Commit graph

5 commits

Author SHA1 Message Date
TheFlow
a4db3e62ec chore(vendor-policy): sweep project-self GitHub URLs to Codeberg (partial)
Some checks are pending
CI / Run Tests (push) Waiting to run
CI / Lint Code (push) Waiting to run
CI / CSP Compliance Check (push) Waiting to run
Addresses the documentation-layer gap after Phase A/B moved the git REMOTE from
GitHub to Codeberg but left ~100 project-self GitHub URLs embedded in markdown,
HTML, JS, and Python files. The remote-layer migration was generalised as
"GitHub is gone from the codebase" without verifying the content layer.

22 files swept in this commit. 27 additional files hold pre-existing inst_016/017/018
or inst_084 debt that would transfer on touch (hook whole-file scan). Those
await a companion hygiene-first commit before their GitHub->Codeberg flip
can land cleanly.

Sweep scope this commit:
  - README.md, SECURITY.md
  - 3 For-Claude-Web bundle files (GitHub URLs noted as "separate concern" in
    today's earlier licence-swap commits)
  - docs/markdown/deployment-guide.md
  - docs/AUTOMATED_SYNC_SETUP, PLURALISM_CHECKLIST, github/AGENT_LIGHTNING_README
  - docs/business-intelligence/governance-bi-tools
  - docs/outreach/EXECUTIVE-BRIEF-BI-GOVERNANCE (+ v2)
  - docs/research/ARCHITECTURAL-SAFEGUARDS-*
  - email-templates/README.md, base-template.html
  - 3 scripts/seed-*-blog-post.js (blog-seeding scripts)
  - scripts/upload-document.js
  - SESSION_HANDOFF_2025-10-23_FRAMEWORK_ANALYSIS.md
  - SECURITY_INCIDENT_POST_MORTEM_2025-10-21.md

Pattern swaps (longest-first):
  github.com/AgenticGovernance/tractatus-framework/issues -> codeberg.org/mysovereignty/tractatus-framework/issues
  github.com/AgenticGovernance/tractatus-framework/discussions -> .../issues (Codeberg has no discussions feature)
  github.com/AgenticGovernance/tractatus-framework.git -> codeberg.org/mysovereignty/tractatus-framework.git
  github.com/AgenticGovernance/tractatus-framework -> codeberg.org/mysovereignty/tractatus-framework
  git@github.com:AgenticGovernance/... -> git@codeberg.org:mysovereignty/...
  github.com/AgenticGovernance/tractatus (old org/repo path) -> codeberg.org/mysovereignty/tractatus-framework
  AgenticGovernance/tractatus-framework (bare) -> mysovereignty/tractatus-framework

Hook validator update (scripts/hook-validators/validate-credentials.js):
  PROTECTED_VALUES.github_org:  'AgenticGovernance'  -> 'mysovereignty'
  PROTECTED_VALUES.license:     'Apache License 2.0' -> EUPL-1.2 long form
  URL detection regex:          /github\.com\/.../   -> /codeberg\.org\/.../
  Placeholder checks + error messages updated to reflect Codeberg as
  authoritative post-migration host. Key names (e.g. `github_org`) retained
  for backward compatibility with validate-file-edit.js.

Held back from this commit (27 files total, documented reasons):

  11 historical session handoffs / closedown docs / incident reports
    (2025-10 through 2026-02) — modifying them rewrites the record to contain
    URLs that did not exist at the time of writing, AND ownership of their
    pre-existing inst_084 exposures transfers on touch.

  8 live-content docs with pre-existing inst_084 debt (port/API-endpoint/
    file-path exposures): docs/markdown/case-studies.md, technical-architecture,
    introduction-to-the-tractatus-framework, implementation-guide-v1.1,
    docs/plans/integrated-implementation-roadmap-2025, docs/governance/*,
    docs/ANTHROPIC_*, docs/GOVERNANCE_SERVICE_*, docs/RESEARCH_DOCUMENTATION_*,
    deployment-quickstart/*.

  8 live-content docs with pre-existing inst_016/017/018 debt:
    CHANGELOG.md, CONTRIBUTING.md, docs/LAUNCH_ANNOUNCEMENT, LAUNCH_CHECKLIST,
    PHASE_4_REPOSITORY_ANALYSIS, PHASE_6_SUMMARY, docs/plans/research-enhancement-
    roadmap-2025, docs/case-studies/pre-publication-audit-oct-2025.

