---
phase: "12"
plan: "04"
type: execute
wave: 4
depends_on:
  - "12-02"
  - "12-03"
files_modified:
  - backend/tests/test_cloud.py
  - backend/tests/test_cloud_items.py
  - backend/tests/test_cloud_security.py
  - frontend/src/components/storage/__tests__/StorageBrowser.capabilities.test.js
  - frontend/src/views/__tests__/CloudFolderView.test.js
  - backend/main.py
  - frontend/package.json
  - frontend/package-lock.json
  - AGENTS.md
  - README.md
  - SECURITY.md
  - RUNBOOK.md
autonomous: true
requirements:
  - CONN-04
  - CLOUD-01
  - CLOUD-08
  - CACHE-01
  - CACHE-02
  - SYNC-01

must_haves:
  truths:
    - "All D-01 through D-18 Phase 12 decisions have automated or explicit rendered-browser evidence"
    - "All six Phase 12 requirements pass owner, admin-negative, provider-contract, metadata-only, and shared-browser tests"
    - "No cloud browse path exposes credentials, downloads file bytes, changes MinIO, or changes user quota"
    - "Security gates report zero blocking high-severity findings before Phase 12 is marked complete"
    - "Project documentation and phase-completion version are synchronized with shipped behavior"
  artifacts:
    - path: "backend/tests/test_cloud_security.py"
      provides: "Cross-user/admin/credential/SSRF/no-byte negative integration suite"
      contains: "test_foreign_user_cannot_browse_cloud_item"
    - path: "SECURITY.md"
      provides: "Phase 12 threat mitigations and security-gate evidence"
      contains: "Phase 12"
    - path: "AGENTS.md"
      provides: "Current phase state and new canonical shared-module rules"
      contains: "Phase 12"
  key_links:
    - from: "backend/tests/test_cloud_security.py"
      to: "backend/api/cloud/browse.py"
      via: "authenticated API negative tests"
      pattern: "404|403"
    - from: "12-CONTEXT.md decisions"
      to: "backend/frontend focused tests"
      via: "decision coverage matrix in plan verification"
      pattern: "D-18"
---

<objective>
Close Phase 12 with cross-layer regression, security, real-PostgreSQL schema evidence, rendered-browser UI verification, and synchronized documentation/versioning. This plan verifies the foundation as a coherent whole; it does not add Phase 13 operations or Phase 14 byte caching.
</objective>

<execution_context>
@$HOME/.claude/get-shit-done/workflows/execute-plan.md
@$HOME/.claude/get-shit-done/templates/summary.md
</execution_context>

<context>
@.planning/phases/12-cloud-resource-foundation/12-01-SUMMARY.md
@.planning/phases/12-cloud-resource-foundation/12-02-SUMMARY.md
@.planning/phases/12-cloud-resource-foundation/12-03-SUMMARY.md
@.planning/phases/12-cloud-resource-foundation/12-CONTEXT.md
@.planning/phases/12-cloud-resource-foundation/12-VALIDATION.md
@.planning/phases/12-cloud-resource-foundation/12-UI-SPEC.md
</context>

<tasks>

<task type="auto">
  <name>Task 1: Complete cross-layer and security-negative coverage</name>
  <files>backend/tests/test_cloud.py, backend/tests/test_cloud_items.py, backend/tests/test_cloud_security.py, frontend/src/components/storage/__tests__/StorageBrowser.capabilities.test.js, frontend/src/views/__tests__/CloudFolderView.test.js</files>
  <read_first>
    - backend/api/cloud/browse.py — final browse trust boundary and response models
    - backend/services/cloud_items.py — final owner/reconciliation logic
    - backend/storage/cloud_utils.py — SSRF and credential encryption invariants
    - backend/tests/conftest.py — auth/admin and real-service fixture conventions
    - .planning/phases/12-cloud-resource-foundation/12-VALIDATION.md — requirement-to-evidence map
    - .planning/phases/12-cloud-resource-foundation/12-CONTEXT.md — D-01 through D-18
  </read_first>
  <action>
    Fill any remaining validation matrix gaps. Add full API negatives for wrong user connection/item IDs, admin browse denial, malformed IDs, disabled/deleted connection, credential field exclusion, provider error sanitization, SSRF preservation, and same provider/item IDs across users/connections. Assert browse/refresh mocks never call get_object, MinIO put/delete, or quota mutation. Add a real PostgreSQL integration case for unique constraints, owner FKs/indexes, and cascade behavior rather than relying on SQLite. Complete frontend regressions for every capability state and local parity. Add a decision coverage table in test comments or verification notes mapping D-01..D-18 to concrete tests without duplicating tests solely for bookkeeping.
  </action>
  <acceptance_criteria>
    - every security invariant has a passing negative test
    - PostgreSQL integration proves constraints/cascades used by production
    - no admin response contains document metadata/content or cloud credentials
    - all six requirement IDs and D-01..D-18 have named evidence
    - backend and frontend full suites pass with zero failures
  </acceptance_criteria>
  <verify><automated>cd backend && pytest -v && cd ../frontend && npm test && npm run build</automated></verify>
  <done>All requirement, decision, ownership, admin, credential, provider, quota, and shared-browser evidence is green.</done>
</task>

