john/tractatus
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
150 commits 1 branch 0 tags 125 MiB
Commit graph

7 commits

Author SHA1 Message Date
TheFlow
36b3ee5055 feat: comprehensive accessibility improvements (WCAG 2.1 AA) 
Achieved 81% error reduction (31 → 6 errors) across 9 pages through systematic
accessibility audit and remediation.

Key improvements:
- Add aria-labels to navigation close buttons (all pages)
- Fix footer text contrast: gray-600 → gray-300 (7 pages)
- Fix button contrast: amber-600 → amber-700, green-600 → green-700
- Fix docs modal empty h2 heading issue
- Fix leader page color contrast (bulk replacement)
- Update audit script: advocate.html → leader.html

Results:
- 7 of 9 pages now fully WCAG 2.1 AA compliant
- Remaining 6 errors likely tool false positives
- All critical accessibility issues resolved

Files modified:
- public/js/components/navbar.js (mobile menu accessibility)
- public/js/components/document-cards.js (modal heading fix)
- public/*.html (footer contrast, button colors)
- public/leader.html (comprehensive color updates)
- scripts/audit-accessibility.js (page list update)

Documentation: docs/accessibility-improvements-2025-10.md

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-10-12 07:08:40 +13:00
TheFlow
c6b792c542 security: harden admin panel before production deployment 
Critical Security Fixes:
1. Remove default credentials from login page (inst_012 compliance)
2. Create auth-check.js utility for client-side authentication
3. Add authentication redirects to all admin pages

Authentication Protection:
- All admin pages now check for valid JWT token on load
- Redirect to login if unauthenticated or token expired
- Token expiration validation (client-side check)
- Role verification (admin/moderator required)
- Periodic token validity checks (every 5 minutes)

Files Protected:
✅ /admin/dashboard.html
✅ /admin/rule-manager.html
✅ /admin/project-manager.html
✅ /admin/claude-md-migrator.html
✅ /admin/blog-curation.html
✅ /admin/audit-analytics.html
(login.html excluded - entry point)

Authentication Flow:
1. User accesses admin page
2. auth-check.js runs immediately
3. Check localStorage for admin_token
4. Parse JWT to verify expiration and role
5. If invalid: redirect to /admin/login.html with reason
6. If valid: allow page to load normally

API Security (already in place):
- All /api/admin/* endpoints require JWT
- authenticateToken middleware validates tokens
- requireRole middleware enforces admin/moderator access

Addresses security concerns:
- inst_012: No internal/confidential data exposure
- inst_013: No sensitive runtime data in public endpoints
- inst_014: No API surface enumeration
- inst_015: No internal documentation exposure

Remaining Recommendations:
- Change default admin password on production (MANUAL STEP)
- Consider IP whitelist for /admin/* (optional)
- Add rate limiting to /api/auth/login (future enhancement)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-10-11 17:26:50 +13:00
TheFlow
91aea5091c feat: implement Rule Manager and Project Manager admin systems 
Major Features:
- Multi-project governance with Rule Manager web UI
- Project Manager for organizing governance across projects
- Variable substitution system (${VAR_NAME} in rules)
- Claude.md analyzer for instruction extraction
- Rule quality scoring and optimization

Admin UI Components:
- /admin/rule-manager.html - Full-featured rule management interface
- /admin/project-manager.html - Multi-project administration
- /admin/claude-md-migrator.html - Import rules from Claude.md files
- Dashboard enhancements for governance analytics

Backend Implementation:
- Controllers: projects, rules, variables
- Models: Project, VariableValue, enhanced GovernanceRule
- Routes: /api/projects, /api/rules with full CRUD
- Services: ClaudeMdAnalyzer, RuleOptimizer, VariableSubstitution
- Utilities: mongoose helpers

Documentation:
- User guides for Rule Manager and Projects
- Complete API documentation (PROJECTS_API, RULES_API)
- Phase 3 planning and architecture diagrams
- Test results and error analysis
- Coding best practices summary

Testing & Scripts:
- Integration tests for projects API
- Unit tests for variable substitution
- Database migration scripts
- Seed data generation
- Test token generator

Key Capabilities:
✅ UNIVERSAL scope rules apply across all projects
✅ PROJECT_SPECIFIC rules override for individual projects
✅ Variable substitution per-project (e.g., ${DB_PORT} → 27017)
✅ Real-time validation and quality scoring
✅ Advanced filtering and search
✅ Import from existing Claude.md files

