docs: sprint 2 wrap-up — README + CHANGELOG + lessons + plan final

- README: status bump to sprint 2, blueprints + workflow + MITRE section, test counts refreshed (131/63/68)
- CHANGELOG: sprint 2 entry under [Unreleased]; sprint 1 moved to its own [Sprint 1] section
- tasks/lessons.md: 5 lessons captured (3 frontend testing gotchas, agent-reuse via SendMessage, e2e refresh on placeholder supersession)
- tasks/todo.md: status flipped to 🟢 SPRINT COMPLET, execution sequence ticks updated with commit hashes

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -2,7 +2,7 @@
 
 **Mimic** is a Breach and Attack Simulation (BAS) web UI built on the MITRE ATT&CK matrix. It replaces the flat Excel spreadsheets that red-teams and SOC analysts pass around at the end of an engagement, providing a shared workspace for Purple Team handoffs.
 
-> Status: **Sprint 1 — Auth + CRUD Engagement**. Simulation workflow and MITRE TTP autocomplete arrive in Sprint 2+.
+> Status: **Sprint 2 — Simulations + MITRE ATT&CK**. The Purple Team workflow (RedTeam fills test → marks for review → SOC documents detection → closes) is now end-to-end testable in the UI, with MITRE technique autocomplete for TTP tagging.
 
 ---
 
@@ -56,7 +56,8 @@ Single-container deployment. A multistage Dockerfile builds the Vite frontend, t
 │                                           │
 │  Flask (Python 3.12)                      │
 │   ├── /api/* ── blueprints (auth, users,  │
-│   │              engagements)             │
+│   │              engagements, simulations,│
+│   │              mitre)                   │
 │   └── /     ── SPA fallback → React build │
 │                                           │
 │  SQLAlchemy ── SQLite at /data/mimic.sqlite │
@@ -65,9 +66,11 @@ Single-container deployment. A multistage Dockerfile builds the Vite frontend, t
 ```
 
 - **Auth**: JWT Bearer tokens (HS256, 60-min TTL). Stateless — no refresh tokens, no server-side session.
-- **Roles**: `admin` (super-user, manages users + engagements), `redteam` (CRUD engagements + simulations), `soc` (read engagements; will write the SOC half of simulations in Sprint 2).
+- **Roles**: `admin` (super-user — cumulates redteam rights on engagements/simulations), `redteam` (CRUD engagements + simulations, full field access), `soc` (read everything, write-only on the SOC half of simulations once the redteam marks them `review_required`).
 - **Password hashing**: argon2 via `argon2-cffi`.
 - **Migrations**: Alembic, applied automatically by the container entrypoint (`flask db upgrade && flask run`).
+- **MITRE ATT&CK**: STIX 2.1 Enterprise bundle committed at `backend/data/mitre/enterprise-attack.json` and indexed at app boot. `make update-mitre` re-fetches the latest bundle and (if the container is running) restarts it to reload the index. The endpoint `GET /api/mitre/techniques?q=` powers the autocomplete on simulations.
+- **Simulation workflow**: Pending → In progress (auto-transition when redteam saves any non-empty field) → Review required (manual, redteam) → Done (manual, redteam or SOC). The state machine is enforced server-side; the UI surfaces the appropriate transition button per role + current state.
 
 See [`SPEC.md`](SPEC.md) § "Décisions techniques" for the full architecture rationale and [`DESIGN.md`](DESIGN.md) for the UI design system.
 
@@ -102,7 +105,7 @@ mimic/
 | `make update` | `git pull && make build && make restart` |
 | `make logs` | `docker logs -f mimic` |
 | `make create-admin USER=… PASS=…` | Run `flask create-admin` inside the container |
-| `make update-mitre` | No-op placeholder — Sprint 2+ will fetch the MITRE STIX bundle |
+| `make update-mitre` | Fetch the latest MITRE STIX 2.1 Enterprise bundle into `backend/data/mitre/`; auto-restart the container if running. Commit the resulting file change manually. |
 | `make test-backend` | `pytest -q` inside the container |
 | `make test-frontend` | `npm run test -- --run` in `frontend/` |
 | `make test-e2e` | Playwright acceptance suite (container must be running) |
@@ -135,9 +138,9 @@ npm run dev          # http://localhost:5173 with /api proxied to :5000
 Tests:
 
 ```bash
-cd backend && pytest -q                # 63 tests
-cd frontend && npm run test -- --run   # 20 tests
-cd e2e && npx playwright test          # 36 tests (needs container up)
+cd backend && pytest -q                # 131 tests
+cd frontend && npm run test -- --run   # 63 tests
+cd e2e && npx playwright test          # 68 tests (needs container up)
 ```
 
 ---