Implements comprehensive system for tracking governance framework false negatives:
Backend:
- src/models/MissedBreach.model.js - Schema with severity, cost tracking, miss reasons
- src/controllers/missedBreach.controller.js - CRUD operations and statistics
- src/routes/missedBreach.routes.js - Admin-only API endpoints
- src/routes/index.js - Route integration at /api/admin/missed-breaches
Functionality:
- Report missed breaches with classification (NO_RULE_EXISTS, RULE_TOO_NARROW, etc.)
- Track actual/estimated costs of missed violations
- Calculate effectiveness rate: detected / (detected + missed)
- Breakdown by miss reason with examples
- Link to original audit logs where available
Statistics:
- Total missed breaches by severity
- Average time to detection
- Cost impact analysis
- Effectiveness comparison vs audit logs
Purpose:
- Measure true framework detection rate (not just blocked actions)
- Identify blind spots in governance rules
- Calculate realistic cost avoidance (avoiding "framework theater")
- Support research integrity claims with empirical data
Related: Cross-environment audit sync (production metrics)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Implements privacy-preserving synchronization of production audit logs
to development for comprehensive governance research analysis.
Backend Components:
- SyncMetadata.model.js: Track sync state and statistics
- audit-sanitizer.util.js: Privacy sanitization utility
- Redacts credentials, API keys, user identities
- Sanitizes file paths and violation content
- Preserves statistical patterns for research
- sync-prod-audit-logs.js: CLI sync script
- Incremental sync with deduplication
- Dry-run mode for testing
- Configurable date range
- AuditLog.model.js: Enhanced schema with environment tracking
- environment field (development/production/staging)
- sync_metadata tracking (original_id, synced_from, etc.)
- New indexes for cross-environment queries
- audit.controller.js: New /api/admin/audit-export endpoint
- Privacy-sanitized export for cross-environment sync
- Environment filter support in getAuditLogs
- MemoryProxy.service.js: Environment tagging in auditDecision()
- Tags new logs with NODE_ENV or override
- Sets is_local flag for tracking
Frontend Components:
- audit-analytics.html: Environment filter dropdown
- audit-analytics.js: Environment filter query parameter handling
Research Benefits:
- Combine dev and prod governance statistics
- Longitudinal analysis across environments
- Validate framework consistency
- Privacy-preserving data sharing
Security:
- API-based export (not direct DB access)
- Admin-only endpoints with JWT authentication
- Comprehensive credential redaction
- One-way sync (production → development)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Implements core BI analytics capabilities for governance ROI measurement:
- Activity classifier utility for automatic event categorization
* Detects activity type (client communication, infrastructure, etc.)
* Calculates risk level, stakeholder impact, data sensitivity
* Computes business impact scores (0-100)
- Enhanced audit controller with BI analytics endpoints
* Cost avoidance calculator with user-configurable factors
* Framework maturity scoring (0-100 scale)
* Team performance comparison (AI vs human)
* Activity type breakdown and ROI projections
- New API routes for cost configuration (GET/POST /api/admin/cost-config)
- Hook validator enhancement
* Automatic activity classification on governance decisions
* MongoDB audit logging with BI context fields
* Business impact scoring for blocked actions
Status: Research prototype v1.0
Note: Cost factors are illustrative placeholders requiring validation
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Dashboard was frozen at 1000 decisions
- Actual total is 3281 decisions
- Increased limit to 10000 to show all audit data
- Chart scaling already handles large datasets properly
Problem:
- Card view uses sections array which contains English text
- Translated documents showed English content in cards
- Only document title was translated
Solution:
- Set sections = undefined for translated documents
- Forces frontend to use traditional full-document view
- Traditional view displays content_html which IS translated
Result:
- Translated documents now show fully translated content
- Card view disabled for translations (traditional view instead)
- All content (title + body) now displays in German/French
Testing:
- German: "Einführung in den Tractatus-Rahmen", "Was ist Tractatus?"
