From 8b04be160f92d2b92ec95b8ce7e34d7540ef783b Mon Sep 17 00:00:00 2001 From: lorentz Date: Fri, 17 Jul 2026 06:48:16 -0400 Subject: [PATCH] docs: fix stale requirement checkboxes (CLASSIFY-01..06, REVIEW-03), record milestone-close deferred items --- .planning/REQUIREMENTS.md | 28 ++++++++++++++-------------- .planning/STATE.md | 17 +++++++++++++++++ 2 files changed, 31 insertions(+), 14 deletions(-) diff --git a/.planning/REQUIREMENTS.md b/.planning/REQUIREMENTS.md index 4ce73eb..28a240d 100644 --- a/.planning/REQUIREMENTS.md +++ b/.planning/REQUIREMENTS.md @@ -60,18 +60,18 @@ destructive remediation gated behind explicit human approval. ### Classification -- [ ] **CLASSIFY-01**: The system classifies a campaign as exactly one of +- [x] **CLASSIFY-01**: The system classifies a campaign as exactly one of `SPAM` / `UNWANTED` / `THREAT`, with confidence, a short summary, evidence-backed reasons, recommended actions, and a `requires_approval` flag -- [ ] **CLASSIFY-02**: Any classification recommending a destructive action +- [x] **CLASSIFY-02**: Any classification recommending a destructive action (purge, block, delete, reset, etc.) always sets `requires_approval: true` -- [ ] **CLASSIFY-03**: When evidence is incomplete (no Mimecast data, no `.eml`, +- [x] **CLASSIFY-03**: When evidence is incomplete (no Mimecast data, no `.eml`, etc.), confidence is lowered and the missing evidence is named in the reasons -- [ ] **CLASSIFY-04**: Known/expected KnowBe4 security-awareness simulations are +- [x] **CLASSIFY-04**: Known/expected KnowBe4 security-awareness simulations are not classified as `THREAT` absent contrary evidence -- [ ] **CLASSIFY-05**: An operator can (re-)trigger classification of a campaign +- [x] **CLASSIFY-05**: An operator can (re-)trigger classification of a campaign via API (`POST /api/phishing/campaigns/{id}/classify`) -- [ ] **CLASSIFY-06**: The classifier accepts structured, size-bounded evidence +- [x] **CLASSIFY-06**: The classifier accepts structured, size-bounded evidence (not raw unbounded email bodies) — long bodies are redacted/truncated before reaching any AI layer, and IT Glue-sourced evidence goes through the existing redacted search path if referenced @@ -120,7 +120,7 @@ destructive remediation gated behind explicit human approval. - [x] **REVIEW-02**: The page displays the campaign's timeline — linked reports, classification history, and audit events (classify/approve/ remediate/mark-false-positive) — in chronological order -- [ ] **REVIEW-03**: The page displays the gathered evidence — parsed EML +- [x] **REVIEW-03**: The page displays the gathered evidence — parsed EML headers/URLs/attachments, sanitized body preview, and Mimecast blast-radius data (including an explicit `unavailable` state when Mimecast isn't configured) — never rendering a raw/unsanitized body or unredacted secrets @@ -216,12 +216,12 @@ Populated during roadmap creation. | CAMP-03 | Phase 18 | Complete | | BLAST-01 | Phase 17 | Complete | | BLAST-02 | Phase 17 | Complete | -| CLASSIFY-01 | Phase 19 | Pending | -| CLASSIFY-02 | Phase 19 | Pending | -| CLASSIFY-03 | Phase 19 | Pending | -| CLASSIFY-04 | Phase 19 | Pending | -| CLASSIFY-05 | Phase 19 | Pending | -| CLASSIFY-06 | Phase 19 | Pending | +| CLASSIFY-01 | Phase 19 | Complete | +| CLASSIFY-02 | Phase 19 | Complete | +| CLASSIFY-03 | Phase 19 | Complete | +| CLASSIFY-04 | Phase 19 | Complete | +| CLASSIFY-05 | Phase 19 | Complete | +| CLASSIFY-06 | Phase 19 | Complete | | REMED-01 | Phase 20 | Complete | | REMED-02 | Phase 20 | Complete | | REMED-03 | Phase 