01..D-18 (CONTEXT.md decisions; no REQ-IDs yet mapped — phase introduces new infrastructure)
-
-**Success Criteria** (what must be TRUE):
-
-1. AI provider settings live in `system_settings`; admin can view, edit, and atomically activate any provider via `PUT /api/admin/ai-config`; `GET /api/admin/ai-config` never returns `api_key_enc` or any decrypted key value
-2. A document whose classification raises an exception is automatically retried by Celery at 30 s, 90 s, and 270 s; after the third failure the document's status remains `classification_failed` and no further retries occur
-3. All OpenAI-compatible providers route through `GenericOpenAIProvider`; classify/suggest pass `response_format={"type":"json_object"}` when `supports_json_mode` is True (Gemini preset is False and falls back to `parse_classification()`); Anthropic uses `output_config.format.type="json_schema"` with a constrained schema
-4. `MAX_AI_CHARS` no longer exists in `openai_provider.py`, `anthropic_provider.py`, or `classifier.py`; each provider truncates input text using its own `context_chars` value via a 60% head + 40% tail strategy
-5. A failed document shows a red "Classification failed" badge and a "Re-analyze" button on the document card; clicking the button calls `POST /api/documents/{id}/classify`, which sets the document to `processing` and re-queues the Celery task
-
-**Plans**: 5 plans (5 waves)
-
-**Wave 1** — Foundation: migration, ORM model, encryption helpers, Wave 0 test stubs
-
- [x] 07-01-PLAN.md — Alembic migration 0005 (system_settings table) + SystemSettings ORM model + services/ai_config.py (HKDF helpers + load_provider_config + env seed on startup) + Wave 0 xfail stubs for D-01..D-16 (test_ai_providers.py, test_ai_config.py, test_admin_ai_config.py, test_document_tasks.py)
-
-**Wave 2** *(blocked on Wave 1)* — Provider layer: ProviderConfig, GenericOpenAIProvider, singleton client fix, registry
-
- [x] 07-02-PLAN.md — ProviderConfig Pydantic model + PROVIDER_DEFAULTS + SUPPORTS_JSON_MODE + GenericOpenAIProvider(OpenAIProvider) + OpenAIProvider singleton refactor + ollama/lmstudio context_chars + MAX_AI_CHARS removal from openai_provider.py + classifier.py + registry-based ai/__init__.py get_provider(config: ProviderConfig) + anthropic>=0.95.0 pin
-
-**Wave 3** *(blocked on Wave 2)* — Anthropic + Classifier wiring
-
- [x] 07-03-PLAN.md — AnthropicProvider singleton + output_config json_schema + smart truncation + MAX_AI_CHARS removal + classifier.classify_document driven by load_provider_config (no inline _settings dict) + ai_config stub removed in favor of real ProviderConfig + load_provider_config_by_id helper
-
-**Wave 4** *(blocked on Wave 3)* — Celery retry harness + Re-queue endpoint
-
- [x] 07-04-PLAN.md — Celery extract_and_classify decorator gains bind=True + max_retries=3 + _ClassificationError sentinel + 30/90/270 backoff + _mark_classification_failed on exhaustion + POST /api/documents/{id}/classify changes to re-queue Celery (sets status=processing, calls .delay()) — promotes test_retry_backoff, test_exhaustion_sets_failed_status, test_reclassify_requeues_celery
-
-**Wave 5** *(blocked on Wave 4)* — Admin UI + Frontend badge
-
- [x] 07-05-PLAN.md — Admin AI-config backend (GET/PUT/test-connection with whitelist + audit logging + atomic is_active flip) + frontend API client helpers (getAiConfig/saveAiConfig/testAiConnection) + AdminAiConfigTab.vue global System AI Providers section ABOVE existing per-user table + DocumentCard.vue classification_failed badge + Re-analyze button + human checkpoint UAT
-
-**Cross-cutting constraints:**
-
- `api_key_enc` is never returned by any admin endpoint — enforced by `_ai_config_to_dict()` whitelist (Plan 05)
- HKDF domain separation: AI settings use `info=b"ai-provider-settings"`, cloud credentials use `info=b"cloud-credentials"` (Plan 01)
- `is_active` flip is atomic: single `UPDATE SET is_active = (provider_id = $target)` — never read-then-write (Plan 05)
- Provider clients are stored as `self._client` in `__init__` — never recreated per call (Plans 02, 03)
- `MAX_AI_CHARS` removal must cover all three locations: openai_provider.py L5, anthropic_provider.py L5, classifier.py L28 (Plans 02 + 03)
- Celery `self.retry()` must be raised from the outer sync task body, never inside `asyncio.run()` (Plan 04 — Pitfall 3)
- `extra_hosts: ["host.docker.internal:host-gateway"]` already present in docker-compose.yml — D-14 is already done; no docker-compose changes required (RESEARCH.md)
- AdminAiConfigTab.vue per-user assignment table is preserved untouched; the new global system section is added ABOVE it (Plan 05 — Pitfall 6)
-
-**Phase gates (must pass before Phase 7 is complete):**
-
- [x] `pytest -v` — zero failures; D-01/D-03/D-05/D-06/D-07/D-09/D-10/D-11/D-12/D-13/D-16 covered by promoted tests (347 passed, 1 pre-existing failure test_extract_docx missing module)
- [x] Security agent: bandit -r backend/ (zero HIGH), npm audit --audit-level=high (2 moderate esbuild/vite dev-only — no high/critical); pip-audit not runnable locally (Python 3.9 vs 3.12 requirements), inherited clean gate from Phase 6.2
- [x] `_ai_config_to_dict()` confirmed to never include `api_key_enc` (test_get_never_returns_key passes; whitelist at admin.py:62)
- [x] HKDF domain separation verified: test_encrypt_api_key_domain_isolation passes (test_ai_config.py:21)
- [x] Atomic `is_active` flip verified: test_set_active_provider_atomic passes (test_admin_ai_config.py:77)
- [x] Human checkpoint UAT approves admin panel + DocumentCard badge end-to-end (07-UAT.md: 11/11 passed 2026-06-05)
-
-**UI hint**: yes
-
---
-
-### Phase 7.1: Security: session revocation on privilege change (CR-01..03) (INSERTED)
-
-**Goal**: Fix the three missing session-revocation calls in `backend/api/auth.py`: `change_password`, `enable_totp`, and `disable_totp` must all call `revoke_all_refresh_tokens()` (excluding the current session). Add `sessions_revoked` to their response shapes and a frontend toast when other sessions are terminated.
-**Mode:** quick
-**Depends on**: Phase 7
-**Requirements**: CR-01, CR-02, CR-03
-
-**Plans**: 2 plans
-
-**Wave 1** — Backend: service + API changes
-
- [ ] 07.1-01-PLAN.md — Add skip_token_hash param to revoke_all_refresh_tokens + wire revoke into change_password, enable_totp, disable_totp with sessions_revoked response + audit log
-
-**Wave 2** *(blocked on Wave 1)*
-
- [ ] 07.1-02-PLAN.md — Tests (3 new test_*_revokes_other_sessions) + frontend toast in SettingsAccountTab.vue + TotpEnrollment.vue
-
---
-
-### Phase 7.2: Security — JTI Claim + Redis Access-Token Revocation (INSERTED)
-
-**Goal**: Add a `jti` (JWT ID) claim to every issued access token. In `get_current_user`, check `redis.get("jti_revoked:{jti}")` and raise 401 if set. Add `revoke_access_token(jti, ttl)` helper called from `change_password`, `enable_totp`, `disable_totp`, and admin account deactivation. Closes the 15-minute window where a revoked session's live access token remains valid.
-**Mode:** quick
-**Depends on**: Phase 7.1
-**Requirements**: Tracked in `.planning/codebase/CONCERNS.md` §"No JTI Claim and No JTI Revocation in Redis"
-
-**Status:** Not planned yet
-
---
-
-### Phase 7.3: Security — ES256 Algorithm Upgrade (INSERTED)
-
-**Goal**: Replace HS256 with ES256 (ECDSA P-256) for JWT signing. Generate a P-256 key pair; store private key in `JWT_PRIVATE_KEY` env var, public key in `JWT_PUBLIC_KEY`. Update `create_access_token` and all `decode_*` functions. Rotate all active refresh tokens on first boot after deploy. A leaked public key cannot forge tokens.
-**Mode:** quick
-**Depends on**: Phase 7.2
-**Requirements**: Tracked in `.planning/codebase/CONCERNS.md` §"JWT Algorithm Downgrade: HS256 Instead of ES256"
-
-**Plans**: 3 plans
-
-**Wave 0** — Test scaffolds (no production code)
-
- [x] 07.3-01-PLAN.md — Wave 0 xfail stubs: test_auth_es256.py (9 stubs covering ES256-01..05 + RM-01..03 + CFG-01 satellite) + extend test_settings_has_jwt_config for refresh_token_expire_hours
-
-**Wave 1** *(blocked on Wave 0)* — ES256 core + startup rotation
-
- [x] 07.3-02-PLAN.md — config.py jwt_private_key/jwt_public_key/refresh_token_expire_hours + services/auth.py 4 sites to ES256 + main.py _rotate_tokens_on_algorithm_change lifespan hook + docker-compose JWT_PRIVATE_KEY/JWT_PUBLIC_KEY + README key-gen snippet + .env.example + version bump 0.1.2
-
-**Wave 2** *(blocked on Wave 1)* — "Remember me" 16h/30d TTL split
-
- [x] 07.3-03-PLAN.md — create_refresh_token remember_me param + LoginRequest.remember_me + _set_refresh_cookie max_age conditional + LoginView.vue "Stay signed in for 30 days" checkbox + stores/auth.js + api/client.js forwarding + human checkpoint
-
-**Status:** Complete (2026-06-06)
-
---
-
-### Phase 7.4: Security — Token Fingerprinting / Token Binding (INSERTED)
-
-**Goal**: Add a `fgp` (fingerprint) claim = `hmac(key, User-Agent + Accept-Language)[:16]` to every issued access token. In `get_current_user`, recompute the fingerprint from the request headers and compare with `hmac.compare_digest`. Limits replay of stolen access tokens to the original device/browser context.
