From 4b3188da3313441e72dfb234d66d3567e0f62861 Mon Sep 17 00:00:00 2001 From: lorentz Date: Thu, 16 Jul 2026 10:41:23 -0400 Subject: [PATCH] docs(phase-20): update tracking after wave 1 --- .planning/ROADMAP.md | 4 ++-- .planning/STATE.md | 12 ++++++------ 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index 33b0732..207c0ff 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -456,7 +456,7 @@ of a functional dependency on Phase 21. 4. Re-running remediation against an already-completed action does not duplicate the destructive effect — proven by a test that calls remediate twice and asserts a single effect/log entry 5. `POST /api/phishing/campaigns/{id}/mark-false-positive` exists, and every state-changing action (classify, approve, remediate, mark-false-positive) writes an `audit_events` row recording actor, event type, and payload **Plans**: 2 plans (2 waves) -- [ ] 20-01-PLAN.md — phishing-audit.ts writeAuditEvent + remediation-service.ts approve/remediate/mark-false-positive orchestrators (idempotent, audited, D-04 guard) + vitest suite (REMED-01..06) +- [x] 20-01-PLAN.md — phishing-audit.ts writeAuditEvent + remediation-service.ts approve/remediate/mark-false-positive orchestrators (idempotent, audited, D-04 guard) + vitest suite (REMED-01..06) - [ ] 20-02-PLAN.md — lib/permissions.ts approve/remediate grant (D-02) + approve/remediate/mark-false-positive routes + classify audit wiring (REMED-02, REMED-03, REMED-04, REMED-05, REMED-06) **UI hint**: no @@ -499,7 +499,7 @@ Phases execute in numeric order. v1.0 (Phases 1-9.1) shipped 2026-07-10. v2.0 (P | 17. Mimecast Blast Radius Lookup | v3.0 | 1/1 | Complete | 2026-07-15 | | 18. Campaign Grouping & Phishing Analysis API | v3.0 | 5/5 | Complete | 2026-07-16 | | 19. Classification Engine | v3.0 | 2/2 | Complete | 2026-07-16 | -| 20. Remediation, Approval & Audit Safety | v3.0 | 0/2 | Planned | - | +| 20. Remediation, Approval & Audit Safety | v3.0 | 1/2 | In Progress| | | 21. Autotask Triage Note | v3.0 | 0/TBD | Not started | - | | 22. Approval UI (LiveLink) | v3.0 | 0/TBD | Not started | - | diff --git a/.planning/STATE.md b/.planning/STATE.md index d28c7e4..14cee98 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -4,8 +4,8 @@ milestone: v3.0 milestone_name: Phishing Triage Automation status: executing stopped_at: Phase 20 context gathered -last_updated: "2026-07-16T14:29:41.665Z" -last_activity: 2026-07-16 -- Phase 20 planning complete +last_updated: "2026-07-16T14:33:34.349Z" +last_activity: 2026-07-16 -- Phase 20 execution started progress: total_phases: 8 completed_phases: 5 @@ -21,14 +21,14 @@ progress: See: .planning/PROJECT.md (updated 2026-07-14) **Core value:** A manager/security operator can see every phishing/spam report ticket automatically triaged, deduplicated into campaigns, and classified — with any destructive remediation gated behind explicit human approval. -**Current focus:** Phase 19 — classification-engine +**Current focus:** Phase 20 — remediation-approval-audit-safety ## Current Position -Phase: 19 (classification-engine) — EXECUTING +Phase: 20 (remediation-approval-audit-safety) — EXECUTING Plan: 1 of 2 -Status: Ready to execute -Last activity: 2026-07-16 -- Phase 20 planning complete +Status: Executing Phase 20 +Last activity: 2026-07-16 -- Phase 20 execution started Progress: [░░░░░░░░░░] 0%