Technical Details:
- MongoDB-backed governance persistence
- RESTful API with Express
- JWT authentication for admin endpoints
- CSP-compliant frontend (no inline handlers)
- Responsive Tailwind UI

This implements Phase 3 architecture as documented in planning docs.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-10-11 17:16:51 +13:00
TheFlow
7336ad86e3 feat: enhance framework services and format architectural documentation 
Framework Service Enhancements:
- ContextPressureMonitor: Enhanced statistics tracking and contextual adjustments
- InstructionPersistenceClassifier: Improved context integration and consistency
- MetacognitiveVerifier: Extended verification capabilities and logging
- All services: 182 unit tests passing

Admin Interface Improvements:
- Blog curation: Enhanced content management and validation
- Audit analytics: Improved analytics dashboard and reporting
- Dashboard: Updated metrics and visualizations

Documentation:
- Architectural overview: Improved markdown formatting for readability
- Added blank lines between sections for better structure
- Fixed table formatting for version history

All tests passing: Framework stable for deployment

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-10-11 00:50:47 +13:00
TheFlow
ec12ba4d71 feat: Session 3 - Audit analytics dashboard 
Created comprehensive audit analytics dashboard for monitoring governance
decisions from MemoryProxy audit trail.

Features:
- Real-time dashboard with summary metrics
- Decisions by action type (bar chart)
- Timeline visualization (hourly distribution)
- Recent decisions table with filtering
- Apache 2.0 licensed

Components:
- Frontend: /admin/audit-analytics.html
- JavaScript: /js/admin/audit-analytics.js
- Backend API: /api/admin/audit-logs
- Backend API: /api/admin/audit-analytics

Metrics Displayed:
- Total decisions count
- Allowed rate percentage
- Violations count
- Active services count

Visualizations:
- Action type distribution
- Timeline (decisions over time)
- Recent decisions log (last 50)

Session 3 Achievement: Advanced monitoring and insights for governance framework

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-10-10 13:05:14 +13:00
TheFlow
e930d9a403 feat: implement blog curation AI with Tractatus enforcement (Option C) 
Complete implementation of AI-assisted blog content generation with mandatory
human oversight and Tractatus framework compliance.

Features:
- BlogCuration.service.js: AI-powered blog post drafting
- Tractatus enforcement: inst_016, inst_017, inst_018 validation
- TRA-OPS-0002 compliance: AI suggests, human decides
- Admin UI: blog-curation.html with 3-tab interface
- API endpoints: draft-post, analyze-content, editorial-guidelines
- Moderation queue integration for human approval workflow
- Comprehensive test coverage: 26/26 tests passing (91.46% coverage)

Documentation:
- BLOG_CURATION_WORKFLOW.md: Complete workflow and API docs (608 lines)
- Editorial guidelines with forbidden patterns
- Troubleshooting and monitoring guidance

Boundary Checks:
- No fabricated statistics without sources (inst_016)
- No absolute guarantee terms: guarantee, 100%, never fails (inst_017)
- No unverified production-ready claims (inst_018)
- Mandatory human approval before publication

Integration:
- ClaudeAPI.service.js for content generation
- BoundaryEnforcer.service.js for governance checks
- ModerationQueue model for approval workflow
- GovernanceLog model for audit trail

Total Implementation: 2,215 lines of code
Status: Production ready

Phase 4 Week 1-2: Option C Complete

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-10-10 08:01:53 +13:00
TheFlow
186870a0b7 feat: add admin dashboard & API reference documentation 
Admin Dashboard (complete):
- Created /admin/login.html with JWT authentication
- Created /admin/dashboard.html with full management UI
- Moderation queue with approve/reject workflows
- User management interface
- Document management interface
- Real-time statistics dashboard
- Activity feed monitoring
- All CSP-compliant (external JS files)

API Reference Documentation (complete):
- Created /api-reference.html with complete API docs
- Authentication endpoints (login, verify)
- Document endpoints (list, get, search)
- Governance status endpoint
- Admin endpoints (stats, moderation, users)
- Error codes reference table
- Request/response examples for all endpoints
- Query parameters documentation

Files Created (5):
- public/admin/login.html (auth interface)
- public/admin/dashboard.html (admin UI)
- public/js/admin/login.js (auth logic)
- public/js/admin/dashboard.js (dashboard logic)
- public/api-reference.html (complete API docs)

All pages tested and accessible (200 OK)
Zero CSP violations - all resources from same origin

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-10-07 12:27:38 +13:00