-**Mode:** quick
-**Depends on**: Phase 7.3
-**Requirements**: Tracked in `.planning/codebase/CONCERNS.md` §"No Token Fingerprint / Token Binding"
-
-**Plans**: 2 plans
-
-**Wave 0** — Test scaffolds (no production code)
-
- [x] 07.4-01-PLAN.md — Wave 0 xfail stubs: test_auth_fgp.py (4 stubs covering FGP-01..04)
-
-**Wave 1** *(blocked on Wave 0)* — Production implementation + test promotion
-
- [x] 07.4-02-PLAN.md — _compute_fgp helper + create_access_token fgp claim + get_current_user fgp validation + login/refresh call site updates + promote all 4 FGP tests
-
-**Status:** Complete (2026-06-06)
-
---
-
---
-
-## Milestones
-
- ✅ **v0.2 — UI Overhaul and Optimization** — Phases 8–11 (shipped 2026-06-17)
-
-<details>
-<summary>✅ v0.2 — UI Overhaul and Optimization (Phases 8–11) — SHIPPED 2026-06-17</summary>
-
- [x] Phase 8: Stack Upgrade & Backend Decomposition (8/8 plans) — completed 2026-06-12
- [x] Phase 9: Admin Panel Rearchitecture (5/5 plans) — completed 2026-06-13
- [x] Phase 10: UX & Interaction (13/13 plans) — completed 2026-06-16
- [x] Phase 11: Visual Design, Responsive Layout & Cleanup (7/7 plans) — completed 2026-06-17
-
-Full archive: `.planning/milestones/v0.2-ROADMAP.md`
-
-</details>
-
-## v0.2 + v0.1 Progress Table
-
-| Phase | Milestone | Plans Complete | Status | Completed |
-|-------|-----------|----------------|--------|-----------|
-| 8. Stack Upgrade & Backend Decomposition | v0.2 | 8/8 | Complete | 2026-06-12 |
-| 9. Admin Panel Rearchitecture | v0.2 | 5/5 | Complete | 2026-06-13 |
-| 10. UX & Interaction | v0.2 | 13/13 | Complete | 2026-06-16 |
-| 11. Visual Design, Responsive Layout & Cleanup | v0.2 | 7/7 | Complete | 2026-06-17 |
-| 1. Infrastructure Foundation | v0.1 | 5/5 | Complete | 2026-05-22 |
-| 2. Users & Authentication | v0.1 | 6/6 | Complete | 2026-06-01 |
-| 3. Document Migration & Multi-User Isolation | v0.1 | 5/5 | Complete | 2026-05-25 |
-| 4. Folders, Sharing, Quotas & Document UX | v0.1 | 9/9 | Complete | 2026-05-28 |
-| 5. Cloud Storage Backends | v0.1 | 12/12 | Complete | 2026-05-30 |
-| 6. Performance & Production Hardening | v0.1 | 6/6 | Complete | 2026-05-30 |
-| 6.1. Close v1.0 audit gaps | v0.1 | 2/2 | Complete | 2026-05-30 |
-| 6.2. Close v1 sharing + cloud-delete + CSV export gaps | v0.1 | 5/5 | Complete | 2026-05-31 |
-| 7. Redo and optimize LLM integration | v0.1 | 5/5 | Complete | 2026-06-05 |
-| 7.1. Security: session revocation on privilege change | v0.1 | 2/2 | Complete | 2026-06-08 |
-| 7.2. Security: JTI claim + Redis access-token revocation | v0.1 | 3/3 | Complete | 2026-06-05 |
-| 7.3. Security: ES256 algorithm upgrade | v0.1 | 3/3 | Complete | 2026-06-06 |
-| 7.4. Security: token fingerprinting / token binding | v0.1 | 2/2 | Complete | 2026-06-06 |
+*Roadmap proposed: 2026-06-17*
@@ -1,47 +1,50 @@
 ---
 gsd_state_version: 1.0
-milestone: v0.2
-milestone_name: UI Overhaul and Optimization
-current_phase: 11
-status: complete
-last_updated: "2026-06-17"
-last_activity: 2026-06-17 -- v0.2 milestone archived
+milestone: v0.3
+milestone_name: Reimagining Cloud Storage integration
+status: ready_to_plan
+last_updated: 2026-06-19T04:04:58.418Z
+last_activity: 2026-06-18 -- Phase 12 execution started
 progress:
-  total_phases: 4
-  completed_phases: 4
-  total_plans: 33
-  completed_plans: 33
-  percent: 100
+  total_phases: 5
+  completed_phases: 1
+  total_plans: 4
+  completed_plans: 69
+  percent: 20
+stopped_at: Phase 12 complete (4/4) — ready to discuss Phase 13
 ---

 # Project State

 **Project:** DocuVault
-**Status:** v0.2 milestone complete — ready for next milestone
+**Status:** Ready to plan
 **Last Updated:** 2026-06-17

 ## Current Position

-Milestone v0.2 shipped 2026-06-17. All 4 phases complete, 40/40 requirements satisfied.
-Next action: `/gsd:new-milestone` to define v0.3
+Phase: 13
+Plan: Not started
+Status: Executing Phase 12
+Last activity: 2026-06-19

 ## Phase Status

 | Phase | Requirements | Status |
 |-------|-------------|--------|
-| 8. Stack Upgrade & Backend Decomposition | PERF-01, CODE-01, CODE-02, CODE-03, CODE-04, CODE-08 | **Complete (8/8 plans)** |
-| 9. Admin Panel Rearchitecture | ADMIN-08..12, CODE-06, CODE-09 | **Complete (5/5 plans)** |
-| 10. UX & Interaction | UX-01..14, CODE-05 | **Complete (13/13 plans)** |
-| 11. Visual Design, Responsive Layout & Cleanup | VISUAL-01..04, RESP-01..05, CODE-07, PERF-02, PERF-03 | **Complete (7/7 plans)** |
+| 12. Cloud Resource Foundation | CONN-04, CLOUD-01, CLOUD-08, CACHE-01, CACHE-02, SYNC-01 | **Not started** |
+| 13. Virtual-Local Cloud Operations | CONN-01..03, CLOUD-02..07, CLOUD-09 | **Not started** |
+| 14. Selective Analysis and Byte Cache | ANALYZE-01..07, CACHE-03..05 | **Not started** |
+| 15. Unified Smart Search | SEARCH-01..07 | **Not started** |
+| 16. Change Tracking and Reliability | SYNC-02..04 | **Not started** |

 ## Performance Metrics

 | Metric | Value |
 |---|---|
-| Phases complete | 4 / 4 |
-| Requirements satisfied | 40 / 40 |
-| Plans complete | 33 / 33 |
-| Tests at close | 277 |
+| Phases complete | 0 / 5 |
+| Requirements satisfied | 0 / 36 |
+| Plans complete | 0 / 0 |
+| Tests at milestone start | 277 |

 ## Accumulated Context

@@ -66,6 +69,7 @@ Next action: `/gsd:new-milestone` to define v0.3
 - v0.1 completed: all 7 foundation phases + security hardening (2026-06-06)
 - v0.2 completed: UI overhaul, admin panel rearchitecture, responsive layout, codebase quality (2026-06-17)
 - v0.2 archived to `.planning/milestones/v0.2-ROADMAP.md`
+- v0.3 proposed: virtual-local cloud operations, selective cloud analysis, bounded byte caching, unified smart search, and provider change tracking

 ### Open Questions

@@ -81,7 +85,7 @@ _Updated at each phase transition._

 | Field | Value |
 |---|---|
-| Last session | 2026-06-17 — v0.2 milestone archived |
-| Next action | /gsd:new-milestone to define v0.3 |
+| Last session | 2026-06-17 — v0.3 roadmap proposed |
+| Next action | Approve roadmap, then discuss or plan Phase 12 |
 | Pending decisions | None |
 | Resume file | None |
@@ -0,0 +1,49 @@
+# Debug: Phase 12 Cloud Schema Cold Start
+
+**Status:** root cause found
+**Date:** 2026-06-19
+**UAT tests:** 1, 2
+
+## Symptoms
+
+- `GET /api/cloud/connections` raises `psycopg.errors.UndefinedColumn` for `cloud_connections.display_name_override`.
+- `POST /api/cloud/connections/webdav` reaches `_upsert_cloud_connection` and raises the same error, preventing Nextcloud account connection.
+
+## Root Cause
+
+The running application code and ORM are at Phase 12, but the live PostgreSQL schema remains at Alembic revision `0005`.
+
+Live evidence:
+
+```text
+$ docker compose run --rm backend alembic current
+0005
+```
+
+Migration `backend/migrations/versions/0006_cloud_resource_foundation.py` correctly adds `cloud_connections.display_name_override` and the Phase 12 cloud metadata tables. The ORM correctly maps that column. The defect is that `docker-compose.yml` has no migration service and the backend command starts Uvicorn directly. Backend, Celery worker, and Celery beat depend on PostgreSQL health, but none depends on `alembic upgrade head` completing. Therefore `docker compose up` can run new application code against an old persistent database.
+
+## Why Automated Tests Missed It
+
+- Most backend tests build schema directly from `Base.metadata.create_all`, which validates the final ORM shape but bypasses Alembic history and deployment ordering.
+- Existing Alembic tests target early migrations and do not exercise an existing PostgreSQL database upgraded from `0005` to `head`.
+- Phase verification checked migration file structure and model parity, not a real cold-start Compose upgrade path.
+
+## Files Involved
+
+- `docker-compose.yml` — no one-shot migration service; backend/workers start after DB health only.
+- `backend/migrations/versions/0006_cloud_resource_foundation.py` — contains the required column and tables but was not applied.
+- `backend/db/models.py` — queries `display_name_override`, exposing schema drift immediately.
+- `backend/tests/test_alembic.py` — lacks a 0005-to-head PostgreSQL upgrade regression.
