Commit graph

14 commits

Author SHA1 Message Date
TheFlow
64888a6e83 feat(governance): architectural enforcement of handoff document reading (inst_083)
Problem: Claude Code was skipping handoff documents despite explicit instructions in
SESSION_CLOSEDOWN_*.md files. This is a 27027-style pattern recognition failure where
the learned pattern "Warmup → run session-init → report ready" overrode the explicit
instruction to read handoff documents.

Root Cause: Voluntary compliance failure - relying on Claude to remember to read
handoff documents after running session-init.js.

Solution: Architectural enforcement via auto-injection

Implementation:
- Modified scripts/session-init.js to automatically detect and parse SESSION_CLOSEDOWN_*.md
- Section 1a now extracts and displays:
  • Priorities from previous session
  • Recent commits (recent work)
  • Known issues/blockers
  • Cleanup summary
- Handoff context injected into session-init output automatically
- No voluntary compliance needed - information appears unavoidably

New Instruction (inst_083):
- Quadrant: SYSTEM
- Persistence: HIGH
- Scope: PERMANENT
- Verification: MANDATORY
- Documents architectural enforcement mechanism
- Synced to MongoDB database

Testing:
- Verified with current session handoff (SESSION_CLOSEDOWN_2025-10-25.md)
- Successfully extracted priorities: "Review framework performance, Continue development work"
- Successfully extracted recent work: RESEARCH_DOCUMENTATION_PLAN.md commit (5a30b3e)
- Successfully extracted cleanup: 8 background processes killed

Impact:
- Prevents loss of session context across sessions/compaction
- Makes handoff priorities unavoidable (appears in session-init output)
- Architectural solution to procedural compliance problem

Related: inst_077 (session-closedown.js), SESSION_MANAGEMENT_ARCHITECTURE.md

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-25 15:04:01 +13:00
TheFlow
35a2b05c6e feat(governance): integrate Wave 5 mechanisms into session lifecycle
Enhanced session-init.js (3 new checks):
- Section 2b: Hook approval cache reset (inst_061)
  Clears stale session approvals on new session
- Section 8a: Defense-in-depth health check (inst_072)
  Verifies 5 credential protection layers on startup
- Section 8b: Dependency license check (inst_080)
  Ensures Apache 2.0 compatibility before work begins

Enhanced session-closedown.js (2 new summaries):
- Scope adjustment summary (inst_052)
  Reports scope changes made during session in handoff
- Hook approval summary (inst_061)
  Documents cached "don't ask again" approvals

Architecture:
- Session-scoped mechanisms now properly integrated
- Lifecycle enforcement ensures no state leakage between sessions
- Handoff documents now include complete session activity tracking

Related: Wave 5 (b570596) - 100% enforcement coverage

📊 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-25 14:15:12 +13:00
TheFlow
436ca56cb0 feat(governance): implement comprehensive enforcement architecture
Completes enforcement implementation from ENFORCEMENT_AUDIT.md analysis:

 Implemented (6 enforcement mechanisms):
1. Token checkpoint monitoring (inst_075)
   - .claude/hooks/check-token-checkpoint.js
   - PostToolUse hook integration

2. Trigger word detection (inst_078, inst_082)
   - .claude/hooks/trigger-word-checker.js (already completed)
   - "ff" and "ffs" triggers architecturally enforced

3. Framework activity verification (inst_064)
   - Enhanced scripts/session-init.js with fade detection
   - Alerts when components stale >20 messages

4. Test requirement enforcement (inst_068)
   - Enhanced .git/hooks/pre-commit
   - Runs tests if test files exist for modified code
   - Blocks commits on test failures

5. Background process tracking (inst_023)
   - scripts/track-background-process.js
   - Integrated into session-init.js and session-closedown.js
   - Tracks persistent vs temporary processes

6. Security logging verification (inst_046)
   - scripts/verify-security-logging.js
   - Can be integrated into deployment workflow

7. Meta-enforcement monitoring system
   - scripts/audit-enforcement.js
   - Scans HIGH persistence instructions for imperatives
   - Reports enforcement gaps (currently 28/39 gaps)

🔒 Protection Added:
- inst_027: Hard block on instruction-history.json edits
- Conventional commit format enforcement (inst_066)
- CSP + test validation in pre-commit hook

📊 Current Enforcement Status:
- Baseline: 11/39 imperative instructions enforced (28%)
- Framework fade detection operational
- Token checkpoints architecturally monitored

🎯 Philosophy:
"If it's MANDATORY, it must be ENFORCED architecturally, not documented."

