[v1.4 IDEATE] 23 candidates (15 UX + 5 Security + 3 carries) - CPO review #18
Closed
opened 2026-06-09 13:48:43 +00:00 by cloudinit-bot
·
2 comments
No Branch/Tag Specified
main
release/v1.5
be/INB-1.5-B-api-spec
be/INB-1.5-C-rbac-spec
cto/pillar-ii-gate-v1-20260615
fe/INB-1.5-A-ui-impl
be/INB-1.5-A-api-spec
frontend/story-133-design-system-tokens
ux/INB-1.5-D-design-spec
be/INB-1.5-A-api-impl
be/INB-1.5-B-api-impl
be/INB-1.5-C-rbac-impl
da/INB-1.5-C-data-spec
fe/INB-1.5-B-ui-impl
fe/INB-1.5-C-rbac-integrate
se/INB-1.5-A-qa
se/INB-1.5-B-qa
se/INB-1.5-C-rbac-pentest
ux/INB-1.5-A-ui-spec
ux/INB-1.5-B-ui-spec
epic/EPIC-INB-1.4-E-dpia
epic/EPIC-INB-1.4-F-threat-model
release/v1
v1.3.0
v1.2.0
v1.1.0
v1.0.0
Labels
Clear labels
architecture
compliance
cpo-approval-required
cpo-review
cto-approved
debt
domain/architecture
domain/backend
domain/data-model
domain/data-pipeline
domain/devops
domain/frontend
domain/security
domain/ux
epic
feature
infra
initiative
intake
major/v1
needs-cto-clarification
pattern/a
pattern/b
pattern/c
pattern/d
pattern/e
pattern/f
pattern/g
pillar-i
pillar-ii
pillar-ii-approved
pillar-iii
refactor
risk
status:dev
status:done
status:qa
status:triage
story
technical-debt
trd
type:epic
type:feature
type:needs-triage
type:project
type:task
type:user-story
v1.0
v1.4
v1.5
Item carries CPO-APPROVAL-REQUIRED flag (board approval needed before PR dual-approval)
CPO review required before EXECUTE wave
CTO approved — Pillar III gate passed
Engineering domain: architecture
Engineering domain: backend
Engineering domain: data-model
Engineering domain: data-pipeline
Engineering domain: devops
Engineering domain: frontend
Engineering domain: security
Engineering domain: ux
New requirement submitted by the Client for SAA intake
MAJOR v1 umbrella — all v1 Initiatives/Epics/PRs trace to this label.
Ambiguity detected — reassigned to CTO for design direction
Dependency pattern a
Dependency pattern b
Dependency pattern c
Dependency pattern d
Dependency pattern e
Dependency pattern f
Dependency pattern g
Pillar I (Strategic Alignment) gate artifact — Roadmap, MAJOR Umbrella, MINOR Milestones, gate PRs.
Execution / decomposition lane (CTO)
Pillar II design/spec approved by CTO
Pillar III — implementation / integration / ADR stories
Kanban state per INB-172 rule 2.
Kanban state per INB-172 rule 2.
Kanban state per INB-172 rule 2.
Kanban state per INB-172 rule 2.
Tech-debt sweep per INB-172 alias command (tea issues list --label technical-debt).
issue-hierarchy canon class (standards/issue-hierarchy.md)
issue-hierarchy canon class (standards/issue-hierarchy.md)
issue-hierarchy canon class (standards/issue-hierarchy.md)
issue-hierarchy canon class (standards/issue-hierarchy.md)
issue-hierarchy canon class (standards/issue-hierarchy.md)
issue-hierarchy canon class (standards/issue-hierarchy.md)
MINOR v1.5 — Mailbox & Administrative Management Interface
No Label
type:user-story
Projects
Clear projects
No project
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: coreci/inboxos-v1#18
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
[v1.4 IDEATE] 23 candidates (15 UX + 5 Security/PII/Compliance + 3 carries) — CPO review requested
v1.4 Ideation — CPO Review Requested
Summary
The v1.4 IDEATE pass has registered 23 candidates on
inboxos/phase/01-v1.4-ideate(commitad45e76). Per the v1.1/v1.2/v1.3 cadence, these remain[CANDIDATE]until the CPO authors matching entries indocs/requirements.md. Per the user's directive, the workflow will proceed through PLAN → EXECUTE → SHIP → VERIFY → COMPLETE regardless; the dual-approval (CPO+CTO) gate on PRs is the actual promotion path.CPO action required: review the 23 candidates below, mark the ones to promote in
docs/requirements.md, and sign off on the 1 [CPO-APPROVAL-REQUIRED] candidate (REQ-INB-57) before EXECUTE enters Wave 3.Source
.ciagent/inboxos/ideation/v1.4-candidates.md(~700 lines, 11 sections, full file:line evidence + acceptance criteria).ciagent/inboxos/REQUIREMENTS.mdv1.4 section (REQ-INB-40..59 + REQ-INB-35c, 38, 39).ciagent/inboxos/ROADMAP.mdv1.4 ideation block.ciagent/inboxos/CI-LOG.mdv1.4 IDEATE---ci---blockThe 20 new candidates (15 UX + 5 Security)
UX (operator experience) — REQ-INB-40 through REQ-INB-54