+- `.planning/phases/12-cloud-resource-foundation/12-VALIDATION.md` — cold-start test expected migration completion, but execution evidence did not actually verify Compose migration orchestration.
+
+## Required Fix Direction
+
+1. Add a one-shot Compose migration service that runs `alembic upgrade head` with `DATABASE_MIGRATE_URL` after PostgreSQL becomes healthy.
+2. Make backend, Celery worker, and Celery beat wait for that migration service to complete successfully.
+3. Add a PostgreSQL/Compose regression proving an existing revision `0005` advances to `0006/head` before the API starts, and assert `display_name_override`, `cloud_items`, `cloud_item_topics`, and `cloud_folder_states` exist.
+4. Document the migration lifecycle and recovery command in README/RUNBOOK.
+5. For the currently running environment, apply `alembic upgrade head` and restart application processes before resuming UAT.
+
+## Scope
+
+Both UAT blockers share this root cause. No evidence currently indicates a separate Nextcloud credential or WebDAV defect.
@@ -0,0 +1,49 @@
+# Debug: Phase 12 Cloud Schema Cold Start
+
+**Status:** root cause found
+**Date:** 2026-06-19
+**UAT tests:** 1, 2
+
+## Symptoms
+
+- `GET /api/cloud/connections` raises `psycopg.errors.UndefinedColumn` for `cloud_connections.display_name_override`.
+- `POST /api/cloud/connections/webdav` reaches `_upsert_cloud_connection` and raises the same error, preventing Nextcloud account connection.
+
+## Root Cause
+
+The running application code and ORM are at Phase 12, but the live PostgreSQL schema remains at Alembic revision `0005`.
+
+Live evidence:
+
+```text
+$ docker compose run --rm backend alembic current
+0005
+```
+
+Migration `backend/migrations/versions/0006_cloud_resource_foundation.py` correctly adds `cloud_connections.display_name_override` and the Phase 12 cloud metadata tables. The ORM correctly maps that column. The defect is that `docker-compose.yml` has no migration service and the backend command starts Uvicorn directly. Backend, Celery worker, and Celery beat depend on PostgreSQL health, but none depends on `alembic upgrade head` completing. Therefore `docker compose up` can run new application code against an old persistent database.
+
+## Why Automated Tests Missed It
+
+- Most backend tests build schema directly from `Base.metadata.create_all`, which validates the final ORM shape but bypasses Alembic history and deployment ordering.
+- Existing Alembic tests target early migrations and do not exercise an existing PostgreSQL database upgraded from `0005` to `head`.
+- Phase verification checked migration file structure and model parity, not a real cold-start Compose upgrade path.
+
+## Files Involved
+
+- `docker-compose.yml` — no one-shot migration service; backend/workers start after DB health only.
+- `backend/migrations/versions/0006_cloud_resource_foundation.py` — contains the required column and tables but was not applied.
+- `backend/db/models.py` — queries `display_name_override`, exposing schema drift immediately.
+- `backend/tests/test_alembic.py` — lacks a 0005-to-head PostgreSQL upgrade regression.
+- `.planning/phases/12-cloud-resource-foundation/12-VALIDATION.md` — cold-start test expected migration completion, but execution evidence did not actually verify Compose migration orchestration.
+
+## Required Fix Direction
+
+1. Add a one-shot Compose migration service that runs `alembic upgrade head` with `DATABASE_MIGRATE_URL` after PostgreSQL becomes healthy.
+2. Make backend, Celery worker, and Celery beat wait for that migration service to complete successfully.
+3. Add a PostgreSQL/Compose regression proving an existing revision `0005` advances to `0006/head` before the API starts, and assert `display_name_override`, `cloud_items`, `cloud_item_topics`, and `cloud_folder_states` exist.
+4. Document the migration lifecycle and recovery command in README/RUNBOOK.
+5. For the currently running environment, apply `alembic upgrade head` and restart application processes before resuming UAT.
+
+## Scope
+
+Both UAT blockers share this root cause. No evidence currently indicates a separate Nextcloud credential or WebDAV defect.
@@ -0,0 +1,393 @@
+---
+phase: 10-ux-interaction
+plan: 13
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+  - frontend/src/components/ui/TreeItem.vue
+  - frontend/src/components/storage/StorageBrowser.vue
+  - frontend/src/App.vue
+  - frontend/src/components/documents/SearchBar.vue
+  - frontend/src/components/layout/OsDragOverlay.vue
+  - frontend/src/__tests__/keyboard.test.js
+  - frontend/src/components/ui/__tests__/TreeItem.test.js
+  - frontend/src/components/storage/__tests__/StorageBrowser.showSearch.test.js
+autonomous: true
+requirements: [UX-02, UX-03, UX-05, UX-06, UX-07, UX-08, UX-09]
+gap_closure: true
+
+must_haves:
+  truths:
+    - "Sidebar Cloud/Folder sections show animated shimmer rows while async data loads — no 'Loading…' text visible"
+    - "Admin routes (/admin/*) render with no AppSidebar — AdminLayout is the sole layout component"
+    - "Pressing '/', 'U', or 'N' in the file manager dispatches to the actual FileManagerView instance — not a RouterView proxy"
+    - "Pressing Escape in the search input clears the field and preserves focus — no browser-native blur"
+    - "Dropping an OS file on the drag overlay triggers upload — capture-phase window listener fires before folder-row handlers"
+    - "Search bar and sort controls are visible at the root of both local and cloud file browsers"
+  artifacts:
+    - path: "frontend/src/components/ui/TreeItem.vue"
+      provides: "Three animate-pulse shimmer rows in the v-if='loading' branch"
+      contains: "animate-pulse"
+    - path: "frontend/src/components/storage/StorageBrowser.vue"
+      provides: "showSearch computed returns true for mode === 'local' OR mode === 'cloud'"
+    - path: "frontend/src/App.vue"
+      provides: "Third template branch for admin routes (no AppSidebar); getFileManagerInstance() via matched.find for keyboard dispatch"
+    - path: "frontend/src/components/documents/SearchBar.vue"
+      provides: "@keydown.escape.prevent.stop suppresses browser native blur on type='search'"
+    - path: "frontend/src/components/layout/OsDragOverlay.vue"
+      provides: "window drop listener registered with capture=true; removeEventListener also passes true"
+  key_links:
+    - from: "frontend/src/App.vue (onKeydown)"
+      to: "FileManagerView.focusSearch / triggerUpload / startNewFolder"
+      via: "router.currentRoute.value.matched.find(r => r.instances?.default)?.instances?.default"
+      pattern: "instances\\.default"
+    - from: "frontend/src/components/layout/OsDragOverlay.vue"
+      to: "window drop event"
+      via: "addEventListener('drop', handler, true)"
+      pattern: "addEventListener.*drop.*true"
+---
+
+<objective>
+Close all 6 UAT gaps from 10-UAT.md that block Phase 10 sign-off: sidebar shimmer (Gap 1), search-at-root visibility (Gap 2), admin sidebar bleed (Gap 3), keyboard shortcuts broken by RouterView proxy (Gap 4 — covers tests 11, 12, 13), Escape-breaks-search (Gap 5), and OS drag-drop not uploading (Gap 6).
+
+Purpose: Phase 10 is recorded complete in ROADMAP.md but UAT (10-UAT.md) shows 9 issues with 6 distinct root causes diagnosed. These targeted fixes close all 6 causes with minimal code change, restoring full UAT pass.
+
+Output: Five production files modified, three test files added. No new dependencies. No regressions.
+</objective>
+
+<execution_context>
+@/Users/nik/.claude/get-shit-done/workflows/execute-plan.md
+@/Users/nik/.claude/get-shit-done/templates/summary.md
+</execution_context>
+
+<context>
+@/Users/nik/Documents/Progamming/document_scanner/.planning/PROJECT.md
+@/Users/nik/Documents/Progamming/document_scanner/.planning/ROADMAP.md
+@/Users/nik/Documents/Progamming/document_scanner/.planning/STATE.md
+@/Users/nik/Documents/Progamming/document_scanner/.planning/phases/10-ux-interaction/10-UAT.md
+
+<interfaces>
+<!-- Key contracts the executor needs. Extracted from codebase. No codebase exploration needed. -->
+
+From frontend/src/App.vue (current full state — relevant sections):
+```html
+<!-- Template — only two branches today: -->
+<AuthLayout v-if="route.meta.layout === 'auth'" />
+<div v-else class="flex h-screen overflow-hidden">
+  <AppSidebar />
+  <main class="flex-1 overflow-y-auto">
+    <router-view ref="routeViewRef" />   <!-- resolves to RouterView proxy, NOT FileManagerView -->
+  </main>
+</div>
+<ToastContainer />
+<OsDragOverlay @files-dropped="onOsFilesDropped" />
+```
+```js
+// script setup
+import { ref, onMounted, onUnmounted } from 'vue'
+import { useRoute } from 'vue-router'
+const route = useRoute()
+const routeViewRef = ref(null)         // ← remove this
+
+function onOsFilesDropped(files) {
+  routeViewRef.value?.handleOsDrop?.(files)  // ← fix to use getFileManagerInstance()
+}
+function onKeydown(e) {
+  // guard: INPUT/TEXTAREA/SELECT/contentEditable + dialog check omitted here
+  routeViewRef.value?.focusSearch?.()    // line 37 ← fix
+  routeViewRef.value?.clearSearch?.()    // line 40 ← fix
+  routeViewRef.value?.triggerUpload?.()  // line 43 ← fix
+  routeViewRef.value?.startNewFolder?.() // line 46 ← fix
+}
+```
+
+From frontend/src/router/index.js — admin route meta:
+```js
+{
+  path: '/admin',
+  component: () => import('../layouts/AdminLayout.vue'),
+  meta: { requiresAdmin: true },   // only on parent; children resolved via matched.some()
+  children: [/* AdminOverviewView, AdminUsersView, AdminQuotasView, AdminAiView, AdminAuditView */]
+}
+```
+
+From frontend/src/components/ui/TreeItem.vue — loading branch to replace (lines 48-52):
+```html
+<div
+  v-if="loading"
+  class="text-xs text-gray-400 py-1"
+  :style="{ paddingLeft: `${(depth + 1) * 12 + 8}px` }"
+>
+  Loading…
+</div>
+```
+
+Shimmer pattern to replicate (from AppSidebar.vue lines 60-64):
+```html
+<div v-if="loadingRoots" class="pl-7 py-1 space-y-1">
+  <div v-for="n in 3" :key="`sk-f-${n}`" class="flex items-center gap-2 py-1">
+    <div class="w-4 h-4 bg-gray-100 rounded animate-pulse shrink-0"></div>
+    <div class="h-3 bg-gray-100 rounded animate-pulse" :style="{ width: (50 + n * 15) + 'px' }"></div>
+  </div>
+</div>
+```
+
+From frontend/src/components/storage/StorageBrowser.vue line 287:
+```js
+const showSearch = computed(() => props.mode === 'local' && props.breadcrumb.length > 0)
+// TARGET STATE:
+const showSearch = computed(() => props.mode === 'local' || props.mode === 'cloud')
+```
+
+From frontend/src/components/documents/SearchBar.vue line 11:
+```html
+@keydown.escape="emit('update:modelValue', '')"
+<!-- TARGET STATE: -->
+@keydown.escape.prevent.stop="emit('update:modelValue', '')"
+```
+
+From frontend/src/components/layout/OsDragOverlay.vue (Options API — lines 52-63):
+```js
+mounted() {
+  window.addEventListener('dragenter', this.onDragEnter)
+  window.addEventListener('dragleave', this.onDragLeave)
+  window.addEventListener('dragover', this.onDragOver)
+  window.addEventListener('drop', this.onDrop)            // ← bubble phase; must become capture
+},
+beforeUnmount() {
+  window.removeEventListener('dragenter', this.onDragEnter)
+  window.removeEventListener('dragleave', this.onDragLeave)
+  window.removeEventListener('dragover', this.onDragOver)
+  window.removeEventListener('drop', this.onDrop)         // ← must match with true
+}
+```
+
+From frontend/src/views/FileManagerView.vue defineExpose (lines 190-196):
+```js
+// These ARE correct — all methods are exposed. The problem is App.vue never reaches this instance.
