lorentz/wulf-pulse
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

docs(phase-15): update tracking after wave 1

Browse source
This commit is contained in:
lorentz 2026-07-15 07:39:39 -04:00
parent 6787308c04
commit 6dffb7b358
2 changed files with 9 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

4
.planning/ROADMAP.md
View file

@ -375,7 +375,7 @@ summarizes classification, blast radius, and recommended/approved remediation st
3. Re-scanning tickets that haven't changed since last processed does not reprocess or duplicate their `reports` rows; a ticket whose Autotask data changed since last processed IS reprocessed (idempotent on ticket state, not just ticket ID) 3. Re-scanning tickets that haven't changed since last processed does not reprocess or duplicate their `reports` rows; a ticket whose Autotask data changed since last processed IS reprocessed (idempotent on ticket state, not just ticket ID)
4. Each flagged ticket's stored evidence includes ticket ID/number, company, requester/reporter, title, description, notes, relevant time entries, and attachment metadata (EVID-01) 4. Each flagged ticket's stored evidence includes ticket ID/number, company, requester/reporter, title, description, notes, relevant time entries, and attachment metadata (EVID-01)
**Plans**: 3 plans **Plans**: 3 plans
- [ ] 15-01-PLAN.md — Migration 097: 7-table phishing-triage schema (reports fully designed, others stubbed) (DETECT-01, DETECT-02, EVID-01) - [x] 15-01-PLAN.md — Migration 097: 7-table phishing-triage schema (reports fully designed, others stubbed) (DETECT-01, DETECT-02, EVID-01)
- [ ] 15-02-PLAN.md — phishing-detector.ts core: pattern matcher + content-hash idempotency + EVID-01 evidence capture + reports upsert (DETECT-01, DETECT-02, EVID-01) - [ ] 15-02-PLAN.md — phishing-detector.ts core: pattern matcher + content-hash idempotency + EVID-01 evidence capture + reports upsert (DETECT-01, DETECT-02, EVID-01)
- [ ] 15-03-PLAN.md — Wiring: webhook fire-and-forget hook + bounded cron sweep service + scheduler branch + migration 098 seed (DETECT-01, DETECT-02) - [ ] 15-03-PLAN.md — Wiring: webhook fire-and-forget hook + bounded cron sweep service + scheduler branch + migration 098 seed (DETECT-01, DETECT-02)
**UI hint**: no **UI hint**: no
@ -477,7 +477,7 @@ Phases execute in numeric order. v1.0 (Phases 1-9.1) shipped 2026-07-10. v2.0 (P
| 12. Orders/Invoices & Company Matching | v2.0 | 5/5 | Complete | 2026-07-11 | | 12. Orders/Invoices & Company Matching | v2.0 | 5/5 | Complete | 2026-07-11 |
| 13. Scheduler & Admin Toggle | v2.0 | 3/3 | Complete | 2026-07-11 | | 13. Scheduler & Admin Toggle | v2.0 | 3/3 | Complete | 2026-07-11 |
| 14. /pax8 UI Surface | v2.0 | 6/6 | Complete | 2026-07-12 | | 14. /pax8 UI Surface | v2.0 | 6/6 | Complete | 2026-07-12 |
| 15. Data Model, Detection & Ticket Evidence | v3.0 | 0/3 | Not started | - | | 15. Data Model, Detection & Ticket Evidence | v3.0 | 1/3 | In Progress| |
| 16. EML/MIME Evidence Parser | v3.0 | 0/TBD | Not started | - | | 16. EML/MIME Evidence Parser | v3.0 | 0/TBD | Not started | - |
| 17. Mimecast Blast Radius Lookup | v3.0 | 0/TBD | Not started | - | | 17. Mimecast Blast Radius Lookup | v3.0 | 0/TBD | Not started | - |
| 18. Campaign Grouping & Phishing Analysis API | v3.0 | 0/TBD | Not started | - | | 18. Campaign Grouping & Phishing Analysis API | v3.0 | 0/TBD | Not started | - |

14
.planning/STATE.md
View file

@ -4,8 +4,8 @@ milestone: v3.0
milestone_name: Phishing Triage Automation milestone_name: Phishing Triage Automation
status: executing status: executing
stopped_at: Phase 15 context gathered stopped_at: Phase 15 context gathered
last_updated: "2026-07-15T11:30:38.677Z" last_updated: "2026-07-15T11:33:35.155Z"
last_activity: 2026-07-15 -- Phase 15 planning complete last_activity: 2026-07-15 -- Phase 15 execution started
progress: progress:
total_phases: 7 total_phases: 7
completed_phases: 0 completed_phases: 0
@ -21,14 +21,14 @@ progress:
See: .planning/PROJECT.md (updated 2026-07-14) See: .planning/PROJECT.md (updated 2026-07-14)
**Core value:** A manager/security operator can see every phishing/spam report ticket automatically triaged, deduplicated into campaigns, and classified — with any destructive remediation gated behind explicit human approval. **Core value:** A manager/security operator can see every phishing/spam report ticket automatically triaged, deduplicated into campaigns, and classified — with any destructive remediation gated behind explicit human approval.
**Current focus:** Phase 15: Data Model, Detection & Ticket Evidence **Current focus:** Phase 15 — Data Model, Detection & Ticket Evidence
## Current Position ## Current Position
Phase: 15 of 21 (Data Model, Detection & Ticket Evidence) Phase: 15 (Data Model, Detection & Ticket Evidence) — EXECUTING
Plan: — (not yet planned) Plan: 1 of 3
Status: Ready to execute Status: Executing Phase 15
Last activity: 2026-07-15 -- Phase 15 planning complete Last activity: 2026-07-15 -- Phase 15 execution started
Progress: [░░░░░░░░░░] 0% Progress: [░░░░░░░░░░] 0%