scripts/quickstart.sh— 15-min green-field operator spin-upscripts/explain_run.py— structured-log → human summaryscripts/find_email.py— search by MID/sender/subjectscripts/reclassify.py— move MID between modulesscripts/replay.py— re-queue failed/skipped MIDsERROR-NN → §X.Ytablescripts/daily_digest.py— run summaryscripts/papra_open.py— open Papra link from MIDpipelines/_artifacts/last_run.json— operator audit cursorscripts/dashboard.py— TUI/CLI status boardscripts/dry_run.py— feed one.eml, no writespipelines/_metrics/healthcheck.json— pollable endpointdocs/operator-tutorial.md— 30-min walkthroughscripts/cost_report.py— monthly NocoDB/S3/Ollama rollupSecurity / PII / Compliance / Product-Grade — REQ-INB-55 through REQ-INB-59
docs/security/dpia.md— Data Protection Impact Assessment (GDPR Art. 35)docs/security/threat-model.md— STRIDE per component3 carries from v1.3 (REQ-INB-35c, 38, 39)
.gitignore opencode.jsonline shadows tracked fileapply_schemas.py --checkoffline test forpapra_indextest_papra_link_parity_offline.pyimapclient runtime-shimPre-deferred to v1.5+ (5 items, audit-trail preserved)
scripts/purge.py(GDPR right-to-be-forgotten)nocodb.audit_logtable (operator mutation log; schema impact)CPO-APPROVAL-REQUIRED detail (REQ-INB-57)
Why this needs CPO sign-off before EXECUTE Wave 3:
PII masking before sending the body to Ollama can regress extraction accuracy. Example failure mode: a
crmrow that contains a credit-card number cannot be extracted if the CC is masked — the extract prompt expects the literal digits. The CPO must author the masking policy indocs/requirements.md(which PII types are masked: SSN, credit-card, IBAN, phone, email; which are preserved for extraction: never; audit trail: regex-match log to_artifacts/pii_scrub.jsonlper message).The proposed policy the CPO can adopt as-is:
\d{3}-\d{2}-\d{4}), credit-card (Luhn-validated\d{13,19}), IBAN (per-country regex), phone (E.164)_artifacts/pii_scrub.jsonl(separate from the run JSONL)Workflow status
372190e)64d45c3, 0 ambiguities)8ff4e31)ad45e76, 23 candidates)Links
.ciagent/inboxos/ideation/v1.4-candidates.md.ciagent/inboxos/REQUIREMENTS.mdv1.4 section.ciagent/inboxos/ROADMAP.mdv1.4 ideation blockinboxos/phase/01-v1.4-ideatemilestone/v1.4-initialAssignment
ideation,v1.4,cpo-review,cpo-approval-required(for REQ-INB-57)/cc @CPO
Paperclip link (closes the naked-issue gap)
docs/requirements.mdv0.4 (Section 6) anddocs/roadmap.mdv0.6 (v1.4 milestone added).REQ-INB-40..REQ-INB-59). 3 v1.3 carry items (REQ-INB-35c, 38, 39) deferred to a separate child issue on the existingv1.0-MVPtechnical-debt lane. 5DEF-V1.4-1..5items recorded as v1.5+ defers in Section 6 audit-trail block.REQ-INB-*pending CEO ratification; (b)REQ-INB-57PII-scrub masking policy pendingrequest_board_approval; (c) CTO technical validation required for the security/PII/observability cluster before build dispatch; (d) build envelope + UAT envelope to be filed when (a) lands.v1.4(id 3) — set 2026-06-09 viatea issues edit 18 --repo jc-capital/inboxos --milestone 3.PR created — awaiting dual approval (CPO + CTO)
The v1.4 EXECUTE stage has shipped. PR #23 is open for review:
inboxos/phase/01-v1.4-execute→mainRequired approvals (per inboxos dual-approval gate):
The PR will NOT be merged to main, and no tag/release will be created, until both approvals are in.
Pillar I Gate — Awaiting Client (CPO) Approval
docs/roadmap.mdper board mandate INB-123).request_confirmationinteractionad1af071-f4cc-4a40-a9fc-3963e58665a8, resolved 2026-06-09 with Option 2: Retroactive v1 ("non-breaking for what is done/released; enforce governance compliance moving forward").What this Gate binds
When the CPO merges PR #25, the SAA will run SOP §6 to instantiate (in this order, all with full Issue Metadata Matrix):
major/v1label (color-coded).MAJOR v1 — InboxOS Core Platformumbrella Issue, body = the Roadmap, labelmajor/v1,blockedByPR #25.BacklogMilestone (labelmajor/v1, due 2026-09-30). Existing legacy Milestones (v1.0-MVP,v1.1-Beta,v1.2-initial,v1.4) stay intact and get themajor/v1label added — non-breaking per CEO directive.release/v1branch.epic/<epic-id>-<slug>).mainbranch ofdocs/roadmap.mdwill be updated to bind the umbrella Issue number into the## MAJOR Umbrellablock.What this Gate does NOT do
.ciagent/changes.## Milestonesbody indocs/roadmap.md(the CPO-authored content is unchanged).main(per INB-328).Open questions surfaced (no decision required for this Gate)
## MINOR release listsection of the Roadmap.DEF-V1.4-1..DEF-V1.4-5items are explicitly out of scope (deferred to v1.5+).