This addresses the root cause of voluntary compliance failures identified
when Claude missed "ffs" trigger and token checkpoints despite active
HIGH persistence instructions.

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-25 13:15:06 +13:00
TheFlow
8210876421 feat(blog): integrate Tractatus framework governance into blog publishing
Implements architectural enforcement of governance rules (inst_016/017/018/079)
for all external communications. Publication blocked at API level if violations
detected.

New Features:
- Framework content checker script with pattern matching for prohibited terms
- Admin UI displays framework violations with severity indicators
- Manual "Check Framework" button for pre-publication validation
- API endpoint /api/blog/check-framework for real-time content analysis

Governance Rules Added:
- inst_078: "ff" trigger for manual framework invocation in conversations
- inst_079: Dark patterns prohibition (sovereignty principle)
- inst_080: Open source commitment enforcement (community principle)
- inst_081: Pluralism principle with indigenous framework recognition

Session Management:
- Fix session-init.js infinite loop (removed early return after tests)
- Add session-closedown.js for comprehensive session handoff
- Refactor check-csp-violations.js to prevent parent process exit

Framework Services:
- Enhanced PluralisticDeliberationOrchestrator with audit logging
- Updated all 6 services with consistent initialization patterns
- Added framework invocation scripts for blog content validation

Files: blog.controller.js:1211-1305, blog.routes.js:77-82,
blog-curation.html:61-72, blog-curation.js:320-446

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-25 08:47:31 +13:00
TheFlow
ac2db33732 fix(submissions): restructure Economist package and fix article display
- Create Economist SubmissionTracking package correctly:
  * mainArticle = full blog post content
  * coverLetter = 216-word SIR— letter
  * Links to blog post via blogPostId
- Archive 'Letter to The Economist' from blog posts (it's the cover letter)
- Fix date display on article cards (use published_at)
- Target publication already displaying via blue badge

Database changes:
- Make blogPostId optional in SubmissionTracking model
- Economist package ID: 68fa85ae49d4900e7f2ecd83
- Le Monde package ID: 68fa2abd2e6acd5691932150

Next: Enhanced modal with tabs, validation, export

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-24 08:47:42 +13:00
TheFlow
a3c8ca462c SECURITY: Remove all internal/confidential files from public repository
CRITICAL SECURITY FIX:
Removed 226 internal and sensitive files from git tracking to protect
the public tractatus-framework repository from exposing confidential
development information, server details, and internal strategies.

SCOPE:
This cleanup separates the INTERNAL repository (tractatus) from the
PUBLIC repository (tractatus-framework on GitHub).

REMOVED DIRECTORIES (entire):
- .claude/ (framework session state, metrics, archives)
- governance/ (internal operational governance)
- For Claude Web/ (internal development specs)
- scripts/hook-validators/ (internal enforcement)
- scripts/framework-components/ (internal components)
- docs/planning/, docs/testing/, docs/outreach/
- docs/stripe-analysis/, docs/economist-analysis/
- docs/framework-incidents/, docs/deployment-logs/
- docs/analysis-archive-2025-10/

REMOVED ROOT FILES:
- CLAUDE_*.md, ClaudeWeb*.md (internal development)
- PITCH-*.md (internal pitch documents)
- PHASE-*.md, MEETING_NOTES*.md (internal planning)
- SESSION*.md, OPTIMAL_NEXT_SESSION*.md (session handoffs)
- ARCHIVE_SUMMARY*.md, CLOSEDOWN*.* (session archives)
- EXECUTIVE_BRIEF*.md (internal briefs)
- Tractatus-Website-Complete-Specification*.md (internal specs)
- UI_TRANSFORMATION_PROJECT_PLAN.md, SITE_IMPROVEMENT_PRIORITIES.md
- SCHEDULED_TASKS.md, TRACTATUS_BRAND_SYSTEM.md
- .stripe-ids.json, .rsyncignore (sensitive/deployment)
- deployment-output.txt, migration-output.txt (logs)
- ECONOMIST_LETTER*.docx, PERPLEXITY_USER_PROMPT.txt (correspondence)