20 | Complete | @@ -232,7 +232,7 @@ Populated during roadmap creation. | ACCESS-01 | Phase 18 | Complete | | REVIEW-01 | Phase 22 | Complete | | REVIEW-02 | Phase 22 | Complete | -| REVIEW-03 | Phase 22 | Pending | +| REVIEW-03 | Phase 22 | Complete | | REVIEW-04 | Phase 22 | Complete | | REVIEW-05 | Phase 22 | Complete | | REVIEW-06 | Phase 22 | Complete | diff --git a/.planning/STATE.md b/.planning/STATE.md index f3f22c7..d006619 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -139,6 +139,23 @@ Items acknowledged and carried forward from previous milestone close: | Follow-up | Real notification list behind Bell icon | Deferred | v1.0 close | | Follow-up | Scroll restoration on Engagement profile back navigation (partial fix only) | Deferred | v1.0 close | +Items acknowledged and deferred at v3.0 milestone close on 2026-07-17 (pre-flight open-artifact audit — none are v3.0/phishing gaps): + +| Category | Item | Status | +|----------|------|--------| +| quick_task | 260519-0oz-add-qbo-createpayment-createdeposit-fh-r | Complete on disk (PLAN+SUMMARY present); missing STATE.md log entry — QBO financial work, unrelated to v3.0 | +| quick_task | 260521-fci-stopgap-nightly-reconciliation-for-stale | Complete on disk (PLAN+SUMMARY present); missing STATE.md log entry — QBO financial work, unrelated to v3.0 | +| quick_task | 260521-foj-fix-weekly-full-fk-error-widen-companies | Complete on disk (PLAN+SUMMARY present); missing STATE.md log entry — Autotask sync fix, unrelated to v3.0 | +| quick_task | 260712-ash-add-pax8-to-the-admin-sync-overview-page | Already logged in Quick Tasks Completed table above — audit flag is a false positive | +| quick_task | 260716-n46-fix-mimecast-blast-radius-date-window-fu | Already logged in Quick Tasks Completed table above — audit flag is a false positive | +| quick_task | 260716-pgr-fix-confidence-display-bug-in-classifica | Already logged in Quick Tasks Completed table above — audit flag is a false positive | +| seed | SEED-001-wulf-standards-engine | Dormant by design — future work, not in v3.0 scope | +| seed | SEED-002-pax8-integration | Dormant by design — future work, not in v3.0 scope | +| seed | SEED-003-general-pulse-data-assistant | Dormant by design — future work, not in v3.0 scope | +| uat_gap | Phase 18 18-HUMAN-UAT.md | Marked `resolved`, 0 pending scenarios — stale status label only | +| verification_gap | Phase 19 19-VERIFICATION.md (`human_needed`) | No actual gaps — 2 non-blocking human-decision items (a regression-guard curl check already traced correct by static analysis, and a THREAT-escalation policy question already implicitly resolved by Phases 20-23 shipping on top of that code without issue) | +| verification_gap | Phase 22 22-VERIFICATION.md (`human_needed`, first-ever verification pass, run at this milestone close) | Code-level: 6/6 requirements confirmed correct by direct source read (REVIEW-01 through REVIEW-06, including REVIEW-03's evidence-sanitization requirement — no `dangerouslySetInnerHTML`, no anchor tags on indicator URLs, explicit Mimecast `unavailable` branch). 5 manual browser click-through checks remain outstanding (full page state-machine, approve/remediate/mark-false-positive live flow, non-privileged-role gating, live Mimecast-unavailable render, URL-inertness/clipboard) — deferred rather than run via Playwright per user choice at 2026-07-17 milestone close. See 22-VERIFICATION.md frontmatter `human_verification` list before relying on this UI in a new deployment. | + ## Session Continuity Last session: 2026-07-16T22:37:09.979Z