P1: Ship Parker, the reporting and executive briefing agent

[jusso-dev]

Mission

Parker turns authoritative Muster and Kelpie history into accurate operational reports and executive briefings. It must never invent metrics or incident facts.

Responsibilities

• Produce weekly/monthly SOC briefs and incident executive updates.
• Calculate MTTA, time to investigation, time to promotion, approval wait, MTTR, recurrence and workflow/agent failure rates.
• Explain metric definitions, population, exclusions, timezone and comparison period.
• Summarise recurring threats, affected business services, response outcomes and unresolved risk.
• Produce audience modes: analyst detail, incident leadership and executive brief.
• Link every number and material statement to underlying queries/cases/decisions.
• Draft email/Markdown output; sending remains an approved external action.

Boundaries

• Query deterministic aggregates before prose generation.
• Distinguish unavailable, zero and not applicable.
• Apply TLP/classification rules and redact evidence from executive output.
• No fabricated trend when sample size is inadequate.

Acceptance criteria

• Parker ships as a clean-install agent assignable from Tasks.
• Typed ReportManifest includes period, filters, metric definitions, values, source references, narrative and caveats.
• Analyst can reproduce every metric via stored query parameters.
• Report can be reviewed/versioned and posted to a room.
• Email dispatch requires explicit approval and records delivery result.
• Governed learning captures approved reporting preferences without changing permissions.

Verification

• Known dataset with exact expected metrics.
• Boundary/timezone/empty-period tests.
• Classification/redaction tests.
• Playwright task-to-report review flow.

[jusso-dev]

Implemented, deployed, and live-proved Parker end to end.

Delivered:

• Deterministic, typed report manifests with authoritative source references, query parameters, caveats, and version history.
• Async Parker execution outside HTTP handlers, organisation-scoped queries, idempotency, leases, replay protection, and gateway routing.
• Review, room posting, scheduling, and governed reporting preferences.
• Approval-gated SMTP delivery with internal-only classification, exact-recipient checks, terminal failure handling, and auditable delivery state.
• Server-side capability checks, append-only audit/outbox records, and transactional state changes.
• Concurrency, cross-organisation, replay, restricted-export, SMTP-acceptance, and approval-execution regression coverage.

Validation:

• Full monorepo pnpm check: green across all 22 packages.
• PostgreSQL worker integration: 8/8, including concurrent replay and terminal authentication failure.
• Parker web integration: 2/2, including approved email queue/outbox execution.
• Local isolated Parker Playwright: 2/2.
• Final CI: https://github.com/jusso-dev/Muster/actions/runs/30231748183
• Final security/supply-chain: https://github.com/jusso-dev/Muster/actions/runs/30231748178

Deployment proof:

• Main revision: e13bb3b56d68b2e453793e757e85451aab5fb434
• Image: ghcr.io/jusso-dev/muster:sha-e13bb3b
• Image ID: sha256:8f34bcfe021343d800869f6f4c28889ba4510caafb948c2da4bb95992ff9e734
• Homelab web, worker, and agent-gateway: healthy, zero restarts.
• Pre-deploy database backup: /home/justinmiddler/muster/backups/issue16-pre-cd84364-20260727T0205Z.dump
• Backup SHA-256: 888e14d324d984eb6938bf3c722e116cc5e4c5670714728d8c7494604f739fb7
• Post-proof counts: rooms 26, messages 170, tasks 29, agent runs 25, audit events 606, outbox events 460, report manifests 5, report deliveries 3.

Authenticated live proof passed the complete deployed journey: synthetic executive task -> async Parker manifest -> review -> approved email -> worker delivery -> Mailpit receipt -> room post -> version 2 -> Parker settings. Two fresh synthetic deliveries were accepted and recorded as delivered. The earlier failed synthetic approval remains preserved as audit evidence of the live routing defect fixed by e13bb3b.