Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
95 changes: 95 additions & 0 deletions .github/workflows/demo-validation.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,95 @@
name: Demo Validation

on:
pull_request:
paths:
- 'src/app/demo/**'
- 'src/app/api/demo/**'
- 'src/lib/demo/**'
- 'scripts/capture-demo-media.ts'
- 'tests/api/demo-session-start.test.ts'
- 'docs/DEMO_MEDIA_CAPTURE.md'
- 'docs/DEMO_READINESS_CHECKLIST.md'
- 'package.json'
- 'package-lock.json'
- '.github/workflows/demo-validation.yml'
push:
branches: [main]
paths:
- 'src/app/demo/**'
- 'src/app/api/demo/**'
- 'src/lib/demo/**'
- 'scripts/capture-demo-media.ts'
- 'tests/api/demo-session-start.test.ts'
- 'docs/DEMO_MEDIA_CAPTURE.md'
- 'docs/DEMO_READINESS_CHECKLIST.md'
- 'package.json'
- 'package-lock.json'
- '.github/workflows/demo-validation.yml'

permissions:
contents: read

concurrency:
group: demo-validation-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

jobs:
validate-demo:
name: Validate browser demo and media capture
runs-on: ubuntu-latest
timeout-minutes: 25

env:
CI: 'true'
NEXT_TELEMETRY_DISABLED: '1'
# Keep capture deterministic and local-only. The media script starts a local dev server if needed.
DEMO_MEDIA_SERVER_COMMAND: npm run dev
DEMO_MEDIA_SERVER_TIMEOUT_MS: '90000'

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '22'
cache: npm

- name: Setup Bun for demo media script
uses: oven-sh/setup-bun@v2
with:
bun-version: latest

- name: Install dependencies
run: npm ci

- name: TypeScript type check
run: npm run typecheck

- name: ESLint
run: npm run lint

- name: Build
run: npm run build

- name: Run demo API unit test
run: npx vitest run tests/api/demo-session-start.test.ts

- name: Generate deterministic demo media
run: npm run demo:media
Comment on lines +80 to +81

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Install Playwright browsers before capturing media

On a fresh GitHub runner, npm ci installs @playwright/test but does not provide the Chromium browser binary; in this repo chromium.launch() reports that npx playwright install is required. Because scripts/capture-demo-media.ts catches browser launch failures, writes capture-report.json, and exits successfully with only fallback storyboards, this workflow can pass the new “browser demo” validation without ever producing real browser screenshots/video. Add a Playwright browser install step (for example with dependencies) or assert browserAutomation.available before accepting the report.

Useful? React with 👍 / 👎.

env:
DEMO_MEDIA_BASE_URL: http://localhost:3000

- name: Verify demo media report exists
run: test -f artifacts/demo-media/capture-report.json

- name: Upload demo media artifacts
if: always()
uses: actions/upload-artifact@v4
with:
name: demo-media-${{ github.run_id }}
path: artifacts/demo-media/
if-no-files-found: error
retention-days: 14
10 changes: 9 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,14 @@ Identity + Badge + Device/Posture + Location Context

See [docs/ARCHITECTURE_OVERVIEW.md](docs/ARCHITECTURE_OVERVIEW.md) for the evolving architecture model.

## Business-facing docs

- [Claim boundaries](docs/CLAIM_BOUNDARIES.md) — safe language for MVP, demo, pilot, and production claims.
- [Value map](docs/VALUE_MAP.md) — executive, IT/security, workflow, audit, and pilot-metric mapping.
- [Product board](docs/PRODUCT_BOARD.md) — current MVP, demo confidence, pilot readiness, future roadmap, and non-goals.
- [Integration priorities](docs/INTEGRATION_PRIORITIES.md) — current demo integrations, first real targets, later targets, and safety boundaries.
- [Architecture future notes](docs/ARCHITECTURE_FUTURE_NOTES.md) — future gateway, remediation, AI-assist, guardrails, and non-goals.

## Current repository status

- **Demo-ready**: Yes — includes demo control scripts, demo validation flow, and demo-oriented tests.
Expand Down Expand Up @@ -155,7 +163,7 @@ Demo and development paths are intentionally optimized for speed and validation.

