ffcac42272
Sprint 0 backend skeleton: Python 3.12 / Flask / SQLAlchemy 2 / Pydantic 2 / Alembic / pytest. Data model §8 complete, C2Connector ABC, Jinja2 sandbox with google-re2 regex_extract (D-011), CAS gzip blob storage (D-012), local auth + group-based RBAC (D-003/D-008), F11 tenant scoping, audit log infrastructure with hash chain anticipated (D-013). Quality gates: ruff/mypy strict/56 unit tests passing. LGTM code-reviewer after 2 rounds of remediation (B1 BLOCKER + 6 MAJOR addressed). Co-Authored-By: backend <backend@mimic.local> * origin/feature/backend-skeleton: docs(backend): track sprint-0 follow-ups + flag integration migration gap feat(backend): wire created_by_id, audit log, F11 scope into CRUD (MA4/5/6) fix(backend): freeze F11 matrix inline in the initial migration (MA3) fix(backend): stream store_blob and enforce max_bytes mid-write (MA2) fix(backend): stop seeding the audit-writer role via postgres-init (MA1) fix(backend): make google-re2 a hard dependency, drop re fallback (B1) chore(backend): mypy strict clean + ruff format pass feat(backend): add content-addressed gzip blob store (D-012) fix(backend): align regex_extract + outputs.blob() with D-011/D-012 fix(backend): align with D-008/D-009 (drop ttp_version, seed F11 matrix) docs: update CHANGELOG + tasks for the backend skeleton sprint 0 test(backend): add pytest baseline (B0.8) feat(backend): add Flask app factory, audit writer, flat CRUD + CLI (B0.7) feat(backend): add local auth + group-based RBAC matching F11 (B0.6) feat(backend): add Jinja2 sandbox + regex_extract filter (B0.5) feat(backend): add C2Connector ABC + payload mapping + factory (B0.4) feat(backend): add §8 data model + Alembic baseline (B0.2, B0.3) chore(backend): bootstrap Python 3.12+ project skeleton (B0.1)
Mimic
Internal BAS (Breach & Attack Simulation) platform for the Red Team. Replays TTPs from engagement journals or an internal ATT&CK library against client infrastructure through VPN/relay, in white-glove coordination with the SOC.
Output: a coverage report mapped to MITRE ATT&CK — measurable, reproducible, archived.
Status
ready-with-prereqs — spec frozen on 2026-05-19, 23 review patches integrated.
Code start blocked on:
- PR1 — Mythic API documentation + pinned version (lead RT)
- PR2 — Internal C2 interface spec + journal export example (internal C2 team)
- PR3 — RT graphic charter for the PDF report (lead RT)
While PR1/PR2/PR3 are open, sprint 0 focuses on the unblocked skeleton.
Spec
The authoritative spec lives in the RT-SecondBrain vault:
Projects/Mimic — Spec.md. Do not duplicate it here.
In-repo documentation:
CHANGELOG.md— chronological log of features, decisions, rollbacks.tasks/spec-decisions.md— implementation arbitrations on top of the spec.tasks/todo.md— current sprint backlog.
Stack (frozen)
- Backend Python 3.12 / Flask / Flask-SocketIO / SQLAlchemy 2 / Pydantic 2 / Alembic / WeasyPrint / pytest + testcontainers / ruff / mypy strict
- Frontend TypeScript / React 18+ / Vite / Tailwind 4 / TanStack Query 5 / Recharts / Playwright
- Storage Postgres (prod) / SQLite (pure-logic unit tests) / testcontainers Postgres (audit log, RBAC, write-only role — incl. unit tests of Postgres-specific behavior, per H38)
- Deploy Docker images + Ansible deployment playbook (per D-010). Reverse proxy (Caddy + TLS + IP allowlist) handled by existing RT infrastructure, out of Mimic scope (D-007).
Layout
mimic/
├── backend/ # Flask app, connectors, orchestrator, reporting, CLI
├── frontend/ # Vite + React app
├── docs/ # Architecture notes, ADRs, deployment
└── tasks/ # Sprint backlog, decisions, lessons
Conventions
- Branches:
feature/<scope>,fix/<scope>,docs/<scope>,chore/<scope>. Long-lived:main. - Commits: Conventional Commits (
feat:,fix:,chore:,docs:,test:,refactor:). - PRs: each branch → review (
code-reviewer) → team-lead merges. No direct push tomain.
Build & run
make targets land at the end of sprint 0. For now the repo is skeleton-only.
Licensing
Internal — proprietary, RT use only. Do not redistribute.