diff --git a/DECISIONS/2026-10-04-readme-claims-audit.md b/DECISIONS/2026-10-04-readme-claims-audit.md new file mode 100644 index 0000000..7ff4223 --- /dev/null +++ b/DECISIONS/2026-10-04-readme-claims-audit.md @@ -0,0 +1,108 @@ +# Decision: README claims audit + +Status: Decided (eight claim decisions; five pending verification at the machine) +Date: 2026-10-04 + +The 2026-10-04 research review flagged README claims a sceptical reviewer +could disprove. Each was decided one by one. + +## Decisions + +| # | Claim | Decision | +|---|-------|----------| +| 1.1 | Audit log | D — verify at machine | +| 1.2 | "Production-grade" | D — keep (risk accepted) | +| 1.3 | DB deployment type | D — verify at machine | +| 2.1 | Dev password | B — sentinel REPLACE_ME | +| 2.2 | Machine-specific paths/ports | A — generic defaults | +| 3.1 | Test count framing | A — break down by tier (verify split) | +| 3.2 | FastAPI "latest" badge | A — pin and show real version | +| 3.3 | "ASDEFCON-aware" | A pending verify, with B/C fallbacks | + +Option meanings, as presented in the session: + +- 1.3 D: match the actual Terraform once verified. Suggested wording: + "Dev deploys Postgres as a Container App with external access disabled. + Prod uses Azure Database for PostgreSQL Flexible Server with private access." +- 2.2 A: default to port 5432 with a note for readers running several + PostgreSQL instances, and remove machine-specific OS paths. +- 3.1 A: state scenarios per tier rather than one total. +- 3.2 A: show the real pinned FastAPI version instead of "latest". + +## Detailed records + +``` +Claim 1.1 — Audit log claim +Decision: D (verify at machine) +Trigger: First time back at PostgreDataMigrationAppWithCSVLoader +Action: Inspect api/services/ and api/routes/audit.py (or + equivalent). Determine if the "every import is + registered" claim is true, partial, or false. +Resolve to: A if false; B if partial; "fix API table description" + if true. +Deadline: Resolve before next external review of the README +``` + +``` +Claim 1.2 — "Production-grade" framing +Decision: D (keep as-is) +Date: 2026-10-04 +Status: Decided against Claude's recommendation and against + the research review's finding +Risk accepted: Research identified this as the single most + damaging line in the README. A sceptical Defence + prime reviewer may use it as the signal to discount + other claims. Explicitly accepted. +Review trigger: If any external reviewer flags this line, or + if any job interview or presales conversation gets + pushed back on it, revisit immediately. +``` + +``` +Claim 2.1 — Dev password in README +Decision: B (sentinel REPLACE_ME, matching sister project) +Date: 2026-10-04 +Action: Replace PGPASSWORD=devpassword123 with PGPASSWORD=REPLACE_ME + Add one line: "See .env.example for the configuration + template." +Related: te-csv-migration PR #13 (2026-10-04) — same pattern +Future: If/when pre-flight validator ported to this repo, sentinel + will be caught at startup +``` + +``` +Claim 3.3 — "ASDEFCON-aware" +Decision: A (pending verification), with pre-committed fallbacks +Date: 2026-10-04 +Trigger: Next time at PostgreDataMigrationAppWithCSVLoader +Action: - Cross-check current VCRM.md output against + DID-V&V-DEF-VCRM content requirements (Strategic + Materiel V5.x) + - Required fields to check: Requirement ID, + requirement text, verification method, test + reference, result, artifact reference, status +Resolve to: + - A if genuinely aligned: use specific DID reference + - B if partially aligned: close the gap first, then + use A; or fall back to "VCRM traceability" as interim + - C if not aligned at all: drop the ASDEFCON phrase, + make it a roadmap item +Deadline: Before next external review of the README +Related: Research C3 (positioning rigor); this is