Implemented improvements from AUDIT_ANALYTICS_IMPROVEMENTS.md:
1. Added Service Health (24h) section:
- Shows which services are healthy (allowed, no violations)
- Green/red status indicators per service
- Displays allowed, blocked, and violation counts
2. Added Violations & Blocks (7 days) section:
- Long-term view of violations and blocks
- Shows only days with issues
- Displays "No violations" message when clean
- Lists services involved in violations
3. Fixed Timeline Chart with proper time bucketing:
- Replaced broken hour-of-day aggregation
- Added 3 modes: 6-hourly (24h), Daily (7d), Weekly (4w)
- Proper date-based bucketing instead of hour grouping
- Interactive mode switching with CSP-compliant event delegation
4. Simplified Recent Decisions table:
- Reduced from 50 to 10 most recent decisions
- Updated heading to clarify scope
All changes are CSP-compliant (no inline styles/handlers, Tailwind only).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Phase 2: Cultural Sensitivity Admin UI
- Display cultural sensitivity analysis results in admin interfaces
- Visual indicators for risk levels (LOW/MEDIUM/HIGH)
- Show concerns and suggested adaptations to human reviewers
- Human-in-the-loop workflow: AI flags, human decides
Implementation:
1. Media Inquiry Admin (public/js/admin/media-triage.js:435-503)
- Cultural Sensitivity Analysis section in inquiry details modal
- Shows risk level with color-coded badges (green/yellow/red)
- Lists cultural concerns with context
- Displays suggested adaptations
- Framework compliance note: "AI flags concerns but never blocks"
- Appears after response is created (response.cultural_sensitivity)
2. Blog Curation Admin (public/js/admin/blog-curation.js:371-398)
- Cultural risk badge in blog post queue list
- Color-coded by risk level (LOW=green, MEDIUM=yellow, HIGH=red)
- HIGH risk shows "⚠️ Human review recommended"
- Lists cultural concerns inline
- Shows count of suggested adaptations
- Appears after publish (moderation.cultural_sensitivity)
UI Features:
- 🌍 Cultural Sensitivity icon for visibility
- Risk-based color coding (traffic light pattern)
- Expandable concern details
- Suggested adaptations inline
- Timestamps for audit trail
- Non-blocking workflow (flags for review, doesn't prevent action)
Human Approval Workflow:
- Existing respond() API already stores cultural_sensitivity data
- Existing publish() API already stores cultural_sensitivity data
- UI displays flags and suggestions
- Human reviewer makes final decision (inst_081 pluralism)
- No new endpoints needed - workflow integrated into existing approval flow
Next: Deploy Phase 2, monitor Phase 3 daily reminders for learning/refinement
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Problem:
- nginx serves blog.html as static file, bypassing Express middleware
- setCsrfToken middleware never runs
- No CSRF cookie set
- Newsletter subscription fails with 403 Forbidden
Root cause:
nginx config: 'try_files $uri @proxy' serves static files directly
Location: /etc/nginx/sites-available/tractatus (line 54)
Solution:
1. blog.js now fetches CSRF token via /api/csrf-token on page load
2. getCsrfToken endpoint now creates token if missing (for static pages)
3. Newsletter form uses fetched token for subscription
Testing:
✅ Local test: CSRF token fetched successfully
✅ Newsletter subscription: Creates record in database
✅ Verified: test-fix@example.com subscribed via curl test
Impact:
- Newsletter subscriptions now work on production
- Fix applies to all static HTML pages (blog.html, etc.)
- Maintains CSRF protection security
Files:
- public/js/blog.js: Added fetchCsrfToken() + use in newsletter form
- src/middleware/csrf-protection.middleware.js: Enhanced getCsrfToken()
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Root cause: MongoDB ObjectId objects were being inserted into data-id
attributes as '[object Object]' instead of their string representation.
Fix: Explicitly call String() on sub._id when creating data attributes.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Updated cache version parameter to force browsers to reload
the fixed newsletter-management.js file with the DELETE button fix.
Previous fix was deployed but browsers were serving old cached version.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
CRITICAL FIX: Automatic cache invalidation for admin JavaScript files.
Root cause: Service worker and browser cache serving stale admin files
even after deploying fixes. Users had to manually clear cache daily.