<task type="auto">
  <name>Task 2: Run security/dependency gates and rendered-browser UAT</name>
  <files>SECURITY.md, RUNBOOK.md</files>
  <read_first>
    - AGENTS.md — mandatory security gate checklist
    - SECURITY.md — existing security documentation format
    - RUNBOOK.md — operational verification format
    - .planning/phases/12-cloud-resource-foundation/12-UI-SPEC.md — visual/accessibility acceptance contract
  </read_first>
  <action>
    Run `bandit -r backend/`, `pip audit`, `npm audit --audit-level=high`, full security-invariant tests, and the repository’s secret scanner where available. Resolve all Phase 12-introduced high/critical findings; do not suppress them. Use the local app and Playwright at desktop and mobile widths to verify connection roots, duplicate-name disambiguation, refreshing/fresh/warning breadcrumb states, hover/focus/tap capability explanations, minimum touch targets, cached-byte marker, no overlap, and retained row usability during delayed refresh. Record commands/results and operational refresh/retry behavior in SECURITY.md/RUNBOOK.md without credentials or document content.
  </action>
  <acceptance_criteria>
    - Bandit reports zero HIGH findings introduced by Phase 12
    - pip/npm audits report zero high/critical vulnerabilities or a documented external blocker requiring owner escalation
    - secret scan finds no committed credentials/tokens
    - desktop/mobile Playwright evidence covers all UI-SPEC state transitions with no overlap
    - SECURITY.md and RUNBOOK.md contain Phase 12 evidence and safe operational guidance
  </acceptance_criteria>
  <verify><automated>cd backend && bandit -r . && pip audit && cd ../frontend && npm audit --audit-level=high && npm test && npm run build</automated></verify>
  <done>Security/dependency/secret gates and rendered desktop/mobile UI verification have no unresolved blocking findings.</done>
</task>

<task type="auto">
  <name>Task 3: Finalize Phase 12 documentation and phase version</name>
  <files>backend/main.py, frontend/package.json, frontend/package-lock.json, AGENTS.md, README.md, SECURITY.md, RUNBOOK.md</files>
  <read_first>
    - AGENTS.md — current state, shared module map, docs/version protocol
    - README.md — features, cloud provider, API, environment sections
    - backend/main.py — backend version source of truth
    - frontend/package.json — frontend version source of truth
    - .planning/ROADMAP.md — exact Phase 12 goal/success criteria
  </read_first>
  <action>
    Update AGENTS current state to Phase 12 complete and add any new canonical cloud contract/service/frontend helpers to shared module maps with non-negotiable no-duplication rules. Update README features/API architecture for multiple same-provider connections, connection-ID virtual browsing, durable metadata, capability explanations, and provider-byte source-of-truth; do not claim Phase 13 mutations or Phase 14 caching are shipped. Update SECURITY/RUNBOOK references to final module and command names. Apply the full-phase minor version bump from 0.1.6 to 0.2.0 in backend main, package.json, and package-lock root/package entry. Run source checks that all three report 0.2.0.
  </action>
  <acceptance_criteria>
    - AGENTS says Phase 12 complete and names the actual shared modules introduced
    - README accurately distinguishes shipped Phase 12 foundation from future cloud operations/cache
    - backend main, frontend package.json, and package-lock root/package entry all equal 0.2.0
    - no documentation includes credentials, raw provider errors, or unshipped capability claims
    - final full suites and build remain green after documentation/version changes
  </acceptance_criteria>
  <verify><automated>rg -n '0\.2\.0' backend/main.py frontend/package.json frontend/package-lock.json && cd backend && pytest -v && cd ../frontend && npm test && npm run build</automated></verify>
  <done>Phase documentation is accurate, shared-module rules are current, versions equal 0.2.0, and final suites/build pass.</done>
</task>

</tasks>

<threat_model>
| Threat ID | Threat | Mitigation and evidence |
|-----------|--------|-------------------------|
| T-12-01 | IDOR/admin content access | Dedicated foreign-user/admin negative integration suite |
| T-12-03 | Credential disclosure | Response/broker/log field assertions and secret scanning |
| T-12-04 | SSRF | Existing validator regression plus provider-request tests |
| T-12-07 | Metadata loss | Pagination/completeness and failed-refresh retention tests |
| T-12-08 | XSS/error leakage | Controlled messages, Vue escaping, rendered tests, no raw exception docs |
| T-12-09 | Quota corruption | no-byte/no-quota cross-layer mocks and DB assertions |
| T-12-10 | Disabled control action | pointer/keyboard/touch suppression tests and rendered UAT |
| T-12-SC | Supply-chain/secrets | pip/npm audits and repository secret scan before completion |
</threat_model>

<verification>
1. Backend and frontend full suites pass with zero failures.
2. Production frontend build succeeds.
3. PostgreSQL integration verifies production constraints.
4. Security gate checklist in AGENTS is fully satisfied.
5. Rendered-browser UAT satisfies the UI-SPEC on desktop and mobile.
6. Requirement coverage is 6/6 and decision coverage is 18/18.
</verification>

<success_criteria>
- Phase 12 success criteria are proven across adapters, database, API, shared browser, and security boundaries.
- No cloud bytes are copied or quota-charged by browsing.
- Documentation accurately describes the completed foundation and future phase boundaries.
- Version sources are synchronized at 0.2.0 and all release gates pass.
</success_criteria>

<output>Create `.planning/phases/12-cloud-resource-foundation/12-04-SUMMARY.md` when complete.</output>