the + single highest-leverage commercial differentiator + in the whole README +``` + +The session gave claims 1.3, 2.2, 3.1 and 3.2 in the summary form above only. + +## Verification results (2026-10-26, `main` @ 59aab1a) + +Recorded on #56. + +| Claim | Finding | Resolution | +|---|---|---| +| 1.1 | True. Every upload and delete writes an `audit_log` row (`api/services/audit.py`), paged by `GET /api/audit/log`. Row counts and timestamps are in the `csv_files` registry. | Fix the API table description | +| 1.3 | Dev (`infra/terraform`) runs `postgres:16-alpine` as a Container App with `external_enabled = false`. Test, staging and prod run Azure Database for PostgreSQL Flexible Server. | Rewrite to match | +| 3.1 | Tier P 23, I 1, S 1, E 1, X 1 (X not in CI per ADR-0001) | Use these counts | +| 3.2 | `fastapi>=0.140.7,<0.142.0` | Badge shows the pinned range | +| 3.3 | The phrase "ASDEFCON-aware" no longer appears in the README on `main`. DID alignment not checked. | Nothing to edit; alignment check stays open | diff --git a/DECISIONS/2026-10-04-readme-structure.md b/DECISIONS/2026-10-04-readme-structure.md new file mode 100644 index 0000000..67349f3 --- /dev/null +++ b/DECISIONS/2026-10-04-readme-structure.md @@ -0,0 +1,19 @@ +# Decision: README structural additions + +Status: Decided +Date: 2026-10-04 + +## Decision + +Add three sections at the top of the README, as recommended by the +2026-10-04 research review: + +- **Status** — what state the project is actually in +- **Known Limitations** — gaps stated plainly, so no reader discovers them first +- **For Reviewers** — where a reviewer should look to check the claims + +Add-only: these sections go in without rewriting existing content. +Claim-level rewrites are governed separately by the README claims audit +(`2026-10-04-readme-claims-audit.md`). + +Applying it is tracked in #58. diff --git a/DECISIONS/2026-10-04-repo-consolidation.md b/DECISIONS/2026-10-04-repo-consolidation.md new file mode 100644 index 0000000..ebc87a6 --- /dev/null +++ b/DECISIONS/2026-10-04-repo-consolidation.md @@ -0,0 +1,62 @@ +# Decision: Consolidate PostgreDataMigrationAppWithCSVLoader and te-csv-migration + +Status: Decided, direction only. Action deferred to machine access. +Date: 2026-10-04 +Review: 2026-10-18 (fallback trigger) + +## Context + +Two public GitHub repos cover overlapping scope: + +- amar-python/PostgreDataMigrationAppWithCSVLoader — bash/SQL batch + core with FastAPI translator layer, Terraform IaC, 142 SQL + assertions, 23 Tier P eval scenarios, VCRM/ASDEFCON design + framing. 38 commits. +- amar-python/te-csv-migration — FastAPI + React rebuild started + 2026-09-24. 24 passing tests, clean secrets pattern, Lovable + frontend decision in progress. ~10 days old. + +The research review (2026-10-04) flagged this as a drag: + "Two public repos with overlapping scope double the surface a + reviewer can find stale." + +## Decision + +**Path C: merge both into a new canonical repo.** + +Reasoning: neither existing repo is clearly ahead; merging forces +intentional selection of what carries forward and drops accumulated +debt from both. + +## Fallback + +If no merge work has begun by **2026-10-18** (two weeks), default to +**Path A**: PostgreDataMigrationAppWithCSVLoader remains canonical, +te-csv-migration gets archived with a banner pointing to the sister +repo. Valuable patterns from te-csv-migration (secrets validator, +test discipline, clean config module, Lovable frontend adoption) +get ported manually. + +Fallback chosen over Path B because the sister project holds the +irreplaceable domain depth (SQL assertions, eval scenarios, +Terraform, ASDEFCON design decisions). te-csv-migration's assets +are younger and easier to port forward than the reverse. + +## Trigger for fallback + +"Started" means a new empty repo exists on GitHub with at least +one commit pulling content from either source repo. Not planning, +not scoping — a real commit. + +## Related + +- Research review 2026-10-04 (strategy and blind-spot analysis) +- te-csv-migration issue #4 (frontend decision, closed with Lovable + adoption recommendation) + +## Outcome (2026-10-26) + +No merge repo existed on GitHub by 2026-10-18. The fallback applied and +was confirmed by the product owner on 2026-10-26: **Path A**. +PostgreDataMigrationAppWithCSVLoader is canonical. Archiving +te-csv-migration and disposing of its open issues is tracked in #72. diff --git a/DECISIONS/2026-10-04-security-md.md b/DECISIONS/2026-10-04-security-md.md new file mode 100644 index 0000000..8604024 --- /dev/null +++ b/DECISIONS/2026-10-04-security-md.md @@ -0,0 +1,43 @@ +# Decision: SECURITY.md + +Status: Decided +Date: 2026-10-04 +Review: 2027-01-04 (quarterly audit cycle) + +## Scope + +Narrow and conventional. Reporting procedure, supported versions, +response commitment. No architecture/threat-model content — +that stays out until there's a separate posture doc (not planned +in current roadmap). + +## Reporting channel + +Email only. Address TBD at machine. GitHub PVR not enabled. + +Mitigation for email-only risk: set the chosen address to +auto-forward to primary inbox with a filter flagging security +keywords. Do this when at machine. + +## Response commitment + +Standard open-source SLA (72hr ack / 7 day triage / 90 day +disclosure / severity-based fix targets). Phrased as best-effort +to acknowledge solo-maintainer reality. + +Risk accepted: missed SLAs are publicly observable and could +be used by a reporter to signal broken commitment hygiene. +Mitigation is the auto-forward above. + +## Content choices + +- PGP paragraph: kept (offers path, no commitment to maintain) +- Safe Harbour: kept (standard, low-cost signal) +- Hall of Thanks: kept +- Scope section: kept (reduces triage noise) + +## Last-audited field + +Added. Convention: bump quarterly even if no changes made. + +Applying SECURITY.md is tracked in #57 (waits on the contact address). diff --git a/DECISIONS/2026-10-04-sovereignty-wording.md b/DECISIONS/2026-10-04-sovereignty-wording.md new file mode 100644 index 0000000..30758a0 --- /dev/null +++ b/DECISIONS/2026-10-04-sovereignty-wording.md @@ -0,0 +1,47 @@ +# Decision: Sovereignty wording + +Status: Decided +Date: 2026-10-04 +Review: 2026-11-15 (deadline for air-gapped install procedure) + +## Framing (effective 2026-11-15) + +> Australian-owned, NV2-cleared expertise. Deployable on +> HCF Certified Strategic cloud or fully offline. + +## Interim framing (until 2026-11-15) + +> Australian-owned, NV2-cleared expertise. Deployable on +> HCF Certified Strategic cloud or on-premise, including +> air-gapped environments. + +## Reasoning + +Each clause is checkable: + +- "Australian-owned" — sole trader, Canberra-based +- "NV2-cleared expertise" — personal clearance, applies to + delivery not software +- "HCF Certified Strategic" — Microsoft Azure (Australian + regions) listed as Certified Strategic at + hostingcertification.gov.au +- "Fully offline" — requires the install procedure below + +Avoids the trap of claiming "sovereign cloud" (which a US- +headquartered hyperscaler cannot deliver) while still +foregrounding the real sovereignty signal (person, clearance, +jurisdiction). + +## Commitment unlocking "fully offline" + +By 2026-11-15, repository must contain: + +- docs/offline-install.md with step-by-step procedure + (vendored Python wheels, npm cache, container tarballs) +- One tested dry run on a clean no-internet VM +- README pointer to the procedure + +If not met by 2026-11-15, continue using interim wording and +re-review deadline. + +Tracked in #60.