lorentz/wulf-pulse
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

docs(phase-17): update tracking after wave 1

Browse source
This commit is contained in:
lorentz 2026-07-15 14:31:59 -04:00
parent 30bfa127bb
commit fc7e47532b
2 changed files with 11 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

6
.planning/ROADMAP.md
View file

@ -357,7 +357,7 @@ summarizes classification, blast radius, and recommended/approved remediation st
- [x] **Phase 15: Data Model, Detection & Ticket Evidence** — New phishing schema (migration 097) + idempotent Autotask ticket scanner + base ticket evidence capture (completed 2026-07-15)
- [x] **Phase 16: EML/MIME Evidence Parser** — Pure RFC822/MIME parser: `.eml` selection (`rfc.eml` over `OriginatingEmail.eml`), normalized headers/URLs/attachments, sanitized body preview, synthetic-fixture tests (completed 2026-07-15)
- [ ] **Phase 17: Mimecast Blast Radius Lookup** — Blast-radius abstraction with graceful `unavailable` degradation when Mimecast isn't configured
- [x] **Phase 17: Mimecast Blast Radius Lookup** — Blast-radius abstraction with graceful `unavailable` degradation when Mimecast isn't configured (completed 2026-07-15)
- [ ] **Phase 18: Campaign Grouping & Phishing Analysis API** — Message-ID-first dedupe/grouping, on-demand single-ticket analysis, and the first `/api/phishing/*` routes with the ACCESS-01 auth convention
- [ ] **Phase 19: Classification Engine** — Deterministic SPAM/UNWANTED/THREAT rule classifier over bounded structured evidence, KnowBe4-simulation guard, (re-)trigger API
- [ ] **Phase 20: Remediation, Approval & Audit Safety** — Proposed-only remediation actions, approve/remediate/mark-false-positive APIs, idempotent re-run, full audit trail
@ -405,7 +405,7 @@ summarizes classification, blast radius, and recommended/approved remediation st
2. When Mimecast is not configured, the same lookup call returns `status: unavailable` synchronously rather than throwing, timing out, or blocking the caller
3. The lookup follows the existing `lib/services/` factory convention (`getMimecastClient()` + `isMimecastConfigured()`-equivalent) so Phase 19's classifier can call it without knowing whether Mimecast is present
**Plans**: 1 plan
- [ ] 17-01-PLAN.md — isMimecastConfigured() gate + mimecast-blast-radius.ts fan-out/merge/cache orchestration + tests (BLAST-01, BLAST-02)
- [x] 17-01-PLAN.md — isMimecastConfigured() gate + mimecast-blast-radius.ts fan-out/merge/cache orchestration + tests (BLAST-01, BLAST-02)
**UI hint**: no
### Phase 18: Campaign Grouping & Phishing Analysis API
@ -483,7 +483,7 @@ Phases execute in numeric order. v1.0 (Phases 1-9.1) shipped 2026-07-10. v2.0 (P
| 14. /pax8 UI Surface | v2.0 | 6/6 | Complete | 2026-07-12 |
| 15. Data Model, Detection & Ticket Evidence | v3.0 | 3/3 | Complete | 2026-07-15 |
| 16. EML/MIME Evidence Parser | v3.0 | 3/3 | Complete | 2026-07-15 |
| 17. Mimecast Blast Radius Lookup | v3.0 | 0/TBD | Not started | - |
| 17. Mimecast Blast Radius Lookup | v3.0 | 1/1 | Complete | 2026-07-15 |
| 18. Campaign Grouping & Phishing Analysis API | v3.0 | 0/TBD | Not started | - |
| 19. Classification Engine | v3.0 | 0/TBD | Not started | - |
| 20. Remediation, Approval & Audit Safety | v3.0 | 0/TBD | Not started | - |

16
.planning/STATE.md
View file

@ -2,10 +2,10 @@
gsd_state_version: 1.0
milestone: v3.0
milestone_name: Phishing Triage Automation
status: completed
status: executing
stopped_at: Phase 17 planned, 1 plan ready
last_updated: "2026-07-15T17:48:04.662Z"
last_activity: 2026-07-15 -- Phase 16 marked complete
last_updated: "2026-07-15T18:25:57.157Z"
last_activity: 2026-07-15 -- Phase 17 execution started
progress:
total_phases: 7
completed_phases: 2
@ -21,14 +21,14 @@ progress:
See: .planning/PROJECT.md (updated 2026-07-14)
**Core value:** A manager/security operator can see every phishing/spam report ticket automatically triaged, deduplicated into campaigns, and classified — with any destructive remediation gated behind explicit human approval.
**Current focus:** Phase 16 — eml-mime-evidence-parser
**Current focus:** Phase 17 — mimecast-blast-radius-lookup
## Current Position
Phase: 16 — COMPLETE
Plan: 1 of 3
Status: Phase 16 complete
Last activity: 2026-07-15 -- Phase 16 marked complete
Phase: 17 (mimecast-blast-radius-lookup) — EXECUTING
Plan: 1 of 1
Status: Executing Phase 17
Last activity: 2026-07-15 -- Phase 17 execution started
Progress: [░░░░░░░░░░] 0%