Edu-Carone-SA/mike

A security-first, admin-managed Mike deployment for organisations running legal AI in controlled AWS environments.

With 102 tracked changes ahead and a push as recently as 9 September 2026, Edu-Carone-SA appears actively focused on hardening and operating the product.

View on GitHub →

Edu-Carone-SA is shaping Mike into a more tightly governed legal-AI platform: controlled user access, hard separation between workspaces, and a staging setup designed to test changes before wider release.

The fork is also simplifying its AI operation around DeepSeek while putting deployment, login, storage and day-to-day reliability under closer operational control. It reads less like an experiment and more like a careful internal rollout for teams handling sensitive legal work.

What's in it

Tenant separation Database-level access controls are intended to keep one organisation's legal work isolated from another's.
Admin-managed accounts Access is provisioned and managed by administrators rather than through open self-service signup.
DeepSeek-led AI Production use is standardised on DeepSeek, with operational support for dependable key management.
AWS staging environment A protected staging setup supports checking the application, login flow and storage before release.
Safer deployments Deployment checks cover database readiness, service health and the conditions needed for a reliable release.
Review and chat reliability The fork is addressing failures that could make AI review appear complete when usable documents were not actually available.

Direction

securityinfrastructuremulti-tenant

Activity

Themed changes and pull requests touching this fork, newest first. Themed changes that haven't been turned into a public post yet still appear — they're real work even without a published writeup.

⛔ #210 MIKE-04: deploy isolated AWS staging environment +76,944 -5,601 2mo ago by EduardoCarone ↗ analysis ↗ GitHub

## MIKE-04: AWS Staging Access

🟢 #20 fix(tabular): TR-02 to TR-05 bugs + SSE keepalive heartbeat +3,274 -93 2mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## Fix: Tabular Review bugs + SSE keepalive

🟢 #19 fix(infra): ALB routing + admin password reset +247 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## Summary

✅ #18 fix(api): add Content-Type header to POST/PATCH requests +2 -1 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## Bug fix: "Valid email is required" when creating users

✅ #17 ci(deploy): fix VPC_SUBNETS comma-separated +1 -1 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

AWS CLI run-task expects comma-separated subnet IDs. Space-separated causes `InvalidParameterException: Subnet ID must match subnet-[0-9a-f]+`.

✅ #16 ci(deploy): switch to native amd64 builds +6 -21 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

QEMU ARM64 builds take 30+ min for 3 images. Switch to native amd64 (GitHub runners are x86_64). Fargate defaults to amd64 when runtimePlatform is not specified.

✅ #15 ci(deploy): trigger on workflow file changes +1 3mo ago self by EduardoCarone ↗ GitHub

Add `.github/workflows/deploy-staging.yml` to the paths filter so changes to the deploy workflow itself trigger the deploy.

✅ #14 ci(deploy): add migration job, fix ARM64 builds, remove :latest tags +219 -25 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## CI: Migration job + ARM64 fix

📝 Edu-Carone-SA makes Mike an admin-provisioned system 2 commits 3mo ago securityworkflow draft

This fork turns account access from self-service signup into a controlled administrative workflow.

📝 ECS deploy pipeline hardening: migrations, architecture, subnet fixes 4 commits 3mo ago minor change

✅ #13 MIKE-05: User Administration - admin-only user management +2,709 -275 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## MIKE-05: User Administration

✅ #12 MIKE-FIX-LLM: make DeepSeek the only production model and fix API key flow +510 -28 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## MIKE-FIX-LLM-PRODUCTION-02: make DeepSeek the only production model and fix API key flow

✅ #11 docs(sprint): MIKE-FIX-LLM-PRODUCTION-01 result +70 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

Sprint result documentation

✅ #10 MIKE-FIX-LLM-PRODUCTION-01: fix LLM key flow and model picker +64 -27 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## What

📝 Edu-Carone-SA puts DeepSeek in sole charge of Mike's AI 4 commits 3mo ago infrastructurechat-ui draft

This fork makes a decisive cost-and-simplicity bet by replacing its multi-provider model choice with DeepSeek alone.