+defineExpose({
+  focusSearch: () => browserRef.value?.focusSearch?.(),
+  triggerUpload: () => browserRef.value?.triggerUpload?.(),
+  startNewFolder: () => browserRef.value?.startNewFolder?.(),
+  clearSearch: () => browserRef.value?.clearSearch?.(),
+  handleOsDrop: (files) => onFilesSelected({ files, autoClassify: true }),
+})
+```
+
+From frontend/src/__tests__/keyboard.test.js (existing structure):
+Uses mountFileManager() helper, vi.mock('../api/client.js', ...), vi.mock('../stores/auth.js', ...),
+vi.mock('../stores/topics.js', ...), setActivePinia(createPinia()), createRouter+createMemoryHistory.
+</interfaces>
+</context>
+
+<tasks>
+
+<task type="auto">
+  <name>Task 1: Sidebar shimmer rows (TreeItem.vue) and search-at-root (StorageBrowser.vue)</name>
+  <files>
+    frontend/src/components/ui/TreeItem.vue
+    frontend/src/components/storage/StorageBrowser.vue
+  </files>
+  <action>
+    TreeItem.vue — replace the v-if="loading" div (lines 48-52) with a shimmer block. The replacement wraps three shimmer rows in a single container div. Apply the indent :style on the container (same binding the removed div had: `{ paddingLeft: \`\${(depth + 1) * 12 + 8}px\` }`). The container also gets `class="py-1 space-y-1"`. Each of the three inner rows uses `class="flex items-center gap-2 py-1"` and contains two children:
+    - Icon placeholder: `class="w-4 h-4 bg-gray-100 rounded animate-pulse shrink-0"`
+    - Text placeholder: `class="h-3 bg-gray-100 rounded animate-pulse"` with `:style="{ width: (50 + n * 15) + 'px' }"`
+    Use `v-for="n in 3"` with `:key="\`sk-t-\${n}\`"` on the inner row div.
+    Do not change any other branch (v-else-if loadError, v-else-if children.length===0, slot children) or any script section.
+
+    StorageBrowser.vue — change line 287 only. Change:
+      `const showSearch = computed(() => props.mode === 'local' && props.breadcrumb.length > 0)`
+    to:
+      `const showSearch = computed(() => props.mode === 'local' || props.mode === 'cloud')`
+    No template changes needed — SearchBar and SortControls already share v-if="showSearch".
+  </action>
+  <verify>
+    <automated>cd /Users/nik/Documents/Progamming/document_scanner/frontend && grep -c "animate-pulse" src/components/ui/TreeItem.vue && grep "showSearch" src/components/storage/StorageBrowser.vue | grep "cloud"</automated>
+  </verify>
+  <done>
+    - `grep -c "animate-pulse" src/components/ui/TreeItem.vue` returns at least 2
+    - `grep -c "Loading" src/components/ui/TreeItem.vue` returns 0
+    - `grep "showSearch" src/components/storage/StorageBrowser.vue` contains `props.mode === 'cloud'`
+  </done>
+</task>
+
+<task type="auto">
+  <name>Task 2: Admin sidebar bleed and keyboard instance resolution (App.vue)</name>
+  <files>frontend/src/App.vue</files>
+  <action>
+    Two root causes, one file. Apply both changes together.
+
+    CHANGE A — Admin sidebar bleed (Gap 3):
+    Insert a v-else-if branch in the template between the auth branch and the user-layout div. The new branch condition is `route.matched.some(r => r.meta.requiresAdmin)`. When true it renders only `<router-view />` — no AppSidebar, no main wrapper. The complete corrected template root (inside the component root, excluding ToastContainer and OsDragOverlay which stay unchanged):
+
+      1. `<AuthLayout v-if="route.meta.layout === 'auth'" />`
+      2. `<router-view v-else-if="route.matched.some(r => r.meta.requiresAdmin)" />`
+      3. `<div v-else class="flex h-screen overflow-hidden">` ... AppSidebar + main + router-view (no ref attribute) ... `</div>`
+
+    Note: the router-view in branch 3 must NOT carry `ref="routeViewRef"` — refs on router-view resolve to the RouterView proxy (same root cause as Gap 4). Remove the ref attribute.
+
+    CHANGE B — Keyboard instance resolution (Gap 4, also fixes tests 12 and 13):
+    The `routeViewRef` ref and its usage must be replaced with a direct instance lookup:
+    1. Add `useRouter` to the `vue-router` import: `import { useRoute, useRouter } from 'vue-router'`
+    2. Add `const router = useRouter()` after `const route = useRoute()`
+    3. Add helper: `function getFileManagerInstance() { return router.currentRoute.value.matched.find(r => r.instances?.default)?.instances?.default ?? null }`
+    4. Remove `const routeViewRef = ref(null)` — no longer used
+    5. Remove `ref` from the `ref` import if it is now unused (check — ref was only used for routeViewRef)
+    6. Replace all `routeViewRef.value?.X?.()` calls in onKeydown with `getFileManagerInstance()?.X?.()`
+    7. Replace `routeViewRef.value?.handleOsDrop?.(files)` in onOsFilesDropped with `getFileManagerInstance()?.handleOsDrop?.(files)`
+
+    After both changes, `ref` from vue should be removed from the import line if nothing else uses it (check first — if ToastContainer or OsDragOverlay use a local ref, keep it; otherwise remove to avoid lint warnings).
+  </action>
+  <verify>
+    <automated>cd /Users/nik/Documents/Progamming/document_scanner/frontend && grep "routeViewRef" src/App.vue; echo "exit:$?"; grep "instances.default" src/App.vue; grep "requiresAdmin" src/App.vue</automated>
+  </verify>
+  <done>
+    - `grep "routeViewRef" src/App.vue` returns no output (fully removed)
+    - `grep "instances.default" src/App.vue` returns the getFileManagerInstance() line
+    - `grep "requiresAdmin" src/App.vue` returns the v-else-if template branch
+    - `grep "useRouter" src/App.vue` appears in import and instantiation
+  </done>
+</task>
+
+<task type="auto">
+  <name>Task 3: Escape modifier (SearchBar.vue) and capture-phase drop (OsDragOverlay.vue)</name>
+  <files>
+    frontend/src/components/documents/SearchBar.vue
+    frontend/src/components/layout/OsDragOverlay.vue
+  </files>
+  <action>
+    SearchBar.vue — one character change on line 11. Add `.prevent.stop` modifiers to `@keydown.escape`:
+    Before: `@keydown.escape="emit('update:modelValue', '')"`
+    After:  `@keydown.escape.prevent.stop="emit('update:modelValue', '')"`
+    `.prevent` stops the browser's native clear+blur behavior on type="search" inputs. `.stop` stops bubbling to App.vue's global keydown handler (which would call clearSearch() a second time). No other changes.
+
+    OsDragOverlay.vue — two lines change in the Options API lifecycle hooks:
+    In mounted(): change `window.addEventListener('drop', this.onDrop)` to `window.addEventListener('drop', this.onDrop, true)`
+    In beforeUnmount(): change `window.removeEventListener('drop', this.onDrop)` to `window.removeEventListener('drop', this.onDrop, true)`
+
+    The third argument `true` registers the listener in capture phase, meaning it runs before any bubble-phase handlers on child elements (including `@drop.prevent` on folder rows in StorageBrowser.vue). The removeEventListener MUST also pass `true` — EventTarget tracks bubble-phase and capture-phase registrations separately, so without `true` the cleanup call would fail silently and the listener would leak.
+
+    Do not change dragenter, dragleave, or dragover listeners — those remain in bubble phase and work correctly.
