Changelog

Master plan v3.2 - 42 waves Z.368-Z.409 deployed in a single session.

Z.398-Z.400 - Phase F (Reports + Scheduler + Notifications)

PDF report engine with WeasyPrint. 2 knighteye-branded templates (exec-brief, compliance-posture). JSON-backed scheduler at /var/lib/ciso/scheduler/jobs.json. 3-channel notify fanout (Telegram, in-app, email).

Z.393-Z.397 - Phase E (Webhook + Approvals + Audit)

Bot webhook router on /api/v1/v29/webhook/tg/<bot_key>. Dual-channel approval engine (Mini App + Telegram inline buttons). Z.246-style hash-chained audit emitter at /var/lib/ciso/audit-chain/master/chain.jsonl. 5 universal action card templates. All 14 bots have setWebhook configured.

Z.388-Z.392 - Phase D (D3 + DC.js + Treant + List)

D3 force-directed entity graph. ATT&CK coverage heatmap (438 techniques, 64.4% covered). Crossfilter linked-filter incidents dashboard. D3 tree hierarchy. Searchable/sortable asset table.

Z.378-Z.387 - Phase C (10 Dashboards)

SOC, Threat-OSINT, Malware, Phishing, Evidence, Reports, Platform, NICE Agents, FinOps, Admin dashboard pages with backing v27 endpoints.

Z.373-Z.377 - Phase B (Mini App v2)

customer_v26_routes engine module with 12 endpoint families. api.darkcoders.io live with valid LE cert. 5 new Mini App pages (Inbox/Personas/Bots/Services/Approvals) wired to real API. 10-tab bottom nav.

Z.368-Z.372 - Phase A (Foundation)

16 persona mailboxes provisioned. BotFather resume cron installed. Eramba MariaDB multipath client (6,320 rows cached). All 14 bots fully post-provisioned. Phase Q sealed (8/8), Phase V sealed (4/4), Phase Y scoped (10-area Year-1 review).