## Roadmap preview

Near-term priorities include authentication hardening, trust consistency, source-of-truth cleanup, admin decomposition, and pilot readiness milestones. See [docs/ROADMAP.md](docs/ROADMAP.md).
Near-term priorities include readiness hygiene, removal of remaining unsafe defaults, package/toolchain normalization, demo verification, and pilot readiness milestones. See [docs/ROADMAP.md](docs/ROADMAP.md) and [docs/READINESS_HYGIENE_STATUS.md](docs/READINESS_HYGIENE_STATUS.md).

## Contributing

Expand Down
58 changes: 56 additions & 2 deletions docs/ARCHITECTURE_FUTURE_NOTES.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,57 @@
# Architecture Future Notes
# SignalGrid Architecture Future Notes

(Your content here)
These notes describe future architecture direction. They are not current production claims.

## Event-driven decision gateway direction

SignalGrid should evolve toward an event-driven decision gateway that:

- Receives signed events from badge, identity, posture, location, and session sources.
- Normalizes context into a consistent policy input.
- Produces explicit decisions such as allow, deny, step-up, quarantine request, or ticket request.
- Emits auditable decision records and downstream integration events.
- Keeps customer-specific integrations behind well-defined adapters.

The gateway should remain deterministic and explainable for high-consequence frontline workflows.

## Constrained remediation playbooks

Future remediation should be modeled as bounded playbooks, not open-ended automation. A safe playbook should include:

- Trigger conditions and required input fields.
- Allowed actions and disallowed actions.
- Approval requirements for high-risk steps.
- Timeout, retry, and rollback behavior.
- Re-check criteria before access is allowed.
- Audit records for `attempted`, `succeeded`, `failed`, and `final decision` states.

## AI-assisted explanation/classification

AI-assisted capabilities may be useful later for summarizing decision context, classifying event patterns, or drafting operator-facing explanations. These should remain future-only until guardrails are implemented.

Any AI-assisted workflow must:

- Avoid autonomous high-risk enforcement.
- Use structured inputs and bounded outputs.
- Preserve policy-engine authority for final decisions.
- Cite the signals and rules behind generated explanations.
- Fail closed or require review when confidence is low or inputs are incomplete.
- Avoid exposing secrets, credentials, or unnecessary personal data.

## Guardrails

Future architecture work should preserve these guardrails:

- Signed inputs for security-sensitive events.
- Explicit environment configuration with no shared-stage or production default secrets.
- Least-privilege integration credentials.
- Clear separation between demo simulation and production code paths.
- Auditable policy decisions and integration actions.
- Deterministic fallback behavior for missing, stale, or conflicting signals.

## Non-goals

- Replacing customer IAM, UEM/MDM, DEX, NAC, SIEM, SOAR, or ITSM platforms.
- Building a generic autonomous agent that can take unrestricted external actions.
- Treating AI-generated explanations as policy decisions.
- Making production-readiness claims before deployment validation, load testing, and customer-specific integration review are complete.
69 changes: 67 additions & 2 deletions docs/CLAIM_BOUNDARIES.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,68 @@
# Claim Boundaries
# SignalGrid Claim Boundaries

(Your content here)
SignalGrid should be described with clear MVP/demo boundaries. Use this document when preparing website copy, demos, sales materials, investor notes, or partner outreach.

## What SignalGrid can claim today

SignalGrid can credibly claim that it:

- Provides a working MVP/demo path for posture-aware shared-device session decisions.
- Evaluates identity, device posture, session context, and policy inputs before returning an access outcome.
- Demonstrates deterministic outcomes for compliant, non-compliant, and unknown-posture scenarios.
- Fails closed for unknown posture in the current session-start path unless an explicit local/demo override is configured.
- Produces auditable decision context and demo-visible integration/action records.
- Includes simulated/demo workflows for NAC, SIEM, ITSM, and remediation-oriented narratives.
- Includes production-oriented packaging and runbook foundations that still require deployment-specific validation.

## What is simulated or demo-only

The following should be labeled as simulated, deterministic demo behavior, or implementation foundation unless validated in a real pilot environment:

- Browser `/demo` scenarios and demo media outputs.
- Demo integration payload previews for NAC, SIEM, ITSM, and related action logs.
- Remediation attempts described in the current demo narrative.
- Any fallback storyboard media generated when browser capture is unavailable.
- Local/demo default keys or local-only script configuration.
- Buyer-safe sample data, seeded posture fixtures, and simulated frontline scenarios.

