ducoterra e29d68d9f0 phase: 82_security_headers ...

All completion criteria verified green — no defects found, nothing to fix. Final report:

**Phase 82 (security headers) — final verification pass: all green**

- Verified prior-run implementation: `app/core/security_headers.py` (pure-ASGI, header-only, exact A1 CSP), registration in `app/main.py` after `configure_caching` (outermost), unit/integration/E2E suites.
- Deviation confirmed sound: `data:`-URI favicon (blocked by locked CSP) → static `frontend/assets/favicon.svg` in 5 templates + Containerfile `cp`; SVG element byte-identical to the old data-URI (verified programmatically); serves 200 with all three headers.
- Curl check (server booted like e2e conftest, log: `/tmp/curl_security_headers_final.log`): `/`, `/api/health`, `/assets/styles.css`, `/nope` (404) → all three headers, CSP exactly `default-src 'self'; base-uri 'none'; frame-ancestors 'none'`.
- `uv run pytest tests/unit/test_security_headers.py tests/integration/test_security_headers.py -v --no-cov` → 13 passed (incl. SSE byte-identity pin).
- `uv run pytest tests/e2e/test_security_headers.py -v --no-cov` (isolated) → 2 passed (headers + zero CSP violations + painted page).
- SSE tripwire `uv run pytest tests/e2e/test_chat_rag.py -v --no-cov` → 3 passed.
- `uv run pytest --cov=app --cov-report=term-missing` → 1665 passed, app/ 99% (>90%); `uv run ruff check . && uv run pyright` → clean (0 errors).
- `git diff --stat` limited to phase-82 files + the two documented deviations (favicon set, `tests/unit/__init__.py`); no `pyproject.toml`/`uv.lock`/JS diffs.
- Commit + phase-dir move left to the harness per pipeline rules (not executed by me).

Next pending phase: `83_chat_save_payload_limits`.

2026-09-07 23:54:41 -04:00

..

__init__.py

phase: 82_security_headers

2026-09-07 23:54:41 -04:00

test_agent.py

feat(rag): pass chat history with prior thinking to the LLM

2026-09-05 16:04:40 -04:00

test_api_tokens_model.py

feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

2026-09-07 12:39:01 -04:00

test_archive_upload.py

feat(sources): upload tarball/zipfile archives as sources — unpack, scan, and replace in place

2026-08-28 15:57:59 -04:00

test_auth.py

feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

2026-09-07 12:39:01 -04:00

test_background_no_motion.py

feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

2026-09-07 12:39:01 -04:00

test_caching.py

feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

2026-09-07 12:39:01 -04:00

test_chat_cancel.py

feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

2026-09-07 12:39:01 -04:00

test_chat_gate.py

feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

2026-09-07 12:39:01 -04:00

test_chat_persistence.py

feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

2026-09-07 12:39:01 -04:00

test_chunker.py

feat(import): index quadlet unit files and jinja templates (A9 revision)

2026-08-28 07:02:24 -04:00

test_config.py

feat(rag): pass chat history with prior thinking to the LLM

2026-09-05 16:04:40 -04:00

test_db.py

feat: scaffold Brain of Reese — FastAPI RAG chat over Postgres 17 + pgvector

2026-08-21 13:42:21 -04:00

test_debugging.py

feat: scaffold Brain of Reese — FastAPI RAG chat over Postgres 17 + pgvector

2026-08-21 13:42:21 -04:00

test_doc_edit_screen.py

feat(docs): save chat answers as docs — edit screen, commit + push to the .env docs branch

2026-09-01 03:52:03 -04:00

test_docs_push.py

feat(docs): save chat answers as docs — edit screen, commit + push to the .env docs branch

2026-09-01 03:52:03 -04:00

test_document_viewer.py

feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

2026-09-07 12:39:01 -04:00

test_frontend_brand.py

fix(chat): keep in-flight answers alive across in-app view switches

2026-09-06 06:31:31 -04:00

test_frontend_feedback.py

feat(rag): retry a failed LLM request before the first token lands — BOR_LLM_RETRIES/BOR_LLM_RETRY_DELAY with a live 'retrying' status

2026-09-02 10:52:38 -04:00

test_frontend_hidden_tab.py

fix(chat): keep generating while the tab is hidden

2026-09-05 14:34:33 -04:00

test_frontend_router.py

fix(ui): give the mobile refresh controls labels and full width

2026-09-07 14:16:41 -04:00

test_frontend_scroll.py

feat(chat): retry the last answer — redo-in-place Retry button on the latest brain bubble

2026-08-29 18:32:15 -04:00

test_frontend_sync_upload.py

fix(ui): give the mobile refresh controls labels and full width

2026-09-07 14:16:41 -04:00

test_frontend_tool_states.py

feat(agent): align the document tools with the harness-trained shape — ls, read(path), grep(pattern, path?)

2026-09-03 11:17:47 -04:00

test_git_sources.py

feat(admin): local directory sources — kind/path on git_sources, combined sync + import, page form + badges

2026-08-27 01:04:16 -04:00

test_git_sync.py

feat(docs): save chat answers as docs — edit screen, commit + push to the .env docs branch

2026-09-01 03:52:03 -04:00

test_hamburger_nav.py

fix button widths on mobile

2026-09-07 14:18:45 -04:00

test_history_copy.py

fix(chat): keep in-flight answers alive across in-app view switches

2026-09-06 06:31:31 -04:00

test_history_page.py

fix(chat): keep in-flight answers alive across in-app view switches

2026-09-06 06:31:31 -04:00

test_history.py

feat(rag): pass chat history with prior thinking to the LLM

2026-09-05 16:04:40 -04:00

test_importer.py

feat(sources): real-time file progress for sync and upload — background upload with success toast

2026-09-01 23:51:43 -04:00

test_llm_client.py

feat(agent): strip raw tool-scaffolding from streamed answers — deterministic filter with one bounded recovery

2026-09-03 13:39:15 -04:00

test_llm_probe.py

feat(rag): agent document tools — list/read tools with env-tuned budgets, SSE tool events + "calling tool" UI

2026-08-26 22:39:14 -04:00

test_llm_stream_teardown.py

feat(agent): align the document tools with the harness-trained shape — ls, read(path), grep(pattern, path?)