  Also NOT in this commit (separate concerns):
  - scripts/add-inst-084-github-url-protection.js (detection-rule logic needs
    framework-level decision on post-migration semantics).
  - .claude/* (framework state).
  - docs/PRODUCTION_DOCUMENTS_EXPORT.json (DB dump).
  - package-lock.json (npm sponsor URLs, third-party).
  - .git/config embedded credentials (requires out-of-band rotation on both
    remote hosts + auth-strategy decision; user-action task).

Context: today's EUPL-1.2 sweep closed the licence-text-content layer
(5c386d0d / 6d49bfbf / ab0a6af4 / 4c1a26e8). This commit starts closing the
matching vendor-URL-content layer. Next: hygiene-first pass on the 16
live-content docs held back, then a second URL-flip pass on them.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-20 10:53:13 +12:00
TheFlow
2691c341f4 docs(bi): remove sanitized documents after public export
Deleted governance-bi-tools.docx and governance-bi-tools.pdf after sanitizing
for public consumption. Content has been integrated into public-facing
documentation and dashboard interfaces.

Part of attack surface reduction effort (inst_084).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-27 19:47:24 +13:00
TheFlow
1f57c13d98 docs(bi): sanitize documentation for public consumption
Removed internal strategic information and reframed claims to align
with framework rules (inst_016, inst_017, inst_018).

Changes:
- Removed frontmatter: media_rollout_notes, strategic_assessment
- Removed maturity claims: 'novel approach', 'key innovation'
- Removed unsupported claims: 'early evidence suggests', 'critical missing piece'

Replaced with:
- Research-appropriate language: 'research prototype', 'experimental system'
- Empirical framing: 'Research Question: Can...'
- Tentative conclusions: 'remains an empirical question'
- Validation requirements emphasized throughout

Document now appropriate for public consumption while maintaining
technical accuracy and research integrity.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-27 12:17:38 +13:00
TheFlow
c195b36014 security(docs): sanitize BI tools documentation to reduce attack surface
Removed specific implementation details from public-facing documentation.

Removed:
- Exact admin dashboard URL paths (/admin/audit-analytics.html)
- Exact API endpoint paths (/api/admin/audit-logs, etc.)
- Internal file paths (activity-classifier.util.js, validate-file-edit.js)

Replaced with:
- Generalized component names (Administrative Dashboard, Activity Classifier)
- Functional descriptions without implementation details
- Architecture concepts without revealing file structure

Security Rationale:
- Follows defense-in-depth principle (inst_072)
- Reduces attack surface by obscuring internal structure
- Maintains documentation value while protecting implementation

Changes:
- Section 5.1: Deployment Components (sanitized API endpoints)
- Implementation references (removed filenames)
- Architecture diagrams (removed specific paths)

This document is marked confidential:false, making this sanitization
critical for production security.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-27 12:10:58 +13:00
TheFlow
367ad284b9 docs(bi): add business intelligence documentation and UI integration
Comprehensive documentation for BI tools research prototype:

Documentation (docs/business-intelligence/):
- governance-bi-tools.md: Complete technical documentation
  * Research status and version tracking
  * Current capabilities (cost avoidance, maturity, team performance)
  * Short-term development roadmap (3-6 months)
  * Long-term research goals (6-18 months)
  * Research limitations and disclaimers
  * Implementation package for trial deployments
- governance-bi-tools.pdf: PDF export for distribution
- governance-bi-tools.docx: DOCX for collaborative editing

UI Integration:
- Admin Dashboard: Prominent BI feature card with capability overview
- Implementer Page: BI tools added to development roadmap section
- Researcher Page: BI documentation link in research resources

Messaging Tone:
- Research-focused, measured approach
- Clear "Research Prototype v1.0" labeling
- Disclaimers about illustrative cost values
- Emphasis on validation requirements

Strategic Positioning:
- Transforms narrative from "AI safety tool" to "Risk Management ROI Platform"
- Demonstrates measurable governance value
- Provides executive decision-making insights

Framework Audit:  Passed (audit_68fe8c2479c3715d85cface5)
- BoundaryEnforcer: Approved for TECHNICAL_IMPLEMENTATION
- CrossReferenceValidator: No conflicts
- ContextPressureMonitor: Analysis complete

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-27 10:37:14 +13:00