## What not to claim yet

Do not claim the following until pilot or production validation exists for the target environment:

- Production readiness for a customer deployment.
- Guaranteed uptime, latency, scale, resilience, or compliance outcomes.
- Certified regulatory compliance such as HIPAA, SOC 2, ISO 27001, FedRAMP, or PCI.
- Fully automated remediation with verified post-remediation re-checks.
- Live customer integrations with a specific IAM, UEM/MDM, DEX, NAC, SIEM, ITSM, or badge system unless that integration has been configured and validated.
- Replacement of existing identity, endpoint, observability, network, ticketing, or device-management systems.
- AI-driven autonomous enforcement decisions.

## Replacement boundaries

SignalGrid is positioned as a decision and orchestration layer between authentication, device posture, and enforcement systems. It does **not** replace:

| Existing category | Boundary language |
| --- | --- |
| IAM / identity provider | SignalGrid uses identity context; it does not replace identity proofing, authentication, or directory ownership. |
| UEM / MDM | SignalGrid consumes posture and enrollment signals; it does not manage full device lifecycle, configuration, or app deployment. |
| DEX / observability | SignalGrid can use operational signals; it does not replace broad employee-experience monitoring or telemetry platforms. |
| NAC / network enforcement | SignalGrid can request enforcement actions; it does not replace network control planes. |
| SIEM / SOAR | SignalGrid emits and enriches events; it does not replace security analytics, incident investigation, or enterprise SOAR governance. |
| ITSM | SignalGrid can create or update workflow records; it does not replace ticketing, change management, or service operations ownership. |

## Safe phrasing

Use language like:

- “SignalGrid sits between authentication and enforcement to make shared-device access decisions based on runtime trust.”
- “The current MVP demonstrates deterministic access outcomes and auditable decision context.”
- “Pilot readiness depends on customer-specific integration validation, operational runbooks, and removal of local/demo defaults.”
- “Remediation is currently shown as a constrained demo narrative unless explicitly implemented and validated in the target environment.”

Avoid language like:

- “Production-ready today.”
- “Replaces your MDM/IAM/NAC/SIEM/ITSM stack.”
- “Fully autonomous remediation.”
- “Compliance guaranteed.”
- “AI decides who gets access.”
24 changes: 12 additions & 12 deletions docs/DEMO_READINESS_CHECKLIST.md
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ The safe demo API mirrors the real session-start response envelope closely enoug
- Security event stream may include allow event depending on policy/event pipeline.

### Current readiness status
- **Partially blocked** in this repo state because session-start posture adapters currently return `unknown` by default, which causes fail-closed deny unless `UNKNOWN_POSTURE_MODE=allow`.
- **Ready when seeded with fresh posture data** because session-start posture adapters now read the shared telemetry posture store. Missing or expired posture still correctly fails closed unless `UNKNOWN_POSTURE_MODE=allow`.

---

Expand Down Expand Up @@ -159,8 +159,8 @@ The safe demo API mirrors the real session-start response envelope closely enoug
- Deterministic executive demo script orchestration for healthcare deny scenario.

### Mocked / simulated now
- `getFleetContext` and `getUEMContext` in session-start path are hardcoded to `unknown` (not live adapter-backed).
- `demo:seed` and `sim:posture` are largely simulation/logging utilities and do not provide authoritative live adapter state for session-start.
- Browser `/demo` scenarios are deterministic and simulated for buyer-safe walkthroughs.
- Demo/default keys used by local scripts are not production controls.
- Remediation attempt in scenario B is talk-track/simulated, not a stateful remediation-retry decision loop.

### Future work (demo-readiness relevant only)
Expand All @@ -172,10 +172,10 @@ The safe demo API mirrors the real session-start response envelope closely enoug

## 4) Remaining Technical Blockers (Can Break Demo)

1. **Posture adapter disconnect (highest risk):** session-start posture service is hardcoded unknown; this can collapse intended compliant/non-compliant differentiation.
2. **Remediation path gap:** required MVP scenario mentions remediation attempt, but session-start currently jumps directly to deny on non-compliance.
3. **Test drift in session-start API expectations:** current API tests show status-code expectation mismatches, indicating contract drift risk before buyer demos.
4. **Demo verification coupling:** `/api/demo/verify` PASS is tied to denied timeline + specific action event presence; allow-path demo validation is under-specified.
1. **Remediation path gap:** required MVP scenario mentions remediation attempt, but session-start currently jumps directly to deny on non-compliance.
2. **Scenario verification coupling:** `/api/demo/verify` PASS is tied to denied timeline + specific action event presence; allow-path and unknown-path demo validation are under-specified.
3. **Local default-key confusion:** demo/test scripts still use local defaults; hosts must avoid presenting those as shared-stage or production-safe settings.
4. **Environment drift risk:** package-manager and toolchain choices are not yet fully normalized across README, scripts, and automation.

