This ledger is the canonical claim-to-validation source for the repository.
- Run commands from repository root unless a command explicitly changes directories.
- If a validation command fails, treat that claim as unverified.
- Claims marked target-state are intentionally excluded from current baseline CI.
- Do not present a capability as baseline in
README.mdor other top-level docs until it has:- a claim ID in this ledger,
- a runnable validation command,
- and matching CI/PR verification evidence.
| Claim ID | Capability claim | Status | Runnable validation | Expected result |
|---|---|---|---|---|
CL-001 |
Canonical proto mirror is synchronized (file-engine/api/proto -> file-engine/proto) |
✅ | cmp file-engine/api/proto/fileengine.proto file-engine/proto/fileengine.proto |
Exit code 0 |
CL-002 |
File Engine baseline module checks compile in baseline scope | ✅ | cd file-engine && go test ./internal/config ./internal/logger ./internal/worker -v |
Tests pass (packages may report [no test files]) |
CL-003 |
Async create-folder flow works end-to-end (enqueue -> worker -> folder created) | ✅ | cd file-engine && go test ./tests/integration -run TestAsyncCreateFolderFlow -v |
PASS for TestAsyncCreateFolderFlow |
CL-004 |
Task status persistence is present for async flow (queued -> running -> success) |
✅ | cd file-engine && go test ./tests/integration -run TestAsyncCreateFolderFlow -v |
Test asserts transition history and persisted status payload |
CL-005 |
Basic audit task events are emitted for async flow | ✅ | cd file-engine && go test ./tests/integration -run TestAsyncCreateFolderFlow -v |
Test asserts task.processing and task.succeeded events |
CL-006 |
Correlation IDs are propagated in async flow state and logs | ✅ | cd file-engine && go test ./tests/integration -run TestAsyncCreateFolderFlow -v |
Test asserts persisted correlation ID; script output includes correlation_id= lines |
CL-007 |
Known-working local baseline script remains green | ✅ | ./file-engine/scripts/dev.sh |
Script completes with [dev] all checks passed |
CL-008 |
Backend scaffold baseline remains valid (composer metadata) | ✅ | cd backend && composer validate --strict |
Exit code 0 |
CL-009 |
Frontend thin-client demo console supports product UX (login, tenant selection, folder/upload/mutations) and operator UX (DLQ, quarantine cleanup, effective policy, drift, evidence pointers) without a Node build runtime | ✅ | test -f frontend/index.html && test -f frontend/app.js && test -f frontend/styles.css && ./scripts/e2e/demo_5_minute.sh --mode=mock |
Exit code 0 and script prints DEMO_5_MINUTE_OK |
CL-010 |
Structured JSON logs with correlation IDs and baseline queue/task metrics exposure are wired for API + worker | ✅ | cd file-engine && go test ./internal/handlers ./internal/observability -v |
Tests pass; handler logs include correlation_id and metrics snapshot assertions pass |
CL-011 |
Documentation link/path drift check remains green | ✅ | ./scripts/doc-drift-check.sh |
Script completes with doc drift check passed |
CL-012 |
Read-path behavior (list results + size/timestamps/ownership metadata + download) enforces path normalization + final authz at File Engine boundary (tenant membership + ACL/RBAC) | ✅ | `cd file-engine && go test ./internal/handlers -run "TestListObjectsReturnsEntries | TestListObjectsRequiresAuthContext |
CL-013 |
HTTP gateway routes for CreateFolder + GetTaskStatus are generated and respond | ✅ | cd file-engine && go test ./internal/server -run TestGatewayCreateFolderAndGetTaskStatusRoutes -v |
Tests pass |
CL-014 |
AuthZ precedence (ACL vs RBAC) behaves as specified | ✅ | `cd file-engine && go test ./internal/auth -run "TestRBACFallback | TestUserACLOverridesRBAC |
CL-015 |
Path normalization guarantees (traversal rejection + canonicalization) | ✅ | `cd file-engine && go test ./internal/authz -run "TestExtractPathNormalizesCreateFolder | TestExtractPathRejectsTraversal |
CL-016 |
Generated gateway artifacts are in sync with proto | ✅ | cd file-engine && ./scripts/generate_grpc_docker.sh && cd .. && git diff --exit-code && test -z "$(git status --porcelain)" |
No diff after generation |
CL-017 |
Worker performance guardrails for async create-folder are enforced (bounded status retries + processing timeout) | ✅ | `cd file-engine && go test ./internal/app/tasks -run "TestWorkerRetriesStatusPersistence | TestWorkerMarksTaskFailedOnProcessingTimeout" -v` |
CL-018 |
Backend vertical-slice VS-001 is explicitly tracked (create-folder control-plane forwarding + task status polling contract) with runnable scaffold validations | ✅ | cd backend && ./scripts/smoke.sh |
Exit code 0 and No syntax errors detected for each file |
CL-020 |