- content_html confirmed 17KB of translated German text
🌐 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
Problem:
- DeepL API with tag_handling='html' mangled markdown structure
- Translated markdown lost H2 headers and line breaks
- Sections couldn't be extracted from translated content
- Frontend showed no cards for translated documents
Root Cause:
- DeepL's HTML tag handling treated markdown as HTML
- Result: HTML entities (>), no line breaks, corrupted structure
Workaround Solution:
- Use English document sections (preserved structure)
- Display translated document title
- Card titles in English, but card content uses translated HTML
- This allows cards to render correctly while preserving UX
Files Changed:
- src/utils/sections.util.js: Section extraction utilities (created)
- src/controllers/documents.controller.js: Return English sections for translations
Limitations:
- Card section titles remain in English
- Full translated content still displays correctly
- TODO: Re-translate with proper markdown preservation
🌐 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
Problem:
- Blog publishing has governance checks (inst_016/017/018/079)
- Media responses and templates had NO checks
- Inconsistent: same risks, different enforcement
Solution - Unified Framework Enforcement:
1. Created ContentGovernanceChecker.service.js (shared service)
2. Enforced in media responses (blocks at API level)
3. Enforced in response templates (scans on create)
4. Scanner for existing templates
Impact:
✅ Blog posts: Framework checks (existing)
✅ Media inquiry responses: Framework checks (NEW)
✅ Response templates: Framework checks (NEW)
✅ Future: Newsletter content ready for checks
Files Changed:
1. src/services/ContentGovernanceChecker.service.js (NEW)
- Unified content scanner for all external communications
- Checks: inst_016 (stats), inst_017 (guarantees), inst_018 (claims), inst_079 (dark patterns)
- Returns detailed violation reports with context
2. src/controllers/media.controller.js
- Added governance check in respondToInquiry()
- Blocks responses with violations (400 error)
- Logs violations with media outlet context
3. src/models/ResponseTemplate.model.js
- Added governance check in create()
- Stores check results in template record
- Prevents violating templates from being created
4. scripts/scan-response-templates.js (NEW)
- Scans all existing templates for violations
- Displays detailed violation reports
- --fix flag to mark violating templates as inactive
Testing:
✅ ContentGovernanceChecker: All pattern tests pass
✅ Clean content: Passes validation
✅ Fabricated stats: Detected (inst_016)
✅ Absolute guarantees: Detected (inst_017)
✅ Dark patterns: Detected (inst_079)
✅ Template scanner: Works (0 templates in DB)
Enforcement Points:
- Blog posts: publishPost() → blocked at API
- Media responses: respondToInquiry() → blocked at API
- Templates: create() → checked before insertion
- Newsletter: ready for future implementation
Architectural Consistency:
If blog needs governance, ALL external communications need governance.
References:
- inst_016: No fabricated statistics
- inst_017: No absolute guarantees
- inst_018: No unverified production claims
- inst_079: No dark patterns/manipulative urgency
- inst_063: External communications consistency
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Root cause: Audit analytics was reading from obsolete .memory/audit/*.jsonl
files (last updated Oct 9), while actual audit logs are written to MongoDB
auditLogs collection (current data through Oct 23).
Fixed: Updated getAuditLogs() to query MongoDB auditLogs collection.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Root cause: MongoDB ObjectId objects were being sent to frontend as-is,
which JSON.stringify converts to '[object Object]' string in data attributes.
Fix: Convert _id to string on server-side before sending to client.
This is the actual fix - previous attempts were client-side workarounds.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fixed unused function parameters by prefixing with underscore
- Removed unused imports and variables
- Applied eslint --fix for automatic style fixes
- Property shorthand
- String template literals
- Prefer const over let where appropriate
- Spacing and formatting
Reduces lint errors from 108+ to 78 (61 unused vars, 17 other issues)
Related to CI lint failures in previous commit
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Frontend:
- Add translate button click handler in submission-modal-enhanced.js
- Display loading state during translation (⏳ Translating...)
