wulf-pulse/.planning/STATE.md

gsd_state_version	milestone	milestone_name	status	stopped_at	last_updated	last_activity	progress
1.0	v3.0	Phishing Triage Automation	executing	Phase 24 context gathered	2026-08-05T23:18:04.601Z	2026-08-05 -- Phase 24 planning complete	total_phases completed_phases total_plans completed_plans percent 9 9 30 30 100

Project State

Project Reference

See: .planning/PROJECT.md (updated 2026-07-14)

Core value: A manager/security operator can see every phishing/spam report ticket automatically triaged, deduplicated into campaigns, and classified — with any destructive remediation gated behind explicit human approval. Current focus: Milestone complete

Current Position

Phase: Milestone v3.0 complete Plan: — Status: Ready to execute Last activity: 2026-08-05 -- Phase 24 planning complete

Performance Metrics

Velocity:

• Total plans completed: 66 (v1.0: 42, v2.0: 20 across phases 10-14 — see per-phase table)
• Average duration: —
• Total execution time: 0.0 hours (v3.0)

By Phase:

Phase	Plans	Total	Avg/Plan
01-09.1 (v1.0)	34	-	-
10-14 (v2.0)	20	-	-
15-21 (v3.0)	TBD	-	-
15	3	-	-
18	5	-	-
21	2	-	-
23	6	-	-

Recent Trend:

• Last 5 plans: — (v2.0 closed 2026-07-12; v3.0 not yet executed)
• Trend: —

Updated after each plan completion

Accumulated Context

Decisions

Decisions are logged in PROJECT.md Key Decisions table. Recent decisions affecting current work:

• v3.0 roadmap: 7 phases (15-21), each a hard dependency on at least one predecessor except Phase 17 (Mimecast blast-radius), which only depends on the Phase 15 schema and could be built in parallel with Phase 16 (EML parser) if split across two workstreams — sequenced after 16 here for a single execution thread

• The durable schema (campaigns/reports/messages/indicators/classifications/ remediation_actions/audit_events) lands in Phase 15, before any service that writes to it — new migration, next number after 096 (097+)

• ACCESS-01 is mapped to Phase 18 (the first phase introducing /api/phishing/* routes) rather than a standalone terminal phase; every later phishing endpoint (19, 20, 21) is expected to continue enforcing the same requireAuth/requirePermission convention as a success-criteria carry-forward, not a re-mapped requirement

• Classification (Phase 19) is sequenced after both Phase 17 (blast-radius) and Phase 18 (campaigns) since it needs both as inputs

• Remediation/approval/audit (Phase 20) is sequenced after Phase 18 (campaigns) and Phase 19 (classifications) — can't approve/gate an action that doesn't reference either

• Autotask triage note (Phase 21) is last — its content summarizes classification + blast radius + recommended/approved remediation state, so it has nothing to summarize until Phases 19-20 exist

Roadmap Evolution

• Phase 22 added: Approval UI (LiveLink) — ticket-ID-addressable Pulse page (Autotask LiveLink target) showing campaign timeline, evidence, and classification, with approve/remediate/mark-false-positive wired to the Phase 20 APIs. Depends on Phase 19 + Phase 20 only; not functionally dependent on Phase 21 despite being numbered after it.

• Phase 23 added: Classification Disposition + Per-Client Automation Gate — dedicated "User Awareness" verdict for confirmed phishing-simulation-vendor reports (currently forced into generic UNWANTED), plus an admin UI gate for per-company automatic vs. manual phishing pipeline execution. Surfaced live during Phase 22 review of a real Breach Secure Now report (ticket 699415) — the classifier already detects the simulation vendor and skips the THREAT tier, but has no distinct outcome to reflect it.

• Phase 24 edited: edited fields: title, goal, success_criteria (tidied up phase.add output; AWS Route 53 DNS sync via BWS credentials, full CRUD + audit logging, integrated into existing sync infra)

Pending Todos

None yet.

Blockers/Concerns

• 2026-07-15 — Phase 18 gap closure (18-04): decision-coverage gate flagged D-02/D-03/D-04 (grouping-parameter decisions from original discuss-phase) as not literally cited in any plan's must_haves/truths. Overridden and proceeded — these decisions were already implemented in 18-01 (24h window, subject normalization, no-merge behavior) and independently confirmed correct by both 18-REVIEW.md and 18-VERIFICATION.md. Citation gap only, not an implementation gap.