Backend VS-001 E2E integration validates backend forwarding to File Engine and task-status polling to success (docker-compose) | ✅ | docker compose build --pull && docker compose up -d && ./scripts/wait-for-http.sh http://localhost:8080/healthz 120 && ./scripts/wait-for-http.sh http://localhost:8081/healthz 120 && ./scripts/e2e/vs001_create_folder.sh && docker compose down -v |
Script exits 0; output contains task_status=success, folder_exists=true, and deterministic E2E_OK |
CL-022 |
Audit coverage: read/list/download emit audit_events records with correlation_id + actor + tenant + action |
✅ | cd file-engine && go test ./tests/integration -run TestAuditEventsEmittedForReadListDownload -v |
PASS; test resets DB state (TRUNCATE ... RESTART IDENTITY) per test and asserts >= 3 persisted rows for (list, read, download) include correlation_id + tenant_id + actor_id + action + result |
CL-025 |
Upload pipeline baseline: staged upload writes to quarantine, then atomic promote moves object to final path (no partial final objects) | ✅ | cd file-engine && go test ./tests/integration -run TestStagedUploadAtomicPromote -v |
PASS; test asserts deterministic quarantine->promote sequencing where final object is absent during staging and only materializes after promotion completes |
CL-031 |
Backend baseline smoke suite runs via dependency install + PHPUnit smoke checks | ✅ | docker compose run --rm --no-deps backend sh -lc 'composer install --no-interaction && ./vendor/bin/phpunit -c phpunit.xml' |
Exit code 0; PHPUnit reports OK/PASS |
CL-032 |
Audit table append-only enforcement rejects UPDATE/DELETE for app DB user | ✅ | cd file-engine && go test ./tests/integration -run TestAuditEventsAppendOnlyEnforced -v |
PASS; test inserts seed row, then asserts UPDATE/DELETE fail and row remains |
CL-033 |
Upload malware gate enforces quarantine→scan→promote policy: dirty scan blocks promote, clean scan allows promote | ✅ | cd file-engine && go test ./tests/integration -run TestUploadScanGateDirtyPreventsPromotion -v |
PASS; test asserts dirty verdict keeps file quarantined and final path absent |
CL-034 |
Ledger baseline gate runs curated baseline validations in CI and blocks regressions | ✅ | ./scripts/ledger-baseline.sh |
Exit code 0; CI Ledger Baseline Gate job passes |
CL-035 |
Audit external sink delivery supports S3 WORM/Loki/SIEM adapters with retries + DLQ and publishes sink lag metric | ✅ | cd file-engine && go test ./tests/integration -run TestAuditExternalSinkDeliveryWithDLQAndLagMetrics -v |
PASS; test validates S3 WORM adapter writes JSONL object, Loki payload delivery, SIEM retry->DLQ behavior, and fileengine_audit_sink_lag_ms updates |
CL-036 |
/readyz executes deterministic DB+queue+storage dependency checks and returns stable per-check JSON state |
✅ | `cd file-engine && go test ./internal/server -run "TestHandleReadyzReturnsReadyWhenChecksPass | TestHandleReadyzReturnsServiceUnavailableWhenAnyCheckFails |
CL-037 |
Storage contract suite enforces shared backend behavior and passes for local baseline (S3/GCS optional via env) | ✅ | cd file-engine && go test ./internal/adapters/storage/local -run TestLocalStorageContractSuite -v |
PASS; local backend satisfies create/write/open/list/move/delete contract; S3/GCS suite entrypoints are present and env-gated |
CL-038 |
OTEL export wiring is initialized for API + worker entrypoints with deterministic endpoint parsing and safe no-export fallback | ✅ | `cd file-engine && go test ./internal/observability -run "TestResolveTracingConfigDefaultsAndExporterToggle | TestInitTracingRejectsUnsupportedEndpointScheme |
CL-039 |
External audit sink env wiring has deterministic minimal validation (bucket/Loki/SIEM/S3-WORM adapters) | ✅ | `cd file-engine && go test ./internal/app/tasks -run "TestBuildImmutableSinkFromEnvBucketWritesJSONL | TestBuildImmutableSinkFromEnvLokiPostsLine |
CL-040 |
Real scanner integration (non-stub ClamAV TCP adapter) enforces quarantine→scan→promote behavior and emits scan duration/verdict metrics + logs | ✅ | cd file-engine && go test ./tests/integration -run TestUploadRealScannerIntegrationEmitsMetricsAndLogs -v |
PASS; test drives upload flow against a fake ClamAV TCP server, validates clean+infected outcomes, and asserts emitted metrics/log fields |
CL-041 |
Governance hardening enforces doc ownership metadata coverage on key docs, documents quarterly alignment cadence, and runs architecture conformance checks in CI (proto sync + endpoint inventory) | ✅ | ./scripts/doc-ownership-check.sh && ./scripts/architecture-conformance-check.sh |
Exit code 0; checks validate metadata/cadence presence and conformance inventory coverage |
CL-042 |
Enterprise identity integration: OIDC broker auth flow is deterministic, CI-gated, and proves tenant authorization remains server-mapped (not JWT tenant claims) with stable deny reason semantics | ✅ | ./scripts/e2e/run_oidc_profile.sh |
