Critical Security Improvements:
- Created .rsyncignore with comprehensive exclusion patterns
- Prevents deployment of CLAUDE.md, .env.backup, session handoffs
- Prevents deployment of internal docs and framework state
- Created deploy-full-project-SAFE.sh with dry-run safety check
Security Response Actions:
- Deleted CLAUDE.md from production (contained port 27017, db names)
- Deleted .env.backup from production (contained credentials)
- Deleted 5+ session handoff documents from production
- Deleted internal planning docs (PHASE-2-*, SECURITY_AUDIT_REPORT)
Root Cause:
Previous deployment used rsync without exclusion filters, syncing
entire project directory including sensitive internal documentation.
Prevention:
- All future deployments must use .rsyncignore
- deploy-full-project-SAFE.sh enforces dry-run before deployment
- deploy-frontend.sh already safe (public/ only)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Security Validation Improvements:
- Added pm.me to allowed email domains (public contact email)
- Added code block detection to skip infrastructure patterns in examples
- Port numbers in markdown code blocks no longer flagged
- Fixes false positives blocking README.md sync
Workflow Improvements:
- Added issues:write permission to notify-failure job
- Fixes 403 error when creating failure notification issues
This allows the public README with code examples and contact info
to pass validation while still blocking actual security issues.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add professional README for public repository with code examples
- Fix all broken documentation links across 4 markdown files
- Add favicon to all HTML pages (eliminates 404 errors)
- Redesign Experience section with 4-card incident grid
- Add GitHub section to docs.html sidebar with repository links
- Migrate 4 new case studies to database (19 total documents)
- Generate 26 PDFs for public download
- Add automated sync GitHub Action for public repository
- Add security validation for public documentation sync
- Update docs-app.js to categorize research topics
Mobile responsive, accessibility compliant, production ready.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
**Cache-Busting Improvements:**
- Switched from timestamp-based to semantic versioning (v1.0.2)
- Updated all HTML files: index.html, docs.html, leader.html
- CSS: tailwind.css?v=1.0.2
- JS: navbar.js, document-cards.js, docs-app.js v1.0.2
- Professional versioning approach for production stability
**systemd Service Implementation:**
- Created tractatus-dev.service for development environment
- Created tractatus-prod.service for production environment
- Added install-systemd.sh script for easy deployment
- Security hardening: NoNewPrivileges, PrivateTmp, ProtectSystem
- Resource limits: 1GB dev, 2GB prod memory limits
- Proper logging integration with journalctl
- Automatic restart on failure (RestartSec=10)
**Why systemd over pm2:**
1. Native Linux integration, no additional dependencies
2. Better OS-level security controls (ProtectSystem, ProtectHome)
3. Superior logging with journalctl integration
4. Standard across Linux distributions
5. More robust process management for production
**Usage:**
# Development:
sudo ./scripts/install-systemd.sh dev
# Production:
sudo ./scripts/install-systemd.sh prod
# View logs:
sudo journalctl -u tractatus -f
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Deployment Strategy:
- Deploy all Koha infrastructure to production
- Keep user-facing functionality disabled until Stripe keys configured
- Allow backend testing and validation before payment processing activation
Changes:
- Add coming-soon-overlay.js component for Koha pages
- Add Stripe configuration check in koha.controller.js (returns 503 if PLACEHOLDER keys detected)
- Update all Koha HTML pages with coming soon overlay script
- Create comprehensive deployment guide (KOHA_PRODUCTION_DEPLOYMENT.md)
- Create automated deployment script (deploy-koha-to-production.sh)
Pre-Production Features:
- Database initialization ready (init-koha.js)
- API endpoints functional but protected
- Transparency dashboard returns empty data structure
- Coming soon overlay prevents user access to incomplete functionality
- All code deployed and testable
Activation Checklist:
- Configure live Stripe keys
- Remove coming-soon overlay scripts
- Remove PLACEHOLDER checks from controller
- Add navigation links to Koha pages
- Test end-to-end donation flow
Estimated Time to Activate: 2-3 hours once Stripe keys ready
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fixed download icon size (1.25rem instead of huge black icons)
- Uploaded all 12 PDFs to production server
- Restored table of contents rendering for all documents
- Fixed modal cards with proper CSS and event handlers
- Replaced all docs-viewer.html links with docs.html
- Added nginx redirect from /docs/* to /docs.html
- Fixed duplicate headers in modal sections
- Improved cache-busting with timestamp versioning
All documentation features now working correctly:
✅ Card-based document viewer with modals
✅ PDF downloads with proper icons
✅ Table of contents navigation
✅ Consistent URL structure
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Implemented complete backend API foundation with authentication, document
management, blog operations, and admin functionality. Added migration tools
for database seeding and document import.
**Controllers (4 files):**
- auth.controller.js: User authentication (login, getCurrentUser, logout)
- documents.controller.js: Document CRUD operations
- blog.controller.js: Blog post management with admin/public access
- admin.controller.js: Admin dashboard (stats, moderation queue, activity)
**Routes (5 files):**
- auth.routes.js: Authentication endpoints
- documents.routes.js: Document API endpoints
- blog.routes.js: Blog API endpoints
- admin.routes.js: Admin API endpoints
- index.js: Central routing configuration with API documentation
**Migration Tools (2 scripts):**
- seed-admin.js: Create admin user for system access
- migrate-documents.js: Import markdown documents with metadata extraction,
slug generation, and dry-run support. Successfully migrated 8 documents
from anthropic-submission directory.
**Server Updates:**
- Integrated all API routes under /api namespace
- Updated homepage to reflect completed API implementation
- Maintained security middleware (Helmet, CORS, rate limiting)
**Testing:**
✅ Server starts successfully on port 9000
✅ Authentication flow working (login, token validation)
✅ Document endpoints tested (list, get by slug)
✅ Admin stats endpoint verified (requires authentication)
✅ Migration completed: 8 documents imported
**Database Status:**
- Documents collection: 8 technical papers
- Users collection: 1 admin user
- All indexes operational
This completes the core backend API infrastructure. Next steps: build
Tractatus governance services (InstructionClassifier, CrossReferenceValidator,
BoundaryEnforcer).
🤖 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