+  </action>
+  <verify>
+    <automated>cd /Users/nik/Documents/Progamming/document_scanner/frontend && grep "keydown.escape" src/components/documents/SearchBar.vue && grep -n "addEventListener.*drop\|removeEventListener.*drop" src/components/layout/OsDragOverlay.vue</automated>
+  </verify>
+  <done>
+    - `grep "keydown.escape" src/components/documents/SearchBar.vue` shows `.prevent.stop` in the modifier chain
+    - `grep "addEventListener.*drop" src/components/layout/OsDragOverlay.vue` shows `true` as third argument
+    - `grep "removeEventListener.*drop" src/components/layout/OsDragOverlay.vue` shows `true` as third argument
+  </done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 4: Regression tests for all 6 gaps</name>
+  <files>
+    frontend/src/__tests__/keyboard.test.js
+    frontend/src/components/ui/__tests__/TreeItem.test.js
+    frontend/src/components/storage/__tests__/StorageBrowser.showSearch.test.js
+  </files>
+  <behavior>
+    TreeItem shimmer:
+    - When loading=true and expanded=true → rendered HTML contains elements with class "animate-pulse"
+    - When loading=true and expanded=true → text "Loading" does not appear in rendered HTML
+
+    StorageBrowser showSearch:
+    - mode='local', breadcrumb=[] → showSearch is true (root-level local, previously false)
+    - mode='local', breadcrumb=[{name:'Folder'}] → showSearch is true (non-root local)
+    - mode='cloud', breadcrumb=[] → showSearch is true (cloud root, previously always false)
+    - mode='shared' → showSearch is false
+
+    App.vue keyboard dispatch:
+    - matched.find(r => r.instances?.default)?.instances?.default on a mounted FileManagerView router returns an object with focusSearch defined
+  </behavior>
+  <action>
+    keyboard.test.js — append a new describe block at the end of the existing file (do not modify or move existing describes):
+
+    "Gap 4: getFileManagerInstance resolves to actual component, not RouterView proxy" — using the existing mountFileManager() helper and makeRouter(), after mounting FileManagerView and flushing promises, access `router.currentRoute.value.matched.find(r => r.instances?.default)?.instances?.default` and assert that it is not null and has a `focusSearch` property. This proves the resolution mechanism the refactored App.vue uses is correct. Import `useRouter` from vue-router at the top if not already imported — check existing imports first.
+
+    TreeItem.test.js — create at `frontend/src/components/ui/__tests__/TreeItem.test.js`:
+    - Import: `describe, it, expect, vi` from vitest; `mount, flushPromises` from @vue/test-utils; TreeItem from the component
+    - Mock AppIcon: `vi.mock('../AppIcon.vue', () => ({ default: { template: '<span/>' } }))`
+    - Helper: `mountExpanded(overrides = {})` — mounts TreeItem with `label="Test"`, `loadChildren: vi.fn().mockResolvedValue([])`, `expandable: true` and spreads overrides. After mount, call `w.vm.toggleExpand()` via `w.vm.$.setupState.toggleExpand()` (or trigger the expand button click) and flush promises to reach expanded state with children loaded.
+    - For the loading=true test: mount with a loadChildren that returns a promise that never resolves (`new Promise(() => {})`). Click the expand button to trigger load. Before flushing, assert the HTML. The loading ref will be true while the promise is pending.
+    - describe "Gap 1: sidebar shimmer rows": two tests as per behavior block above.
+    - describe "Gap 1 regression: non-loading branches unchanged": one test asserting that with loadChildren resolving to [] and expanded, the "Empty" text appears (sibling v-else-if branch guard).
+
+    StorageBrowser.showSearch.test.js — create at `frontend/src/components/storage/__tests__/StorageBrowser.showSearch.test.js`:
+    - Heavy stub setup: all child components that StorageBrowser imports must be stubbed (SearchBar, SortControls, DocumentCard, FolderRow, EmptyState, AppIcon, BreadcrumbBar, DropZone, etc.) — use `stubs: { SearchBar: true, SortControls: true, ... }` in global mount options or individual vi.mock calls.
+    - Mock all API calls used on mount (listDocuments, listFolders, etc.) via vi.mock('../../../api/client.js', ...).
+    - After mount with given props, access `w.vm.showSearch` directly as a computed.
+    - Props for mount: at minimum `mode`, `breadcrumb`, `documents: []`, `folders: []`, `topicColorFn: () => '#000'`, `loading: false`.
+    - Four it() blocks as per behavior block above.
+    - Wrap in `describe("Gap 2: showSearch visible at root for local and cloud modes", ...)`.
+
+    All new tests run as part of `npm run test -- --run` without additional flags.
+  </action>
+  <verify>
+    <automated>cd /Users/nik/Documents/Progamming/document_scanner/frontend && npm run test -- --reporter=verbose --run 2>&1 | grep -E "(PASS|FAIL|SKIP| ✓ | × | ✗ )" | tail -50</automated>
+  </verify>
+  <done>
+    - All new describe blocks appear in output with passing test indicators
+    - `npm run test -- --run` exits 0 with zero failures
+    - `grep -c "animate-pulse" src/components/ui/__tests__/TreeItem.test.js` returns at least 1
+    - `grep -c "showSearch" src/components/storage/__tests__/StorageBrowser.showSearch.test.js` returns at least 4
+  </done>
+</task>
+
+</tasks>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| OS file drag → window drop (capture) | Files arrive via browser DataTransfer API — browser-enforced; no network boundary crossed; payload handled only client-side before going through existing authenticated upload flow |
+| Admin route layout selection | Template branch selection is display-only — backend enforces admin access via get_current_admin dep on every admin endpoint; changing template rendering creates no auth regression |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Disposition | Mitigation Plan |
+|-----------|----------|-----------|-------------|-----------------|
+| T-10gc-01 | Tampering | OsDragOverlay capture-phase drop handler | accept | Handler reads only e.dataTransfer.files (browser-controlled), resets overlay state, emits to parent — no direct server interaction; upload goes through existing authenticated API path unchanged |
+| T-10gc-02 | Spoofing | router.currentRoute.value.matched.find().instances.default | accept | Read-only Vue internals lookup; no user-supplied data flows through this path; cannot be spoofed via URL manipulation — Vue populates instances after component mount, not from route params |
+| T-10gc-03 | Elevation of Privilege | App.vue v-else-if admin branch | accept | Branch adds a missing layout guard (removes AppSidebar for admin); it does not grant or deny route access — navigation guard in router/index.js is unchanged and continues to enforce requiresAdmin check |
+| T-10gc-SC | Tampering | npm/pip/cargo installs | accept | No new packages installed — all fixes are template/script edits to existing files |
+</threat_model>
+
+<verification>
+Manual UAT re-run checklist (all must pass before marking complete):
+
+Gap 1 — Sidebar shimmer: Expand a cloud provider tree item in the sidebar while data loads. Animated shimmer rows appear; "Loading…" text is absent.
+
+Gap 2 — Search at root: Navigate to / (file manager root, no folder entered). Search bar and sort controls are visible in the content area header.
+
+Gap 3 — Admin sidebar: Navigate to /admin/users in a logged-in admin session. Only the AdminLayout and AdminSidebar render — AppSidebar (user nav) is absent.
+
+Gap 4 — Keyboard shortcuts: With the file manager at root, press '/'. Search bar receives cursor focus. Press 'U'. File picker dialog opens. Press 'N'. New folder inline input appears.
+
+Gap 5 — Escape behavior: Type text into the search bar. Press Escape. Field clears. Cursor remains in the field. Type again immediately — new characters appear (no re-click required).
+
+Gap 6 — OS drag-drop: Drag a file from Finder/Explorer over the browser window. Overlay appears. Release the file. Upload begins (progress visible or toast appears).
+
+Automated gate:
+`cd frontend && npm run test -- --run` — exits 0, zero failures, no skipped tests regressed.
+</verification>
+
+<success_criteria>
+- All 6 UAT gaps confirmed closed by manual re-run of the 6 scenarios above
+- `npm run test -- --run` exits 0 with zero failures across the full suite (baseline: 211 passing)
+- Five production files modified with surgical changes only — no refactors, no feature additions
+- Three new test files committed with passing tests covering each gap
+- `grep -c "Loading" frontend/src/components/ui/TreeItem.vue` returns 0
+- `grep "showSearch" frontend/src/components/storage/StorageBrowser.vue` matches the `|| props.mode === 'cloud'` form
+- `grep "routeViewRef" frontend/src/App.vue` returns empty
+- `grep "requiresAdmin" frontend/src/App.vue` returns the v-else-if template branch line
+- `grep "addEventListener.*drop.*true" frontend/src/components/layout/OsDragOverlay.vue` returns a match
+- `grep "removeEventListener.*drop.*true" frontend/src/components/layout/OsDragOverlay.vue` returns a match
+- `grep "prevent.stop" frontend/src/components/documents/SearchBar.vue` returns the escape handler line
+</success_criteria>
+
+<output>
+Create `/Users/nik/Documents/Progamming/document_scanner/.planning/phases/10-ux-interaction/10-13-SUMMARY.md` when done.
+</output>
@@ -0,0 +1,42 @@
+---
+phase: 11-visual-design-responsive-layout-cleanup
+plan: 1
+type: execute
+wave: 0
+depends_on: [10-complete]
+requirements: [PERF-02]
+files_modified:
+  - frontend/vite.config.js
+  - .planning/phases/11-visual-design-responsive-layout-cleanup/11-RESEARCH.md
+  - .planning/perf/phase11-baseline.html
+  - .planning/perf/phase11-baseline-summary.md
+autonomous: true
+---
+
+# Plan 11-01 — Bundle Baseline & UI Audit
+
+## Objective
+
+Capture the Phase 11 pre-optimization bundle baseline before any lazy-loading or visual cleanup begins, then record a targeted audit of the visual/responsive issues Phase 11 will address.
+
+## Tasks
+
+1. Wire existing `rollup-plugin-visualizer` into `frontend/vite.config.js` behind an opt-in environment flag such as `ANALYZE=true`. The dependency already exists in `frontend/package.json`.
+2. Run a production build with analysis enabled and write the baseline report to `.planning/perf/phase11-baseline.html`.
+3. Add `.planning/perf/phase11-baseline-summary.md` with bundle size, largest chunks, route/component observations, and the exact command used.
+4. Update `11-RESEARCH.md` if execution discovers facts that differ from the refresh research.
