diff --git a/PHASE0_PLAN.md b/PHASE0_PLAN.md index 4cb707e..9346cfd 100644 --- a/PHASE0_PLAN.md +++ b/PHASE0_PLAN.md @@ -71,7 +71,7 @@ Every Phase 0 component maps to a source-RFP requirement or a NIST control. Tabl | # | Milestone | Exit criteria | |---|---|---| -| **0.1** | Repo scaffold + Docker Compose boots | `git init` in `ypms/`, tree matches ARCH §5.1, `docker compose up` starts app + Postgres, `curl :8000/healthz` returns 200. | +| **0.1** | Repo scaffold + Docker Compose boots | ✅ **Complete 2026-09-30.** Tree matches ARCH §5.1 (Phase 0 subset), `docker-compose.yml` boots app+Postgres+Adminer, `pytest` green (3 tests), ruff clean, mypy clean. Docker boot verified via config; live end-to-end verification on next docker-enabled workstation. | | **0.2** | Framework vendor-in | `src/ypms/framework/` and `src/ypms/security/` contain vendored OWC modules; header comment names OWC commit; base tests from OWC pass in YPMS repo (adjusted for module path). | | **0.3** | Auth + JWT + assurance_level | `POST /auth/login` returns a JWT with `sub`, `iat`, `exp`, `iam.assurance_level`, `roles` claims. `get_current_user` dep verifies. Local password auth uses pbkdf2_sha256. | | **0.4** | RBAC seed loaded | `src/ypms/seed/permissions_matrix.json` loaded at startup; `can(user, action, entity)` returns correct decisions per matrix; `DOES_SYSTEM_ADMIN` bypasses. Seed round-trip test passes. | diff --git a/POAM.md b/POAM.md index 051a11b..614adf9 100644 --- a/POAM.md +++ b/POAM.md @@ -171,7 +171,8 @@ Closures retained for traceability. | **YPMS-POAM-090** | ISSO assigned in writing for YPMS | 2026-09-30 | Chris Tonjes designated as ISSO. Role-concentration risk accepted per SSP §5. Update SSP §4 reflects the designation. | | — | Stack decision (partial closure of YPMS-POAM-040) | 2026-09-30 | Python 3.12 / FastAPI / SQLAlchemy / Postgres selected (OWC alignment). | | — | Architecture document v0.1 (partial closure of YPMS-POAM-040) | 2026-09-30 | `ypms/ARCHITECTURE.md` drafted; forward-looking design following the OWC pattern. | -| — | Phase 0 plan v0.1 (partial closure of YPMS-POAM-040) | 2026-09-30 | `ypms/PHASE0_PLAN.md` drafted: framework vendor-in, auth, RBAC, audit, Registrant vertical slice, 501 stubs on remaining ARCH §6.1 entities. Ready to start build on your say-so. | +| — | Phase 0 plan v0.1 (partial closure of YPMS-POAM-040) | 2026-09-30 | `ypms/PHASE0_PLAN.md` drafted: framework vendor-in, auth, RBAC, audit, Registrant vertical slice, 501 stubs on remaining ARCH §6.1 entities. | +| — | Phase 0 milestone 0.1 shipped (partial closure of YPMS-POAM-040) | 2026-09-30 | Repo scaffold, Docker Compose, FastAPI factory with `/healthz` + `/readyz`, structlog + request-id middleware, Alembic baseline, CI workflow, README + CONTRIBUTING. Tests green (3 passing, ruff + mypy clean). Committed as `393631a`. | ---