• 2026-07-16 — Phase 23 planning: decision-coverage gate flagged D-01/D-02/D-03/D-04/D-05/D-06/D-08 (7 of 8 decisions) as not literally cited by D-NN: prefix in any plan's must_haves/truths. Overridden and proceeded — spot-checked plan 23-01's must_haves.truths directly and confirmed it substantively describes D-01 through D-04's content (USER_AWARENESS verdict, acknowledge_user action, noteType 18 customer-visible note, manual-path real posting) without the literal citation prefix; the plan-checker's second-pass review (after the blocker-revision cycle) independently confirmed via live source reads that all 8 decisions map to implementing tasks with no contradictions. Same citation-format gap as the Phase 18 precedent above, not an implementation gap.

• 2026-07-16 — Phase 23 gap-closure planning (--gaps, plan 23-06): re-running the decision-coverage gate against the phase directory re-surfaced the same 7 pre-existing citation-format misses from the initial planning override above (D-01/D-02/D-03/D-04/D-05/D-06/D-08 — all already implemented and VERIFIED per 23-VERIFICATION.md's Observable Truths #1-15). Not a new gap and not introduced by 23-06 (which only touches AUTOGATE-03/webhook idempotency and cites no CONTEXT.md decisions of its own). Overridden and proceeded for the same reason as the original override — retroactively reformatting 5 already-executed, already-shipped plans to add literal D-NN: citations under designated headings is out of scope for a narrow gap-closure run targeting Truth #18 only.

Quick Tasks Completed

#	Description	Date	Commit	Directory
260712-ash	Add PAX8 to admin sync overview page + detail page	2026-07-12	6ed6c66	260712-ash-add-pax8-to-the-admin-sync-overview-page
260716-n46	Fix Mimecast blast-radius future-end-date swallow bug + multi-tenant gap (per-company tenant resolution)	2026-07-16	9951e53	260716-n46-fix-mimecast-blast-radius-date-window-fu
260716-pgr	Fix confidence display bug (0-1 scale rendered as raw percent, e.g. "1%" instead of "100%")	2026-07-16	3f16268	260716-pgr-fix-confidence-display-bug-in-classifica
260717-a19	Fix phishing simulation-vendor allowlist gaps (3 missing KnowBe4 domains), auto-parse timing race (retry on ticket.update), and parseAndStoreMessage idempotency; reclassified 6 stale Seubert campaigns (all flipped UNWANTED → USER_AWARENESS)	2026-07-17	cf04f07	260717-a19-fix-phishing-simulation-vendor-allowlist
260717-v6c	Add "Mark as accidental report" action to the phishing Action Area — closes out a campaign and posts a fixed customer-facing note to the reporter (distinct from the silent "Mark as false positive" action)	2026-07-18	565a0c1	260717-v6c-add-a-mark-as-accidental-report-action-t
260718-7v8	Fix Mimecast blast-radius false positives — date-scope getHeldMessages() and add a sender-domain relevance guard so unrelated held mail in a recipient's queue no longer inflates held/matched counts or overwrites a genuinely delivered recipient's status	2026-07-18	b7d6be4	260718-7v8-fix-mimecast-blast-radius-held-message-f
260718-9qg	Add self-contained QBO_INTEGRATION_HANDOFF.md documenting Pulse's QuickBooks Online OAuth2 flow, token storage/refresh, sandbox/production API base URLs, and gotchas (deletion-diffing, CSRF state gap, NEXTAUTH_URL legacy var) for a new app's team	2026-07-18	ea8a36b	260718-9qg-create-a-quickbooks-online-integration-h
260721-fy8	Fix missing mimecast-sync/qbo scheduler dispatch branches (both silently fell through to a generic Autotask full sync) and reschedule mimecast-sync off the 2am 3-way cron collision with qbo-sync-2am and veeam-full	2026-07-21	db7db98	260721-fy8-fix-mimecast-and-qbo-sync-scheduler-disp
260721-mmf	Fix Mimecast blast-radius query scope — dropped the single-recipient to/recipient filter from searchDeliveredMessages/getHeldMessages so the fan-out returns every delivered/held message across the whole tenant for a campaign's sender+subject+date-window, not just whether it reached the original reporter's mailbox	2026-07-21	534eda3	260721-mmf-fix-mimecast-blast-radius-scope
260721-n49	Fix gatherCampaignEvidence() (used by auto-classification on ticket creation) to resolve the reporting company's own mimecast_tenants row before calling getBlastRadius(), mirroring the campaign-detail route's existing per-tenant resolution — previously it always used the global env-configured (Wulf) tenant, silently returning wrong-tenant (often empty) blast-radius data for any company with its own registered Mimecast tenant	2026-07-21	9f12cd6	260721-n49-fix-classifier-mimecast-tenant-scope