✅ #9 feat(llm): add DeepSeek V4 Pro/Flash as LLM provider +462 -9 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## Summary

✅ #8 MIKE-04B: final fixes - E2E spec and signup disabled +90 -1 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## Final fixes for MIKE-04B

✅ #7 MIKE-04B: recover AWS staging frontend and S3 readiness +2,372 -32 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## MIKE-04B: Recover AWS Staging Frontend and S3 Readiness

⛔ #6 MIKE-04: deploy isolated AWS staging environment +1,686 -4 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## MIKE-04: AWS Staging Access

📝 Edu-Carone-SA brings Mike's staging stack in-house on AWS 2 commits 3mo ago infrastructuresecurity draft

This fork trades hosted building blocks for a self-managed staging environment designed to keep tighter control of deployment, access and spend.

Show 27 more

✅ #5 MIKE-03: Authorization, tenancy and Row Level Security +2,958 -19 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## MIKE-03: Authorization, tenancy and Row Level Security

✅ #4 MIKE-02 Part 2: Expanded quality gates, tests, E2E, templates and docs +3,119 -166 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

Complete Sprint 2 spec: backend ESLint, zero-warnings, 144 tests, Playwright E2E, coverage, ci-success aggregator, templates, docs, risk register. See commit history for details.

✅ #3 MIKE-02: Quality CI pipeline and security scanning +4,127 -1,671 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## Objective

📝 Edu-Carone-SA puts tenant walls around Mike's client data 1 commit 3mo ago securitymulti-tenant draft

This fork adds database-level checks intended to stop one organisation from seeing another's work.

📝 Edu-Carone-SA puts a real quality gate around Mike 1 commit 3mo ago infrastructuresecurity draft

This fork makes reliability checks more visible before legal-data changes reach production.

✅ #2 MIKE-01: Reproducible local development environment +5,387 -3,945 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

Sprint 1 deliverables: runtime pinning, env validation, Docker Compose, health/readiness, automation scripts, synthetic fixtures, tests, and documentation. See commit history for details.

✅ #1 MIKE-00: Foundation diagnostic and Sprint 0 deliverables +59,871 3mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## Summary

⛔ #209 MIKE-00: Foundation diagnostic and Sprint 0 deliverables +59,871 3mo ago by EduardoCarone ↗ analysis ↗ GitHub

## Summary

📝 Edu-Carone-SA puts Mike behind a more disciplined release gate 1 commit 3mo ago securityinfrastructure draft

The fork moves routine quality and security checks from individual laptops into a shared delivery process.

📝 Edu-Carone-SA makes Mike easier to trust before it goes anywhere 1 commit 3mo ago infrastructuresecurity draft

This fork turns a promising legal-AI stack into something a team can set up, check and test with fewer unpleasant surprises.

📝 Edu-Carone-SA puts Atlas through a security gate before launch 1 commit 3mo ago securityinfrastructure draft

This fork starts by defining what must be safe before any legal work or client access moves onto the platform.

📝 Edu-Carone-SA puts Atlas through a production-readiness reality check 0 commits — securityinfrastructure draft

Before adapting Mike for internal use, this fork maps the risks that could matter most to legal teams handling sensitive work.

📝 Edu-Carone-SA builds a staging front door, but it never ships 0 commits — infrastructuresecurity draft

The fork proposed a protected AWS test environment where the application and login flow could be tried before release.

📝 Edu-Carone-SA restores admin access and untangles a production routing clash 0 commits — securityinfrastructure draft

Two reported production failures had locked out administrators and sent browser pages to the wrong service.

📝 Edu-Carone-SA is making tabular review harder to fool 0 commits — workflowinfrastructure draft

The proposed fixes target a quiet but serious problem: a review can look complete even when the wrong documents, or no usable documents, reached the AI.

📝 Edu-Carone-SA puts hard walls between legal workspaces 0 commits — securitymulti-tenant draft

The fork now treats access to matter data as a first-class security boundary, not an assumption.

📝 Edu-Carone-SA gets Mike's AWS staging environment back on its feet 0 commits — infrastructureintegration draft

A deployment recovery turns a blocked test environment into a working platform for checking the product before wider release.

📝 Edu-Carone-SA closes Mike's staging front door 0 commits — securityworkflow draft

Public sign-ups are now shut off in the staging environment, with the login journey checked from browser to dashboard.

