MIKE-00: Foundation diagnostic and Sprint 0 deliverables

From the PR description

Summary

Sprint 0 - Foundation Diagnostic for the Atlas internal deployment of Mike OSS.

This PR delivers the due-diligence baseline required before any code customization, infrastructure provisioning, or production work. It contains only documentation, SBOM artifacts, and analysis; no business logic was changed.

What was done

• Forked Open-Legal-Products/mike to Edu-Carone-SA/mike.
• Configured upstream remote and recorded baseline SHA.
• Inventoried stack, env vars, routes, schema, and dependencies.
• Generated CycloneDX SBOMs for backend (402 components) and frontend (1,233 components).
• Ran secret scan (gitleaks), dependency audit (npm audit), and SAST (semgrep).
• Created current-state and target-state architecture documents.
• Created initial STRIDE threat model with P0-P3 risk register.
• Analyzed upstream open issues and PRs (83 issues / 38 PRs).
• Authored ADRs: hosting strategy, Supabase strategy, storage strategy, AGPL compliance.
• Created legal validation request for AGPL-3.0.

Key findings

P0 risks (must close before production)

1. No Row Level Security on core tenant tables (upstream issue #144; only 6 auxiliary tables have RLS). A leaked Supabase service key would expose all data.
2. Raw LLM prompts/completions can be logged to disk via RAW_LLM_STREAM_LOG_DIR / LOG_RAW_LLM_STREAM.
3. /case-law/case-opinions is unauthenticated.
4. AGPL-3.0 legal interpretation pending before any external user access.

P1 risks

• Email-only project sharing with no organization/role model.
• Download tokens are non-expiring.
• No audit trail for sensitive operations.
• 100 MB in-memory uploads and unbounded LibreOffice conversion.
• High-severity vulnerabilities in tmp, protobufjs, ws, undici.

Architecture decisions

• Hosting: Option A - AWS ECS Fargate + managed Supabase + Amazon S3 + CloudFront/WAF.
• Supabase: managed in Phase 1; self-host or replacement deferred to Phase 2E if required.
• Storage: migrate from R2 to Amazon S3 private with SSE-KMS and IAM Task Roles.
• AGPL: preserve all notices and seek legal sign-off before go-live.

Artifacts included

artifacts/
  sbom-backend.json
  sbom-frontend.json
docs/
  architecture/current-state.md
  architecture/target-state.md
  security/threat-model.md
  upstream/BASELINE.md
  upstream/ISSUES-PRS-ANALYSIS.md
  adr/ADR-001-hosting-strategy.md
  adr/ADR-002-supabase-strategy.md
  adr/ADR-003-storage-strategy.md
  adr/ADR-004-agpl-compliance.md
  legal/AGPL-VALIDATION-REQUEST.md
.gitattributes

Verdict

READY to start Sprint 1 (local development reproducibility).

Production is explicitly NO-GO until the P0 risks above are remediated and the Security Gate (Sprint 14) is approved.

Checklist

• Fork created and upstream remote preserved
• Branch protection recommended in target-state doc (will be applied in Sprint 2)
• Baseline SHA documented
• Endpoint and schema inventories
• Threat model with P0-P3 risks
• SBOMs generated and versioned
• ADRs authored
• AGPL validation request submitted for legal review
• No real data used
• All changes are documentation/artifacts only

Next steps

1. Legal review of docs/legal/AGPL-VALIDATION-REQUEST.md.
2. Merge this PR.
3. Begin Sprint 1: sprint/MIKE-01-LOCAL-DEVELOPMENT.