Exit code 0; output contains OIDC_OK and deny_reason=tenant_mapping_denied; denied response includes stable error.code, error.reason, error.tenant_id, and error.request_id/error.correlation_id fields |
CL-043 |
Malware gate operational hardening: scanner retry on transient errors, scan DLQ tooling (list/retry/resolve), and TTL quarantine cleanup with SLO-oriented metrics are enforced | ✅ | `cd file-engine && go test ./internal/services ./internal/server ./internal/observability -run "TestUploadServiceScannerRetryEventuallySucceeds | TestUploadServiceScannerFailureEnqueuesDLQ |
CL-044 |
End-to-end observability assets are checked in and validated: OTEL dev composition wiring, trace/correlation header propagation (backend->engine), golden dashboard/alerts-as-code, and incident drill script | ✅ | ./scripts/validate-observability-assets.sh && cd backend && php -l app/Support/TraceHeaders.php && php -l app/Services/FileEngineService.php && php -l app/Http/Controllers/FolderController.php && php -l app/Http/Controllers/UploadController.php && php -l app/Http/Controllers/TaskController.php && cd ../file-engine && go test ./internal/observability -v |
Exit 0; validation confirms alert rules/dashboard/drill assets, backend correlation wiring syntax, and OTEL observability package tests pass |
CL-045 |
Storage contract maturity/parity hardening: adapters enforce normalized paths + deterministic list ordering; contract suite validates metadata/timestamps/read-after-write semantics; checksum metadata is surfaced and resumable/chunked upload semantics are tested | ✅ | `cd file-engine && go test ./internal/adapters/storage/contract ./internal/adapters/storage/local ./internal/services -run "TestLocalStorageContractSuite | TestLocalStorageListMetadata |
CL-046 |
Governance controls baseline: tenant policy config is validated at startup, per-tenant quota/object/rate limits are enforced at File Engine final gate, retention/legal-hold block deletion, lifecycle cleanup is policy-driven, and governance decision events provide audit evidence | ✅ | `cd file-engine && go test ./internal/services ./internal/server ./internal/observability -run "TestLoadGovernancePolicyFromFile | TestLoadGovernancePolicyFromSourceEnvelope |
CL-047 |
Upload public API contract is stable across backend and engine (Initiate -> Upload chunk -> Complete) with deterministic clean/dirty scan outcomes, stable error envelope, and idempotency-safe retries |
✅ | docker compose up -d --build redis postgres file-engine file-engine-worker backend && ./scripts/wait-for-http.sh http://localhost:8080/healthz 120 && ./scripts/wait-for-http.sh http://localhost:8081/healthz 120 && ./scripts/e2e/upload_lifecycle.sh && docker compose down -v |
Exit code 0; output contains UPLOAD_OK; clean path returns scan_status=clean; dirty path returns 403 with stable error envelope; complete replay with same idempotency key is deterministic |
CL-048 |
Production OTEL deployment hardening is baseline-validated: deterministic collector/backend connectivity check fails fast on bad exporter endpoint config and verifies exported traces, alert rules syntax checks are scripted, and sink/scanner/exporter-down drills validate expected incident signals + runbook flow | ✅ | ./scripts/check-otel-connectivity.sh && ./scripts/drills/production_deployment_hardening.sh |
Exit 0; scripts emit OTEL_CONNECTIVITY_OK and PRODUCTION_DEPLOYMENT_HARDENING_DRILLS_OK after verifying traces, alert rules, deterministic drill outcomes, and paging validation wiring |
CL-049 |
Governance control plane next-step baseline: archive-tier lifecycle transitions are policy-driven, external signed policy source distribution is supported, runtime-vs-source drift checks emit governance audit evidence + metrics/alert signal, and operators can query effective tenant policy via admin endpoint | ✅ | `cd file-engine && go test ./internal/services ./internal/server ./internal/observability -run "TestLoadGovernancePolicyFromSourceEnvelope | TestUploadServiceArchiveLifecycleTransition |
CL-050 |
Paging-provider delivery path is baseline-validated with deterministic local webhook sink semantics and production-drill wiring | ✅ | ./scripts/check-paging-delivery.sh && ./scripts/drills/production_deployment_hardening.sh |
Exit 0; scripts emit PAGING_OK incident_id=..., PAGING_DELIVERED_OK, and PRODUCTION_DEPLOYMENT_HARDENING_DRILLS_OK |
CL-051 |
Scanner/upload operational closure is baseline-validated with explicit SLO alert thresholds, on-call+escalation runbook checks, and an operator-ready scanner outage drill transcript | ✅ | ./scripts/validate-alert-rules.sh && ./scripts/check-malware-runbook.sh && ./scripts/drills/scanner_down.sh |
Exit 0; scripts emit alert rules validation passed, MALWARE_RUNBOOK_OK, and SCANNER_DRILL_OK alert=scanner_down runbook=... |
CL-052 |
