# TrustOS — Quick TODO List

## 🔴 BLOCKERS (Fix First)

- [ ] **Services won't start** - Docker/Docker Compose unavailable; verify or install
- [ ] **Auth endpoints are stubs** - Login returns 200 without checking credentials
- [ ] **API endpoints return no data** - All routes return empty responses; implement database queries
- [ ] **Frontend has no API integration** - Dashboard/findings pages are empty shells

---

## 🟡 CRITICAL PRIORITY (This Week)

### Backend
- [ ] Implement `/api/v1/auth/login` - Password hashing, JWT generation
- [ ] Implement `/api/v1/dashboard` - Query risk scores, return real data
- [ ] Implement `/api/v1/findings` GET/POST/PATCH - Full CRUD
- [ ] Run Alembic migrations - Create database tables
- [ ] Test auth flow end-to-end

### Frontend
- [ ] Create `lib/api.ts` - HTTP client with auth header injection
- [ ] Wire login form to backend
- [ ] Create auth context & route guards
- [ ] Fetch dashboard data and render
- [ ] Fetch findings list and display

---

## 📋 PHASE 1 DELIVERABLES (Current Sprint)

- [ ] Working login (backend + frontend)
- [ ] Dashboard showing real data (score, top risks, trend)
- [ ] Findings table with filtering & sorting
- [ ] Findings detail page with status updates
- [ ] Digital Footprint Center (basic)
- [ ] Audit Report generation (basic)

---

## 📦 PHASE 2 FEATURES (Next Sprint)

- [ ] AI Risk Translation (OpenAI/Anthropic integration)
- [ ] Attack Path Visualization
- [ ] Continuous Monitoring (APScheduler)
- [ ] External API integrations (HIBP, NVD)
- [ ] Email notifications

---

## ✅ ALREADY DONE

- ✅ Documentation (README, ARCHITECTURE, API, BUILD_PLAN, BUSINESS_PLAN, DEPLOYMENT)
- ✅ Project structure (frontend, backend, infra organized)
- ✅ Database schema (15 tables, multi-tenant design)
- ✅ API route skeleton (7 route files, 589 lines)
- ✅ Frontend components (RiskDial, ScoreTrend, Sidebar, TopRiskCard)
- ✅ Frontend pages (dashboard, findings, login, footprint, reports)
- ✅ Docker Compose setup
- ✅ Dependencies configured

---

## 📊 Effort Estimate

| Phase | Hours | Weeks | Priority |
|-------|-------|-------|----------|
| Backend Implementation | 54-68 | 1.5-2 | 🔴 CRITICAL |
| Frontend Integration | 56-64 | 1.5-2 | 🔴 CRITICAL |
| Infrastructure | 20 | 0.5 | 🟡 HIGH |
| **MVP Total** | **146-168** | **4-6** | |

---

## 🎯 Success Criteria for MVP

- [ ] User can log in (any role: executive, it_admin, trustos_admin)
- [ ] Dashboard shows Cyber Health Score, Top 3 Risks, 90-day trend
- [ ] IT Admin can view all findings with filtering
- [ ] IT Admin can update finding status (open → in_progress → resolved → verified)
- [ ] Risk score recalculates when findings change
- [ ] API responses match documentation
- [ ] No 500 errors in happy path flows
- [ ] Multi-tenant isolation verified (user only sees their tenant's data)

---

## 🚀 To Start Development

```bash
# Backend
cd backend
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
cp .env.example .env
# Edit .env with your settings
alembic upgrade head
python seed.py
uvicorn app.main:app --reload

# Frontend (new terminal)
cd frontend
npm install
# Create .env.local with NEXT_PUBLIC_API_URL=http://localhost:8000
npm run dev

# Database
cd infra
docker-compose up  # or use Postgres standalone
```

---

## 📞 Next Steps

1. Get Docker running or verify local Postgres
2. Implement authentication endpoint (highest impact)
3. Implement dashboard endpoint (first feature users see)
4. Get end-to-end login → dashboard working
5. Then expand to other endpoints and pages

**Target**: First working feature by end of week