REMOVED SCRIPTS:
- scripts/deploy-*.sh (contain server IPs)
- scripts/session-init.js, scripts/check-session-pressure.js
- scripts/analyze-violations.js
- scripts/hook-validators/*.js (5 files)
- scripts/framework-components/*.js

REMOVED DOCS (96 files):
- docs/SESSION*.md, docs/session-handoff-*.md
- docs/DEPLOYMENT*.md, docs/MULTI_PROJECT*.md
- docs/DOCUMENT_AUDIT*.md, docs/DOCUMENT_*.md
- docs/BLOG-POST-OUTLINES.md
- docs/PHASE-*.md, docs/STRIPE_*.md, docs/KOHA*.md
- docs/SECURITY_AUDIT*.md, docs/FRAMEWORK_FAILURE*.md
- docs/BENCHMARK*.md, docs/IMPLEMENTATION_PROGRESS*.md
- docs/BOOTSTRAPPING*.md, docs/GOVERNANCE-RULE-LIBRARY.md
- docs/SIMULATION*.md, docs/API_MEMORY*.md

ADDED PROTECTIONS:
1. Comprehensive .gitignore (172 lines)
   - Blocks all internal directories
   - Blocks all internal file patterns
   - Prevents accidental commits

2. PUBLIC_REPO_CHECKLIST.md
   - Security verification checklist
   - Weekly maintenance procedures
   - Clear guidelines for public vs internal

REMAINING PUBLIC FILES: 6,435
- src/: 85 (open source services)
- tests/: 35 (unit/integration tests)
- public/: 178 (website frontend)
- scripts/: 111 (public utilities)
- docs/: 107 (public documentation)
- root: 13 (README, LICENSE, package.json, configs)

VERIFICATION:
✓ No server IPs
✓ No SSH keys or credentials
✓ No payment system secrets
✓ No internal planning documents
✓ No session handoffs or development logs
✓ No deployment scripts with production details

RESULT:
Public tractatus-framework repository now contains ONLY:
- Open source code
- Public documentation
- Implementation guides
- Apache 2.0 licensed content

Internal tractatus repository (local) retains ALL files for development.

🤖 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-21 18:50:16 +13:00
TheFlow
2756953963 feat(framework): implement Phase 1 proactive content scanning
CREATED:
- scripts/framework-components/ProhibitedTermsScanner.js (420 lines)
  • Scans codebase for inst_016/017/018 violations
  • Pattern detection for guarantee language, fabricated stats, unverified claims
  • Auto-fix capability with context awareness
  • CLI interface: --details, --fix, --staged flags

- tests/unit/ProhibitedTermsScanner.test.js (39 tests, all passing)
  • Pattern detection tests (inst_017, inst_018)
  • Context awareness tests
  • Auto-fix functionality tests
  • Edge case handling

MODIFIED:
- scripts/session-init.js
  • Added Section 7: Scanning for Prohibited Terms
  • Renumbered subsequent sections (CSP → 8, Dev Env → 9, Continuous → 10)
  • Scans on every session start, reports violations

- scripts/hook-validators/validate-file-write.js
  • Added missing checkPreActionCheckRecency() function (fixes hook crash)

- package.json/package-lock.json
  • Added glob@11.0.3 dependency

RESULTS:
• Scanner operational: 39/39 tests passing
• Session integration: Runs automatically on session start
• Current scan: Found 364 violations (188 inst_017, 120 inst_018, 56 inst_016)
• Violations need user review (many in historical docs, specifications)

IMPACT:
• Framework now PROACTIVE instead of reactive
• Violations detected at session start (not weeks later)
• Auto-fix available for simple cases
• Closes critical detection gap identified in framework assessment

NEXT STEPS (user decision):
• Review 364 violations (many false positives in historical docs)
• Optionally: Implement pre-commit hook
• Phase 2: Context-aware rule surfacing
• Phase 3: Active metacognitive assistance

