knacky/mimic-big
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: update CHANGELOG + tasks for the backend skeleton sprint 0

Browse Source 
- CHANGELOG.md: detail every B0.1..B0.8 deliverable + spec deltas
  D-008 (ttp_version coexists), D-009 (audit hash chain v1),
  D-010 (no type_annotation_map on declarative base).
- tasks/todo.md: tick every B0.x item.
- tasks/spec-decisions.md: log D-008, D-009, D-010 alongside the
  pre-existing D-001..D-007.
This commit is contained in:
knacky
2026-05-21 20:34:19 +02:00
parent 5d9415bb9f
commit 887182cfd7
3 changed files with 93 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
tasks/todo.md
View File

@@ -2,24 +2,29 @@
Repo skeleton + foundational modules. Nothing that depends on PR1/PR2/PR3.
## Backend (`backend`)
## Backend (`backend`) — done in `feature/backend-skeleton`
- [ ] B0.1 — `backend/` Python project: `pyproject.toml` (ruff, mypy strict, pytest, coverage),
`Makefile`, `Dockerfile`, `docker-compose.yml` for Postgres dev DB.
- [ ] B0.2 — Alembic init + complete initial migration covering the §8 schema (incl.
`c2_credential`, `user`, `group`, `user_group`, `permission`, `group_permission`,
`soc_session`, audit_log with write-only Postgres role). **No `ttp_version` table** (D-009).
Seed groups `rt_operator`, `rt_lead`, `soc_analyst` with F11 permissions (D-008).
- [ ] B0.3 — SQLAlchemy 2 typed mapped classes for every table + repositories scaffold.
- [ ] B0.4 — `C2Connector` ABC + dataclasses (`Payload`, `TaskHandle`, `TaskResult`) + enum
`payload_type` + factory keyed on `c2_type`. **No real implementation.**
- [ ] B0.5 — Jinja2 SandboxedEnvironment + `regex_extract` filter via `google-re2` +
`{{outputs.text}}` and `{{outputs.blob(key)}}` accessors with 10 MB cap.
- [ ] B0.6 — Local auth (login/password bcrypt + Flask server-side sessions) + RBAC
group-based decorators + F11 permission matrix declared in code.
- [ ] B0.7 — Flat CRUD endpoints (engagements, hosts, TTPs, scenarios) — no orchestration,
no WebSocket, no reporting yet.
- [ ] B0.8 — pytest baseline: unit (SQLite) + integration scaffold (testcontainers Postgres).
- [x] B0.1 — `backend/` Python 3.12+ project: `pyproject.toml` (ruff, mypy strict, pytest,
coverage 70 %), `Makefile` (Docker/Podman auto), multi-stage `Dockerfile`,
`docker-compose.yml` for Postgres dev DB, `.env.example`.
- [x] B0.2 — Alembic baseline migration `202605210001_initial_schema` creates every table,
enum, index, and the idempotent grants for the audit write-only Postgres role. **No
`ttp_version` table** (D-009). Groups `rt_operator`, `rt_lead`, `soc_analyst` seeded
with the exact F11 permission matrix (D-008).
- [x] B0.3 — SQLAlchemy 2 typed mapped classes for every spec §8 aggregate (engagement,
host, user/group RBAC, ttp, scenario/scenario_step, run/run_step/cleanup, detection,
evidence, report, soc_session, c2_credential, audit_log).
- [x] B0.4 — `C2Connector` ABC + dataclasses + `payload_type` enum + factory keyed on
`c2_type`. Mythic payload map populated; Home stays empty until PR2.
- [x] B0.5 — Jinja2 SandboxedEnvironment, `regex_extract` filter (google-re2 with `re`
fallback) per D-011 semantics (fail-loud no-match), `{{ outputs.text }}` /
`{{ outputs.blob() }}` accessors with 10 MB cap.
- [x] B0.6 — bcrypt password helpers + SOC opaque token (256-bit url-safe, bcrypt-hashed) +
group-based RBAC matrix matching F11 + `@require_perm` decorator.
- [x] B0.7 — Flat CRUD blueprints for engagements / hosts / TTPs / scenarios (incl. step
composition with F3 invariant `host.c2_type == scenario.c2_type`).
- [x] B0.8 — pytest baseline: unit tests passing, integration scaffold ready
(testcontainers Postgres + `/healthz` smoke).
## Frontend (`ux-frontend`)