Documentation contract synchronization is baseline-validated: README narrative aligns with promoted ledger claims, route maturity matrix reflects upload/OIDC/readiness baseline routes, and roadmap-ledger gap analysis reflects Milestone 7 closure | ✅ | `./scripts/doc-drift-check.sh && rg -n -F "POST /v1/uploads:initiate" docs/route-maturity-matrix.md && rg -n -F "PUT /v1/uploads/{uploadId}:chunk" docs/route-maturity-matrix.md && rg -n -F "POST /v1/uploads/{uploadId}:complete" docs/route-maturity-matrix.md && rg -n -F "GET /readyz" docs/route-maturity-matrix.md && rg -n -F "OIDC profile end-to-end" docs/route-maturity-matrix.md && rg -n "Milestone 7 — Production Operations Closure.*Implemented | README wording drift corrected |
CL-053 |
Sustainability & ownership resilience baseline start: branch-protection mapping is documented/referenced, named domain backups are explicit, and release-cadence sustainability metrics report is deterministic | ✅ | `./scripts/sustainability-metrics.sh artifacts/sustainability-metrics.md && rg -n "branch-protection-mapping | ownership-backup-matrix |
CL-054 |
Sustainability closure: .github/OWNERS references are CI-checked, authz/monitoring path-scoped reviewer checks are actionable in CI, sustainability metrics emit markdown artifacts, quarterly alignment checklist generation is scripted, and new maintainer operability drills are scripted |
✅ | ./scripts/check-owners-governance.sh && ./scripts/sustainability-metrics.sh artifacts/sustainability-metrics.md && ./scripts/generate-quarterly-alignment-issue.sh && ./scripts/drills/new_maintainer_operability_drill.sh |
Exit 0; outputs include OWNERS_GOVERNANCE_REFERENCE_OK, SUSTAINABILITY_METRICS_OK, QUARTERLY_ALIGNMENT_CHECKLIST_GENERATED=..., and NEW_MAINTAINER_OPERABILITY_DRILL_OK |
CL-055 |
Mutation-surface expansion baseline: object move/rename, governed delete enforcement, and admin quarantine restore are exposed through backend + engine APIs with validation drill coverage | ✅ | `cd file-engine && go test ./internal/server -run "TestObjectMoveEndpoint | TestQuarantineRestoreEndpoint |
CL-056 |
Access-review compliance export is a stable contract with actor/tenant last-read and last-write signals derived from audit history, plus monthly operator artifact generation command for audit-ready evidence | ✅ | cd file-engine && go test ./internal/identity ./internal/server -v && bash -n file-engine/scripts/export_access_review.sh && bash -n file-engine/scripts/generate_monthly_access_review_report.sh |
PASS; identity/server tests and script syntax checks validate the stable export/report contract surfaces |
CL-057 |
Module-boundary maintenance guardrails are baseline-validated: canonical logger package is unified (internal/logger), app/use-case vs domain/services split is documented, and architecture conformance check enforces boundary invariants |
✅ | ./scripts/architecture-conformance-check.sh && cd file-engine && go test ./internal/logger ./internal/services ./internal/app/usecases -v |
Exit 0; conformance gate validates boundary doc + deprecated logger-path absence, and baseline packages compile cleanly |
CL-058 |
Enterprise readiness v2 baseline: deterministic k6 smoke/soak load profiles are added; per-tenant/per-actor fairness limits (RPS, upload concurrency, enqueue rate) emit throttling metrics/audit; Redis queue backpressure rejects enqueue with explicit operator signal; and admin per-tenant upload/download byte usage report is exposed | ✅ | `cd file-engine && go test ./internal/observability ./internal/server ./internal/handlers -run "TestTenantUsageSnapshot | TestTenantCostReportEndpoint |
CL-059 |
Data durability & recovery baseline: backup/restore strategy + local simulation script are documented; disaster drills cover DB restore/replay, storage corruption detection, and audit sink outage catch-up; integrity verification sampling endpoint/job emits mismatch metrics and governance/audit signals | ✅ | `cd file-engine && go test ./internal/server ./internal/observability -run "TestIntegrityVerifyEndpointDetectsCorruption | TestTenantUsageSnapshot |
CL-060 |
API productization baseline: explicit /v1 + proto evolution compatibility policy is documented; thin Go client and backend PHP wrapper are present for external-consumer usage; and golden compatibility fixtures gate request/response stability for upload lifecycle, readiness, and authz-deny envelope |
✅ | ./scripts/check-api-compatibility.sh && cd file-engine && go test ./client -v && cd ../backend && php -l app/Clients/FileEngineClient.php && php -l app/Services/FileEngineService.php |
PASS; compatibility golden suite passes and thin client layers compile/lint cleanly |
CL-061 |
