ECC DPS · Engineering Docs

Appearance

Changelog ​

The platform's release history, reconstructed from the Git histories of dps-code-api (API) and ecc-dps-dashboard (dashboard). Entries are grouped by release; dates are approximate commit dates. This page is updated whenever behavior, architecture, permissions, data structures, deployment, or operational procedures change (see Maintenance).

2026-09 — Current release ​

API (dps-code-api) ​

  • Event system (migrations 033/034): canonical append-only events stream with a single validated write path (rpc_write_event); report/queue/ discipline/admin writers emit events in the same transaction; historical backfill (guarded, non-destructive). 034 hardens actor identity (p_actor_id as a first-class parameter), adds the atomic conclude action, atomic queue completion/requeue, atomic report deletion with forensic audit, and the bot's audited onboarding RPC lane (no rank writes).
  • Audit log review (migration 032): rpc_audit_log_v2 with event-type filter; /audit?event= support; actor-name resolution; index additions.
  • Environment isolation: one Flask codebase serves production and demo via trusted ingress hostname resolution; environment-bound session cookies with an environment claim; request-scoped Supabase clients; optional HMAC ingress assertions; demo allowlist identity mapping and fail-closed reset.
  • Base schema versioned as migration 000 for release reproducibility.
  • ER:LC relay client (erlc_relay.py) with failover + circuit breaker; /erlc/player/<id> route.
  • Security hardening: request body caps, report-ID bounds, URL scheme validation, CORS origin allowlist, RPC privilege lockdown (016), Director rank checks in the database (012), hierarchy guards, admin access-list fixes, contact-thread guards (019).
  • Realtime authorization fixes (026/027) for private training channels.
  • Punishments (029) + discipline delivery queue (030/031): retained punishment records, transactional create/update/revoke with audit, atomic delivery pickup with live punishment embeds, profile lookups.
  • Training Center (023–025, 028): multi-scenario sessions, engine, is_trainer admin control.
  • Contact actor identity threaded through reply/close routes (canonical Discord ID, not display-name disguise).

Dashboard (ecc-dps-dashboard) ​

  • Punishments UI (list/detail, issue flow with profile lookup, delivery status, requeue recovery).
  • Training Center app: role-branched routes, trainee shell, trainer control center, Realtime hook with token refresh + reconciliation, recovery tools.
  • Security hardening: URL sanitization at all sinks (urlSafety.ts), fullscreen lightbox sanitization, permission-aware nav, sensitive-field masking.
  • Production Playwright smoke suites (smoke, training, realtime join/live, agent management).
  • Section header labels on every page; server-side name resolution for closed-by and evidence uploaders.

2026-08 — Training Center and hardening ​

  • Training Center V1.1: sessions, scenario engine, Realtime synchronization, trainee/trainer separation, grading, recovery controls.
  • Report contact threads: reply/close/respond flow, thread wrapping/locking, agent self/higher-rank protections.
  • Discord profile snapshots: capture at report creation, profile cards, interactive modals.
  • Server-side pagination for dockets; multi-criteria sorting; status filters; supervisor queue gating.
  • Validated/invalidated counted as closed in analytics; status-tag and investigation UI restorations.
  • Admin area: health status site with incident history, queue maintenance (requeue/cancel/sweep), audit trail, access management, report correction, schema visibility, Director rank checks.
  • Demo environment: canonical seeded dataset with idempotent reset.

2026-07 and earlier — Foundation ​

  • Discord OAuth sign-in for DPS agents; dashboard route tree; report CRUD + action queue (validate/invalidate/investigate/contact); notes/evidence/ timeline; agent onboarding records; bot generators; audit log with server-side search; action-queue reliability (stale requeue, atomic claim); transactional RPCs; admin core (allowlist, append-only audit, schema ledger); RLS/least-privilege hardening; data-integrity FKs and status constraints; Discord embed parity for actions.

How to add an entry ​

When a change lands (per the Maintenance rules):

  1. Add a dated entry under the current release, API and/or Dashboard as appropriate.
  2. Reference migrations by number when schema/RPC behavior changed.
  3. Link the related documentation pages that were updated with the change.