lorentz/wulf-pulse
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
wulf-pulse/.planning/STATE.md
lorentz 820e5c584b fix(state): correct STATE.md progress totals after tool bug 
gsd-sdk's state.complete-phase fallback (gsd-tools.cjs) overwrote the
milestone-wide progress totals with just phase 24's counts (total_phases:
1, total_plans: 7) and lost milestone_name entirely. Restored accurate
project-wide totals (10 phases / 37 plans across v3.0 including this
post-ship addition) and the milestone name.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-05 23:19:13 -04:00

175 lines
13 KiB
Markdown
Raw Permalink Blame History

---
gsd_state_version: 1.0
milestone: v3.0
milestone_name: Phishing Triage Automation
status: completed
stopped_at: Phase 24 complete
last_updated: "2026-08-06T03:18:19.527Z"
last_activity: 2026-08-06 -- Phase 24 marked complete
progress:
total_phases: 10
completed_phases: 10
total_plans: 37
completed_plans: 37
percent: 100
---
# Project State
## Project Reference
See: .planning/PROJECT.md (updated 2026-07-14)
**Core value:** A manager/security operator can see every phishing/spam report ticket automatically triaged, deduplicated into campaigns, and classified — with any destructive remediation gated behind explicit human approval.
**Current focus:** Phase 24 complete — AWS Route 53 DNS sync live in production
## Current Position
Phase: 24 (aws-route-53-dns-sync-track-changes-crud-operations-full-aud) — COMPLETE
Plan: 7 of 7
Status: Phase 24 complete
Last activity: 2026-08-06 -- Phase 24 marked complete
## Performance Metrics
**Velocity:**
- Total plans completed: 66 (v1.0: 42, v2.0: 20 across phases 10-14 — see per-phase table)
- Average duration: —
- Total execution time: 0.0 hours (v3.0)
**By Phase:**
| Phase | Plans | Total | Avg/Plan |
|-------|-------|-------|----------|
| 01-09.1 (v1.0) | 34 | - | - |
| 10-14 (v2.0) | 20 | - | - |
| 15-21 (v3.0) | TBD | - | - |
| 15 | 3 | - | - |
| 18 | 5 | - | - |
| 21 | 2 | - | - |
| 23 | 6 | - | - |
**Recent Trend:**
- Last 5 plans: — (v2.0 closed 2026-07-12; v3.0 not yet executed)
- Trend: —
*Updated after each plan completion*
## Accumulated Context
### Decisions
Decisions are logged in PROJECT.md Key Decisions table.
Recent decisions affecting current work:
- v3.0 roadmap: 7 phases (15-21), each a hard dependency on at least one
predecessor except Phase 17 (Mimecast blast-radius), which only depends on
the Phase 15 schema and could be built in parallel with Phase 16 (EML
parser) if split across two workstreams — sequenced after 16 here for a
single execution thread
- The durable schema (campaigns/reports/messages/indicators/classifications/
remediation_actions/audit_events) lands in Phase 15, before any service
that writes to it — new migration, next number after 096 (097+)
- ACCESS-01 is mapped to Phase 18 (the first phase introducing
`/api/phishing/*` routes) rather than a standalone terminal phase; every
later phishing endpoint (19, 20, 21) is expected to continue enforcing the
same `requireAuth`/`requirePermission` convention as a success-criteria
carry-forward, not a re-mapped requirement
- Classification (Phase 19) is sequenced after both Phase 17 (blast-radius)
and Phase 18 (campaigns) since it needs both as inputs
- Remediation/approval/audit (Phase 20) is sequenced after Phase 18
(campaigns) and Phase 19 (classifications) — can't approve/gate an action
that doesn't reference either
- Autotask triage note (Phase 21) is last — its content summarizes
classification + blast radius + recommended/approved remediation state,
so it has nothing to summarize until Phases 19-20 exist
### Roadmap Evolution
- Phase 22 added: Approval UI (LiveLink) — ticket-ID-addressable Pulse page
(Autotask LiveLink target) showing campaign timeline, evidence, and
classification, with approve/remediate/mark-false-positive wired to the
Phase 20 APIs. Depends on Phase 19 + Phase 20 only; not functionally
dependent on Phase 21 despite being numbered after it.
- Phase 23 added: Classification Disposition + Per-Client Automation Gate —
dedicated "User Awareness" verdict for confirmed phishing-simulation-vendor
reports (currently forced into generic UNWANTED), plus an admin UI gate
for per-company automatic vs. manual phishing pipeline execution. Surfaced
live during Phase 22 review of a real Breach Secure Now report (ticket
699415) — the classifier already detects the simulation vendor and skips
the THREAT tier, but has no distinct outcome to reflect it.
- Phase 24 edited: edited fields: title, goal, success_criteria (tidied up phase.add output; AWS Route 53 DNS sync via BWS credentials, full CRUD + audit logging, integrated into existing sync infra)
### Pending Todos
None yet.
