DocVault

Jul 9, 2026 · 2 min

The NCP server was shut down and DocVault moved to a shared Vultr box. Prod and demo containers were already running and healthy there, but both public URLs failed the TLS handshake — the shared edge Caddy had no docvault vhost. Wired the vhosts, retargeted the deploy script, redeployed latest main, verified everything (including the co-hosted apps) at 200.

Jun 21, 2026 · 2 min

The demo had been made a non-admin for safety, which hid the AI assistant and admin screens — so it looked like a different, crippled product. Fixed by making the demo a full admin but enforcing read-only at the middleware and in the AI engine.

Jun 20, 2026 · 2 min

The operator found the UI hard and wanted the AI to guide them. Added a doc-grounded help_docs tool so the assistant answers how-to/install questions strictly from a curated usage guide — lightweight RAG, no vector DB needed at this scale.

Jun 20, 2026 · 2 min

Alerts were pull-only (dashboard) and the Slack notifier was unconfigured, so a non-technical admin who didn't log in never found out. Added SMTP email for high/critical alerts plus a daily Korean digest, with an on-demand send.

Jun 19, 2026 · 3 min

A second AI assistant (Codex) shipped 22 commits while I was away. I reviewed the diff adversarially, confirmed it was solid, then fixed two real holes — a passwordless-admin footgun in the demo login and a missing code-signing pipeline — and a deploy bug my own verification caught.

Jun 17, 2026 · 1 min

The installer download and the install guide were scattered (download buried in Agent Status, guide a separate static page in a new tab). Consolidated into a single in-app /admin/install page reachable from the sidebar.

Jun 17, 2026 · 5 min

Candid post-mortem of building the one-click Windows installer + guides + in-app install page: the assistant's mistakes, the environment dead-ends, the real-world gotchas, and the process friction. No sugarcoating.

Jun 16, 2026 · 2 min

Shipping a one-click installer wasn't enough for a non-technical user: SmartScreen hides its Run button and email blocks .bat files. Rewrote the install page into a visual, dialog-by-dialog guide and added transfer guidance for the admin.

Jun 16, 2026 · 2 min

Added host→employee assignment, CSV bulk user import, an AI security briefing, and a tool-use AI assistant that can both query live data and perform actions (create user, assign host, ack alert) — every action logged and one-click rollback-able.

Jun 16, 2026 · 2 min

A non-technical user installing the agent opened Docker by mistake and got stuck on the PSK placeholder. Replaced the copy-paste PowerShell install with an admin-only, secret-baked, self-elevating .bat they just double-click.

Jun 10, 2026 · 3 min

To actually deploy DocVault for a remote user, I implemented the real osquery TLS wire protocol on the server (enroll_secret → node_key) so a stock osquery node can connect, and rewrote the clipboard agent around a bounded retry queue with periodic re-enrollment so events survive network outages. Plus a one-command Compose deploy and a full deployment guide.

Jun 9, 2026 · 2 min

A full repository review found missing admin and folder authorization checks, fail-open agent PSK behavior, fragile CSV export generation, and incomplete audit coverage. Commits e0d498d, 6df4c71, and 9f81995 close those gaps and add regression tests.

Jun 9, 2026 · 3 min

After verifying a separate batch of access-control fixes, I closed the remaining auth gaps — an API-login 2FA bypass with no brute-force limit, example/weak secrets accepted at startup, and a hardcoded admin password — then added a Docker Compose + Caddy stack that auto-migrates and auto-issues TLS for both a dedicated server and an all-in-one install.

May 27, 2026 · 2 min

A documentation audit revealed README claimed AES-256-GCM but the actual cipher on file bodies was CTR with no authentication tag. Rewrote encryption.go as chunked GCM with truncation and reorder defenses, and fixed a concurrent-INSERT race in the hash chain triggers in the same commit.

Apr 8, 2026 · 1 min

Added GitHub Actions CI + a release workflow, plus deploy scripts for the server and the Windows agents — turning ad-hoc builds into a repeatable pipeline.

Apr 8, 2026 · 1 min

Register sensitive files by SHA-256; the server matches incoming endpoint file events against those hashes (cached in memory) and records detections — so a tracked file is caught even if it's renamed.

Apr 1, 2026 · 1 min

Added TOTP-based 2FA implemented from the RFC primitives (HMAC-based one-time codes), a QR setup flow, a second login step, and recovery codes.

Apr 1, 2026 · 1 min

Added a risk-scoring engine that compares each event against a per-user behavioral baseline (work hours, weekends, known IPs, …) and accumulates weighted anomaly scores. Threshold-rule based — deliberately not ML.

Mar 31, 2026 · 1 min

Added a macOS clipboard agent and refactored the single 397-line main into clean per-platform files (Windows/macOS) with a shared core and a launchd service.

Mar 31, 2026 · 1 min

Added a Server-Sent Events hub so the dashboard updates live as endpoint events arrive — no polling, no WebSocket complexity.

Mar 25, 2026 · 1 min

Added a SHA-256 hash chain on audit_logs and endpoint_events via DB triggers, plus UPDATE/DELETE prevention. Chose DB-level enforcement so any insert path — including ad-hoc psql — is forced through the chain.

Mar 24, 2026 · 1 min

Ran the 8-phase implementation plan from CLAUDE.md to a working end-to-end skeleton in one commit, with AI assistance. Surface coverage was wide but depth was thin — the interesting parts came later.