Maintenance-cost reduction baseline: service entrypoints are consolidated by deleting legacy file-engine/cmd/main.go; architecture guardrails enforce no direct DB imports in handlers/server and generated-doc freshness; docs-as-code artifacts (endpoint inventory, route inventory, dashboard references) are generated from source |
✅ | ./scripts/generate-doc-artifacts.sh && ./scripts/architecture-conformance-check.sh && ./scripts/doc-drift-check.sh |
PASS; generated docs remain clean in git diff, architecture conformance enforces single entrypoint + handler DB-boundary rules, and drift checks gate docs artifacts |
CL-062 |
Scale/fairness product closure: core-flow SLOs are published, k6 smoke is CI-gated while soak is nightly-scheduled, upload throttling returns explicit THROTTLED envelope + audit evidence, and dependency backpressure drill + operator runbook are deterministic |
✅ | `cd file-engine && go test ./internal/server ./internal/handlers -run "TestUploadRateLimitedReturnsThrottledEnvelopeAndAudit | TestCreateFolderQueueUnavailableReturnsUnavailable" -v && ./scripts/drills/dependency_backpressure.sh && bash -n scripts/drills/dependency_backpressure.sh` |
CL-063 |
Data durability/integrity first-class contract is baseline-validated: integrity verification policy is configurable (sample_size, failure_threshold, ignore_paths) with false-positive handling, dev-grade DB/storage RTO+RPO objectives are explicit, restore/drill runbooks are script-backed, and one-command evidence bundle generation is deterministic |
✅ | `cd file-engine && go test ./internal/server -run "TestIntegrityVerifyEndpointDetectsCorruption | TestIntegrityVerifyEndpointHonorsFailureThreshold |
CL-064 |
Multi-tenant compliance productization is baseline-validated: access review export v1 keeps stable schema with optional HMAC-signed artifact output, governance policy updates emit audit evidence with before/after policy hash, tenant evidence endpoint returns effective-policy/drift/review/drill pointers, and one-command tenant compliance packet generation is deterministic | ✅ | `cd file-engine && go test ./internal/server -run "TestGovernancePolicyUpdateEndpointEmitsBeforeAfterHashAudit | TestTenantEvidenceEndpointReturnsPointers" -v && bash -n file-engine/scripts/generate_monthly_access_review_report.sh scripts/generate_tenant_compliance_packet.sh && ./scripts/doc-drift-check.sh` |
CL-065 |
API & SDK hardening for external consumers is baseline-validated: compatibility golden fixtures cover mutation/governance-block/throttling contracts, Go+PHP thin clients expose typed error handling and retry/backoff ergonomics, and /v1 compatibility policy checks fail PRs that change API surface without required versioning+consumer-doc updates |
✅ | `./scripts/check-api-compatibility.sh && cd file-engine && go test ./client ./internal/server -run "TestAsAPIErrorParsesEnvelope | TestDoWithRetryRetriesTemporaryAPIError |
CL-066 |
Async mutation expansion: move/rename object now supports task execution semantics with persisted status transitions, correlation/request propagation, idempotency key handling, and object mutation audit evidence | ✅ | cd file-engine && go test ./tests/integration -run TestAsyncMutationMoveObjectFlow -v |
PASS; test validates enqueue -> worker -> (queued,running,success) progression, audit event emission, and destination-side object move effect |
CL-067 |
Async mutation expansion: governed delete task enforces final governance gate during worker execution and returns stable task-failure error envelope when policy denies deletion | ✅ | cd file-engine && go test ./tests/integration -run TestAsyncMutationGovernedDeleteFinalGateDenies -v |
PASS; negative path proves "backend accepted task, engine denied delete" with stable error envelope fields and retained object side effect |
CL-068 |
Async mutation expansion: quarantine restore task executes through worker with status persistence, correlation propagation, and idempotent payload contract fields | ✅ | cd file-engine && go test ./tests/integration -run TestAsyncMutationQuarantineRestoreFlow -v |
PASS; test validates quarantined seed -> async restore task -> successful promote and object mutation audit evidence |
CL-069 |
Human-resilience continuity gate is baseline-enforced: CODEOWNERS explicitly maps critical domains (auth/authz, upload+scanner, audit sink+DLQ, observability/alerts/drills, governance controls), CI path-scoped reviewer continuity checks require security/platform/maintainer approvals for critical paths, and release checklist now gates on executing the new maintainer drill | ✅ | `./scripts/check-owners-governance.sh && bash -n scripts/check-reviewer-continuity.sh && rg -n "reviewer-continuity | file-engine/internal/auth* |
CL-070 |
Deployment realism path is executable beyond compose-only: profile templates (dev/stage/prod), kind smoke (/healthz + /readyz), rollback drill, release/versioning doc, and prod-like runtime wiring gate are script-backed |
