Edu-Carone-SA/mike

A security-hardened, self-hosted Mike deployment aimed at controlled multi-user AI workspaces.

The 17 tracked changes form a concentrated delivery push, though the fork has not been pushed since 22 July 2026.

Edu-Carone-SA is turning Mike into a more operationally managed application: an AWS-hosted staging environment, self-hosted authentication services, and a deployment process designed to make releases predictable.

The product direction is toward a controlled multi-tenant workspace rather than an open self-service tool. It adds administrator-managed accounts, tenant protections, and a simplified production model choice centred on DeepSeek. Curious readers can follow the GitHub link for the implementation detail.

What's in it

Managed user access Administrators can create or invite users, change roles, reset passwords, revoke sessions, and disable accounts.
Tenant protection The application is being hardened so users and shared resources are governed by explicit access controls.
AWS staging deployment An isolated staging environment provides a working application and login path ahead of production changes.
Self-hosted authentication Authentication is operated within the deployment environment, with public sign-up disabled.
DeepSeek-led AI configuration DeepSeek is the sole production model provider, with its models available for the application's AI work.
Release safeguards Deployment includes quality checks, security gates, database migration checks, and recovery-focused operational fixes.

Direction

infrastructuresecuritymulti-tenant

Activity

Themed changes and pull requests touching this fork, newest first. Themed changes that haven't been turned into a public post yet still appear — they're real work even without a published writeup.

🟢 #20 fix(tabular): TR-02 to TR-05 bugs + SSE keepalive heartbeat +3,274 -93 26d ago self by EduardoCarone ↗ analysis ↗ GitHub

## Fix: Tabular Review bugs + SSE keepalive

🟢 #19 fix(infra): ALB routing + admin password reset +247 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## Summary

✅ #18 fix(api): add Content-Type header to POST/PATCH requests +2 -1 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## Bug fix: "Valid email is required" when creating users

✅ #17 ci(deploy): fix VPC_SUBNETS comma-separated +1 -1 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

AWS CLI run-task expects comma-separated subnet IDs. Space-separated causes `InvalidParameterException: Subnet ID must match subnet-[0-9a-f]+`.

✅ #16 ci(deploy): switch to native amd64 builds +6 -21 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

QEMU ARM64 builds take 30+ min for 3 images. Switch to native amd64 (GitHub runners are x86_64). Fargate defaults to amd64 when runtimePlatform is not specified.

✅ #15 ci(deploy): trigger on workflow file changes +1 1mo ago self by EduardoCarone ↗ GitHub

Add `.github/workflows/deploy-staging.yml` to the paths filter so changes to the deploy workflow itself trigger the deploy.

✅ #14 ci(deploy): add migration job, fix ARM64 builds, remove :latest tags +219 -25 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## CI: Migration job + ARM64 fix

📝 Edu-Carone-SA makes Mike an admin-provisioned system 2 commits 1mo ago securityworkflow draft

This fork turns account access from self-service signup into a controlled administrative workflow.

📝 ECS deploy pipeline hardening: migrations, architecture, subnet fixes 4 commits 1mo ago minor change

✅ #13 MIKE-05: User Administration - admin-only user management +2,709 -275 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## MIKE-05: User Administration

✅ #12 MIKE-FIX-LLM: make DeepSeek the only production model and fix API key flow +510 -28 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## MIKE-FIX-LLM-PRODUCTION-02: make DeepSeek the only production model and fix API key flow

✅ #11 docs(sprint): MIKE-FIX-LLM-PRODUCTION-01 result +70 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

Sprint result documentation

✅ #10 MIKE-FIX-LLM-PRODUCTION-01: fix LLM key flow and model picker +64 -27 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## What

📝 Edu-Carone-SA puts DeepSeek in sole charge of Mike's AI 4 commits 1mo ago infrastructurechat-ui draft

This fork makes a decisive cost-and-simplicity bet by replacing its multi-provider model choice with DeepSeek alone.