Changes:
1. Service Worker (v0.1.2):
- Added NEVER_CACHE_PATHS for /js/admin/, /api/, /admin/
- These paths now ALWAYS fetch from network, never cache
- Bumped version to trigger cache clear on all clients
2. Server-side Cache Control:
- Added Cache-Control: no-store headers for admin/API paths
- Added Pragma: no-cache and Expires: 0 for belt-and-suspenders
- Prevents browser AND proxy caching
This ensures:
- Admin JavaScript updates deploy immediately
- API responses are never stale
- No more manual cache clearing required
Testing:
- Admin files will now always be fresh from server
- Service worker will auto-update to v0.1.2 on next visit
- Browsers will respect no-cache headers going forward
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Updated architecture.html to use new cache-busting version 0.1.0.1761283486841
to force browser reload of fixed interactive-diagram.js.
This file was missed by the automated cache update script.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Updated cache-busting version to force browser reload of fixed JavaScript.
Root cause: Browser serving cached version of newsletter-management.js
with old arrow function bug, even though production file had the fix.
Changes:
- Bumped version to 0.1.0.1761283486841 across all HTML files
- Updated public/admin/newsletter-management.html (missed by auto-script)
- Updated version.json and service worker
Related fix: Newsletter DELETE button sending [object Object]
Fixed in commit edb1540 but cached version prevented fix from loading.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add new 'CRM & Communications' section for contact/inquiry management
- Add Editorial Guidelines to Content Management
- Add Credential Vault to System & Framework
- Reorganize for future unified CRM across all projects
CRITICAL FIX: Newsletter subscription was returning "Forbidden" error
because the CSRF protection was incorrectly configured.
Root cause:
- CSRF cookie was set with httpOnly: true
- JavaScript cannot read httpOnly cookies
- Frontend couldn't extract token to send in X-CSRF-Token header
- Double-submit CSRF pattern requires client to read the cookie
Changes:
- csrf-protection.middleware.js: Set httpOnly: false (required for double-submit pattern)
- blog.js: Extract CSRF token from cookie and include in X-CSRF-Token header
Security Note: This is the correct implementation per OWASP guidelines
for double-submit cookie CSRF protection. The cookie is still protected
by SameSite: strict and domain restrictions.
Fixes: #newsletter-subscription-forbidden-mobile
CRITICAL FIX: Economist submission package was showing no data because
the frontend was storing the entire API response wrapper instead of
extracting the actual post and submission data.
Changes:
- submission-modal-enhanced.js: Extract .post from blog API response
- submission-modal-enhanced.js: Extract .data from submissions API response
- publications.routes.js: Restore original routes and add /targets endpoint
- Cache version bumped to force browser updates
Fixes: #economist-submission-data-missing
Created comprehensive Editorial Guidelines Manager to display all 22
publication targets with detailed submission requirements:
**New Page:** `/admin/editorial-guidelines.html`
- Display all publication targets in filterable grid
- Filter by tier, type, language, region
- Show submission requirements (word counts, language, exclusivity)
- Display editorial guidelines (tone, focus areas, things to avoid)
- Contact information (email addresses, response times)
- Target audience information
**Backend:**
- Added GET /api/publications/targets endpoint
- Serves publication targets from config file
- Returns 22 publications with all metadata
**Frontend:**
- Stats overview (total, premier, high-value, strategic)
- Publication cards with color-coded tiers
- Detailed requirements and guidelines display
- Responsive grid layout
This provides centralized access to submission guidelines for all
target publications including The Economist, Le Monde, The Guardian,
Financial Times, etc. Previously this data was only in the config
file and not accessible through the admin interface.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Fixed 401 Unauthorized errors in blog validation/submission modal:
- Added Authorization Bearer token to /api/blog/admin/:id fetch (line 153)
- Added Authorization Bearer token to /api/submissions/by-blog-post/:id fetch (line 162)
- Added Authorization Bearer token to /api/submissions/:id/export fetch (line 818)
All admin API endpoints require authentication. The submission modal
was making unauthenticated requests, causing 401 errors when trying
to load article data or export submission packages.
The 404 error on by-blog-post is expected when no submission exists
for that blog post ID yet.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Fixed invalid CSS property 'justify-center;' on line 486 of
tractatus-theme.css. Changed to correct CSS property:
'justify-content: center;'
This was causing Firefox console errors:
"Unknown property 'justify-center;'. Declaration dropped."
The error was in the .loading-overlay class which is used for
loading states across admin pages. The invalid property prevented
proper centering of loading spinners on mobile devices.
Also regenerated minified CSS (39.4% size reduction: 24KB → 15KB).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Fixed inconsistent cache version parameters across admin pages.