- Update French textarea with translated content
- Auto-update word counts after translation
- Show success message with DeepL attribution
Backend:
- Add POST /api/submissions/:id/translate endpoint
- Integrate Translation.service (DeepL)
- Save translations to SubmissionTracking.documents
- Mark translations as 'translatedBy: deepl', 'approved: false'
- Return translated text with caching metadata
Complete Translation Flow:
1. User clicks 'Translate EN → FR' button
2. Frontend sends English text to /api/submissions/:id/translate
3. Backend calls DeepL API via Translation.service
4. Translation cached for 24 hours
5. Result saved to submission.documents[docType].versions[]
6. French textarea populated with translation
7. User can review/edit before saving submission
Next: Configure DEEPL_API_KEY in .env to enable translations
- Add cache: 'no-store' to all apiCall functions in admin JS files
- Prevents browser fetch cache from serving stale error responses
- Addresses submissions endpoint 500 errors that weren't appearing in server logs
- Killed duplicate server process (PID 1583625)
- Added debug logging to submissions controller
- Files modified: blog-validation.js, blog-curation.js, blog-curation-enhanced.js
- User is also a native MongoDB class, not Mongoose model
- Removed all .populate() calls for createdBy, lastUpdatedBy, notes.author
- These were causing MissingSchemaError for User model
- Submissions can be returned without populated user data
- BlogPost uses native MongoDB (not Mongoose), causing MissingSchemaError
- Removed all .populate('blogPostId') calls that tried to reference non-existent Mongoose model
- Manually fetch blog post data in controllers when needed
- Updated getSubmissions, getSubmissionById, getSubmissionByBlogPost, exportSubmission
- Updated SubmissionTracking static methods: getByStatus, getByPublication
- Standalone submissions (like Le Monde) now display without errors
- Changed populate to use options object with strictPopulate: false
- Allows submissions without blogPostId (standalone packages) to be returned
- Fixes 500 error on /api/submissions endpoint
- Le Monde package should now be visible in UI after server restart
- Enhanced update-cache-version.js to update service worker and version.json
- Added inst_075 governance instruction (HIGH persistence)
- Integrated cache check into deployment script (Step 1/5)
- Created CACHE_MANAGEMENT_ENFORCEMENT.md documentation
- Bumped version to 0.1.1
- Updated all HTML cache parameters
BREAKING: Deployment now blocks if JS changed without cache update
- Create Economist SubmissionTracking package correctly:
* mainArticle = full blog post content
* coverLetter = 216-word SIR— letter
* Links to blog post via blogPostId
- Archive 'Letter to The Economist' from blog posts (it's the cover letter)
- Fix date display on article cards (use published_at)
- Target publication already displaying via blue badge
Database changes:
- Make blogPostId optional in SubmissionTracking model
- Economist package ID: 68fa85ae49d4900e7f2ecd83
- Le Monde package ID: 68fa2abd2e6acd5691932150
Next: Enhanced modal with tabs, validation, export
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add missing space after comma in SubmissionTracking model
- Replace string concatenation with template literal in blog controller
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
SUMMARY:
Fixed admin login failures caused by two issues:
1. Response sanitization middleware stripping auth tokens
2. Admin users missing password field in database
ROOT CAUSE ANALYSIS:
- sanitizeResponseData middleware removed ALL fields named 'token'
- This included authentication tokens that SHOULD be sent to clients
- Admin user records created without proper password field
- User.authenticate() failed on bcrypt.compare() with undefined password
FIXES:
1. Changed auth response field from 'token' to 'accessToken'
- Avoids overly aggressive sanitization
- More semantically correct (it's specifically an access token)
- Frontend updated to use data.accessToken
2. Created fix-admin-user.js script
- Properly creates admin user via User.create()
- Ensures password field is bcrypt hashed
- Deletes old malformed user records
3. Updated login.js auto-fill for correct dev email
- Changed from admin@tractatus.local to admin@agenticgovernance.digital
TESTING:
- Local login now returns accessToken (308 char JWT)
- User object returned with proper ID serialization
- Auth flow: POST /api/auth/login → returns accessToken + user
- Ready for production deployment
FILES:
- src/controllers/auth.controller.js: Use accessToken field
- public/js/admin/login.js: Store data.accessToken, update default email
- scripts/fix-admin-user.js: Admin user creation/fix utility
NEXT STEPS:
1. Deploy to production
2. Run: node scripts/fix-admin-user.js admin@agenticgovernance.digital <password>
3. Test admin login at /admin/login.html
🤖 Generated with Claude Code (https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
SUMMARY:
Completed migration from deprecated 'public: true/false' field to modern
'visibility' field across entire codebase. Ensures single source of truth
for document visibility state.