✅ | bash -n scripts/check-runtime-wiring.sh scripts/k8s/kind_smoke.sh scripts/drills/k8s_rollback_drill.sh && ./scripts/check-runtime-wiring.sh --profile prod |
Shell syntax checks pass; runtime wiring script exits 0 when required env is set and envelope file exists |
CL-071 |
Performance budgets and capacity planning are baseline-enforced: k6 smoke/soak apply latency+error thresholds, error-budget investigation policy is explicit, component/queue/storage sizing guidance is documented, and hot-path (download, upload complete) profiling is script-reproducible |
✅ | `cd file-engine && go test ./internal/server -run "^$" -bench "BenchmarkHandle(Download | UploadComplete)$" -benchtime=1x && ./file-engine/scripts/capture_hotpath_profile.sh && bash -n file-engine/scripts/capture_hotpath_profile.sh` |
CL-072 |
Security posture hardening is continuously reviewable: boundary-aware threat-model diff prompt automation, focused negative security regression suite (traversal/IDOR-style tenant crossing/token misuse/tenant confusion/policy drift), supply-chain checks with SBOM/signing story, and secrets-rotation continuity drill expansion | ✅ | ./scripts/generate-threat-model-diff-prompt.sh && ./scripts/security-regression-suite.sh && ./scripts/supply-chain-checks.sh && ./scripts/drills/rotate-secrets-drill.sh |
Scripts emit THREAT_MODEL_DIFF_PROMPT when boundary-sensitive changes exist, SECURITY_REGRESSION_SUITE_OK, SUPPLY_CHAIN_CHECKS_OK, and ROTATE_SECRETS_DRILL_OK |
CL-073 |
Architecture boundary enforcement expanded, docs generation includes endpoint inventory + SDK examples + policy schema docs, and one-command contributor onboarding (make bootstrap && make demo) produces deterministic evidence links |
✅ | ./scripts/architecture-conformance-check.sh && ./scripts/generate-doc-artifacts.sh && make bootstrap && make demo |
Commands succeed; generated docs remain clean in git and demo output includes DEMO_5_MINUTE_OK plus evidence link lines |
This section summarizes capability status by domain with ownership, acceptance tests, and target milestones. Target milestones reference the roadmap phases in README.md.
| Domain | Current state | Primary owner | Backup reviewer | Acceptance tests | Target milestone |
|---|---|---|---|---|---|
| AuthZ | Baseline RBAC + path-based ACL with inheritance is implemented; tenant scoping enforced at File Engine boundary. | @agslima (Agnaldo Silva Lima) | Security reviewer rotation (docs/security-reviewers.md) |
cd file-engine && go test ./internal/auth -v |
Phase 1 (read authz baseline) |
| Storage | Storage contract suite is baseline-enforced for local backend; S3/GCS contract entrypoints exist and are env-gated. | @agslima (Agnaldo Silva Lima) | Platform engineer rotation (docs/platform-engineers.md) |
cd file-engine && go test ./internal/adapters/storage/local -run TestLocalStorageContractSuite -v |
Phase 3 (storage backends) |
| Storage parity hardening | Canonical backend parity matrix and consistency model are documented; adapters normalize path/list semantics and surface checksum metadata with resumable upload semantics covered in tests (CL-045). | @agslima (Agnaldo Silva Lima) | Platform engineer rotation (docs/platform-engineers.md) |
`cd file-engine && go test ./internal/adapters/storage/contract ./internal/adapters/storage/local ./internal/services -run "TestLocalStorageContractSuite | TestLocalStorageListMetadata |
| Governance controls | Tenant governance policy config (quota/object/rate/retention/legal hold/lifecycle/archive) is startup/source-validated and enforced at the File Engine boundary with admin delete/cleanup/effective-policy controls plus drift-detection audit+metrics evidence (CL-049). | @agslima (Agnaldo Silva Lima) | Security + platform rotations (docs/security-reviewers.md, docs/platform-engineers.md) |
`cd file-engine && go test ./internal/services ./internal/server ./internal/observability -run "TestLoadGovernancePolicyFromFile | TestLoadGovernancePolicyFromSourceEnvelope |
| Tasks | Async task enqueue + worker execution now covers create-folder + move + governed-delete + quarantine-restore flows with persisted status transitions, stable failure envelope semantics, correlation propagation, idempotency key fields, and worker guardrails for bounded retries/timeouts. | @agslima (Agnaldo Silva Lima) | Platform engineer rotation (docs/platform-engineers.md) |
`cd file-engine && go test ./tests/integration -run "TestAsyncCreateFolderFlow | TestAsyncMutationMoveObjectFlow |
| Uploads | Staged upload + atomic promote are baseline-validated, scan-gated guardrails are baseline-enforced (CL-033), real scanner integration is baseline-validated (CL-040), and public Initiate→Upload→Complete contract is CI-gated with idempotent retry semantics (CL-047). | @agslima (Agnaldo Silva Lima) | Security + platform rotations (docs/security-reviewers.md, docs/platform-engineers.md) |