✅ #9 feat(llm): add DeepSeek V4 Pro/Flash as LLM provider +462 -9 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## Summary

✅ #8 MIKE-04B: final fixes - E2E spec and signup disabled +90 -1 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## Final fixes for MIKE-04B

✅ #7 MIKE-04B: recover AWS staging frontend and S3 readiness +2,372 -32 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## MIKE-04B: Recover AWS Staging Frontend and S3 Readiness

⛔ #6 MIKE-04: deploy isolated AWS staging environment +1,686 -4 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## MIKE-04: AWS Staging Access

📝 Edu-Carone-SA brings Mike's staging stack in-house on AWS 2 commits 1mo ago infrastructuresecurity draft

This fork trades hosted building blocks for a self-managed staging environment designed to keep tighter control of deployment, access and spend.

✅ #5 MIKE-03: Authorization, tenancy and Row Level Security +2,958 -19 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## MIKE-03: Authorization, tenancy and Row Level Security

Show 27 more

✅ #4 MIKE-02 Part 2: Expanded quality gates, tests, E2E, templates and docs +3,119 -166 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

Complete Sprint 2 spec: backend ESLint, zero-warnings, 144 tests, Playwright E2E, coverage, ci-success aggregator, templates, docs, risk register. See commit history for details.

✅ #3 MIKE-02: Quality CI pipeline and security scanning +4,127 -1,671 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## Objective

📝 Edu-Carone-SA puts tenant walls around Mike's client data 1 commit 1mo ago securitymulti-tenant draft

This fork adds database-level checks intended to stop one organisation from seeing another's work.

📝 Edu-Carone-SA gives Mike a proper production safety net 2 commits 1mo ago securityinfrastructure draft

This fork is less about new legal-AI features and more about making changes safer to ship and easier to trust.

✅ #2 MIKE-01: Reproducible local development environment +5,387 -3,945 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

Sprint 1 deliverables: runtime pinning, env validation, Docker Compose, health/readiness, automation scripts, synthetic fixtures, tests, and documentation. See commit history for details.

✅ #1 MIKE-00: Foundation diagnostic and Sprint 0 deliverables +59,871 1mo ago self by EduardoCarone ↗ analysis ↗ GitHub

## Summary

📝 MIKE-01: reproducible local dev environment 1 commit 1mo ago minor change

📝 Edu-Carone-SA puts legal and security gates ahead of production 1 commit 1mo ago compliancesecurity draft

This fork starts with a clear message: no commercial rollout until its licensing and security risks are understood and closed.

📝 Edu-Carone-SA builds a staging front door, but it never ships 0 commits — infrastructuresecurity draft

The fork proposed a protected AWS test environment where the application and login flow could be tried before release.

📝 Edu-Carone-SA restores admin access and untangles a production routing clash 0 commits — securityinfrastructure draft

Two reported production failures had locked out administrators and sent browser pages to the wrong service.

📝 Edu-Carone-SA is making tabular review harder to fool 0 commits — workflowinfrastructure draft

The proposed fixes target a quiet but serious problem: a review can look complete even when the wrong documents, or no usable documents, reached the AI.

📝 Edu-Carone-SA puts Atlas through a production-readiness reality check 0 commits — securityinfrastructure draft

Before customising Mike for Atlas, this fork has drawn a firm line between local experimentation and safe production use.

📝 Establish a local development baseline 0 commits — minor change

📝 Edu-Carone-SA makes every proposed change clear a security gate 0 commits — securityworkflow draft

This fork moves quality checks from a developer's laptop into required controls before changes can reach the main branch.

📝 Complete Sprint 2 quality and CI coverage 0 commits — minor change

📝 Edu-Carone-SA puts hard walls between legal workspaces 0 commits — securitymulti-tenant draft

The fork now treats access to matter data as a first-class security boundary, not an assumption.