+5. Audit the frontend for Phase 11 targets:
+   - synchronous non-critical route imports
+   - responsive sidebar/admin sidebar gaps
+   - tables or grids that overflow below `sm`/`md`
+   - modal overflow below 640px
+   - inconsistent form, hover, focus, active, spacing, and typography patterns
+   - unreferenced files and imports
+
+## Acceptance Criteria
+
+- Baseline bundle report exists before any Phase 11 optimization commits.
+- `vite.config.js` does not generate analyzer output unless explicitly requested.
+- `11-RESEARCH.md` remains accurate after the baseline build.
+- Audit notes are concrete enough that plans 11-02 through 11-06 can execute without rediscovering scope.
+- `cd frontend && npm run build` succeeds with and without analysis enabled.
@@ -0,0 +1,43 @@
+---
+phase: 11-visual-design-responsive-layout-cleanup
+plan: 2
+type: execute
+wave: 1
+depends_on: [11-01]
+requirements: [PERF-03]
+files_modified:
+  - frontend/src/router/index.js
+  - frontend/src/router/__tests__/router.guard.test.js
+autonomous: true
+---
+
+# Plan 11-02 — Lazy-Load Non-Critical Routes
+
+## Objective
+
+Satisfy PERF-03 by lazy-loading every route component that is not needed for the initial render, while preserving auth/admin guard behavior.
+
+## Tasks
+
+1. Keep `FileManagerView` synchronous for `/` as the critical first authenticated surface unless the baseline report shows a strong reason to split it. Document this in `router/index.js` near the import.
+2. Replace synchronous imports in `frontend/src/router/index.js` for non-initial routes:
+   - `TopicsView`
+   - `DocumentView`
+   - `SettingsView`
+   - `CloudStorageView`
+   - `CloudFolderView`
+3. Keep `/folders/:folderId` on the same `FileManagerView` component for behavior parity with `/`; it is already in the initial chunk because `/` uses the same component.
+4. Preserve existing lazy auth/admin/shared route imports.
+5. Extend router tests so guard behavior is verified with lazy route components:
+   - non-admin cannot enter `/admin/*`
+   - admin redirects away from non-admin routes
+   - refresh-before-guard still runs when access token is absent
+   - `/topics`, `/document/:id`, `/settings`, `/cloud`, and `/cloud/:provider/:folderId` still resolve
+6. Build once and confirm route chunks are emitted.
+
+## Acceptance Criteria
+
+- `rg "import .*View" frontend/src/router/index.js` only returns `FileManagerView` unless a new initial-render route is explicitly justified.
+- Admin child routes remain lazy-loaded.
+- Router guard tests pass.
+- `cd frontend && npm run build` succeeds and emits split route chunks.
@@ -0,0 +1,52 @@
+---
+phase: 11-visual-design-responsive-layout-cleanup
+plan: 3
+type: execute
+wave: 2
+depends_on: [11-02]
+requirements: [RESP-01, RESP-02, RESP-03, RESP-05]
+files_modified:
+  - frontend/src/App.vue
+  - frontend/src/layouts/AdminLayout.vue
+  - frontend/src/components/layout/AppSidebar.vue
+  - frontend/src/components/admin/AdminSidebar.vue
+  - frontend/src/components/storage/StorageBrowser.vue
+  - frontend/src/__tests__/keyboard.test.js
+  - frontend/src/components/storage/__tests__/StorageBrowser.skeleton.test.js
+autonomous: true
+---
+
+# Plan 11-03 — Responsive Shells & Storage Rows
+
+## Objective
+
+Make both user and admin layouts usable below `lg`, and make storage rows fit smaller viewports without losing core actions.
+
+## Tasks
+
+1. Use layout-local drawer refs, not a new Pinia store:
+   - `App.vue` owns user drawer state.
+   - `AdminLayout.vue` owns admin drawer state.
+   - Watch route changes in each layout root and close the drawer after navigation.
+   - Do not put drawer state in `AppSidebar.vue` or `AdminSidebar.vue`.
+2. Add a mobile-only header with a hamburger button for the user layout.
+3. Hide `AppSidebar` below `lg`; open it in a slide-in overlay drawer with backdrop tap, route-change close, and `translate-x-0` / `-translate-x-full` transition.
+4. Apply the same responsive shell behavior to `AdminLayout` and `AdminSidebar`.
+5. Update `StorageBrowser` row/grid classes so:
+   - Size column hides below `md`
+   - Modified column hides below `sm`
+   - icon, name, and actions remain visible
+   - grid templates do not reserve hidden column widths on mobile
+6. Ensure inline icon action buttons have at least `36px` touch targets below `md`.
+7. Add or update tests for drawer open/close, route-change close, admin drawer behavior, responsive column classes, and touch target classes.
+8. Verify with browser screenshots or Playwright at 375px, 768px, 1024px, and desktop width.
+
+## Acceptance Criteria
+
+- User sidebar is hidden below 1024px and accessible through a hamburger drawer.
+- Admin sidebar has matching mobile behavior.
+- Drawer closes on backdrop tap and navigation tap.
+- Storage rows satisfy RESP-02 without horizontal overflow at 375px.
+- Icon actions satisfy RESP-03.
+- Drawer state is owned only by `App.vue` and `AdminLayout.vue`.
+- Frontend tests and build pass.
@@ -0,0 +1,40 @@
+---
+phase: 11-visual-design-responsive-layout-cleanup
+plan: 4
+type: execute
+wave: 3
+depends_on: [11-03]
+requirements: [VISUAL-02, RESP-04]
+files_modified:
+  - frontend/tailwind.config.js
+  - frontend/src/components/**/*.vue
+  - frontend/src/views/**/*.vue
+autonomous: true
+---
+
+# Plan 11-04 — Forms Baseline & Mobile-Safe Modals
+
+## Objective
+
+Normalize form controls through `@tailwindcss/forms` and make every modal scroll safely on mobile viewports.
+
+## Tasks
+
+1. Confirm `@tailwindcss/forms` remains installed and active in `tailwind.config.js`; it is already wired today, so this should be a verification step unless execution finds drift.
+2. Audit inputs, selects, textareas, checkboxes, and radio buttons for conflicting per-component browser-reset styles.
+3. Normalize form classes to the smallest consistent Tailwind pattern already used by the app.
+4. Update modal shells so content below 640px is scrollable and never exceeds viewport height:
+   - `ShareModal.vue`: centered panel gets mobile `max-h` and `overflow-y-auto`.
+   - `CloudCredentialModal.vue`: tall WebDAV/Nextcloud form gets mobile `max-h` and `overflow-y-auto`.
+   - `FolderDeleteModal.vue`: adopt the same mobile-safe panel pattern.
+   - `DocumentPreviewModal.vue`: preserve full-screen preview but verify header/content sizing at narrow widths.
+   - any auth/account confirmation modal-like surfaces found in the audit
+5. Add focused tests or DOM assertions for mobile-safe modal classes and form baseline coverage.
+
+## Acceptance Criteria
+
+- Forms plugin is active and relied on consistently.
+- No modal content overflows a 375x667 viewport.
+- No modal text or action row is clipped below 640px.
+- The desktop modal appearance remains behaviorally unchanged.
+- `npm run test -- --run` and `npm run build` pass.
@@ -0,0 +1,46 @@
+---
+phase: 11-visual-design-responsive-layout-cleanup
+plan: 5
+type: execute
+wave: 4
+depends_on: [11-04]
+requirements: [VISUAL-01, VISUAL-03, VISUAL-04]
+files_modified:
+  - frontend/src/components/**/*.vue
+  - frontend/src/views/**/*.vue
+autonomous: true
+---
+
+# Plan 11-05 — Visual Consistency Pass
+
+## Objective
+
+Make spacing, typography, hover, focus-visible, and active states consistent across the frontend without introducing a component-library rewrite.
+
+## Tasks
+
+1. Preserve legitimate data-driven inline styles:
+   - topic color swatches
+   - quota/progress widths
+   - Teleport dropdown coordinates
+   - tree indentation
+2. Remove arbitrary spacing and decorative inline styles unless they are data-driven layout values with no Tailwind equivalent.
+3. Normalize typography to this app scale:
+   - page title: `text-2xl font-semibold`
+   - section title: `text-lg font-semibold`
+   - panel/table heading: `text-sm font-semibold`
+   - body: `text-sm`
+   - caption/metadata: `text-xs`
+4. Replace generic `focus:ring-*` only patterns on interactive elements with this keyboard focus convention: `focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500 focus-visible:ring-offset-1`.
+5. Ensure buttons, links, card rows, table rows, menu items, and icon actions have coherent hover and active states.
+6. Avoid broad palette changes; preserve the current DocuVault identity while removing one-off visual drift.
+7. Add focused tests or static checks for the agreed invariants where practical.
+
+## Acceptance Criteria
+
+- No unnecessary `px-[...]`, margin `style=`, or one-off typography overrides remain.
+- Interactive elements have hover plus keyboard-visible focus states.
+- Typography reads as one app scale, not per-component choices.
+- Data-driven inline styles remain where they carry runtime values.
+- Visual changes are behavior-preserving.
+- Frontend tests and build pass.
@@ -0,0 +1,45 @@
+---
+phase: 11-visual-design-responsive-layout-cleanup
+plan: 6
+type: execute
+wave: 5
+depends_on: [11-05]
+requirements: [CODE-07, PERF-02]
+files_modified:
+  - frontend/src/**/*
+  - .planning/perf/phase11-final.html
+  - .planning/perf/phase11-final-summary.md
+  - .planning/phases/11-visual-design-responsive-layout-cleanup/11-VERIFICATION.md
+autonomous: true
+---
+
+# Plan 11-06 — Dead-Code Cleanup & Final Measurement
+
+## Objective
+
+Delete unreferenced frontend code and capture the final bundle report after all Phase 11 optimizations are complete.
+
+## Tasks
+
+1. Run dead-code searches for unreferenced components, stores, helpers, imports, and old route views.
