docs(wave-8): handover for next agent run (#60)

Author: SchenLong

team/docs/adr/WAVE-8-HANDOVER.md

@@ -0,0 +1,127 @@
+# Wave 8 execution — threat intel + DNA content depth
+
+You are resuming a long-running program on the DojoLM monorepo. Wave 7B
+merged to `main` on 2026-04-20 via ADRs 0061-0072 and PRs #46-59.
+Post-merge audit closed 4 findings (severity mix, DNA auto-load,
+physical fixture emission, TS errors) in ADR-0072.
+
+**Wave 8 is threat-intel + DNA content depth — the intel feeds return
+rich structured data; we currently collapse it to skeleton records.
+Stop doing that. Build the structured fields operators actually want
+to filter / aggregate on.** 6 core tickets + 5 gap-fill tickets from
+the Wave 7B.10 audit, ~4-5 weeks single-agent.
+
+## Repo state
+
+- **Branch:** new worktree, branch from `main`.
+- **Gates on the Wave 7B close commit:** dojolm-web 6903/6903,
+  bu-tpi 6175/6175, verify:docs ALL METRICS MATCH (3,465 fixtures),
+  test:tools 11/11.
+- **Pre-existing TS errors:** 40+ in admin/login/etc route tests —
+  NOT Wave 8 scope; runtime tests pass.
+- **Pre-existing lint:** `eslint-plugin-react` vs ESLint 10 —
+  inherited, not Wave 8 scope.
+
+## Read first
+
+1. [`team/docs/IMPLEMENTATION-RULES.md`](../IMPLEMENTATION-RULES.md) —
+   every time. Auto-approval, parallel subagent research, Ollama test
+   endpoint, BlackUnicorn branding, closure checklist.
+2. [`team/docs/FUTURE-IMPLEMENTATIONS.md`](../FUTURE-IMPLEMENTATIONS.md)
+   — deferred / speculative items with trigger.
+3. [`team/docs/adr/WAVES-5-10-ROADMAP.md`](WAVES-5-10-ROADMAP.md)
+   §"Wave 8" — the 6 core ticket specs.
+4. [`team/docs/adr/wave-0/0071-fixture-gap-audit.md`](wave-0/0071-fixture-gap-audit.md)
+   — 5 additional Wave 8+ tickets (Atemi / Arena / Bushido / Kagami /
+   Mitsuke corpora) proposed with effort + shape.
+5. `team/docs/adr/wave-0/0062-0072-*.md` — every Wave 7B + audit ADR.
+6. `team/backlog/README.md` — every Wave 0-7B + audit ticket
+   `~~shipped~~`.
+7. `team/docs/adr/WAVE-7B-HANDOVER.md` — prior handover (closed
+   2026-04-20).
+
+## What Wave 8 IS
+
+Two concurrent themes.
+
+### Theme A — Intel depth (6 core tickets per roadmap)
+
+| # | Ticket | Effort | Status |
+|---|---|---|---|
+| 8.1 | `I-FIELD-NORMALIZATION` — extract structured fields (CVSS vector, CWE id, affected products, reference type) from upstream JSON; extend `IntelligenceEntryRecord` with optional typed fields; adapters populate; `LibraryPageTemplate` renders. | ~3d | open |
+| 8.2 | `I-SEVERITY-RECONCILIATION` — when NVD says HIGH and EPSS says LOW for same CVE, surface both side-by-side with composite score. Add "signal conflict" badge. | ~2d | open |
+| 8.3 | `I-ATLAS-STIX` — upgrade MITRE ATLAS adapter from `case-studies.json` to STIX 2.1 bundle. Richer relationships (technique → tactic → mitigation). Preserves existing `IntelligenceEntryRecord` shape. | ~3d | open |
+| 8.4 | `DNA-LINEAGE-UI` — Amaterasu DNA UI surface for the Wave 7B.6 corpus (28 nodes in `DEFAULT_ATTACK_NODES`). Tree view with family → technique → variant drill-down. Click-through to linked Sengoku plans via `metadata.sengokuPlanIds`. | ~3d | open |
