kite/.planning/phases/13-virtual-local-cloud-operations/13-09-PLAN.md

---
phase: "13"
plan: "09"
type: execute
wave: 6
depends_on:
  - "13-08"
files_modified:
  - backend/api/cloud/operations.py
  - backend/api/cloud/schemas.py
  - backend/services/cloud_operations.py
  - backend/services/cloud_items.py
  - backend/storage/google_drive_backend.py
  - backend/storage/onedrive_backend.py
  - backend/storage/webdav_backend.py
  - backend/tests/test_cloud_mutations.py
  - backend/tests/test_cloud_security.py
  - backend/tests/test_cloud_audit.py
autonomous: true
requirements:
  - CLOUD-06
  - CLOUD-07
  - CLOUD-09
must_haves:
  truths:
    - "Move is restricted to one connection and rejects self or descendant destinations before and after provider submission."
    - "Delete returns typed trash-versus-permanent disclosure and stronger folder warnings without leaking provider internals."
    - "Successful move and delete operations reconcile metadata and emit metadata-only audit rows before success returns."
  artifacts:
    - path: "backend/api/cloud/operations.py"
      provides: "Move and delete endpoints with destination, stale, and delete-disclosure safeguards."
    - path: "backend/services/cloud_operations.py"
      provides: "Move and delete orchestration tied to centralized reconciliation and metadata-only auditing."
  key_links:
    - from: "move and delete provider result"
      to: "cloud_items stable row identity"
      via: "centralized post-mutation reconciliation"
      pattern: "parent_ref"
---

<objective>
Implement the bounded backend move and delete slice of Phase 13: same-connection validation, stale guards, delete disclosure, metadata reconciliation, and metadata-only audit behavior.

Purpose: Deliver `CLOUD-06`, `CLOUD-07`, and the remaining mutation half of `CLOUD-09` without dragging create-folder or rename work back into scope.
Output: Passing backend move, delete, security, and audit suites.
</objective>

<execution_context>
@$HOME/.codex/gsd-core/workflows/execute-plan.md
@$HOME/.codex/gsd-core/templates/summary.md
</execution_context>

<context>
@AGENTS.md
@.planning/phases/13-virtual-local-cloud-operations/13-CONTEXT.md
@backend/api/cloud/operations.py
@backend/services/cloud_operations.py
@backend/services/cloud_items.py
@backend/storage/google_drive_backend.py
@backend/storage/onedrive_backend.py
@backend/storage/webdav_backend.py
@backend/tests/test_cloud_security.py
@backend/tests/test_cloud_audit.py
</context>

## Artifacts this phase produces

- Move and delete support in the operations router and cloud operations service.
- Four-provider destination, stale, trash-versus-permanent delete, and audit-safe success behavior.
- Passing move, delete, security, and audit suites.

## Pattern analogs

- `backend/api/folders.py` — local move and delete handler structure.
- `backend/services/cloud_items.py` — stable identity and freshness reconciliation behavior.
- `backend/tests/test_cloud_security.py` — wrong-owner and cross-connection negative tests.

<tasks>

<task type="auto" tdd="true">
  <name>Task 1: Implement move with same-connection validation, stale guards, and centralized reconciliation</name>
  <files>backend/api/cloud/operations.py, backend/api/cloud/schemas.py, backend/services/cloud_operations.py, backend/services/cloud_items.py, backend/storage/google_drive_backend.py, backend/storage/onedrive_backend.py, backend/storage/webdav_backend.py, backend/tests/test_cloud_mutations.py, backend/tests/test_cloud_security.py</files>
  <read_first>
    - backend/api/folders.py
    - backend/services/cloud_items.py
    - backend/tests/test_cloud_security.py
    - backend/tests/test_cloud_mutations.py
    - .planning/phases/13-virtual-local-cloud-operations/13-CONTEXT.md
  </read_first>
  <behavior>
    - Test 1: move rejects cross-connection, self, and descendant destinations before and after provider submission
    - Test 2: stale version or etag mismatches stop the move, refresh the folder, and return typed retry-needed guidance
    - Test 3: successful move reconciles metadata before success returns
  </behavior>
  <action>
    Implement D-07 through D-09 for move. Enforce same-connection-only movement, disable or reject self and descendant destinations, normalize stale precondition failures, and keep provider differences behind the shared contract for Google Drive, OneDrive, and the shared WebDAV path. Route successful move results back through `backend/services/cloud_items.py` so identity, parent linkage, and freshness remain centralized.
  </action>
  <acceptance_criteria>
    - move and security suites pass
    - invalid destinations are rejected consistently in service and provider paths
    - successful move uses centralized reconciliation before success returns
  </acceptance_criteria>
  <verify>
    <automated>docker compose run --rm backend pytest -v tests/test_cloud_mutations.py tests/test_cloud_security.py -k "move or destination" -x</automated>
  </verify>
  <done>Move now satisfies the single-connection, descendant-safety, and stale-refresh rules.</done>
</task>

