|
|
a449ecec5b
|
feat/044-drift-mvp (#58)
Beschreibung
Implementiert das Drift MVP Feature (Spec: 044-drift-mvp) mit Fokus auf automatische Drift-Erkennung zwischen Inventory Sync Runs und Bulk-Triage für Findings.
Was wurde implementiert?
Drift-Erkennung: Vergleicht Policy-Snapshots, Assignments und Scope Tags zwischen Baseline- und Current-Runs. Deterministische Fingerprints verhindern Duplikate.
Findings UI: Neue Filament Resource für Findings mit Listen- und Detail-Ansicht. DB-only Diffs (keine Graph-Calls zur Laufzeit).
Bulk Acknowledge:
"Acknowledge selected" (Bulk-Action auf der Liste)
"Acknowledge all matching" (Header-Action, respektiert aktuelle Filter; Type-to-Confirm bei >100 Findings)
Scope Tag Fix: Behebt False Positives bei Legacy-Daten ohne scope_tags.ids (inferiert Default-Werte).
Authorization: Tenant-isoliert, Rollen-basiert (Owner/Manager/Operator können acknowledge).
Tests: Vollständige Pest-Coverage (28 Tests, 347 Assertions) für Drift-Logik, UI und Bulk-Actions.
Warum diese Änderungen?
Problem: Keine automatisierte Drift-Erkennung; manuelle Triage bei vielen Findings ist mühsam.
Lösung: Async Drift-Generierung mit persistenter Findings-Tabelle. Safe Bulk-Tools für Massen-Triage ohne Deletes.
Konformität: Folgt AGENTS.md Workflow, Spec-Kit (Tasks + Checklists abgehakt), Laravel/Filament Best Practices.
Technische Details
Neue Dateien: ~40 (Models, Services, Tests, Views, Migrations)
Änderungen: Filament Resources, Jobs, Policies
DB: Neue findings Tabelle (JSONB für Evidence, Indexes für Performance)
Tests: ./vendor/bin/sail artisan test tests/Feature/Drift --parallel → 28 passed
Migration: ./vendor/bin/sail artisan migrate (neue Tabelle + Indexes)
Screenshots / Links
Spec: spec.md
Tasks: tasks.md (alle abgehakt)
UI: Findings-Liste mit Bulk-Actions; Detail-View mit Diffs
Checklist
Tests passieren (parallel + serial)
Code formatiert (./vendor/bin/pint --dirty)
Migration reversibel
Tenant-Isolation enforced
No Graph-Calls in Views
Authorization checks
Spec + Tasks aligned
Deployment Notes
Neue Migration: create_findings_table
Neue Permissions: drift.view, drift.acknowledge
Queue-Job: GenerateDriftFindingsJob (async, deduped)
|
2026-01-14 23:16:10 +00:00 |
|
|
|
dedca3c612
|
spec: add inventory specs 039-044 (#42)
What’s included
• specs/039-inventory-program/ — program/epic overview (vision + phased plan)
• specs/041-inventory-ui/ — UI skeleton (Inventory list, Coverage, Sync Runs)
• specs/042-inventory-dependencies-graph/ — dependency graph skeleton (assignments/filters/scope tags → later)
• specs/043-cross-tenant-compare-and-promotion/ — compare/promotion skeleton (read-only first; writes gated later)
• specs/044-drift-mvp/ — drift detection skeleton (read-only by default)
Why
We need a clear, spec-first structure for:
• separating Inventory (“last observed”) from Snapshots/Backups (immutable)
• scaling to MSP / multi-tenant workflows (portfolio, compare, monitoring)
• making future modules (security suite, drift, promotion) consistent with the Constitution (fail-safe, auditability, contract-driven Graph)
Scope / Non-goals (this PR)
• No implementation tasks executed
• No DB migrations, services, jobs, or UI changes
• No changes to Graph contracts or supported policy types
Review focus
• Naming/numbering and folder structure (spec.md, plan.md, tasks.md for each spec)
• Scope boundaries and non-goals across 041–044
• Alignment with Constitution principles (tenant isolation, read-only default for analysis, explicit gating for high-risk writes)
Follow-up (next PRs)
• Spec 040: Inventory Core (data model + selection hash + missing semantics + NFRs + tests)
• Implementation PRs will be split per spec (040 → 041 → 042/043/044)
⸻
Co-authored-by: Ahmed Darrazi <ahmeddarrazi@adsmac.local>
Reviewed-on: #42
|
2026-01-07 14:01:07 +00:00 |
|