+2. Explicitly classify these known suspects before deleting or retaining:
+   - `frontend/src/views/AccountView.vue` (`/account` currently redirects to `/settings`)
+   - `frontend/src/components/admin/__tests__/AdminAiConfigTab.test.js`
+   - `frontend/src/components/admin/__tests__/AdminQuotasTab.test.js`
+   - `frontend/src/components/admin/__tests__/AdminUsersTab.test.js`
+3. Confirm `HomeView.vue`, `FolderView.vue`, and `AdminView.vue` remain absent.
+4. Delete files with no active route and no active import in the same commit as their references are removed.
+5. Remove unused imports and stale tests that target deleted files; keep behavior tests that still protect live surfaces.
+6. Run the final analyzer build and write `.planning/perf/phase11-final.html`.
+7. Add `.planning/perf/phase11-final-summary.md` comparing baseline vs final bundle size, chunk count, and largest chunks.
+8. Produce `11-VERIFICATION.md` mapping every Phase 11 requirement to code/test/build evidence.
+
+## Acceptance Criteria
+
+- CODE-07 is satisfied: no dead files, unused route components, unused stores, or unused imports remain.
+- Known suspects are each documented as deleted or intentionally retained.
+- Final bundle report and summary are committed under `.planning/perf/`.
+- Baseline and final reports are both present.
+- `cd frontend && npm run test -- --run` passes.
+- `cd frontend && npm run build` passes.
+- Phase 11 verification maps VISUAL-01..04, RESP-01..05, CODE-07, PERF-02, and PERF-03 to concrete evidence.
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
curo1305	692600c755	test(12): close Nyquist validation gap	2026-06-22 06:44:33 +02:00
curo1305	e64980af5f	docs(phase-12): add security threat verification — 26/26 closed	2026-06-22 01:39:24 +02:00
curo1305andClaude Sonnet 4.6	c283623903	docs(phase-12): resolve UAT gaps and close phase after 12-06 gap closure Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-21 22:38:23 +02:00
curo1305	bd5e8f4192	docs(12): add code review report for phase 12-06 gap closure	2026-06-21 22:35:01 +02:00
curo1305	4a910549ac	docs(12-06): add plan 06 SUMMARY — UUID-only navigation, multi-account, credential-update	2026-06-21 22:30:51 +02:00
curo1305	c85e4abd91	chore(12-06): bump version 0.2.1 → 0.2.2	2026-06-21 22:30:11 +02:00
curo1305	057b4999fd	feat(12-06): UUID-only cloud navigation, breadcrumb hierarchy, route-aware sidebar - CloudProviderTreeItem: getCloudFoldersByConnectionId(connection.id) + /cloud/{uuid}/root - CloudFolderTreeItem: connectionId prop replaces provider slug in browse + route - AppSidebar: Cloud Storage active only on exact /cloud; connection nodes use per-connection isActive - New tests: CloudProviderTreeItem, CloudFolderTreeItem, AppSidebar cloud active-state	2026-06-21 22:30:05 +02:00
curo1305	731b65ecdd	feat(12-06): connection-ID native lifecycle — always INSERT, PUT credentials, connectionsFor multi-account - Replace _upsert_cloud_connection with _insert_cloud_connection (always inserts new UUID row) - Add PUT /connections/{id}/credentials endpoint (owner-scoped, SSRF + health-check, password-preserve) - SettingsCloudTab: connectionsFor() renders all same-provider connections with Add account row - CloudCredentialModal.submit: calls updateWebDavCredentials on edit, connectWebDav on create - utils.js: FastAPI validation arrays normalised to concise field messages (Rule 2) - Backend tests: same-provider independence + IDOR negative test for credential update	2026-06-21 22:29:59 +02:00
curo1305	97c30c3a15	docs(12): plan cloud UAT gap fixes	2026-06-21 22:21:05 +02:00
curo1305	70ed1219a9	test(12): pause UAT - 1 passed, 2 issues, 3 blocked	2026-06-21 22:18:14 +02:00
curo1305	8c80607df9	fix(dev-env): complete local startup configuration	2026-06-21 20:43:45 +02:00
curo1305	461b56892c	docs(12-05): mark VERIFICATION.md passed — all 5 truths verified	2026-06-21 20:33:37 +02:00
curo1305andClaude Sonnet 4.6	206f564248	test(12-05): fix test_nextcloud_connect_persists + compose migration test path - test_nextcloud_connect_persists: provider=nextcloud routes to NextcloudBackend (not WebDAVBackend) — add storage.nextcloud_backend.validate_cloud_url patch and use AsyncMock for asyncio.to_thread (plain return_value=True is not awaitable, swallowed by except → False). Test now passes HTTP 201. - test_compose_migrations: skip module when docker-compose.yml is not found at the expected repo-root path (file is not mounted inside the backend container). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-20 12:35:35 +02:00
curo1305andClaude Sonnet 4.6	043a7817e2	fix(12-uat): add display_name_override schema regression + Compose hardening - test_list_connections_reads_display_name_override_column: proves GET /api/cloud/connections does not raise UndefinedColumn (direct Phase 12 UAT blocker regression) - docker-compose: promtail socket :ro, Grafana password fail-fast (:?) - test_migration_0006: DDL privilege test fails not skips when role absent - README: version 0.2.1 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-20 11:07:30 +02:00
curo1305andClaude Sonnet 4.6	760a8d4bcd	fix(12-uat): resolve critical code review findings in gap closure (CR-01 through CR-03, IN-01) - CR-01: promtail Docker socket mounted :ro (was read-write) - CR-02: Grafana admin password uses :? fail-fast (was :-changeme default) - CR-03: DDL privilege test fails not skips when docuvault_app role absent - IN-01: README version synced to 0.2.1 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-20 10:55:23 +02:00
curo1305	b6526e46f1	docs(12): add gap closure code review report	2026-06-20 10:54:22 +02:00
curo1305	bb818e0621	docs(phase-12): resolve UAT gaps and debug sessions after 12-05 gap closure	2026-06-20 10:51:44 +02:00
curo1305	34be364ca7	docs(phase-12): update tracking after gap closure wave	2026-06-20 10:50:38 +02:00
curo1305	824d271a42	chore: merge executor worktree (worktree-agent-a724010d4b729caf8)	2026-06-20 10:50:22 +02:00
curo1305	67d3e4bcac	docs(12-05): complete gap closure plan SUMMARY	2026-06-20 10:49:59 +02:00
curo1305	3ca57dcd0c	fix(12-05): bump version to 0.2.1 and update docs for migration-gated startup - backend/main.py, frontend/package.json: version 0.2.0 → 0.2.1 - CLAUDE.md, AGENTS.md: current state updated to reflect gap-closure - README.md: startup instructions note migrate runs automatically; update migration commands - RUNBOOK.md: startup diagram includes migrate service; migration gate explanation - SECURITY.md: Phase 12 gap-closure threat register and security gate evidence	2026-06-20 10:49:21 +02:00
curo1305	de2efd1664	test(12-05): add migration 0005→0006 integration regression and RUNBOOK migration ops - test_migration_0006.py: proves display_name_override, cloud_items, cloud_item_topics, cloud_folder_states, unique constraints, indexes, and DDL privilege boundary - Tests skip cleanly without INTEGRATION=1/INTEGRATION_DATABASE_URL (no dev DB mutation) - RUNBOOK: add Database Migrations section with revision check, upgrade, recovery, and emergency schema-drift remediation commands	2026-06-20 10:47:11 +02:00
curo1305	1b3084ddfa	feat(12-05): add migration-gated Compose startup path - Add one-shot migrate service using DATABASE_MIGRATE_URL and alembic upgrade head - Add migrate dependency (service_completed_successfully) to backend, celery-worker, celery-beat - migrate service has same read_only/cap_drop/no-new-privileges hardening as other services - Add test_compose_migrations.py: 7 static assertions on Compose configuration	2026-06-20 10:45:22 +02:00
curo1305	66d8634b17	docs(12): plan UAT migration gap closure	2026-06-20 10:40:37 +02:00
curo1305	a7e17d69b4	docs(12): add root causes from diagnosis	2026-06-19 23:44:04 +02:00
curo1305	802afebafe	test(12): complete UAT - 0 passed, 2 issues	2026-06-19 23:39:22 +02:00
curo1305	13b9d83401	docs(phase-12): update validation strategy	2026-06-19 06:10:55 +02:00
curo1305	33264862c1	docs(phase-12): evolve PROJECT.md and CLAUDE.md after phase completion	2026-06-19 06:06:01 +02:00
curo1305	8e5d7a1900	docs(phase-12): complete phase execution	2026-06-19 06:05:03 +02:00
curo1305andClaude Sonnet 4.6	b6911fb4ed	fix(12): resolve critical code review findings (CR-01 through CR-04) - CR-01: fix browse URL from /folders/{id} to /items?parent_ref= (broken feature) - CR-02: remove raw provider exception text from _TerminalProviderError messages - CR-03: add user_id predicate to get_or_create_folder_state query (ownership boundary) - CR-04: add max_length=255 to ConnectionRenameRequest.display_name Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-19 02:00:05 +02:00
curo1305	de63e2a3a4	docs(12): add code review report	2026-06-19 01:59:17 +02:00
curo1305	b7ae44b3f8	docs(phase-12): update tracking after wave 4	2026-06-19 01:55:47 +02:00
curo1305	06ccc865b9	chore: merge executor worktree (worktree-agent-aa3d7c2b49ba82638)	2026-06-19 01:55:35 +02:00
curo1305	7b1fc6e5cf	docs(12-04): create Phase 12 Plan 04 SUMMARY.md Records security-negative suite completion, threat register closure, gate evidence, version bump to 0.2.0, and D-01..D-18 decision coverage map.	2026-06-19 01:55:15 +02:00
curo1305	c441fc63e5	chore(12-04): bump version to 0.2.0 and finalize Phase 12 documentation - backend/main.py, frontend/package.json: 0.1.6 → 0.2.0 (phase-complete minor bump) - AGENTS.md: current state updated to Phase 12 complete; cloud-resource-foundation summary with browse contract, security suite, and Phase 13/14 boundary note - README.md: version updated to 0.2.0 - All existing shared module map rules and frontend architecture constraints unchanged	2026-06-19 01:54:24 +02:00