📝 Edu-Carone-SA gets Mike's AWS staging environment back on its feet 0 commits — infrastructureintegration draft

A deployment recovery turns a blocked test environment into a working platform for checking the product before wider release.

📝 Edu-Carone-SA closes Mike's staging front door 0 commits — securityworkflow draft

Public sign-ups are now shut off in the staging environment, with the login journey checked from browser to dashboard.

📝 Edu-Carone-SA brings DeepSeek into Mike's model lineup 0 commits — integrationworkflow draft

The fork adds two DeepSeek options, giving teams another route to AI-assisted legal work without treating compatibility as an afterthought.

📝 Edu-Carone-SA gets its legal-AI operations room working 0 commits — workflowanalytics draft

A QA repair pass fixes the gaps that made a live production run hard to trust or follow.

📝 Document sprint results 0 commits — minor change

📝 Edu-Carone-SA makes DeepSeek the one AI engine to watch 0 commits — infrastructuresecurity draft

This fork narrows production AI to a single provider while making key management more dependable for the people running it.

📝 Edu-Carone-SA puts Mike's user lifecycle behind an admin desk 0 commits — securityworkflow draft

This fork replaces open signup with controlled account management and a record of who changed what.

📝 Edu-Carone-SA makes Mike deployments safer to ship 0 commits — infrastructureworkflow draft

This fork turns deployment from a hopeful push into a sequence that checks the database and services are ready.

📝 Switch container builds to native amd64 0 commits — minor change

📝 Edu-Carone-SA fixes AWS task launches across multiple subnets 0 commits — infrastructure draft

A small configuration correction removes a hard stop for deployments that need more than one network segment.

📝 Edu-Carone-SA makes admin controls actually work 0 commits — workflowsecurity draft

A small request fix restores the basic account-management actions a legal AI team needs to run safely.

Threads of work (detailed view)

21 threads have been distilled into posts.

Edu-Carone-SA makes Mike an admin-provisioned system

This fork turns account access from self-service signup into a controlled administrative workflow.

securityworkflow

2 commits · latest 1mo ago

Edu-Carone-SA puts DeepSeek in sole charge of Mike's AI

This fork makes a decisive cost-and-simplicity bet by replacing its multi-provider model choice with DeepSeek alone.

infrastructurechat-ui

4 commits · latest 1mo ago

Edu-Carone-SA brings Mike's staging stack in-house on AWS

This fork trades hosted building blocks for a self-managed staging environment designed to keep tighter control of deployment, access and spend.

infrastructuresecurity

2 commits · latest 1mo ago

Edu-Carone-SA puts tenant walls around Mike's client data

This fork adds database-level checks intended to stop one organisation from seeing another's work.

securitymulti-tenant

1 commit · latest 1mo ago

Edu-Carone-SA gives Mike a proper production safety net

This fork is less about new legal-AI features and more about making changes safer to ship and easier to trust.

securityinfrastructure

2 commits · latest 1mo ago

Edu-Carone-SA puts legal and security gates ahead of production

This fork starts with a clear message: no commercial rollout until its licensing and security risks are understood and closed.

compliancesecurity

1 commit · latest 1mo ago

Pull requests (detailed view)

20 PRs touch this fork — inbound (filed against it) or outbound (filed from it). State icons match the editorial dashboard.

🟢 Open (2)

🟢 open · #20 fix(tabular): TR-02 to TR-05 bugs + SSE keepalive heartbeat

by EduardoCarone · opened 1mo ago

Edu-Carone-SA/mike ← Edu-Carone-SA/mike · +3,274 -93 · self · ↗ analysis · ↗ GitHub

🟢 open · #19 fix(infra): ALB routing + admin password reset

by EduardoCarone · opened 1mo ago

Edu-Carone-SA/mike ← Edu-Carone-SA/mike · +247 · self · ↗ analysis · ↗ GitHub