lorentz/wulf-pulse
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

docs(phase-19): update tracking after wave 1

Browse source
This commit is contained in:
lorentz 2026-07-16 08:23:11 -04:00
parent 7ac57bd2d4
commit 28f28a87a4
2 changed files with 9 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

4
.planning/ROADMAP.md
View file

@ -435,7 +435,7 @@ summarizes classification, blast radius, and recommended/approved remediation st
4. A synthetic KnowBe4 security-awareness-simulation fixture is not classified as `THREAT` absent contrary evidence
5. `POST /api/phishing/campaigns/{id}/classify` (re-)triggers classification, enforces the Phase 18 auth convention, and the classifier only ever receives structured, size-bounded evidence — long bodies are redacted/truncated before reaching any AI layer, and IT Glue-sourced evidence (if referenced) goes through the existing redacted `lib/services/analyzer/itglue-search.ts` path
**Plans**: 2 plans (2 waves)
- [ ] 19-01-PLAN.md — campaign-classifier.ts deterministic rule engine (evidence gather + D-03/D-04/D-06 rules + D-05 confidence + D-08 actions + append-only INSERT) + vitest suite + synthetic KnowBe4/BSN fixtures (CLASSIFY-01, CLASSIFY-02, CLASSIFY-03, CLASSIFY-04, CLASSIFY-06)
- [x] 19-01-PLAN.md — campaign-classifier.ts deterministic rule engine (evidence gather + D-03/D-04/D-06 rules + D-05 confidence + D-08 actions + append-only INSERT) + vitest suite + synthetic KnowBe4/BSN fixtures (CLASSIFY-01, CLASSIFY-02, CLASSIFY-03, CLASSIFY-04, CLASSIFY-06)
- [ ] 19-02-PLAN.md — POST /api/phishing/campaigns/[id]/classify route (requirePermission analyze + UUID guard + classifyCampaign delegation) (CLASSIFY-05)
**UI hint**: no
@ -490,7 +490,7 @@ Phases execute in numeric order. v1.0 (Phases 1-9.1) shipped 2026-07-10. v2.0 (P
| 16. EML/MIME Evidence Parser | v3.0 | 3/3 | Complete | 2026-07-15 |
| 17. Mimecast Blast Radius Lookup | v3.0 | 1/1 | Complete | 2026-07-15 |
| 18. Campaign Grouping & Phishing Analysis API | v3.0 | 5/5 | Complete | 2026-07-16 |
| 19. Classification Engine | v3.0 | 0/TBD | Not started | - |
| 19. Classification Engine | v3.0 | 1/2 | In Progress| |
| 20. Remediation, Approval & Audit Safety | v3.0 | 0/TBD | Not started | - |
| 21. Autotask Triage Note | v3.0 | 0/TBD | Not started | - |

14
.planning/STATE.md
View file

@ -4,8 +4,8 @@ milestone: v3.0
milestone_name: Phishing Triage Automation
status: executing
stopped_at: Phase 19 context gathered
last_updated: "2026-07-16T12:04:49.122Z"
last_activity: 2026-07-16 -- Phase 19 planning complete
last_updated: "2026-07-16T12:08:17.266Z"
last_activity: 2026-07-16 -- Phase 19 execution started
progress:
total_phases: 7
completed_phases: 4
@ -21,14 +21,14 @@ progress:
See: .planning/PROJECT.md (updated 2026-07-14)
**Core value:** A manager/security operator can see every phishing/spam report ticket automatically triaged, deduplicated into campaigns, and classified — with any destructive remediation gated behind explicit human approval.
**Current focus:** Phase 19 — classification engine
**Current focus:** Phase 19 — classification-engine
## Current Position
Phase: 19
Plan: Not started
Status: Ready to execute
Last activity: 2026-07-16 -- Phase 19 planning complete
Phase: 19 (classification-engine) — EXECUTING
Plan: 1 of 2
Status: Executing Phase 19
Last activity: 2026-07-16 -- Phase 19 execution started
Progress: [░░░░░░░░░░] 0%