### Blockers/Concerns
- 2026-07-15 — Phase 18 gap closure (18-04): decision-coverage gate flagged D-02/D-03/D-04 (grouping-parameter decisions from original discuss-phase) as not literally cited in any plan's `must_haves`/`truths`. Overridden and proceeded — these decisions were already implemented in 18-01 (24h window, subject normalization, no-merge behavior) and independently confirmed correct by both 18-REVIEW.md and 18-VERIFICATION.md. Citation gap only, not an implementation gap.
- 2026-07-16 — Phase 23 planning: decision-coverage gate flagged D-01/D-02/D-03/D-04/D-05/D-06/D-08 (7 of 8 decisions) as not literally cited by `D-NN:` prefix in any plan's `must_haves`/`truths`. Overridden and proceeded — spot-checked plan 23-01's `must_haves.truths` directly and confirmed it substantively describes D-01 through D-04's content (USER_AWARENESS verdict, acknowledge_user action, noteType 18 customer-visible note, manual-path real posting) without the literal citation prefix; the plan-checker's second-pass review (after the blocker-revision cycle) independently confirmed via live source reads that all 8 decisions map to implementing tasks with no contradictions. Same citation-format gap as the Phase 18 precedent above, not an implementation gap.
- 2026-07-16 — Phase 23 gap-closure planning (`--gaps`, plan 23-06): re-running the decision-coverage gate against the phase directory re-surfaced the same 7 pre-existing citation-format misses from the initial planning override above (D-01/D-02/D-03/D-04/D-05/D-06/D-08 — all already implemented and VERIFIED per 23-VERIFICATION.md's Observable Truths #1-15). Not a new gap and not introduced by 23-06 (which only touches AUTOGATE-03/webhook idempotency and cites no CONTEXT.md decisions of its own). Overridden and proceeded for the same reason as the original override — retroactively reformatting 5 already-executed, already-shipped plans to add literal `D-NN:` citations under designated headings is out of scope for a narrow gap-closure run targeting Truth #18 only.
### Quick Tasks Completed
| # | Description | Date | Commit | Directory |
|---|-------------|------|--------|-----------|
| 260712-ash | Add PAX8 to admin sync overview page + detail page | 2026-07-12 | 6ed6c66 | [260712-ash-add-pax8-to-the-admin-sync-overview-page](./quick/260712-ash-add-pax8-to-the-admin-sync-overview-page/) |
| 260716-n46 | Fix Mimecast blast-radius future-end-date swallow bug + multi-tenant gap (per-company tenant resolution) | 2026-07-16 | 9951e53 | [260716-n46-fix-mimecast-blast-radius-date-window-fu](./quick/260716-n46-fix-mimecast-blast-radius-date-window-fu/) |
| 260716-pgr | Fix confidence display bug (0-1 scale rendered as raw percent, e.g. "1%" instead of "100%") | 2026-07-16 | 3f16268 | [260716-pgr-fix-confidence-display-bug-in-classifica](./quick/260716-pgr-fix-confidence-display-bug-in-classifica/) |
| 260717-a19 | Fix phishing simulation-vendor allowlist gaps (3 missing KnowBe4 domains), auto-parse timing race (retry on ticket.update), and parseAndStoreMessage idempotency; reclassified 6 stale Seubert campaigns (all flipped UNWANTED → USER_AWARENESS) | 2026-07-17 | cf04f07 | [260717-a19-fix-phishing-simulation-vendor-allowlist](./quick/260717-a19-fix-phishing-simulation-vendor-allowlist/) |
| 260717-v6c | Add "Mark as accidental report" action to the phishing Action Area — closes out a campaign and posts a fixed customer-facing note to the reporter (distinct from the silent "Mark as false positive" action) | 2026-07-18 | 565a0c1 | [260717-v6c-add-a-mark-as-accidental-report-action-t](./quick/260717-v6c-add-a-mark-as-accidental-report-action-t/) |
| 260718-7v8 | Fix Mimecast blast-radius false positives — date-scope `getHeldMessages()` and add a sender-domain relevance guard so unrelated held mail in a recipient's queue no longer inflates held/matched counts or overwrites a genuinely delivered recipient's status | 2026-07-18 | b7d6be4 | [260718-7v8-fix-mimecast-blast-radius-held-message-f](./quick/260718-7v8-fix-mimecast-blast-radius-held-message-f/) |
| 260718-9qg | Add self-contained `QBO_INTEGRATION_HANDOFF.md` documenting Pulse's QuickBooks Online OAuth2 flow, token storage/refresh, sandbox/production API base URLs, and gotchas (deletion-diffing, CSRF state gap, NEXTAUTH_URL legacy var) for a new app's team | 2026-07-18 | ea8a36b | [260718-9qg-create-a-quickbooks-online-integration-h](./quick/260718-9qg-create-a-quickbooks-online-integration-h/) |
| 260721-fy8 | Fix missing `mimecast-sync`/`qbo` scheduler dispatch branches (both silently fell through to a generic Autotask full sync) and reschedule `mimecast-sync` off the 2am 3-way cron collision with `qbo-sync-2am` and `veeam-full` | 2026-07-21 | db7db98 | [260721-fy8-fix-mimecast-and-qbo-sync-scheduler-disp](./quick/260721-fy8-fix-mimecast-and-qbo-sync-scheduler-disp/) |