curo1305	fccb9c6394	security(12-04): add Phase 12 security gate evidence and cloud ops runbook - SECURITY.md: Phase 12 threat register (T-12-01 through T-12-SC) with evidence for all 8 threat IDs; bandit/npm audit gate results; accepted risks for pip-audit tooling gap and DISABLED connection behavior - RUNBOOK.md: Phase 12 cloud operations section covering connection management, browse refresh lifecycle, item metadata queries, stuck-refresh recovery, and security operation notes	2026-06-19 01:52:49 +02:00
curo1305	3b24058e15	test(12-04): add dedicated cloud security-negative integration suite - test_foreign_user_cannot_browse_cloud_item (IDOR T-12-01, CONN-04) - test_admin_cannot_browse_cloud_connection (admin block T-12-01, D-03) - test_browse_response_excludes_credentials_and_raw_fields (T-12-03, D-06) - test_ssrf_url_validation_invariants (T-12-04, D-14) - test_browse_no_quota_mutation (T-12-09, D-07) - test_browse_no_minio_calls (T-12-09, D-08) - test_disabled_connection_browse_blocked (D-17) - test_same_provider_items_scoped_to_connection (D-01, D-05 PostgreSQL) - test_no_byte_download_during_browse (D-18) - 16 tests pass; full suite 509 passed	2026-06-19 01:51:13 +02:00
curo1305	8a99230048	docs(phase-12): update tracking after wave 3	2026-06-18 23:33:03 +02:00
curo1305	84c2549c36	chore: merge executor worktree (worktree-agent-a280818c01e94acd2)	2026-06-18 23:32:56 +02:00
curo1305	5287efd34c	docs(12-03): add plan 03 execution summary	2026-06-18 23:32:41 +02:00
curo1305	c6c0742267	feat(12-03): breadcrumb freshness, formatRelativeTime, v0.1.6, docs - BreadcrumbBar: refreshing spinner, fresh checkmark (fades 3s), stale warning banner - Accessible labels and role=status for all freshness states - formatters.js: add formatRelativeTime (shared, no duplication) - Version bump 0.1.5 → 0.1.6 in backend/main.py and frontend/package.json - AGENTS.md: update state, shared module map (formatRelativeTime) - README.md: unified connection-root browsing and capability explanations feature text - 17 BreadcrumbBar tests pass; 323 total; production build clean	2026-06-18 23:31:50 +02:00
curo1305	44244335a1	feat(12-03): capability-aware action rendering in StorageBrowser - Add capabilities, connectionRoot, folderFreshness, lastRefreshedAt, byteAvailability props - CapabilityButton inline component: aria-disabled, click/Enter/Space/touch suppression - Gray for unsupported, amber for temporarily_unavailable — no native disabled - Local defaults preserve all pre-Phase-12 drag/share/move/delete behavior - Cached-byte marker (clock icon) on size column when byteAvailability='cached' - No marker for cloud_only - AppIcon: add info, clock icons - 50 StorageBrowser tests pass	2026-06-18 23:29:10 +02:00
curo1305	bf9af11274	feat(12-03): connection-ID routing, rename, session folder memory, thin views - Route /cloud/:connectionId/:folderId replaces /cloud/:provider/:folderId - api/cloud.js: getCloudFoldersByConnectionId + renameCloudConnection - cloudConnections store: rename, selectConnection, setBrowseState, defaultDisplayName, session storage helpers - CloudStorageView: thin — passes connectionRoots to StorageBrowser - CloudFolderView: thin — uses connectionId param, never provider slug - SettingsCloudTab: inline rename input for each active connection - 27 tests pass: store, view, settings	2026-06-18 23:25:29 +02:00
curo1305	6f0ecfa39b	docs(phase-12): update tracking after wave 2	2026-06-18 23:19:55 +02:00
curo1305	81c4d52041	chore: merge executor worktree (worktree-agent-ac074b0ec7fc0dbc3)	2026-06-18 23:19:27 +02:00
curo1305	f61736621e	chore: track AGENTS.md (untracked file blocking wave-2 merge)	2026-06-18 23:19:05 +02:00
curo1305	e5d6b9ea53	docs(12-02): execution summary — CloudResourceAdapter, browse endpoint, Celery refresh task	2026-06-18 23:18:30 +02:00
curo1305	c6237ca57f	feat(12-02): add refresh_cloud_folder Celery task, staleness trigger, version 0.1.5 - Add tasks/cloud_tasks.py: durable refresh_cloud_folder task with 3-retry bounded backoff (30s/90s/270s +jitter), credential decryption in worker only - Register tasks.cloud_tasks.* on documents queue in celery_app.py - Add stale-while-revalidate staleness trigger in browse.py (5-min threshold) - Add 4 Task 3 tests: idempotency, cached-row retention on failure, task structure, no-byte-download contract; add background-refresh scheduling integration test - Bump backend version 0.1.4 → 0.1.5, frontend package.json 0.1.4 → 0.1.5 - Update AGENTS.md with Phase 12 Plan 02 state and new shared module map entries - Update README with connection-ID browse API table and v0.1.5	2026-06-18 23:17:34 +02:00
curo1305	e186019066	feat(12-02): decompose api/cloud.py into package with connection-ID browse endpoint - Add api/cloud/ package: connections.py, browse.py, schemas.py, __init__.py - Add GET /api/cloud/connections/{connection_id}/items (T-12-01 IDOR, T-12-03 cred-free) - Add PATCH /api/cloud/connections/{id} for display_name_override rename - Add display_name_override ORM field to CloudConnection model - Add CloudResourceAdapter service layer with str/UUID coercion - Fix UUID type compatibility: test_cloud_items.py now uses UUID(as_uuid=True) matching conftest — removes String(36) patch that caused type incompatibility - Add 11 Phase 12 integration tests (IDOR, admin block, credential exclusion, duplicate providers, rename, malformed UUID) - Remove deleted api/cloud.py (replaced by api/cloud/ package)	2026-06-18 23:10:30 +02:00
curo1305	ff33439f0a	feat(12-02): normalize all four providers into CloudResourceAdapter contract - GoogleDriveBackend: list_folder with full pagination, native doc size=None, get_capabilities - OneDriveBackend: list_folder with @odata.nextLink pagination, get_capabilities - WebDAVBackend: list_folder via PROPFIND with SSRF re-validation, get_capabilities - NextcloudBackend: inherits CloudResourceAdapter from WebDAVBackend - build_cloud_resource_adapter() added to factory - 22 new contract/behavior/pagination/no-byte-download tests (51 total pass)	2026-06-18 22:45:09 +02:00
curo1305	71ba0293a5	docs(phase-12): update tracking after wave 1	2026-06-18 22:39:35 +02:00
curo1305	312a96d2bf	chore: merge executor worktree (worktree-agent-a032d981c3b3ec11b)	2026-06-18 22:39:06 +02:00
curo1305	3127853c1e	docs(12-01): complete cloud-resource-foundation plan 01 summary	2026-06-18 22:38:46 +02:00
curo1305	718fb2c2b5	feat(12-01): durable owner-scoped cloud metadata schema (migration 0006 + models) - Migration 0006: cloud_items, cloud_item_topics, cloud_folder_states tables - cloud_connections: add display_name_override column for same-provider disambiguation - CloudItem, CloudItemTopic, CloudFolderState ORM models with owner/connection indexes - Unique (connection_id, provider_item_id) boundary; no MinIO object_key field - Root folder state representable as parent_ref='' without CloudItem parent row - services/cloud_items.py: resolve_owned_connection, upsert, list, reconcile, folder state - 17 unit/integration tests covering model fields, isolation, quota invariant, idempotency	2026-06-18 22:37:28 +02:00
curo1305	0a7273b9fe	feat(12-01): normalized cloud resource capability contract and unit tests - Define 9 action keys, 3 capability states, 6 reason codes in cloud_base.py - Immutable CloudCapability, CloudResource, CloudListing frozen dataclasses - Abstract CloudResourceAdapter with list_folder, get_capabilities, merge_item_capabilities - No mutation methods in Phase 12 interface (Phase 13 boundary enforced) - 29 unit tests covering vocabulary, validation, merge behavior, fake adapter	2026-06-18 22:34:23 +02:00
curo1305	11b91775b6	docs(12): create phase plan	2026-06-18 22:30:07 +02:00
curo1305andClaude Sonnet 4.6	fe54a855b3	docs(phase-12): fix UI-SPEC typography and spacing blocking issues - Collapse font weights from 3 to 2: drop font-medium (500), use font-semibold (600) for row primary names, labels, column headers; font-normal (400) for body - Fix sm spacing token usage: replace p-1.5 (6px) with p-2 (8px) to match declared 8px value - Update health badge in connection root list from font-medium to font-semibold Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-18 22:19:25 +02:00
curo1305andClaude Sonnet 4.6	ea682fdecd	docs(phase-12): add UI design contract for cloud-resource-foundation Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-18 22:16:22 +02:00
curo1305	52b110acef	docs(phase-12): add research and validation strategy	2026-06-18 22:13:23 +02:00
curo1305	09814c28a9	docs(12): capture phase context	2026-06-18 22:07:26 +02:00
curo1305	a323276e37	docs: create milestone v0.3 roadmap (5 phases)	2026-06-17 23:27:21 +02:00
curo1305	608acedaf6	docs: define milestone v0.3 requirements	2026-06-17 23:24:54 +02:00
curo1305	9150d28fe1	docs: research milestone v0.3 cloud storage integration	2026-06-17 23:19:01 +02:00
curo1305	0e56c85349	docs: start milestone v0.3 Reimagining Cloud Storage integration	2026-06-17 23:16:21 +02:00
curo1305andClaude Sonnet 4.6	123ae5b29b	chore: archive v0.2 phase directories to milestones/v0.2-phases/ Moves phases 08–11 execution artifacts from .planning/phases/ to .planning/milestones/v0.2-phases/ to keep .planning/phases/ clean for the next milestone. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-17 14:34:52 +02:00