From 35339a62b8b44a9fca7a9a010d87d5fba394434b Mon Sep 17 00:00:00 2001 From: lorentz Date: Wed, 15 Jul 2026 07:51:46 -0400 Subject: [PATCH] docs(phase-15): update tracking after wave 3 --- .planning/ROADMAP.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index 0af7965..cc20682 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -355,7 +355,7 @@ reference either. Phase 21 (Autotask triage note) is last because its note conte summarizes classification, blast radius, and recommended/approved remediation state — it has nothing to summarize until Phases 19 and 20 exist. -- [ ] **Phase 15: Data Model, Detection & Ticket Evidence** — New phishing schema (migration 097) + idempotent Autotask ticket scanner + base ticket evidence capture +- [x] **Phase 15: Data Model, Detection & Ticket Evidence** — New phishing schema (migration 097) + idempotent Autotask ticket scanner + base ticket evidence capture (completed 2026-07-15) - [ ] **Phase 16: EML/MIME Evidence Parser** — Pure RFC822/MIME parser: `.eml` selection (`rfc.eml` over `OriginatingEmail.eml`), normalized headers/URLs/attachments, sanitized body preview, synthetic-fixture tests - [ ] **Phase 17: Mimecast Blast Radius Lookup** — Blast-radius abstraction with graceful `unavailable` degradation when Mimecast isn't configured - [ ] **Phase 18: Campaign Grouping & Phishing Analysis API** — Message-ID-first dedupe/grouping, on-demand single-ticket analysis, and the first `/api/phishing/*` routes with the ACCESS-01 auth convention @@ -377,7 +377,7 @@ summarizes classification, blast radius, and recommended/approved remediation st **Plans**: 3 plans - [x] 15-01-PLAN.md — Migration 097: 7-table phishing-triage schema (reports fully designed, others stubbed) (DETECT-01, DETECT-02, EVID-01) - [x] 15-02-PLAN.md — phishing-detector.ts core: pattern matcher + content-hash idempotency + EVID-01 evidence capture + reports upsert (DETECT-01, DETECT-02, EVID-01) -- [ ] 15-03-PLAN.md — Wiring: webhook fire-and-forget hook + bounded cron sweep service + scheduler branch + migration 098 seed (DETECT-01, DETECT-02) +- [x] 15-03-PLAN.md — Wiring: webhook fire-and-forget hook + bounded cron sweep service + scheduler branch + migration 098 seed (DETECT-01, DETECT-02) **UI hint**: no ### Phase 16: EML/MIME Evidence Parser @@ -477,7 +477,7 @@ Phases execute in numeric order. v1.0 (Phases 1-9.1) shipped 2026-07-10. v2.0 (P | 12. Orders/Invoices & Company Matching | v2.0 | 5/5 | Complete | 2026-07-11 | | 13. Scheduler & Admin Toggle | v2.0 | 3/3 | Complete | 2026-07-11 | | 14. /pax8 UI Surface | v2.0 | 6/6 | Complete | 2026-07-12 | -| 15. Data Model, Detection & Ticket Evidence | v3.0 | 2/3 | In Progress| | +| 15. Data Model, Detection & Ticket Evidence | v3.0 | 3/3 | Complete | 2026-07-15 | | 16. EML/MIME Evidence Parser | v3.0 | 0/TBD | Not started | - | | 17. Mimecast Blast Radius Lookup | v3.0 | 0/TBD | Not started | - | | 18. Campaign Grouping & Phishing Analysis API | v3.0 | 0/TBD | Not started | - |