kite/.planning/phases/13-virtual-local-cloud-operations/13-09-PLAN.md

phase, plan, type, wave, depends_on, files_modified, autonomous, requirements, must_haves

phase	plan	type	wave	depends_on	files_modified	autonomous	requirements	must_haves
13	09	execute	6	13-08	backend/api/cloud/operations.py backend/api/cloud/schemas.py backend/services/cloud_operations.py backend/services/cloud_items.py backend/storage/google_drive_backend.py backend/storage/onedrive_backend.py backend/storage/webdav_backend.py backend/tests/test_cloud_mutations.py backend/tests/test_cloud_security.py backend/tests/test_cloud_audit.py	true	CLOUD-06 CLOUD-07 CLOUD-09	truths artifacts key_links Move is restricted to one connection and rejects self or descendant destinations before and after provider submission. Delete returns typed trash-versus-permanent disclosure and stronger folder warnings without leaking provider internals. Successful move and delete operations reconcile metadata and emit metadata-only audit rows before success returns. path provides backend/api/cloud/operations.py Move and delete endpoints with destination, stale, and delete-disclosure safeguards. path provides backend/services/cloud_operations.py Move and delete orchestration tied to centralized reconciliation and metadata-only auditing. from to via pattern move and delete provider result cloud_items stable row identity centralized post-mutation reconciliation parent_ref

Implement the bounded backend move and delete slice of Phase 13: same-connection validation, stale guards, delete disclosure, metadata reconciliation, and metadata-only audit behavior.

Purpose: Deliver CLOUD-06, CLOUD-07, and the remaining mutation half of CLOUD-09 without dragging create-folder or rename work back into scope. Output: Passing backend move, delete, security, and audit suites.

<execution_context> @$HOME/.codex/gsd-core/workflows/execute-plan.md @$HOME/.codex/gsd-core/templates/summary.md </execution_context>

@AGENTS.md @.planning/phases/13-virtual-local-cloud-operations/13-CONTEXT.md @backend/api/cloud/operations.py @backend/services/cloud_operations.py @backend/services/cloud_items.py @backend/storage/google_drive_backend.py @backend/storage/onedrive_backend.py @backend/storage/webdav_backend.py @backend/tests/test_cloud_security.py @backend/tests/test_cloud_audit.py

Artifacts this phase produces

• Move and delete support in the operations router and cloud operations service.
• Four-provider destination, stale, trash-versus-permanent delete, and audit-safe success behavior.
• Passing move, delete, security, and audit suites.

Pattern analogs

• backend/api/folders.py — local move and delete handler structure.
• backend/services/cloud_items.py — stable identity and freshness reconciliation behavior.
• backend/tests/test_cloud_security.py — wrong-owner and cross-connection negative tests.

Task 1: Implement move with same-connection validation, stale guards, and centralized reconciliation backend/api/cloud/operations.py, backend/api/cloud/schemas.py, backend/services/cloud_operations.py, backend/services/cloud_items.py, backend/storage/google_drive_backend.py, backend/storage/onedrive_backend.py, backend/storage/webdav_backend.py, backend/tests/test_cloud_mutations.py, backend/tests/test_cloud_security.py - backend/api/folders.py - backend/services/cloud_items.py - backend/tests/test_cloud_security.py - backend/tests/test_cloud_mutations.py - .planning/phases/13-virtual-local-cloud-operations/13-CONTEXT.md - Test 1: move rejects cross-connection, self, and descendant destinations before and after provider submission - Test 2: stale version or etag mismatches stop the move, refresh the folder, and return typed retry-needed guidance - Test 3: successful move reconciles metadata before success returns Implement D-07 through D-09 for move. Enforce same-connection-only movement, disable or reject self and descendant destinations, normalize stale precondition failures, and keep provider differences behind the shared contract for Google Drive, OneDrive, and the shared WebDAV path. Route successful move results back through `backend/services/cloud_items.py` so identity, parent linkage, and freshness remain centralized. - move and security suites pass - invalid destinations are rejected consistently in service and provider paths - successful move uses centralized reconciliation before success returns docker compose run --rm backend pytest -v tests/test_cloud_mutations.py tests/test_cloud_security.py -k "move or destination" -x Move now satisfies the single-connection, descendant-safety, and stale-refresh rules. Task 2: Implement delete disclosure and metadata-only audit-safe success paths backend/api/cloud/operations.py, backend/api/cloud/schemas.py, backend/services/cloud_operations.py, backend/storage/google_drive_backend.py, backend/storage/onedrive_backend.py, backend/storage/webdav_backend.py, backend/tests/test_cloud_mutations.py, backend/tests/test_cloud_security.py, backend/tests/test_cloud_audit.py - backend/services/cloud_operations.py - backend/tests/test_cloud_security.py - backend/tests/test_cloud_audit.py - .planning/phases/13-virtual-local-cloud-operations/13-CONTEXT.md - Test 1: delete returns typed trash-versus-permanent disclosure for files and folders - Test 2: folder delete messaging is stronger than file delete messaging - Test 3: successful delete emits metadata-only audit rows before success returns Implement D-10 and D-11 for delete. Normalize provider results so the frontend can distinguish trash versus permanent delete without leaking provider internals, keep folder delete semantics explicit, and write metadata-only audit rows only after authoritative success. Preserve all owner-scope, secret-secrecy, and no-byte guarantees from the Wave 0 security suites. - delete, security, and audit suites pass - delete success discloses trash versus permanent behavior without provider leakage - no audit row includes provider URLs, tokens, bytes, or document text docker compose run --rm backend pytest -v tests/test_cloud_mutations.py tests/test_cloud_security.py tests/test_cloud_audit.py -k "delete or audit" -x Delete now satisfies the disclosure, security, and metadata-only audit rules.

<threat_model>

Trust Boundaries

Boundary	Description
user-selected destination → provider mutation	Invalid folder destinations must be rejected before and after provider submission.
delete success → audit trail	Only authoritative success may write metadata-only delete events.

STRIDE Threat Register

Threat ID	Category	Component	Disposition	Mitigation Plan
T-13-27	T	move destinations	mitigate	Mutation and security suites enforce same-connection, self, and descendant rejection.
T-13-28	T	stale move safety	mitigate	Stale guards refresh and require retry instead of forcing move.
T-13-29	I	delete disclosure and audit	mitigate	Typed delete results and audit tests keep provider behavior transparent and metadata-only.
</threat_model>

- Pass the move, delete, security, and audit suites. - Confirm every backend pytest invocation is a direct `docker compose run --rm backend pytest ...` command. - Confirm move and delete remain separated from create-folder and rename work in both files touched and task scope.

<success_criteria>

• The backend fully supports CLOUD-06 and CLOUD-07 plus the remaining move/delete portion of CLOUD-09.
• Stale safety, destination validation, and delete disclosure are explicit and tested across all supported provider classes.
• This bounded plan stays at 10 files and does not absorb create-folder or rename behavior. </success_criteria>

Create `.planning/phases/13-virtual-local-cloud-operations/13-09-SUMMARY.md` when done