+| 8.5 | `MITSUKE-INDICATOR-TYPES` — current indicators flat strings. Add typed categories (domain, IP, hash, URL-pattern, TTP-id) with per-type rendering + filters. **Fold in the Wave 7B.10 Mitsuke corpus gap** (60+ indicators + 15+ triage templates). | ~2-4d | open |
+| 8.6 | `KAGAMI-CORPUS-IF-EXISTS` — promote from FUTURE per ADR-0071: `src/lib/kagami/` doesn't exist. Create `src/lib/kagami/fixtures.ts` with 40+ behaviour-test pairs + 10+ model-pair comparisons. | ~3d | open (promote) |
+
+**Theme A total: ~18 days.**
+
+### Theme B — Wave 7B.10 gap-fill (3 additional corpus tickets)
+
+| # | Ticket | Effort | Source |
+|---|---|---|---|
+| 8.7 | `ATEMI-CORPUS` — new `src/lib/atemi/fixtures.ts`: 20+ Attack Tools, 30+ Playbooks, 15+ Campaigns. Cross-references Wave 7B.6 DNA families. | ~3d | ADR-0071 |
+| 8.8 | `ARENA-MATCH-CORPUS` — new `src/lib/arena/fixtures.ts`: 25+ multi-agent matches + 5+ historical leaderboard snapshots. | ~3d | ADR-0071 |
+| 8.9 | `BUSHIDO-FRAMEWORK-CORPUS` — new `src/lib/bushido/fixtures.ts`: 8+ compliance frameworks (NIST/ISO27001/SOC2/HIPAA/GDPR/FedRAMP/EU-AI-Act/BU-Internal) + 50+ mappings/framework + 30+ evidence templates. | ~5d | ADR-0071 |
+
+**Theme B total: ~11 days.**
+
+## Total effort
+
+| Theme | Tickets | Days |
+|---|---|---|
+| A — Intel depth | 6 | ~18 |
+| B — 7B.10 gap-fill | 3 | ~11 |
+| **Total Wave 8** | **9** | **~29 (~5 weeks)** |
+
+## Working rules (inherited)
+
+- Auto-approval / parallel subagents / live tests / 100% pass / no
+  force-push / ADR per ticket (start at 0073 — 0072 was audit
+  follow-up).
+- BU branding target: every new fixture / indicator / corpus entry
+  uses the QA-MASTER-PLAN §737-754 id convention
+  `<target>-<attack-shortname>-<severity>-<nnn>` and references a
+  fictional LLM (DojoLM / BonkLM / Basileak / PantheonLM / Marfaak).
+- Criticity mix: 10% CRITICAL / 20% HIGH / 30% MEDIUM / 30% LOW /
+  10% INFO on every net-new corpus.
+
+## PR contract
+
+- One ticket = one PR (large), unless explicitly bundled.
+- Every ticket has its own ADR (start at 0073).
+- Admin-merge pattern: pre-existing CI rot blocks normal merge;
+  confirm with user before admin-merging the first Wave 8 PR, then
+  proceed autonomously.
+
+## Wave 9+ direction
+
+See [`WAVES-5-10-ROADMAP.md`](WAVES-5-10-ROADMAP.md) §"Wave 9" —
+UX polish + test depth (~2 weeks, 5 tickets) — and §"Wave 10" —
+demo / provider coverage / operator docs (~2 weeks, 5 tickets).
+
+## First task
+
+Recommended: ticket **8.4 DNA-LINEAGE-UI** first — it consumes the
+Wave 7B.6 corpus that already exists (`DEFAULT_ATTACK_NODES`) and
+gives operators a visible win. No new corpus needed to start.
+
+Alternatively: **8.1 I-FIELD-NORMALIZATION** for breadth — every
+downstream ticket (8.2/8.3/8.5) benefits from the richer record
+shape.
+
+Ask the user which Wave 8 ticket to ship first; default to **8.4
+DNA-LINEAGE-UI**.
+
+For whichever ticket is accepted:
+
+1. Read the matching roadmap section + ADR-0066 (DNA corpus) +
+   ADR-0069 (plan annotations) if 8.4.
+2. Draft an implementation brief.
+3. Build → test → lint → verify:docs → audit → re-audit until CLEAN.
+4. Create `team/docs/adr/wave-0/0073-<slug>.md`.
+5. Update `team/backlog/README.md` when shipped.
+6. Commit + report + ask for the next ticket.
+
+Under 100 words for your first response.