| 260721-mmf | Fix Mimecast blast-radius query scope — dropped the single-recipient `to`/`recipient` filter from `searchDeliveredMessages`/`getHeldMessages` so the fan-out returns every delivered/held message across the whole tenant for a campaign's sender+subject+date-window, not just whether it reached the original reporter's mailbox | 2026-07-21 | 534eda3 | [260721-mmf-fix-mimecast-blast-radius-scope](./quick/260721-mmf-fix-mimecast-blast-radius-scope/) |
| 260721-n49 | Fix `gatherCampaignEvidence()` (used by auto-classification on ticket creation) to resolve the reporting company's own `mimecast_tenants` row before calling `getBlastRadius()`, mirroring the campaign-detail route's existing per-tenant resolution — previously it always used the global env-configured (Wulf) tenant, silently returning wrong-tenant (often empty) blast-radius data for any company with its own registered Mimecast tenant | 2026-07-21 | 9f12cd6 | [260721-n49-fix-classifier-mimecast-tenant-scope](./quick/260721-n49-fix-classifier-mimecast-tenant-scope/) |
## Deferred Items
Items acknowledged and carried forward from previous milestone close:
| Category | Item | Status | Deferred At |
|----------|------|--------|-------------|
| Follow-up | Tablet breakpoint (`md:max-w-2xl`) on mobile shell | Deferred | v1.0 close |
| Follow-up | Real notification list behind Bell icon | Deferred | v1.0 close |
| Follow-up | Scroll restoration on Engagement profile back navigation (partial fix only) | Deferred | v1.0 close |
Items acknowledged and deferred at v3.0 milestone close on 2026-07-17 (pre-flight open-artifact audit — none are v3.0/phishing gaps):
| Category | Item | Status |
|----------|------|--------|
| quick_task | 260519-0oz-add-qbo-createpayment-createdeposit-fh-r | Complete on disk (PLAN+SUMMARY present); missing STATE.md log entry — QBO financial work, unrelated to v3.0 |
| quick_task | 260521-fci-stopgap-nightly-reconciliation-for-stale | Complete on disk (PLAN+SUMMARY present); missing STATE.md log entry — QBO financial work, unrelated to v3.0 |
| quick_task | 260521-foj-fix-weekly-full-fk-error-widen-companies | Complete on disk (PLAN+SUMMARY present); missing STATE.md log entry — Autotask sync fix, unrelated to v3.0 |
| quick_task | 260712-ash-add-pax8-to-the-admin-sync-overview-page | Already logged in Quick Tasks Completed table above — audit flag is a false positive |
| quick_task | 260716-n46-fix-mimecast-blast-radius-date-window-fu | Already logged in Quick Tasks Completed table above — audit flag is a false positive |
| quick_task | 260716-pgr-fix-confidence-display-bug-in-classifica | Already logged in Quick Tasks Completed table above — audit flag is a false positive |
| seed | SEED-001-wulf-standards-engine | Dormant by design — future work, not in v3.0 scope |
| seed | SEED-002-pax8-integration | Dormant by design — future work, not in v3.0 scope |
| seed | SEED-003-general-pulse-data-assistant | Dormant by design — future work, not in v3.0 scope |
| uat_gap | Phase 18 18-HUMAN-UAT.md | Marked `resolved`, 0 pending scenarios — stale status label only |
| verification_gap | Phase 19 19-VERIFICATION.md (`human_needed`) | No actual gaps — 2 non-blocking human-decision items (a regression-guard curl check already traced correct by static analysis, and a THREAT-escalation policy question already implicitly resolved by Phases 20-23 shipping on top of that code without issue) |
| verification_gap | Phase 22 22-VERIFICATION.md (`human_needed`, first-ever verification pass, run at this milestone close) | Code-level: 6/6 requirements confirmed correct by direct source read (REVIEW-01 through REVIEW-06, including REVIEW-03's evidence-sanitization requirement — no `dangerouslySetInnerHTML`, no anchor tags on indicator URLs, explicit Mimecast `unavailable` branch). 5 manual browser click-through checks remain outstanding (full page state-machine, approve/remediate/mark-false-positive live flow, non-privileged-role gating, live Mimecast-unavailable render, URL-inertness/clipboard) — deferred rather than run via Playwright per user choice at 2026-07-17 milestone close. See 22-VERIFICATION.md frontmatter `human_verification` list before relying on this UI in a new deployment. |
## Session Continuity
Last session: 2026-08-05T22:31:11.414Z
Stopped at: Phase 24 context gathered
Resume file: .planning/phases/24-aws-route-53-dns-sync-track-changes-crud-operations-full-aud/24-CONTEXT.md
</content>
## Operator Next Steps
- Start the next milestone with /gsd-new-milestone
Reference in a new issue View git blame Copy permalink