curo1305andClaude Sonnet 4.6 8629bc0854 docs(phase-7): add security threat verification — 12/12 CLOSED ...

Formal Phase 7 SECURITY.md:
- T-07-01: api_key_enc excluded from GET /api/admin/ai-config (whitelist)
- T-07-02: HKDF domain separation confirmed (ai-provider-settings vs cloud-credentials)
- T-07-03: is_active atomic UPDATE, no read-then-write
- T-07-04: empty api_key normalised to "not-needed" before AsyncOpenAI
- T-07-05/07/09/11: accepted risks documented
- T-07-06/08/10/12: mitigations verified in implementation + tests
bandit: zero HIGH; npm audit: zero high/critical; threats_open: 0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-05 10:50:44 +02:00

..

.continue-here.md

wip: phase 7 planning paused — ready to execute

2026-06-03 18:34:49 +02:00

.gitkeep

docs(07): create phase plan — 5 plans, verification passed

2026-06-03 18:25:00 +02:00

07-01-PLAN.md

docs(07): create phase plan — 5 plans, verification passed

2026-06-03 18:25:00 +02:00

07-01-SUMMARY.md

docs(07-01): complete plan summary — system_settings DB + HKDF + Wave 0 stubs

2026-06-04 18:51:12 +02:00

07-02-PLAN.md

docs(07): create phase plan — 5 plans, verification passed

2026-06-03 18:25:00 +02:00

07-02-SUMMARY.md

docs(07-02): complete provider config + GenericOpenAIProvider + registry plan

2026-06-04 19:04:18 +02:00

07-03-PLAN.md

docs(07): create phase plan — 5 plans, verification passed

2026-06-03 18:25:00 +02:00

07-03-SUMMARY.md

docs(07-03): complete plan summary — AnthropicProvider output_config + classifier ProviderConfig refactor

2026-06-04 19:16:43 +02:00

07-04-PLAN.md

docs(07): create phase plan — 5 plans, verification passed

2026-06-03 18:25:00 +02:00

07-04-SUMMARY.md

docs(07-04): add plan summary — Celery retry harness + POST /classify re-queue complete

2026-06-04 23:12:11 +02:00

07-05-PLAN.md

docs(07): create phase plan — 5 plans, verification passed

2026-06-03 18:25:00 +02:00

07-05-SUMMARY.md

docs(07-05): add plan summary — Tasks 1-3 complete, Task 4 human checkpoint pending

2026-06-04 23:24:09 +02:00

07-CONTEXT.md

docs(07): capture phase context

2026-06-02 20:24:08 +02:00

07-DISCUSSION-LOG.md

docs(07): capture phase context

2026-06-02 20:24:08 +02:00

07-PATTERNS.md

docs(07): create phase plan — 5 plans, verification passed

2026-06-03 18:25:00 +02:00

07-RESEARCH.md

docs(07): create phase plan — 5 plans, verification passed

2026-06-03 18:25:00 +02:00

07-SECURITY.md

docs(phase-7): add security threat verification — 12/12 CLOSED

2026-06-05 10:50:44 +02:00

07-UAT.md

docs(07-uat): mark all 11 UAT tests pass — phase 07 complete

2026-06-05 09:30:41 +02:00

07-VALIDATION.md

docs(07): create phase plan — 5 plans, verification passed

2026-06-03 18:25:00 +02:00