All HTML files now use v=0.1.0.1761262254119 to ensure mobile
browsers fetch fresh assets.
Changes:
- Updated all 12 admin HTML files to consistent cache version
- Updated all 17 public HTML files via update-cache-version script
- Service worker version: 0.1.1
- Version.json: 0.1.1
This ensures service worker cache invalidation triggers properly
and all pages reference matching asset versions.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Updated service worker cache version from 0.1.1 to 0.1.2 to force
mobile browsers to invalidate old cached assets. This ensures users
see the latest calendar.js with enhanced error handling.
Also updated version.json to match with relevant changelog entries
for mobile calendar fixes and DeepL integration.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Added cache: 'no-store' to prevent cached 500 errors
- Enhanced error messages with status codes
- Display detailed error messages to user
- Log API response text for debugging
- Helps diagnose mobile loading issues
Frontend:
- Add translate button click handler in submission-modal-enhanced.js
- Display loading state during translation (⏳ Translating...)
- Update French textarea with translated content
- Auto-update word counts after translation
- Show success message with DeepL attribution
Backend:
- Add POST /api/submissions/:id/translate endpoint
- Integrate Translation.service (DeepL)
- Save translations to SubmissionTracking.documents
- Mark translations as 'translatedBy: deepl', 'approved: false'
- Return translated text with caching metadata
Complete Translation Flow:
1. User clicks 'Translate EN → FR' button
2. Frontend sends English text to /api/submissions/:id/translate
3. Backend calls DeepL API via Translation.service
4. Translation cached for 24 hours
5. Result saved to submission.documents[docType].versions[]
6. French textarea populated with translation
7. User can review/edit before saving submission
Next: Configure DEEPL_API_KEY in .env to enable translations
- Display English and French versions side-by-side for all documents
- Add 'Translate EN → FR' button using DeepL
- Show word counts for each language version
- Display translation metadata (translatedBy, approved status)
- Mark primary language for each document
- Support readonly mode for blog-linked content
Documents tab now shows:
- Main Article (EN/FR)
- Cover Letter (EN/FR)
- Author Bio (EN/FR)
- Pitch Email (EN/FR)
Next: Add translation button click handler and API endpoint
**GOVERNANCE RULE**: Tractatus uses DeepL API ONLY for all translations.
NEVER use LibreTranslate or any other translation service.
Changes:
- Created Translation.service.js using proven family-history DeepL implementation
- Added DEEPL_API_KEY to .env configuration
- Installed node-cache dependency for translation caching
- Supports all SubmissionTracking schema languages (en, fr, de, es, pt, zh, ja, ar, mi)
- Default formality: 'more' (formal style for publication submissions)
- 24-hour translation caching to reduce API calls
- Batch translation support (up to 50 texts per request)
Framework Note: Previous attempt to use LibreTranslate was a violation of
explicit user instruction. This has been corrected.
Signed-off-by: Claude <noreply@anthropic.com>
- Add data-is-standalone flag to manage-submission buttons
- Create openStandaloneSubmissionModal function for packages without blog posts
- Update renderOverviewTab to handle null article (standalone submissions)
- Display standalone submission notice with purple badge
- Load submission data directly via /api/submissions/{id}
- Differentiate UI labels (Submitted vs Published dates)
- Files modified: blog-validation.js, submission-modal-enhanced.js
- Add cache: 'no-store' to all apiCall functions in admin JS files
- Prevents browser fetch cache from serving stale error responses
- Addresses submissions endpoint 500 errors that weren't appearing in server logs
- Killed duplicate server process (PID 1583625)
- Added debug logging to submissions controller
- Files modified: blog-validation.js, blog-curation.js, blog-curation-enhanced.js
- Updated to v0.1.1 to force browser refresh
- Ensures users get fixed submissions controller code
- Removed BlogPost populate() calls that caused 500 errors
- Added detailed console logs to track submission loading
- Check if API response is ok
- Log all submissions found
- Log filtering logic for standalone submissions
- Cache version updated
- Modified loadValidationArticles() to load standalone submissions (no blogPostId)
- Updated rendering to handle both blog posts and standalone packages
- Fixed API endpoint from /api/blog/posts/:id to /api/blog/admin/:id
- Standalone packages show with purple 'STANDALONE PACKAGE' badge
- Button text changes to 'View Package' for standalone submissions
- Cache version bumped to 0.1.1
- Enhanced update-cache-version.js to update service worker and version.json
- Added inst_075 governance instruction (HIGH persistence)
- Integrated cache check into deployment script (Step 1/5)
- Created CACHE_MANAGEMENT_ENFORCEMENT.md documentation
- Bumped version to 0.1.1
- Updated all HTML cache parameters
BREAKING: Deployment now blocks if JS changed without cache update
- Create Economist SubmissionTracking package correctly:
* mainArticle = full blog post content
* coverLetter = 216-word SIR— letter
* Links to blog post via blogPostId
- Archive 'Letter to The Economist' from blog posts (it's the cover letter)
- Fix date display on article cards (use published_at)
- Target publication already displaying via blue badge
Database changes:
- Make blogPostId optional in SubmissionTracking model
- Economist package ID: 68fa85ae49d4900e7f2ecd83
- Le Monde package ID: 68fa2abd2e6acd5691932150
Next: Enhanced modal with tabs, validation, export
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add comprehensive About page emphasizing moral philosophy foundation over organizational theory. PluralisticDeliberationOrchestrator positioned as primary research focus. Te Tiriti o Waitangi content integrated to establish indigenous data sovereignty principles.