MIGRATION EXECUTION:
✓ Created migration script with dry-run support
✓ Migrated 120 documents in database (removed deprecated field)
✓ Post-migration: 0 documents with 'public' field, 127 with 'visibility'
✓ Zero data loss - all documents already had visibility set correctly
CODE CHANGES:
1. Database Migration (scripts/migrate-public-to-visibility.js):
- Created safe migration with dry-run mode
- Handles documents with both fields (cleanup)
- Post-migration verification built-in
- Execution: node scripts/migrate-public-to-visibility.js --execute
2. Document Model (src/models/Document.model.js):
- Removed 'public' field from create() method
- Updated findByQuadrant() to use visibility: 'public'
- Updated findByAudience() to use visibility: 'public'
- Updated search() to use visibility: 'public'
3. API Controller (src/controllers/documents.controller.js):
- Removed legacy filter: { public: true, visibility: { $exists: false } }
- listDocuments() now uses clean filter: visibility: 'public'
- searchDocuments() now uses clean filter: visibility: 'public'
4. Scripts Updated:
- upload-document.js: Removed public: true
- seed-architectural-safeguards-document.js: Removed public: true
- import-5-archives.js: Removed public: true
- verify-34-documents.js: Updated query filter to use visibility
- query-all-documents.js: Updated query filter to use visibility
VERIFICATION:
✓ 0 remaining 'public: true/false' usages in src/ and scripts/
✓ All documents use visibility field exclusively
✓ API queries now filter on visibility only
✓ Backward compatibility code removed
DATA MODEL:
Before: { public: true, visibility: 'public' } (redundant)
After: { visibility: 'public' } (single source of truth)
BENEFITS:
- Cleaner data model
- Single source of truth for visibility
- Simplified API logic
- Removed backward compatibility overhead
- Consistent with document security model
FRAMEWORK COMPLIANCE:
Addresses SCHEDULED_TASKS.md item "Legacy public Field Migration"
Completes Sprint 2 Medium Priority task
NEXT STEPS (Optional):
- Deploy migration to production
- Monitor for any edge cases
- Consider adding visibility to database indexes
🤖 Generated with Claude Code (https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
SECURITY IMPROVEMENTS:
- Change default visibility from 'public' to 'internal' (prevents accidental exposure)
- Add visibility validation (public/internal/confidential/archived)
- Require valid category for public documents
- Add workflow_status tracking (draft/review/published)
PUBLISH WORKFLOW:
- New Document.publish(id, options) method with comprehensive validation
- New Document.unpublish(id, reason) method with audit trail
- New Document.listByWorkflowStatus(status) for workflow management
API ENDPOINTS (Admin only):
- POST /api/documents/:id/publish - Explicit publish with category validation
- POST /api/documents/:id/unpublish - Revert to internal with reason
- GET /api/documents/drafts - List unpublished documents
WORLD-CLASS UX:
- Clear validation messages with actionable guidance
- Lists available categories in error messages
- Tracks publish/unpublish history for audit trail
BACKWARD COMPATIBLE:
- Existing public documents unaffected
- Migration scripts automatically use safer defaults
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add createPortalSession endpoint to koha.controller.js
- Add POST /api/koha/portal route with rate limiting
- Add 'Manage Your Subscription' section to koha.html
- Implement handleManageSubscription() in koha-donation.js
- Add Koha link to navigation menu in navbar.js
- Allow donors to self-manage subscriptions via Stripe portal
- Portal supports: payment method updates, cancellation, invoice history
Ref: Customer Portal setup docs in docs/STRIPE_CUSTOMER_PORTAL_NEXT_STEPS.md
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add AI-powered media inquiry triage with Tractatus governance:
- MediaTriage.service.js: Comprehensive AI analysis service
- Urgency classification (high/medium/low) with reasoning
- Topic sensitivity detection
- BoundaryEnforcer checks for values-sensitive topics
- Talking points generation
- Draft response generation (always requires human approval)
- Triage statistics for transparency
- Enhanced media.controller.js:
- triageInquiry(): Run AI triage on specific inquiry
- getTriageStats(): Public transparency endpoint
- Full governance logging for audit trail
- Updated media.routes.js:
- POST /api/media/inquiries/:id/triage (admin only)
- GET /api/media/triage-stats (public transparency)
