Project Meridian
Financial projection software for a specific industry. Users model long-term scenarios, plan capital improvements, and generate stakeholder presentations.
- Multi-year financial modeling
- Scenario comparison
- Stakeholder presentation generation
- Persona-tested with 3 user profiles
Activity Timeline
AES-256-GCM vault with separated ciphertext/key storage, gated /vlt/ web surface, and 6-command CLI. Two architectural bugs caught mid-implementation — stale auth path armed live app 55 seconds, require_gate bypass in completion gate — both fixed with regression coverage.
Incident-driven: API key exposure triggered vault UX commission. AES-256-GCM with AAD binding, owner cookie auth, ciphertext/key separation, and query-string banning all specified. Credential remediation completed same-hour.
AES-256-GCM with AAD binding, owner-cookie gate, query-string ban on vault routes, separated ciphertext/master-key storage. API key exposure incident contained and used as UX redesign evidence. Awaiting owner ruling before implementation.
Multi-model benchmark pitted Fable, Claude, GPT-5.5, Kimi K2.7, and GLM-5.2; Fable 5 xhigh won. Architecture audit: 40 pages, 25 API routes, 21 DB tables, 58 tests. Test suites hardened with robust dev-server teardown. 14 commits.
System design for a BACKLOG.md scanner with 14-day freshness filtering and energizing-item selection criteria. Implementation instructions prepared but not yet executed.
Bundles P01–P06 cover SheetJS xlsx CVE migration, ralph-loop plugin patterns, Parallel-Task MCP integration, and Context7 improvements. Ordered by likelihood to surface actionable insights.
Removed Decimal.js global config conflict, guarded NPV division-by-zero, patched parseFloat regressions in 5 monetary value sites. Added organizationId defense-in-depth to 3 UPDATE services missing org scope. Workspace status tracking upgraded from mtime stub to 4 real signals.
Coverage: LIKE injection, multi-tenancy filters, CSV formula injection, ReDoS, demo token verification, projection validation, CI least-privilege. Four documentation files added including a pre-PR checklist and remediation roadmap. Semgrep and Codex cross-validations complete.
Format functions consolidated across 25 API services, 30+ pages, and 50+ components from 7 local variants to one shared source. Golden snapshot tests validate output equivalence. Security audit identified CSV injection, ReDoS, and a committed Terraform plan file among 5 total findings queued for remediation.
Docker containerization and GitHub Actions CI/CD pipeline added alongside Terraform IaC. Security hardened with Cognito authentication, auth middleware, and row-level security on all tables. Development environment migrated from WSL to native Ubuntu 24.04 LTS (RTX 3090 workstation) with NTFS mount driver fix.
Full Cognito/auth flow mapped and credentials consolidated across environments. Production stack defined: ECS Fargate + Terraform IaC + GitHub Actions + WAF v2. Phase 1 Cognito hardening underway.
Cognito password mismatch traced to a specific user account in us-east-1. EC2 infrastructure confirmed healthy on both ports. Fix is documented but SSH access is unavailable on the current machine.
Horizontal axis labeling implemented. Homepage carousel redesigned. Deploy infrastructure updated. Version stable at 0.0.1.
Presentation exit and contrast fixes. Test user login flow and pending page UX improvements. Health status: passing.