Skip to content

v0.3.0 — Plan, approve, retest, and an operable SPA

Choose a tag to compare

View all tags
@SelfishCoconut SelfishCoconut released this 14 Jul 13:16
· 130 commits to main since this release
v0.3.0
6cdec5d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.3.0 — Plan, approve, retest, and an operable SPA

Milestone M3 (Plan & approve). The whole tool now runs end-to-end from a
browser on localhost: upload a pentest PDF, review/edit an AI-proposed
safety-gated retest plan, approve it, run the retest, and read
evidence-backed verdicts — still open / fixed / inconclusive.

Highlights

  • FR-04 — Retest-plan generation (#9): an LLM proposes typed probe actions;
    a deterministic gate binds each to the allowlisted base URL and drops
    off-allowlist or destructive actions before anything runs (ADR-0011).
  • FR-05 — Server-side approval gate (#10): versioned plans, a single
    execution chokepoint that refuses anything unapproved, edits/regenerates
    re-gated through the FR-06 allowlist, executed version stamped on each verdict
    (ADR-0012).
  • FR-11 — React SPA, operable from the UI alone (#16): a Vite/React/TS/Tailwind
    app served by FastAPI at /, API under /api; PDF upload runs FR-01→FR-03 as a
    polled background job; the full plan → approve → retest → verdict flow with
    evidence + plan history is driven entirely from the browser (ADR-0013, accepted).
  • UI redesign (#55): a dark/light-themeable "forensic verdict instrument"
    console — two-voice colour language (iris = the system's voice; red/amber/green =
    reality's verdict), a left-nav sidebar with a live recent-reports jump list,
    self-hosted IBM Plex fonts (offline, NFR-03), a determination-ledger meter and a
    revalidation pipeline track. Presentational only — no API or architecture change.

Quality

  • Backend: 126 tests @ 96% coverage; frontend eslint/tsc/vitest in CI.
  • Pre-release codebase-sanity audit: GO — mechanical gates clean, no dead
    code / complexity regression / architectural drift.
  • ADRs accepted this cycle: 0011, 0012, 0013.

Known follow-ups (early M4)

  • Frontend test health: add @vitest/coverage-v8 + a CI threshold and unit-test
    the redesign's pure logic (PipelineTrack, DeterminationMeter,
    activePlan/latestVerdict, errorMessage).
  • De-duplicate the redesign's status→colour mapping and button/pill class strings
    into shared primitives.

Next

M4 — Trust & audit (→ v0.4.0): FR-08 execution sanity checker, FR-10 audit
trail + verdict re-derivation, FR-12 versioned JSON export.

Assets 2
Loading