From 78b6b49c5bb93e5143539322db5887b5d8fe3e2c Mon Sep 17 00:00:00 2001 From: lorentz Date: Thu, 16 Jul 2026 19:37:45 -0400 Subject: [PATCH] docs(23-03): backfill Phase 23 CLASSDISP-*/AUTOGATE-* requirement entries - Adds Classification Disposition + Automation Gate subsection under v1 Requirements (Phase 23 is active v3.0 roadmap work, not deferred) - Adds 6 Traceability rows (CLASSDISP-01/02/03, AUTOGATE-01/02/03 -> Phase 23, Pending) - Updates Coverage footer counts (32 -> 38 total) - No existing v1/v2 entries or rows altered --- .planning/REQUIREMENTS.md | 39 ++++++++++++++++++++++++++++++++++++--- 1 file changed, 36 insertions(+), 3 deletions(-) diff --git a/.planning/REQUIREMENTS.md b/.planning/REQUIREMENTS.md index 4a00f38..f485b6b 100644 --- a/.planning/REQUIREMENTS.md +++ b/.planning/REQUIREMENTS.md @@ -137,6 +137,33 @@ destructive remediation gated behind explicit human approval. a failed request; the page enforces no separate or relaxed permission model from the underlying APIs +### Classification Disposition + Automation Gate + +- [ ] **CLASSDISP-01**: The classifier assigns a dedicated `USER_AWARENESS` + verdict to campaigns confirmed as phishing-simulation-vendor (KnowBe4/Breach + Secure Now) reports, replacing the previous forced-`UNWANTED` disposition + for these confirmed-simulation cases +- [ ] **CLASSDISP-02**: `USER_AWARENESS` maps to a new non-destructive + `acknowledge_user` action that posts a customer-visible thank-you note + (Autotask `noteType: 18`, "Client Portal Note") to the reporting employee +- [ ] **CLASSDISP-03**: The campaign review UI surfaces `USER_AWARENESS` and + `acknowledge_user` distinctly from the existing SPAM/UNWANTED/THREAT + verdicts and their actions +- [ ] **AUTOGATE-01**: A per-company `phishing_automation_gate` table and + admin-gated `GET`/`PATCH`/`DELETE` API let an operator read and set three + independent opt-in automation flags (`auto_parse`, `auto_classify`, + `auto_report`) per Autotask company, defaulting to all-OFF when no row + exists +- [ ] **AUTOGATE-02**: An `/admin/phishing-automation` page lists companies + with three independent per-company `Switch` toggles (one per automation + stage), backed by the `AUTOGATE-01` API +- [ ] **AUTOGATE-03**: When a company's automation gate stages are enabled, + the Autotask webhook automatically runs the gated parse→classify→acknowledge + chain for that company's phishing reports, with the `acknowledge_user` + auto-post carve-out narrowly scoped to `USER_AWARENESS` verdicts only — all + other verdicts/actions still require manual approval regardless of gate + state + ## v2 Requirements Deferred to future release. Tracked but not in current roadmap. @@ -209,13 +236,19 @@ Populated during roadmap creation. | REVIEW-04 | Phase 22 | Complete | | REVIEW-05 | Phase 22 | Complete | | REVIEW-06 | Phase 22 | Complete | +| CLASSDISP-01 | Phase 23 | Pending | +| CLASSDISP-02 | Phase 23 | Pending | +| CLASSDISP-03 | Phase 23 | Pending | +| AUTOGATE-01 | Phase 23 | Pending | +| AUTOGATE-02 | Phase 23 | Pending | +| AUTOGATE-03 | Phase 23 | Pending | **Coverage:** -- v1 requirements: 32 total -- Mapped to phases: 32 (Phases 15-22) +- v1 requirements: 38 total +- Mapped to phases: 38 (Phases 15-23) - Unmapped: 0 ✓ --- *Requirements defined: 2026-07-14* *Traceability populated: 2026-07-14 — ROADMAP.md Phases 15-21* -*Last updated: 2026-07-14 after initial definition* +*Last updated: 2026-07-16 — backfilled Phase 23 CLASSDISP-*/AUTOGATE-* entries (23-03)*