---

Expand All @@ -192,9 +192,9 @@ The safe demo API mirrors the real session-start response envelope closely enoug

## 6) Demo-Readiness Next Fix Tasks (No Feature Expansion)

1. **Wire real posture reads in session-start service** from existing telemetry/UEM stores so scenario A and B are both first-class and deterministic.
2. **Implement minimal remediation attempt state machine** in session-start flow (single retry path + explicit audit fields).
3. **Add one golden script for each scenario** (allow/deny/unknown) that returns machine-checkable pass/fail JSON.
4. **Align session-start API tests with contract** (or contract with tests) to remove status-code ambiguity before external demos.
5. **Extend `/api/demo/verify` with scenario selector** so each of the three required scenarios can be verified explicitly.
1. **Implement minimal remediation attempt state machine** in session-start flow (single retry path + explicit audit fields), or keep remediation consistently labeled as simulated.
2. **Add one golden script for each scenario** (allow/deny/unknown) that returns machine-checkable pass/fail JSON.
3. **Extend `/api/demo/verify` with scenario selector** so each of the three required scenarios can be verified explicitly.
4. **Document local-only demo defaults** so default keys are never mistaken for shared-stage or production configuration.
5. **Keep seeded posture fixtures fresh** in demo scripts so scenario A and B remain deterministic.

52 changes: 50 additions & 2 deletions docs/INTEGRATION_PRIORITIES.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,51 @@
# Integration Priorities
# SignalGrid Integration Priorities

(Your content here)
SignalGrid integrates by consuming identity/posture/context signals, making a decision, and coordinating downstream actions. Current integration language should distinguish demo simulation from validated customer integrations.

## Current simulated/demo integrations

The current repository can demonstrate integration behavior through deterministic demo flows and local payload previews for:

- Badge/session-start events.
- Device posture fixtures and telemetry-store reads.
- NAC-style quarantine/action records.
- SIEM-style security event records.
- ITSM-style ticket/action records.
- Demo media and storyboard outputs.

These are useful for explaining the control loop, but they should not be described as live production integrations unless connected and validated in a target environment.

## First real integration targets

Prioritize the smallest integration set needed to prove a pilot workflow:

1. **Identity / badge source** — confirm who is requesting access and map badge/session context to a user.
2. **UEM/MDM or endpoint posture source** — provide fresh compliant, non-compliant, or unknown posture signals.
3. **Audit/event sink** — preserve decision evidence in a customer-approved log destination.
4. **ITSM workflow** — create reviewable tickets or tasks for denied or remediated sessions.
5. **NAC or enforcement target** — only after policy, rollback, and safety boundaries are explicit.

## Later integration targets

After the first pilot workflow is stable, consider:

- Additional MDM/UEM providers.
- Endpoint security and DEX telemetry providers.
- SIEM/SOAR enrichment and correlation workflows.
- HRIS or workforce context sources where appropriate and approved.
- Location/RTLS systems for shared-device return or zone context.
- Multiple enforcement systems for complex frontline environments.

## Integration safety boundaries

- Do not use production credentials in demos.
- Do not call real webhooks from browser demo or media capture flows.
- Require explicit signing secrets and scoped credentials for shared/staging environments.
- Prefer read-only or audit-only pilot modes before write/enforcement actions.
- Use least-privilege service accounts and short rollback paths.
- Keep high-risk actions disabled until policy ownership and approval gates are clear.
- Record integration actions with enough detail for post-demo or post-pilot review.

## Pilot sequencing recommendation

Start with identity, posture, and audit evidence. Add ticketing next. Add enforcement only when customer stakeholders agree on policy, blast radius, rollback, and success metrics.
Loading
Loading