cd file-engine && go test ./tests/integration -run TestStagedUploadAtomicPromote -v and `cd file-engine && go test ./tests/integration -run "TestUploadScanGateDirtyPreventsPromotion |
TestUploadRealScannerIntegrationEmitsMetricsAndLogs" -v` |
| Upload operations hardening | Scanner retry policy + scan DLQ operator workflows + quarantine TTL cleanup and SLO metrics are baseline-validated for failure-mode safety (CL-043), and scanner/on-call operational closure is baseline-validated via encoded thresholds + escalation-ready drill transcript checks (CL-051). | @agslima (Agnaldo Silva Lima) | Security + platform rotations (docs/security-reviewers.md, docs/platform-engineers.md) |
`cd file-engine && go test ./internal/services ./internal/server ./internal/observability -run "TestUploadServiceScannerRetryEventuallySucceeds | TestUploadServiceScannerFailureEnqueuesDLQ |
| Audit | Baseline task audit events are emitted for async/read flows, append-only table enforcement is baseline-validated (CL-032), and external sink delivery (S3 WORM/Loki/SIEM + DLQ/lag metrics) is baseline-validated (CL-035). | @agslima (Agnaldo Silva Lima) | Security reviewer rotation (docs/security-reviewers.md) |
cd file-engine && go test ./tests/integration -run TestAsyncCreateFolderFlow -v and `cd file-engine && go test ./tests/integration -run "TestAuditEventsAppendOnlyEnforced |
TestAuditExternalSinkDeliveryWithDLQAndLagMetrics" -v` |
| Observability | Structured logs + queue/task metrics baseline are in place, and OTEL export wiring is baseline-validated for API + worker entrypoints (CL-038); full backend/alerting pipeline remains target-state. | @agslima (Agnaldo Silva Lima) | Platform engineer rotation (docs/platform-engineers.md) |
cd file-engine && go test ./internal/handlers ./internal/observability -v and `cd file-engine && go test ./internal/observability -run "TestResolveTracingConfigDefaultsAndExporterToggle |
TestInitTracingRejectsUnsupportedEndpointScheme |
| Observability & alertability hardening | Dev OTEL collector/backend composition, trace-header propagation to engine boundary, golden dashboard templates, alerts-as-code, and scripted incident drill validation are implemented (CL-044). | @agslima (Agnaldo Silva Lima) | Platform engineer rotation (docs/platform-engineers.md) |
./scripts/validate-observability-assets.sh && cd backend && php -l app/Support/TraceHeaders.php && php -l app/Services/FileEngineService.php && php -l app/Http/Controllers/FolderController.php && php -l app/Http/Controllers/UploadController.php && php -l app/Http/Controllers/TaskController.php && cd ../file-engine && go test ./internal/observability -v |
Phase 4 (operational readiness) |
| OTEL production deployment hardening | Collector/backend connectivity checks, alert-rule syntax gating, deterministic sink/scanner/exporter-down drills, and paging delivery verification are baseline-validated for production incident closure workflows (CL-048, CL-050). | @agslima (Agnaldo Silva Lima) | Platform engineer rotation (docs/platform-engineers.md) |
./scripts/check-otel-connectivity.sh && ./scripts/check-paging-delivery.sh && ./scripts/drills/production_deployment_hardening.sh |
Phase 4 (production deployment hardening closure + paging delivery validation) |
| Scale & fairness | Core SLOs for list/download/upload-complete/task-complete are published, deterministic k6 smoke vs nightly soak scheduling is codified, throttled envelope semantics are stable, and dependency backpressure drills are runbook-backed (CL-062). | @agslima (Agnaldo Silva Lima) | Platform engineer rotation (docs/platform-engineers.md) |
`cd file-engine && go test ./internal/server ./internal/handlers -run "TestUploadRateLimitedReturnsThrottledEnvelopeAndAudit | TestCreateFolderQueueUnavailableReturnsUnavailable" -v && ./scripts/drills/dependency_backpressure.sh` |
| Backend control-plane | Vertical-slice delivery model in place; VS-001 includes docker-compose E2E forwarding + polling validation (CL-020) before broader backend expansion. | @agslima (Agnaldo Silva Lima) | Repo reviewer backup (.github/OWNERS) |
docker compose build --pull && docker compose up -d && ./scripts/wait-for-http.sh http://localhost:8080/healthz 120 && ./scripts/wait-for-http.sh http://localhost:8081/healthz 120 && ./scripts/e2e/vs001_create_folder.sh && docker compose down -v |
Phase 2 (first validated control-plane slice) |
| Human resilience & reviewer continuity | Critical domains now have explicit CODEOWNERS path coverage and CI reviewer continuity gating for auth/authz, monitoring/observability, and capability-ledger changes; release cadence includes a new-maintainer drill gate (CL-069). | @agslima (Agnaldo Silva Lima) | Repo reviewer backup (.github/OWNERS) |
