[AZ-185][AZ-186] Batch 2

Made-with: Cursor

_docs/03_implementation/batch_01_report.md

@@ -1,18 +1,24 @@
 # Batch Report
 
 **Batch**: 1
-**Tasks**: 01_test_infrastructure
-**Date**: 2026-04-13
+**Tasks**: AZ-182, AZ-184, AZ-187
+**Date**: 2026-04-15
 
 ## Task Results
 
 | Task | Status | Files Modified | Tests | AC Coverage | Issues |
 |------|--------|---------------|-------|-------------|--------|
-| 01_test_infrastructure | Done | 12 files | 1/1 pass | 5/5 ACs (AC-1,2,3 require Docker) | None |
+| AZ-182_tpm_security_provider | Done | 8 files | 8 pass (1 skip without swtpm) | 6/6 ACs covered | None |
+| AZ-184_resumable_download_manager | Done | 2 files | 8 pass | 5/5 ACs covered | None |
+| AZ-187_device_provisioning_script | Done | 3 files | 5 pass | 5/5 ACs covered | None |
 
-## AC Test Coverage: 5/5 covered (3 require Docker environment)
-## Code Review Verdict: PASS (infrastructure scaffold, no logic review needed)
+## Excluded
+
+AZ-183 (Resources Table & Update API) — admin API repo, not this workspace.
+
+## AC Test Coverage: All covered (16/16)
+## Code Review Verdict: PASS_WITH_WARNINGS
 ## Auto-Fix Attempts: 0
 ## Stuck Agents: None
 
-## Next Batch: 02_test_health_auth
+## Next Batch: AZ-185, AZ-186 (Batch 2 — 8 points)

_docs/03_implementation/batch_02_report.md

@@ -1,28 +1,19 @@
 # Batch Report
 
 **Batch**: 2
-**Tasks**: 02_test_health_auth
-**Date**: 2026-04-13
+**Tasks**: AZ-185, AZ-186
+**Date**: 2026-04-15
 
 ## Task Results
 
 | Task | Status | Files Modified | Tests | AC Coverage | Issues |
 |------|--------|---------------|-------|-------------|--------|
-| 02_test_health_auth | Done | 2 files | 6 tests | 5/5 ACs covered | None |
+| AZ-185_update_manager | Done | 4 files | 10 pass | 6/6 ACs covered | None |
+| AZ-186_cicd_artifact_publish | Done | 3 files | 8 pass | 5/5 ACs covered | None |
 
-## AC Test Coverage: All covered
-
-| AC | Test | Status |
-|----|------|--------|
-| AC-1: Health returns 200 | test_health_returns_200 | Covered |
-| AC-2: Status unauthenticated | test_status_unauthenticated | Covered |
-| AC-3: Login valid | test_login_valid_credentials | Covered |
-| AC-4: Login invalid | test_login_invalid_credentials | Covered |
-| AC-5: Login empty body | test_login_empty_body | Covered |
-| AC-2+3: Status authenticated | test_status_authenticated_after_login | Covered |
-
-## Code Review Verdict: PASS
+## AC Test Coverage: All covered (11/11)
+## Code Review Verdict: PASS_WITH_WARNINGS
 ## Auto-Fix Attempts: 0
 ## Stuck Agents: None
 
-## Next Batch: 03_test_resources, 04_test_unlock, 05_test_resilience_perf (parallel)
+## Next Batch: All tasks complete

_docs/03_implementation/reviews/batch_02_review.md

@@ -0,0 +1,41 @@
+# Code Review Report
+
+**Batch**: 2 (AZ-185, AZ-186)
+**Date**: 2026-04-15
+**Verdict**: PASS_WITH_WARNINGS
+
+## Spec Compliance
+
+All 11 acceptance criteria across 2 tasks are satisfied with corresponding tests.
+
+| Task | ACs | Covered | Status |
+|------|-----|---------|--------|
+| AZ-185 Update Manager | 6 | 6/6 | All pass (10 tests) |
+| AZ-186 CI/CD Artifact Publish | 5 | 5/5 | All pass (8 tests) |
+
+## Findings
+
+| # | Severity | Category | File:Line | Title |
+|---|----------|----------|-----------|-------|
+| 1 | Low | Style | scripts/publish_artifact.py | Union syntax fixed |
+| 2 | Low | Maintainability | src/main.py:15 | Deprecated on_event startup |
+
+### Finding Details
+
+**F1: Union syntax fixed** (Low / Style)
+- Location: `scripts/publish_artifact.py:172,182`
+- Description: Used `list[str] | None` syntax, fixed to `Optional[List[str]]` for consistency
+- Status: Fixed
+
+**F2: Deprecated on_event startup** (Low / Maintainability)
+- Location: `src/main.py:15`
+- Description: `@app.on_event("startup")` is deprecated in modern FastAPI in favor of lifespan context manager
+- Suggestion: Migrate to `@asynccontextmanager lifespan` when upgrading FastAPI — not blocking
+- Task: AZ-185
+
+## Cross-Task Consistency
+
+- AZ-185 uses AZ-184's `ResumableDownloadManager` correctly via its public API
+- AZ-186 encrypt format (IV + AES-CBC + PKCS7) is compatible with AZ-184's `decrypt_cbc_file()`
+- AZ-186's `encryption_key` is hex-encoded; AZ-185's `_aes_key_from_encryption_field` handles hex decoding
+- Self-update ordering (loader last) correctly implemented in AZ-185