Final

Create new / review existing

1 · Home Setup

2 · Devices

3 · Network

4 · Goals

5 · Review

Passphrase set client-side → encrypted .hassar file downloaded

Revision — "Other (custom)" on every choice field

Every chip/tile selection in the wizard (house type, rooms, brands, per-brand devices, network protocols, goals) now has an "+ Other" option to type a custom value, so the wizard never limits the customer to the preset list.

1 · Home Setup — custom house type + room

2 · Devices — custom brand + per-brand device

3 · Network — custom protocol

4 · Goals — custom goal

• ✓ Blueprint encrypted client-side (AES-256-GCM, PBKDF2-SHA256, 390,000 iterations) — passphrase and plaintext never leave the browser
• ✓ Server stores only a SHA-256 hash + file size for ownership — never blueprint content
• ✓ JWT auth — short-lived access token + httpOnly refresh cookie
• ✓ Account lockout after 5 failed logins (15 min)
• ✓ Anti email-enumeration on registration
• ✓ Rate limiting on all auth and chat endpoints
• ✓ CORS allowlist — no wildcard origins
• ✓ Role-gated admin routes (RBAC)
• ✓ Non-root Docker container
• ✓ Semgrep static scan — clean
• ✓ Promptfoo LLM red-team — all jailbreak/PII/prompt-extraction attempts refused

• ✓ Frontend live — Next.js on Cloudflare Pages (hassar.ai)
• ✓ Backend live — FastAPI, client's own server (backend.hassar.ai)
• ✓ AGIM connected — api.hassar.ai routed correctly, Jim responding end-to-end
• ✓ Behaviour rules live in AGIM's own system prompt; HASSAR.AI only forwards messages and blueprint context
• ✓ HASSAR.AI fallback prompt kept minimal — only used if AGIM is offline