Also implements auto-compact tracking system to gather empirical data on Claude Code context compression events, enabling future heuristic predictions.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Frontend Maintenance:
- Updated cache-busting version parameters on all script/CSS links
- researcher.html: Version updates for navbar, i18n, scroll-animations
- implementer.html: Version updates for components
- leader.html: Version updates for components
- i18n-simple.js: Updated internationalization utility
These version updates ensure users get fresh content after website
audit deployment and prevent stale cache issues.
All changes deployed to production and verified working.
- Converted all 9 accordion divs to semantic <button> elements
- Added ARIA attributes: aria-expanded, aria-controls, id for each button
- Accordion content: role="region" and aria-labelledby for screen readers
- Keyboard support: Enter and Space keys toggle accordions (WAI-ARIA pattern)
- Mobile optimization: 44px/48px touch targets, touch-action: manipulation
- iOS tap feedback: -webkit-tap-highlight-color
- Footer i18n: No footer object in leader.json (uses common.json correctly)
- Updated leader-page.js with keyboard handlers and ARIA state management
- Version 1.5.0
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Added diagrams from public tractatus-framework repo: architecture-main-flow.svg (6.6KB), trigger-decision-tree.svg (6.7KB)
- Diagram sizing: max-width 600px for readable display, responsive width 100%
- Fixed skip link: Added <main id="main-content"> wrapper for proper accessibility
- Quick navigation: 44px touch targets, flex-wrap for mobile, aria-label="Page sections"
- Download buttons: Descriptive ARIA labels, 44px minimum height
- Code blocks: Added role="region" and descriptive ARIA labels to all 6 service examples
- Mobile optimization: -webkit-overflow-scrolling, 11px code font on small screens, 16px body prevents iOS zoom
- API examples verified accurate against actual BoundaryEnforcer.service.js implementation
- CSP compliance: Moved diagram sizing to CSS class instead of inline styles
- Version 1.4.0
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Full WCAG accessibility: ARIA attributes (aria-expanded, aria-controls), keyboard navigation (Enter/Space)
- Reframed research context: Berlin/Weil as primary intellectual foundation (moral pluralism, categorical imperative)
- Bibliography with proper academic citations: Weil (The Need for Roots, Gravity and Grace), Berlin (Four Essays on Liberty)
- Fixed footer i18n: Implemented recursive deepMerge() to preserve nested translation objects
- Root cause: Shallow merge {...obj1, ...obj2} was overwriting entire footer object from common.json
- Consolidated all footer translations in common.json, removed from page-specific files
- Mobile optimization: 44px/48px touch targets, touch-action: manipulation, responsive design
- Progressive enhancement: <noscript> fallback for JavaScript-disabled users
- Version 1.3.0
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
IMPLEMENTER PAGE (public/implementer.html):
- Complete rewrite from 761 to 635 lines (developer-focused)
- Added both framework architecture diagrams (SVGs)
- Replaced fake @tractatus/framework npm package with real code examples
- Removed all marketing disclaimers and verbose filler
- Added technical specs for all 6 core services with real API examples
- Fixed GitHub repository links to match package.json
FOOTER FIXES (researcher.html, leader.html):
- Fixed script loading order (version-manager before i18n)
- Removed duplicate <!-- Footer --> comment in researcher.html
- Now matches index.html script structure for consistency
Result: Implementer page now shows actual framework documentation with real code examples and architecture diagrams
🤖 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