Deferred Items

Items acknowledged and carried forward from previous milestone close:

Category	Item	Status	Deferred At
Follow-up	Tablet breakpoint (md:max-w-2xl) on mobile shell	Deferred	v1.0 close
Follow-up	Real notification list behind Bell icon	Deferred	v1.0 close
Follow-up	Scroll restoration on Engagement profile back navigation (partial fix only)	Deferred	v1.0 close

Items acknowledged and deferred at v3.0 milestone close on 2026-07-17 (pre-flight open-artifact audit — none are v3.0/phishing gaps):

Category	Item	Status
quick_task	260519-0oz-add-qbo-createpayment-createdeposit-fh-r	Complete on disk (PLAN+SUMMARY present); missing STATE.md log entry — QBO financial work, unrelated to v3.0
quick_task	260521-fci-stopgap-nightly-reconciliation-for-stale	Complete on disk (PLAN+SUMMARY present); missing STATE.md log entry — QBO financial work, unrelated to v3.0
quick_task	260521-foj-fix-weekly-full-fk-error-widen-companies	Complete on disk (PLAN+SUMMARY present); missing STATE.md log entry — Autotask sync fix, unrelated to v3.0
quick_task	260712-ash-add-pax8-to-the-admin-sync-overview-page	Already logged in Quick Tasks Completed table above — audit flag is a false positive
quick_task	260716-n46-fix-mimecast-blast-radius-date-window-fu	Already logged in Quick Tasks Completed table above — audit flag is a false positive
quick_task	260716-pgr-fix-confidence-display-bug-in-classifica	Already logged in Quick Tasks Completed table above — audit flag is a false positive
seed	SEED-001-wulf-standards-engine	Dormant by design — future work, not in v3.0 scope
seed	SEED-002-pax8-integration	Dormant by design — future work, not in v3.0 scope
seed	SEED-003-general-pulse-data-assistant	Dormant by design — future work, not in v3.0 scope
uat_gap	Phase 18 18-HUMAN-UAT.md	Marked resolved, 0 pending scenarios — stale status label only
verification_gap	Phase 19 19-VERIFICATION.md (human_needed)	No actual gaps — 2 non-blocking human-decision items (a regression-guard curl check already traced correct by static analysis, and a THREAT-escalation policy question already implicitly resolved by Phases 20-23 shipping on top of that code without issue)
verification_gap	Phase 22 22-VERIFICATION.md (human_needed, first-ever verification pass, run at this milestone close)	Code-level: 6/6 requirements confirmed correct by direct source read (REVIEW-01 through REVIEW-06, including REVIEW-03's evidence-sanitization requirement — no dangerouslySetInnerHTML, no anchor tags on indicator URLs, explicit Mimecast unavailable branch). 5 manual browser click-through checks remain outstanding (full page state-machine, approve/remediate/mark-false-positive live flow, non-privileged-role gating, live Mimecast-unavailable render, URL-inertness/clipboard) — deferred rather than run via Playwright per user choice at 2026-07-17 milestone close. See 22-VERIFICATION.md frontmatter human_verification list before relying on this UI in a new deployment.

Session Continuity

Last session: 2026-08-05T22:31:11.414Z Stopped at: Phase 24 context gathered Resume file: .planning/phases/24-aws-route-53-dns-sync-track-changes-crud-operations-full-aud/24-CONTEXT.md

Operator Next Steps

• Start the next milestone with /gsd-new-milestone