<task type="auto" tdd="true">
  <name>Task 2: Implement delete disclosure and metadata-only audit-safe success paths</name>
  <files>backend/api/cloud/operations.py, backend/api/cloud/schemas.py, backend/services/cloud_operations.py, backend/storage/google_drive_backend.py, backend/storage/onedrive_backend.py, backend/storage/webdav_backend.py, backend/tests/test_cloud_mutations.py, backend/tests/test_cloud_security.py, backend/tests/test_cloud_audit.py</files>
  <read_first>
    - backend/services/cloud_operations.py
    - backend/tests/test_cloud_security.py
    - backend/tests/test_cloud_audit.py
    - .planning/phases/13-virtual-local-cloud-operations/13-CONTEXT.md
  </read_first>
  <behavior>
    - Test 1: delete returns typed trash-versus-permanent disclosure for files and folders
    - Test 2: folder delete messaging is stronger than file delete messaging
    - Test 3: successful delete emits metadata-only audit rows before success returns
  </behavior>
  <action>
    Implement D-10 and D-11 for delete. Normalize provider results so the frontend can distinguish trash versus permanent delete without leaking provider internals, keep folder delete semantics explicit, and write metadata-only audit rows only after authoritative success. Preserve all owner-scope, secret-secrecy, and no-byte guarantees from the Wave 0 security suites.
  </action>
  <acceptance_criteria>
    - delete, security, and audit suites pass
    - delete success discloses trash versus permanent behavior without provider leakage
    - no audit row includes provider URLs, tokens, bytes, or document text
  </acceptance_criteria>
  <verify>
    <automated>docker compose run --rm backend pytest -v tests/test_cloud_mutations.py tests/test_cloud_security.py tests/test_cloud_audit.py -k "delete or audit" -x</automated>
  </verify>
  <done>Delete now satisfies the disclosure, security, and metadata-only audit rules.</done>
</task>

</tasks>

<threat_model>
## Trust Boundaries

| Boundary | Description |
|----------|-------------|
| user-selected destination → provider mutation | Invalid folder destinations must be rejected before and after provider submission. |
| delete success → audit trail | Only authoritative success may write metadata-only delete events. |

## STRIDE Threat Register

| Threat ID | Category | Component | Disposition | Mitigation Plan |
|-----------|----------|-----------|-------------|-----------------|
| T-13-27 | T | move destinations | mitigate | Mutation and security suites enforce same-connection, self, and descendant rejection. |
| T-13-28 | T | stale move safety | mitigate | Stale guards refresh and require retry instead of forcing move. |
| T-13-29 | I | delete disclosure and audit | mitigate | Typed delete results and audit tests keep provider behavior transparent and metadata-only. |
</threat_model>

<verification>
- Pass the move, delete, security, and audit suites.
- Confirm every backend pytest invocation is a direct `docker compose run --rm backend pytest ...` command.
- Confirm move and delete remain separated from create-folder and rename work in both files touched and task scope.
</verification>

<success_criteria>
- The backend fully supports `CLOUD-06` and `CLOUD-07` plus the remaining move/delete portion of `CLOUD-09`.
- Stale safety, destination validation, and delete disclosure are explicit and tested across all supported provider classes.
- This bounded plan stays at 10 files and does not absorb create-folder or rename behavior.
</success_criteria>

<output>
Create `.planning/phases/13-virtual-local-cloud-operations/13-09-SUMMARY.md` when done
</output>