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-21 17:37:51 +13:00
TheFlow
ffddd678a8 fix(mongodb): resolve production connection drops and add governance sync system
- Fixed sync script disconnecting Mongoose (prevents production errors)
- Created text search index (fixes search in rule-manager)
- Enhanced inst_024 with closedown protocol, added inst_061
- Added sync infrastructure: API routes, dashboard widget, auto-sync
- Fixed MemoryProxy tests MongoDB connection
- Created ADR-001 and integration tests

Result: Production stable, 52 rules synced, search working

🤖 Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-21 11:39:05 +13:00
TheFlow
92c44026eb chore(framework): session tracking, test enforcement, and schema improvements
SUMMARY:
Atomic commit of framework improvements and session tracking from 2025-10-20
admin UI overhaul session. Includes test enforcement, schema fixes, null
handling, and comprehensive session documentation.

FRAMEWORK IMPROVEMENTS:

1. Test Failure Enforcement (scripts/session-init.js):
   - Test failures now BLOCK session initialization (was warning only)
   - Exit with code 1 on test failures
   - Prevents sessions from starting with broken framework components
   - Enhanced error messaging for clarity

2. Schema Fix (src/models/VerificationLog.model.js):
   - Fixed 'type' field conflict in action subdocument
   - Explicitly nest fields to avoid Mongoose keyword collision
   - Was causing schema validation issues

3. Null Handling (src/services/MetacognitiveVerifier.service.js):
   - Added null parameter validation in verify() method
   - Returns BLOCK decision for null action/reasoning
   - Prevents errors in test scenarios expecting graceful degradation
   - Confidence: 0, Level: CRITICAL for null inputs

SESSION TRACKING:

4. Hooks Metrics (.claude/metrics/hooks-metrics.json):
   - Total edit hooks: 708 (was 707)
   - Total write hooks: 212 (was 211)
   - Tracked session activity for governance analysis
   - Last updated: 2025-10-20T09:16:38.047Z

5. User Suggestions (.claude/user-suggestions.json):
   - Added suggestion tracking: "could be a tailwind issue"
   - Hypothesis priority: HIGH
   - Enables inst_049 enforcement (test user hypothesis first)
   - Session: 2025-10-07-001

6. Session Completion Document:
   - SESSION_COMPLETION_2025-10-20_ADMIN_UI_AND_AUTONOMOUS_RULES.md
   - Complete session summary: Phase 1, Phase 2, autonomous rules
   - Token usage: 91,873 / 200,000 (45.9%)
   - Framework pressure: 14.6% (NORMAL)
   - Zero errors, 8 new rules established

RATIONALE:
These changes improve framework robustness (test enforcement, null handling),
fix technical debt (schema conflict), and provide complete session audit trail
for governance analysis and future sessions.

IMPACT:
- Test failures now prevent broken sessions (was allowing them)
- Schema validation errors resolved
- MetacognitiveVerifier handles edge cases gracefully
- Complete session audit trail preserved

FILES MODIFIED: 6
- scripts/session-init.js: Test enforcement
- src/models/VerificationLog.model.js: Schema fix
- src/services/MetacognitiveVerifier.service.js: Null handling
- .claude/metrics/hooks-metrics.json: Session activity
- .claude/user-suggestions.json: Hypothesis tracking

FILES ADDED: 1
- SESSION_COMPLETION_2025-10-20_ADMIN_UI_AND_AUTONOMOUS_RULES.md: Session documentation

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-21 04:05:09 +13:00
TheFlow
5b947e3b6f chore(framework): update instruction history and hook metrics
Update framework tracking files from extended session work:
- Instruction history with security workflow instructions
- Hook metrics from document security session
- Hook validator updates for pre-action checks

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-19 12:48:21 +13:00
TheFlow
d0ab1357f0 feat: implement continuous framework enforcement architecture
Implements architectural enforcement to prevent framework fade (voluntary
compliance failures). This addresses Case Study #27028 where AI skipped
session-init.js despite explicit CRITICAL warnings while implementing
anti-fade enforcement mechanisms.

