From 36ef9e7ce3c558f41508c1f85220d516859692d3 Mon Sep 17 00:00:00 2001 From: lorentz Date: Wed, 15 Jul 2026 10:33:49 -0400 Subject: [PATCH] docs(phase-16): update tracking after wave 1 --- .planning/ROADMAP.md | 6 +++--- .planning/STATE.md | 14 +++++++------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index 79095aa..48bfc8a 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -391,8 +391,8 @@ summarizes classification, blast radius, and recommended/approved remediation st 4. Parsed output includes a sanitized/truncated body preview stored alongside the raw evidence, distinct from the full raw body 5. `npx vitest run` for the new parser test file passes using synthetic fixtures only (no real customer email) **Plans**: 3 plans -- [ ] 16-01-PLAN.md — Deps (mailparser + linkify-it) + pure EML parser: 3-tier selection, RFC822/MIME normalization, structured SPF/DKIM/DMARC verdicts, sanitized preview, no-network + size-guard tests (EVID-02, EVID-03, EVID-04) -- [ ] 16-02-PLAN.md — Supporting infra: AutotaskClient.getAttachmentContent (items[0]), b2 EML_OBJECT_KEY_REGEX + parameterized key validation, migration 099 indicators.metadata JSONB (EVID-03, EVID-04; D-05, D-07) +- [x] 16-01-PLAN.md — Deps (mailparser + linkify-it) + pure EML parser: 3-tier selection, RFC822/MIME normalization, structured SPF/DKIM/DMARC verdicts, sanitized preview, no-network + size-guard tests (EVID-02, EVID-03, EVID-04) +- [x] 16-02-PLAN.md — Supporting infra: AutotaskClient.getAttachmentContent (items[0]), b2 EML_OBJECT_KEY_REGEX + parameterized key validation, migration 099 indicators.metadata JSONB (EVID-03, EVID-04; D-05, D-07) - [ ] 16-03-PLAN.md — phishing-eml-service orchestration: list→select→fetch→B2 (gated)→parse→persist messages/indicators, end-to-end no-network + graceful-degrade tests (EVID-03, EVID-04; D-05, D-06, D-07) **UI hint**: no @@ -481,7 +481,7 @@ Phases execute in numeric order. v1.0 (Phases 1-9.1) shipped 2026-07-10. v2.0 (P | 13. Scheduler & Admin Toggle | v2.0 | 3/3 | Complete | 2026-07-11 | | 14. /pax8 UI Surface | v2.0 | 6/6 | Complete | 2026-07-12 | | 15. Data Model, Detection & Ticket Evidence | v3.0 | 3/3 | Complete | 2026-07-15 | -| 16. EML/MIME Evidence Parser | v3.0 | 0/3 | Planned | - | +| 16. EML/MIME Evidence Parser | v3.0 | 2/3 | In Progress| | | 17. Mimecast Blast Radius Lookup | v3.0 | 0/TBD | Not started | - | | 18. Campaign Grouping & Phishing Analysis API | v3.0 | 0/TBD | Not started | - | | 19. Classification Engine | v3.0 | 0/TBD | Not started | - | diff --git a/.planning/STATE.md b/.planning/STATE.md index d1caa6e..dc8e12c 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -4,8 +4,8 @@ milestone: v3.0 milestone_name: Phishing Triage Automation status: executing stopped_at: Phase 16 context gathered -last_updated: "2026-07-15T14:17:04.813Z" -last_activity: 2026-07-15 -- Phase 16 planning complete +last_updated: "2026-07-15T14:18:57.463Z" +last_activity: 2026-07-15 -- Phase 16 execution started progress: total_phases: 7 completed_phases: 1 @@ -21,14 +21,14 @@ progress: See: .planning/PROJECT.md (updated 2026-07-14) **Core value:** A manager/security operator can see every phishing/spam report ticket automatically triaged, deduplicated into campaigns, and classified — with any destructive remediation gated behind explicit human approval. -**Current focus:** Phase 16 — eml/mime evidence parser +**Current focus:** Phase 16 — eml-mime-evidence-parser ## Current Position -Phase: 16 -Plan: Not started -Status: Ready to execute -Last activity: 2026-07-15 -- Phase 16 planning complete +Phase: 16 (eml-mime-evidence-parser) — EXECUTING +Plan: 1 of 3 +Status: Executing Phase 16 +Last activity: 2026-07-15 -- Phase 16 execution started Progress: [░░░░░░░░░░] 0%