2026-09-03 11:17:47 -04:00

test_main.py

perf(ui): cache busting — HTML no-cache + versioned asset URLs (?v=) with immutable 1y asset caching

2026-08-25 22:42:10 -04:00

test_markdown_tables.py

feat(chat): render markdown tables in answers, viewer, and thinking

2026-08-28 03:35:50 -04:00

test_mock_tool_flow.py

feat(agent): align the document tools with the harness-trained shape — ls, read(path), grep(pattern, path?)

2026-09-03 11:17:47 -04:00

test_models.py

feat(docs): save chat answers as docs — edit screen, commit + push to the .env docs branch

2026-09-01 03:52:03 -04:00

test_overview.py

feat(rag): lite-generated KB overview in the system prompt — stored single row, regenerated on import, <knowledge_base> section in HIGH+LOW prompts

2026-08-25 20:22:51 -04:00

test_pinned_composer.py

feat(web): move the chat action cluster to the pinned bottom and align the button sets

2026-09-02 01:08:18 -04:00

test_prompts.py

fix(agent): teach the document-identity contract on ls/read/grep refusals — end the post-harness tool-loop rambling

2026-09-04 13:11:07 -04:00

test_rate_limit.py

phase: 81_login_rate_limit

2026-09-07 23:08:46 -04:00

test_remove_confirm_modal.py

fix(chat): keep in-flight answers alive across in-app view switches

2026-09-06 06:31:31 -04:00

test_retriever.py

finally getting accurate answers

2026-09-05 10:26:39 -04:00

test_save_as_doc_button.py

feat(docs): save the whole chat session as a doc

2026-09-05 16:59:31 -04:00

test_save_chat_ui.py

feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

2026-09-07 12:39:01 -04:00

test_scaffolding_filter.py

feat(agent): strip raw tool-scaffolding from streamed answers — deterministic filter with one bounded recovery

2026-09-03 13:39:15 -04:00

test_security_headers.py

phase: 82_security_headers

2026-09-07 23:54:41 -04:00

test_shared_header.py

feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

2026-09-07 12:39:01 -04:00

test_shared_page.py

feat(web): 2x reading column on wide desktops — 92rem at >=1500px (chat, shared, document view)

2026-09-01 00:39:19 -04:00

test_source_removal.py

feat(sources): removing a source deletes its files and index entries behind a confirmation modal

2026-09-02 15:55:33 -04:00

test_sources_meta.py

feat(chat): invalidate saved chats on sources sync — versioned stamps, stale marker, Regenerate against the new index

2026-08-30 23:39:15 -04:00

test_sources_midstream.py

feat(chat): retry the last answer — redo-in-place Retry button on the latest brain bubble

2026-08-29 18:32:15 -04:00

test_sse_events.py

feat(agent): align the document tools with the harness-trained shape — ls, read(path), grep(pattern, path?)

2026-09-03 11:17:47 -04:00

test_stale_ui_copy.py

fix(chat): keep in-flight answers alive across in-app view switches

2026-09-06 06:31:31 -04:00

test_steering_prompts.py

feat(rag): steering notes — tune how Brain answers, stored in Postgres and injected into every system prompt

2026-08-22 16:44:42 -04:00

test_steering_toggle_removal.py

fix(chat): keep in-flight answers alive across in-app view switches

2026-09-06 06:31:31 -04:00

test_steering.py

feat(rag): global tuning manager — /tuning.html + PUT /api/steering/{id}: create, edit, list, delete steering notes without a chat

2026-08-25 13:46:32 -04:00

test_sticky_header.py

fix(web): keep the navbar stuck to the top — drop the body height cap on the sticky range

2026-09-01 04:20:26 -04:00

test_summarizer.py

feat(rag): lite-model document summaries — non-markdown docs summarized at import, summary chunk retrieves and resolves to the full source doc

2026-08-25 17:48:37 -04:00

test_summary_edit_ui.py

feat(kb): edit + re-embed document summaries from the viewer (admin)

2026-08-31 23:52:22 -04:00

test_sync_button.py

fix(chat): keep in-flight answers alive across in-app view switches

2026-09-06 06:31:31 -04:00

test_sync_model_probe.py

feat(sync): fail fast with a modal when a model is unavailable

2026-08-27 23:44:35 -04:00

test_themes.py

feat(web): customizable placeholder, footer text, and color theme via BOR_* env vars

2026-09-01 12:04:06 -04:00

test_thinking_scroll.py

fix(chat): stop the submit up-hop and keep the thinking pin alive across paragraph breaks

2026-08-28 17:10:02 -04:00

test_token_gate.py

feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

2026-09-07 12:39:01 -04:00

test_tokens.py

feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

2026-09-07 12:39:01 -04:00

test_wide_column_css.py

feat(docs): save chat answers as docs — edit screen, commit + push to the .env docs branch

2026-09-01 03:52:03 -04:00