GOVERNANCE PRINCIPLES DEMONSTRATED:
- AI analyzes and suggests, humans decide
- 100% human review required before any response
- All AI reasoning transparent and visible
- BoundaryEnforcer escalates values-sensitive topics
- No auto-responses without human approval
Reference: docs/FEATURE_RICH_UI_IMPLEMENTATION_PLAN.md lines 123-164
Priority: 4 of 10 (10-12 hours estimated, backend complete)
Status: Backend complete, frontend UI pending
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Framework Service Enhancements:
- ContextPressureMonitor: Enhanced statistics tracking and contextual adjustments
- InstructionPersistenceClassifier: Improved context integration and consistency
- MetacognitiveVerifier: Extended verification capabilities and logging
- All services: 182 unit tests passing
Admin Interface Improvements:
- Blog curation: Enhanced content management and validation
- Audit analytics: Improved analytics dashboard and reporting
- Dashboard: Updated metrics and visualizations
Documentation:
- Architectural overview: Improved markdown formatting for readability
- Added blank lines between sections for better structure
- Fixed table formatting for version history
All tests passing: Framework stable for deployment
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Complete implementation of AI-assisted blog content generation with mandatory
human oversight and Tractatus framework compliance.
Features:
- BlogCuration.service.js: AI-powered blog post drafting
- Tractatus enforcement: inst_016, inst_017, inst_018 validation
- TRA-OPS-0002 compliance: AI suggests, human decides
- Admin UI: blog-curation.html with 3-tab interface
- API endpoints: draft-post, analyze-content, editorial-guidelines
- Moderation queue integration for human approval workflow
- Comprehensive test coverage: 26/26 tests passing (91.46% coverage)
Documentation:
- BLOG_CURATION_WORKFLOW.md: Complete workflow and API docs (608 lines)
- Editorial guidelines with forbidden patterns
- Troubleshooting and monitoring guidance
Boundary Checks:
- No fabricated statistics without sources (inst_016)
- No absolute guarantee terms: guarantee, 100%, never fails (inst_017)
- No unverified production-ready claims (inst_018)
- Mandatory human approval before publication
Integration:
- ClaudeAPI.service.js for content generation
- BoundaryEnforcer.service.js for governance checks
- ModerationQueue model for approval workflow
- GovernanceLog model for audit trail
Total Implementation: 2,215 lines of code
Status: Production ready
Phase 4 Week 1-2: Option C Complete
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
**Cache-Busting Improvements:**
- Switched from timestamp-based to semantic versioning (v1.0.2)
- Updated all HTML files: index.html, docs.html, leader.html
- CSS: tailwind.css?v=1.0.2
- JS: navbar.js, document-cards.js, docs-app.js v1.0.2
- Professional versioning approach for production stability
**systemd Service Implementation:**
- Created tractatus-dev.service for development environment
- Created tractatus-prod.service for production environment
- Added install-systemd.sh script for easy deployment
- Security hardening: NoNewPrivileges, PrivateTmp, ProtectSystem
- Resource limits: 1GB dev, 2GB prod memory limits
- Proper logging integration with journalctl
- Automatic restart on failure (RestartSec=10)
**Why systemd over pm2:**
1. Native Linux integration, no additional dependencies
2. Better OS-level security controls (ProtectSystem, ProtectHome)
3. Superior logging with journalctl integration
4. Standard across Linux distributions
5. More robust process management for production
**Usage:**
# Development:
sudo ./scripts/install-systemd.sh dev
# Production:
sudo ./scripts/install-systemd.sh prod
# View logs:
sudo journalctl -u tractatus -f
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Deployment Strategy:
- Deploy all Koha infrastructure to production
- Keep user-facing functionality disabled until Stripe keys configured
- Allow backend testing and validation before payment processing activation
Changes:
- Add coming-soon-overlay.js component for Koha pages
- Add Stripe configuration check in koha.controller.js (returns 503 if PLACEHOLDER keys detected)
- Update all Koha HTML pages with coming soon overlay script
- Create comprehensive deployment guide (KOHA_PRODUCTION_DEPLOYMENT.md)
- Create automated deployment script (deploy-koha-to-production.sh)
Pre-Production Features:
- Database initialization ready (init-koha.js)
- API endpoints functional but protected