📝 Edu-Carone-SA brings DeepSeek into Mike's model lineup 0 commits — integrationworkflow draft

The fork adds two DeepSeek options, giving teams another route to AI-assisted legal work without treating compatibility as an afterthought.

📝 Edu-Carone-SA gets its legal-AI operations room working 0 commits — workflowanalytics draft

A QA repair pass fixes the gaps that made a live production run hard to trust or follow.

📝 Document sprint results 0 commits — minor change

📝 Edu-Carone-SA makes DeepSeek the one AI engine to watch 0 commits — infrastructuresecurity draft

This fork narrows production AI to a single provider while making key management more dependable for the people running it.

📝 Edu-Carone-SA puts Mike's user lifecycle behind an admin desk 0 commits — securityworkflow draft

This fork replaces open signup with controlled account management and a record of who changed what.

📝 Edu-Carone-SA makes Mike deployments safer to ship 0 commits — infrastructureworkflow draft

This fork turns deployment from a hopeful push into a sequence that checks the database and services are ready.

📝 Switch container builds to native amd64 0 commits — minor change

📝 Edu-Carone-SA fixes AWS task launches across multiple subnets 0 commits — infrastructure draft

A small configuration correction removes a hard stop for deployments that need more than one network segment.

📝 Edu-Carone-SA makes admin controls actually work 0 commits — workflowsecurity draft

A small request fix restores the basic account-management actions a legal AI team needs to run safely.

Threads of work (detailed view)

24 threads have been distilled into posts.

Edu-Carone-SA makes Mike an admin-provisioned system

This fork turns account access from self-service signup into a controlled administrative workflow.

securityworkflow

2 commits · latest 3mo ago

Edu-Carone-SA puts DeepSeek in sole charge of Mike's AI

This fork makes a decisive cost-and-simplicity bet by replacing its multi-provider model choice with DeepSeek alone.

infrastructurechat-ui

4 commits · latest 3mo ago

Edu-Carone-SA brings Mike's staging stack in-house on AWS

This fork trades hosted building blocks for a self-managed staging environment designed to keep tighter control of deployment, access and spend.

infrastructuresecurity

2 commits · latest 3mo ago

Edu-Carone-SA puts tenant walls around Mike's client data

This fork adds database-level checks intended to stop one organisation from seeing another's work.

securitymulti-tenant

1 commit · latest 3mo ago

Edu-Carone-SA puts a real quality gate around Mike

This fork makes reliability checks more visible before legal-data changes reach production.

infrastructuresecurity

1 commit · latest 3mo ago

Edu-Carone-SA puts Mike behind a more disciplined release gate

The fork moves routine quality and security checks from individual laptops into a shared delivery process.

securityinfrastructure

1 commit · latest 3mo ago

Edu-Carone-SA makes every proposed change clear a security gate

This fork moves quality checks from a developer's laptop into required controls before changes can reach the main branch.

securityworkflow

1 commit · latest 3mo ago

Edu-Carone-SA makes Mike easier to trust before it goes anywhere

This fork turns a promising legal-AI stack into something a team can set up, check and test with fewer unpleasant surprises.

infrastructuresecurity

1 commit · latest 3mo ago

Edu-Carone-SA puts Atlas through a security gate before launch

This fork starts by defining what must be safe before any legal work or client access moves onto the platform.

securityinfrastructure

1 commit · latest 3mo ago

Edu-Carone-SA puts Atlas through a production-readiness reality check

Before customising Mike for Atlas, this fork has drawn a firm line between local experimentation and safe production use.

securityinfrastructure

1 commit · latest 3mo ago

Pull requests (detailed view)

22 PRs touch this fork — inbound (filed against it) or outbound (filed from it). State icons match the editorial dashboard.

🟢 Open (2)

🟢 open · #20 fix(tabular): TR-02 to TR-05 bugs + SSE keepalive heartbeat

by EduardoCarone · opened 3mo ago

Edu-Carone-SA/mike ← Edu-Carone-SA/mike · +3,274 -93 · self · ↗ analysis · ↗ GitHub

🟢 open · #19 fix(infra): ALB routing + admin password reset

by EduardoCarone · opened 3mo ago

Edu-Carone-SA/mike ← Edu-Carone-SA/mike · +247 · self · ↗ analysis · ↗ GitHub