## New Components

### Hook Validators (scripts/hook-validators/)
- validate-file-edit.js: Pre-Edit enforcement (CSP, conflicts, boundaries)
- validate-file-write.js: Pre-Write enforcement (overwrites, boundaries)
- check-token-checkpoint.js: Prevents checkpoint fade at 50k/100k/150k

### Documentation
- CONTINUOUS_ENFORCEMENT_ARCHITECTURE.md: Technical architecture
- BOOTSTRAPPING_SOLUTION.md: Solves auto-run session-init problem
- PRE_APPROVED_COMMANDS.md: Extracted from CLAUDE.md (context reduction)
- Case Study #27028: Framework fade during anti-fade implementation

### Session Initialization Enhancement
- scripts/session-init.js: Added Section 8 (Hook Architecture Status)
- Reports hook validator installation and pre-approved commands

### CLAUDE.md Reduction (Not Committed - .gitignored)
- Reduced from 235 lines to 86 lines (63% reduction)
- Philosophy: "If it can be enforced in code, it should not be documented"

## Key Findings

Case Study #27028 proved documentation-based governance fundamentally
cannot work. AI skipped session-init.js despite "⚠️ CRITICAL" warning
while actively implementing anti-fade enforcement. This validates the
thesis that architectural enforcement (code that runs automatically)
is the only viable solution.

## Next Steps

Bootstrapping solution required: session-init.js needs automatic
invocation on continued sessions. Without this, framework fade will
recur. Options documented in BOOTSTRAPPING_SOLUTION.md.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-15 19:55:12 +13:00
TheFlow
1906c0be0b docs: update framework to 6 services with PluralisticDeliberationOrchestrator
- Updated all core documentation (introduction, core-concepts, implementation guides)
- Added comprehensive PluralisticDeliberationOrchestrator sections
- Fixed implementation-guide-v1.1.md (BlogCuration → PluralisticDeliberationOrchestrator)
- Updated UI pages (index, researcher, leader) to reflect 6 services
- Enhanced cache busting with unified version script
- FAQ already includes comprehensive value pluralism coverage (Q18-22)

Framework now correctly documents all 6 mandatory services:
1. InstructionPersistenceClassifier
2. CrossReferenceValidator
3. BoundaryEnforcer
4. ContextPressureMonitor
5. MetacognitiveVerifier
6. PluralisticDeliberationOrchestrator (added October 2025)

🤖 Generated with Claude Code
2025-10-12 19:55:44 +13:00
TheFlow
7f3eeece3c feat: comprehensive documentation improvements and GitHub integration
- Add professional README for public repository with code examples
- Fix all broken documentation links across 4 markdown files
- Add favicon to all HTML pages (eliminates 404 errors)
- Redesign Experience section with 4-card incident grid
- Add GitHub section to docs.html sidebar with repository links
- Migrate 4 new case studies to database (19 total documents)
- Generate 26 PDFs for public download
- Add automated sync GitHub Action for public repository
- Add security validation for public documentation sync
- Update docs-app.js to categorize research topics

Mobile responsive, accessibility compliant, production ready.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-09 14:33:14 +13:00
TheFlow
426fde1ac5 feat(infra): semantic versioning and systemd service implementation
**Cache-Busting Improvements:**
- Switched from timestamp-based to semantic versioning (v1.0.2)
- Updated all HTML files: index.html, docs.html, leader.html
- CSS: tailwind.css?v=1.0.2
- JS: navbar.js, document-cards.js, docs-app.js v1.0.2
- Professional versioning approach for production stability

**systemd Service Implementation:**
- Created tractatus-dev.service for development environment
- Created tractatus-prod.service for production environment
- Added install-systemd.sh script for easy deployment
- Security hardening: NoNewPrivileges, PrivateTmp, ProtectSystem
- Resource limits: 1GB dev, 2GB prod memory limits
- Proper logging integration with journalctl
- Automatic restart on failure (RestartSec=10)

**Why systemd over pm2:**
1. Native Linux integration, no additional dependencies
2. Better OS-level security controls (ProtectSystem, ProtectHome)
3. Superior logging with journalctl integration
4. Standard across Linux distributions
5. More robust process management for production

**Usage:**
  # Development:
  sudo ./scripts/install-systemd.sh dev

  # Production:
  sudo ./scripts/install-systemd.sh prod

  # View logs:
  sudo journalctl -u tractatus -f

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-09 09:16:22 +13:00