- Transparency dashboard returns empty data structure
- Coming soon overlay prevents user access to incomplete functionality
- All code deployed and testable
Activation Checklist:
- Configure live Stripe keys
- Remove coming-soon overlay scripts
- Remove PLACEHOLDER checks from controller
- Add navigation links to Koha pages
- Test end-to-end donation flow
Estimated Time to Activate: 2-3 hours once Stripe keys ready
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
**Three Public Features:**
- Media Inquiry System: Press/media can submit inquiries with AI triage (Phase 2)
- Case Study Submissions: Community can submit real-world AI safety failures
- Blog Curation: Admin-only topic suggestions with AI assistance (Phase 2)
**Backend Implementation:**
- Media routes/controller: /api/media/inquiries endpoints
- Cases routes/controller: /api/cases/submit endpoints
- Blog routes/controller: Already existed, documented
- Human oversight: All submissions go to moderation queue
- Tractatus boundaries: BoundaryEnforcer integration in blog controller
**Frontend Forms:**
- /media-inquiry.html: Public submission form for press/media
- /case-submission.html: Public submission form for case studies
- Full validation, error handling, success messages
**Validation Middleware Updates:**
- Support nested field validation (contact.email, submitter.name)
- validateEmail(fieldPath) now parameterized
- validateRequired() supports dot-notation paths
**Phase 1 Status:**
- AI triage: Manual (Phase 2 will add Claude API integration)
- All submissions require human review and approval
- Moderation queue operational
- Admin dashboard endpoints ready
**Files Added:**
- public/media-inquiry.html
- public/case-submission.html
- src/controllers/media.controller.js
- src/controllers/cases.controller.js
- src/routes/media.routes.js
- src/routes/cases.routes.js
**Files Modified:**
- src/routes/index.js (registered new routes)
- src/routes/auth.routes.js (updated validateEmail call)
- src/middleware/validation.middleware.js (nested field support)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fixed download icon size (1.25rem instead of huge black icons)
- Uploaded all 12 PDFs to production server
- Restored table of contents rendering for all documents
- Fixed modal cards with proper CSS and event handlers
- Replaced all docs-viewer.html links with docs.html
- Added nginx redirect from /docs/* to /docs.html
- Fixed duplicate headers in modal sections
- Improved cache-busting with timestamp versioning
All documentation features now working correctly:
✅ Card-based document viewer with modals
✅ PDF downloads with proper icons
✅ Table of contents navigation
✅ Consistent URL structure
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Implemented complete backend API foundation with authentication, document
management, blog operations, and admin functionality. Added migration tools
for database seeding and document import.
**Controllers (4 files):**
- auth.controller.js: User authentication (login, getCurrentUser, logout)
- documents.controller.js: Document CRUD operations
- blog.controller.js: Blog post management with admin/public access
- admin.controller.js: Admin dashboard (stats, moderation queue, activity)
**Routes (5 files):**
- auth.routes.js: Authentication endpoints
- documents.routes.js: Document API endpoints
- blog.routes.js: Blog API endpoints
- admin.routes.js: Admin API endpoints
- index.js: Central routing configuration with API documentation
**Migration Tools (2 scripts):**
- seed-admin.js: Create admin user for system access
- migrate-documents.js: Import markdown documents with metadata extraction,
slug generation, and dry-run support. Successfully migrated 8 documents
from anthropic-submission directory.
**Server Updates:**
- Integrated all API routes under /api namespace
- Updated homepage to reflect completed API implementation
- Maintained security middleware (Helmet, CORS, rate limiting)
**Testing:**
✅ Server starts successfully on port 9000
✅ Authentication flow working (login, token validation)
✅ Document endpoints tested (list, get by slug)
✅ Admin stats endpoint verified (requires authentication)
✅ Migration completed: 8 documents imported
**Database Status:**
- Documents collection: 8 technical papers
- Users collection: 1 admin user
- All indexes operational
This completes the core backend API infrastructure. Next steps: build
Tractatus governance services (InstructionClassifier, CrossReferenceValidator,
BoundaryEnforcer).
🤖 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