./scripts/check-owners-governance.sh && bash -n scripts/check-reviewer-continuity.sh |
Phase 8 (continuity gate enforcement) |
| API productization | Versioning policy (/v1 non-breaking + proto evolution rules), thin client layers (Go + PHP), and golden compatibility fixture gate are baseline-validated (CL-060). |
@agslima (Agnaldo Silva Lima) | Repo reviewer backup (.github/OWNERS) |
./scripts/check-api-compatibility.sh && cd file-engine && go test ./client -v && cd ../backend && php -l app/Clients/FileEngineClient.php && php -l app/Services/FileEngineService.php |
Phase 5 (external-consumer productization) |
| Maintenance-cost reduction | Legacy dual-path service entrypoint is removed, architecture conformance checks enforce handler DB-boundary + generated-doc freshness, and documentation artifacts are generated from source (CL-061). | @agslima (Agnaldo Silva Lima) | Repo reviewer backup (.github/OWNERS) |
./scripts/generate-doc-artifacts.sh && ./scripts/architecture-conformance-check.sh && ./scripts/doc-drift-check.sh |
Phase 5 (maintenance-cost reduction hardening) |
| Data durability & recovery | Durability is script-backed with explicit dev-grade RTO/RPO, configurable integrity sampling/threshold + false-positive controls, deterministic recovery drills, and one-command evidence bundle generation (CL-059, CL-063). | @agslima (Agnaldo Silva Lima) | Platform engineer rotation (docs/platform-engineers.md) |
`cd file-engine && go test ./internal/server -run "TestIntegrityVerifyEndpointDetectsCorruption | TestIntegrityVerifyEndpointHonorsFailureThreshold |
| Enterprise identity (OIDC) | OIDC profile E2E is deterministic and CI-gated; enforcement remains tenant mapping at File Engine boundary with stable deny reason semantics (CL-042). | @agslima (Agnaldo Silva Lima) | Security reviewer rotation (docs/security-reviewers.md) |
docker compose --profile oidc up -d --build keycloak postgres redis file-engine file-engine-worker && ./scripts/wait-for-http.sh http://localhost:8082/realms/file-engine/.well-known/openid-configuration 120 && ./scripts/e2e/oidc_login_and_call_engine.sh && docker compose --profile oidc down -v |
Phase 4 (enterprise identity hardening) |
| Deployment realism (Kubernetes + env separation + rollback) | Dev/stage/prod env templates are explicit, kind smoke + rollback drills are executable, release/versioning discipline is documented, and prod-like runtime dependency wiring is script-validated (CL-070). | @agslima (Agnaldo Silva Lima) | Platform engineer rotation (docs/platform-engineers.md) |
bash -n scripts/check-runtime-wiring.sh scripts/k8s/kind_smoke.sh scripts/drills/k8s_rollback_drill.sh && ./scripts/check-runtime-wiring.sh --profile prod |
Milestone 10 (deployment realism closure) |
| Performance budgets & capacity planning | Core-flow latency/error budgets are CI-gated via k6 smoke and nightly soak, explicit error-budget investigation triggers are documented, rough component sizing/queue/storage assumptions are published, and hot-path pprof capture is reproducible for operator debugging (CL-071). | @agslima (Agnaldo Silva Lima) | Platform engineer rotation (docs/platform-engineers.md) |
`cd file-engine && go test ./internal/server -run "^$" -bench "BenchmarkHandle(Download | UploadComplete)$" -benchtime=1x && ./file-engine/scripts/capture_hotpath_profile.sh` |
| Security posture hardening (always-on) | Threat-model boundary diff prompts, focused negative security regression suite, supply-chain checks with SBOM/signing story, and rotate-secrets continuity drill are baseline-operationalized (CL-072). | @agslima (Agnaldo Silva Lima) | Security reviewer rotation (docs/security-reviewers.md) |
./scripts/generate-threat-model-diff-prompt.sh && ./scripts/security-regression-suite.sh && ./scripts/supply-chain-checks.sh && ./scripts/drills/rotate-secrets-drill.sh |
Milestone 12 (continuous security posture closure) |
| Onboarding and docs-generation velocity | Expanded architecture conformance boundary rules, generated docs for endpoint inventory + SDK examples + governance policy schema, and one-command onboarding/demo evidence flow are baseline-operationalized (CL-073). | @agslima (Agnaldo Silva Lima) | Repo reviewer backup (.github/OWNERS) |
./scripts/architecture-conformance-check.sh && ./scripts/generate-doc-artifacts.sh && make bootstrap && make demo |
Milestone 14 (cognitive-load reduction closure) |
The following areas remain target-state and are not currently baseline-gated by CI:
- No additional target-state exclusions are tracked for Milestone 14 cognitive-load reduction closure after
CL-073; maintain quarterly ownership rotation reviews as an operational process expectation.
Promote newly identified target-state areas only when each has a dedicated runnable validation command.