From 390e917de9322cfdc91c2e1d70b367ca8f9fa9be Mon Sep 17 00:00:00 2001 From: Chris Tonjes Date: Wed, 30 Sep 2026 19:12:46 -0400 Subject: [PATCH] Mark milestone 0.4 complete in PHASE0_PLAN and POA&M Co-Authored-By: Claude Opus 4.7 (1M context) --- PHASE0_PLAN.md | 2 +- POAM.md | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/PHASE0_PLAN.md b/PHASE0_PLAN.md index 62707d7..6f0ef50 100644 --- a/PHASE0_PLAN.md +++ b/PHASE0_PLAN.md @@ -74,7 +74,7 @@ Every Phase 0 component maps to a source-RFP requirement or a NIST control. Tabl | **0.1** | Repo scaffold + Docker Compose boots | ✅ **Complete 2026-09-30.** Tree matches ARCH §5.1 (Phase 0 subset), `docker-compose.yml` boots app+Postgres+Adminer, `pytest` green (3 tests), ruff clean, mypy clean. Docker boot verified via config; live end-to-end verification on next docker-enabled workstation. | | **0.2** | Framework vendor-in | ✅ **Complete 2026-09-30.** OWC framework (base, bulk, crud, pagination, router, version_history) + security (models, rbac) + audit (models, service) + users (models) + auth stub vendored with owc→ypms renames. YPMS-specific `framework/pii_audit.py` added on top. Pagination bug in upstream fixed here (peek-ahead cursor was silently dropping rows). 26 tests passing, 93.10% coverage. Migration `0002_framework_tables.py` creates the shared tables. | | **0.3** | Auth + JWT + assurance_level | ✅ **Complete 2026-09-30.** `POST /auth/login` (OAuth2 form) returns access + refresh JWTs; access token carries `sub`, `uid`, `roles`, `iam.assurance_level`, `mfa_verified`, `iat`, `exp`, `type`. `get_current_user` verifies and rejects refresh tokens. `/auth/refresh`, `/auth/me`, `/auth/change-password` (≥12 char floor) also shipped. Login lockout after 5 IP-scoped failed attempts / 15 min per NIST AC-7. 43 tests, 93.47% coverage. | -| **0.4** | RBAC seed loaded | `src/ypms/seed/permissions_matrix.json` loaded at startup; `can(user, action, entity)` returns correct decisions per matrix; `DOES_SYSTEM_ADMIN` bypasses. Seed round-trip test passes. | +| **0.4** | RBAC seed loaded | ✅ **Complete 2026-09-30.** 8 roles seeded from `seed/roles.py`. Permissions matrix at `seed/permissions_matrix.json` — role-first grants across 30 entities × 8 actions. `python -m ypms.seed.run` wired into docker-compose. Loader validates every cell against declared actions/entities and refuses unknown roles at seed time. 53 tests, 92.20% coverage; end-to-end `can()` decisions verified per role including admin bypass. | | **0.5** | Registrant vertical slice | `Registrant` model + schemas + router + migration + permissions + tests. CRUD works end-to-end; SSN masked in serializer output; `@audit_read("pii_access")` fires on GET; every state change emits audit row. Coverage doc at `docs/coverage/registrant.md`. | | **0.6** | 501-stub routers for remaining entities | Every entity in ARCH §6.1 (except Registrant, User, Role, Permission, AuditRow) has a router registered in `main.py` that returns 501 while still firing RBAC + audit. Test asserts RBAC decision and audit emission for each. | | **0.7** | Retention scaffold | `retention_policy` attribute on every entity model (even 501-stub entities have a model). Nightly job in `src/ypms/framework/retention.py` runs, logs "0 records to purge" — no-op but wired. | diff --git a/POAM.md b/POAM.md index c814072..703f886 100644 --- a/POAM.md +++ b/POAM.md @@ -175,6 +175,7 @@ Closures retained for traceability. | — | Phase 0 milestone 0.1 shipped (partial closure of YPMS-POAM-040) | 2026-09-30 | Repo scaffold, Docker Compose, FastAPI factory with `/healthz` + `/readyz`, structlog + request-id middleware, Alembic baseline, CI workflow, README + CONTRIBUTING. Tests green (3 passing, ruff + mypy clean). Committed as `393631a`. | | — | Phase 0 milestone 0.2 shipped (partial closure of YPMS-POAM-040) | 2026-09-30 | OWC framework vendored (base/crud/bulk/pagination/router/version_history + audit + security/rbac + users + auth stub) with owc→ypms renames. YPMS pii_audit decorator added. Pagination bug in upstream OWC fixed here (peek-ahead cursor). 26 tests passing, 93.10% coverage. Migration 0002 creates the framework tables. | | — | Phase 0 milestone 0.3 shipped (partial closure of YPMS-POAM-040) | 2026-09-30 | Local password auth + JWT access/refresh tokens with YPMS-specific claims (`uid`, `roles`, `iam.assurance_level`, `mfa_verified`). Endpoints: /auth/login, /auth/refresh, /auth/me, /auth/change-password. NIST AC-7 lockout at 5 attempts / 15 min (source RFP C.5.7.10). 43 tests passing, 93.47% coverage. | +| — | Phase 0 milestone 0.4 shipped (partial closure of YPMS-POAM-040) | 2026-09-30 | Data-driven RBAC seed: 8 roles + permissions matrix (30 entities × 8 actions) at `src/ypms/seed/`. Bootstrap admin auto-seeded (`chris` / DOES_SYSTEM_ADMIN). Loader idempotent + validates cell references. `python -m ypms.seed.run` chained into docker-compose. 53 tests passing, 92.20% coverage. | ---