docs: refresh roadmap and setup guidance

PLAN.md

@@ -1,6 +1,6 @@
 # PLAN.md — OpenDevOps Agent Roadmap
 
-> An openv-source AWS DevOps Agent clone. Powered by OpenRouter LLMs.
+> An open-source AWS DevOps Agent clone. Powered by OpenRouter LLMs.
 > Investigate incidents, find root causes, ship fixes faster.
 
 ---
@@ -24,10 +24,23 @@ a community, maybe make AWS nervous enough to call.
 
 ---
 
+## Current Status Snapshot (May 2026)
+
+- Core platform is live on main: CLI, FastAPI API, streaming chat UI, Docker Compose, and PostgreSQL persistence.
+- Read-only AWS investigation toolset is in place across CloudWatch, CloudTrail, ECS, Lambda, EC2, RDS, and IAM.
+- run_bash_command (read-only AWS CLI / kubectl / docker) is implemented with allowlist validation and timeout.
+- MCP server support is implemented (devops-agent mcp) for external clients.
+- Slack webhook notifications and proactive polling are implemented.
+- Remaining roadmap items are mostly hardening, extensibility, and productization work.
+
+---
+
 ## Phase 1 — Solid Foundation (MVP) 🏗️
 
 **Goal:** A working CLI agent that can investigate a described incident using AWS data.
 
+**Status:** Delivered on main
+
 **Duration estimate:** 1–2 weeks solo
 
 ### Deliverables
@@ -50,6 +63,8 @@ a community, maybe make AWS nervous enough to call.
 
 **Goal:** The agent understands *your* environment, not just individual services.
 
+**Status:** Partially delivered (logs insights, ask/report modes, history persistence)
+
 ### Features
 - **Application topology mapping** — auto-discover how services connect
   (e.g., API Gateway → Lambda → DynamoDB)
@@ -70,6 +85,8 @@ a community, maybe make AWS nervous enough to call.
 
 **Goal:** Fit into existing DevOps workflows without friction.
 
+**Status:** Partially delivered (Slack integration complete; PagerDuty/GitHub pending)
+
 ### Features
 - **Slack webhook output** — post investigation findings to a channel
 - **PagerDuty trigger input** — auto-start investigations from PD alerts
@@ -200,13 +217,11 @@ a community, maybe make AWS nervous enough to call.
 
 ## Immediate Next Steps (This Week)
 
-1. `uv init opendevops-agent` — create the project
-2. Implement `tools/cloudwatch.py` first (most useful, easiest to mock)
-3. Write the system prompt in `agent/prompts.py`
-4. Build the bare minimum agent loop in `agent/core.py`
-5. Wire up `devops-agent investigate` CLI command
-6. Test with a real CloudWatch alarm from your AWS account
-7. Record a demo GIF for the README
+1. Add CI smoke test for docker compose up plus API/UI health checks.
+2. Add secret-scanning in CI and rotate any exposed credentials.
+3. Finish soft-delete cleanup job (or explicitly document it as product-only backlog).
+4. Implement Bash sandbox Phase 2 (isolated throwaway container runtime).
+5. Add context-aware tool loading to reduce unnecessary tool exposure per investigation.
 
 ---
 

README.md

@@ -64,11 +64,11 @@ docker run -d --name opendevops-pg \
   -e POSTGRES_DB=opendevops \
   -e POSTGRES_USER=dev \
   -e POSTGRES_PASSWORD=dev \
-  -p 5432:5432 \
+  -p 5433:5432 \
   postgres:16
 
 # Add to .env
-echo "DATABASE_URL=postgresql://dev:dev@localhost:5432/opendevops" >> .env
+echo "DATABASE_URL=postgresql://dev:dev@localhost:5433/opendevops" >> .env
 
 # Create tables (safe to re-run)
 uv run python scripts/setup_db.py
@@ -86,6 +86,7 @@ the full schema reference.
 docker compose up --build
 # Backend: http://localhost:8000
 # Frontend: http://localhost:80
+# Postgres (host): localhost:5433
 ```
 
 The backend image installs AWS CLI v2 automatically — the bash execution tool
@@ -151,11 +152,12 @@ src/
 ├── cli/               # Typer CLI commands
 └── integrations/      # Future: Slack, PagerDuty
 frontend/
-└── index.html         # Chat UI — sidebar, live tool calls, cost card
+└── src/               # React UI source (Vite)
 migrations/
 └── 001_initial.sql    # App schema (sessions, messages, tool_calls, usage_events)
 scripts/
-└── setup_db.py        # One-shot DB setup (runs migrations + LangGraph checkpointer)
+├── setup_db.py        # One-shot DB setup (runs migrations + LangGraph checkpointer)
+└── test_db_connection.py # DB connectivity smoke test (.env-driven)
 docs/
 └── schema.md          # Full schema reference with ER diagram
 ```
@@ -192,7 +194,8 @@ docs/
 - [x] **Multi-provider LLM support** — 100+ providers via LiteLLM; swap models with a single `LLM_MODEL` env var change; supports OpenRouter, Anthropic, OpenAI, Groq, Ollama, and any OpenAI-compatible endpoint; see [docs/llm_providers.md](docs/llm_providers.md)
 - [x] **MCP integration** — expose the agent as an MCP server (`devops-agent mcp`); `investigate`, `ask`, and `list_sessions` tools available in Claude Desktop, Cursor, or any MCP-compatible client; stdio and HTTP+SSE transports; see [docs/mcp_server.md](docs/mcp_server.md)
 - [ ] **Custom tools via URL** — register external tools by pointing at an OpenAPI/HTTP endpoint; agent discovers and calls them alongside built-in AWS tools
-- [ ] **Bash sandbox + AWS CLI tool** — expose a sandboxed `run_aws_cli(command)` escape-hatch tool alongside the 19 structured tools; read-only enforcement via per-org IAM role (`List*`/`Get*`/`Describe*` only); covers the long tail of AWS CLI commands no predefined tool handles; per-org credential isolation via scoped profiles
+- [x] **Bash CLI escape hatch (Phase 1)** — `run_bash_command` is implemented for read-only AWS CLI, kubectl, and docker commands with strict allowlist validation and timeout.
+- [ ] **Bash sandbox Phase 2** — run each bash command in an isolated throwaway container (`--network none`, read-only FS, non-root, resource limits).
 - [ ] **Optimize tool loading** — pass only relevant tools per investigation context instead of the full 19-tool set
 - [ ] **Message middleware pipeline** — compaction, summarization, intent detection, context trimmer
 - [ ] **Guardrails** — input/output validation, PII scrubbing, query scope enforcement