105 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Sharang Parnerkar	fc71439011	feat(pitch-deck): admin UI for investor + financial-model management ... Adds /pitch-admin dashboard with real admin accounts (bcrypt) and full audit attribution for every state-changing action. Backend: - pitch_admins + pitch_admin_sessions tables (migration 002) - pitch_audit_logs.admin_id + target_investor_id columns - lib/admin-auth.ts: bcryptjs hashing, single-session enforcement, jose JWT with 'pitch-admin' audience claim, requireAdmin guard - logAudit extended to accept admin_id and target_investor_id - middleware.ts: gates /pitch-admin/* and /api/admin/* on the admin cookie (with bearer-secret fallback for CLI compatibility) - 14 API routes under /api/admin-auth and /api/admin (login, logout, me, dashboard, investors[id] CRUD + resend, admins CRUD, fm scenarios + assumptions PATCH) - Existing /api/admin/{invite,investors,revoke,audit-logs} migrated to requireAdmin and now log with admin_id + target_investor_id - scripts/create-admin.ts CLI bootstrap (npm run admin:create) Frontend: - /pitch-admin/login + /pitch-admin/(authed) route group - AdminShell with sidebar nav + StatCard + AuditLogTable components - Dashboard with KPIs, recent logins, recent activity - Investors list with search/filter + resend/revoke inline actions - Investor detail with inline edit + per-investor audit timeline - Audit log viewer with actor/action/date filters + pagination - Financial model scenario list + per-scenario assumption editor (categorized, inline edit, before/after diff in audit) - Admins management (add, deactivate, reset password) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-07 11:27:18 +02:00
Sharang Parnerkar	645973141c	feat(pitch-deck): passwordless investor auth, audit logs, snapshots & PWA (#2) ... Adds investor-facing access controls, persistence, and PWA support to the pitch deck: - Passwordless magic-link auth (jose JWT + nodemailer SMTP) - Per-investor audit logging (logins, slide views, assumption changes, chat) - Financial model snapshot persistence (auto-save/restore per investor) - PWA support (manifest, service worker, offline caching, branded icons) - Safeguards: email watermark overlay, security headers, content protection, rate limiting, IP/new-IP detection, single active session per investor - Admin API: invite, list investors, revoke, query audit logs - pitch-deck service added to docker-compose.coolify.yml Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-07 08:48:38 +00:00
Benjamin Admin	3a2567b44d	feat(pitch-deck): add AI Presenter mode with LiteLLM migration and FAQ system ... - Migrate chat API from Ollama to LiteLLM (OpenAI-compatible SSE) - Add 15-min presenter storyline with bilingual scripts for all 20 slides - Add FAQ system (30 entries) with keyword matching for instant answers - Add IntroPresenterSlide with avatar placeholder and start button - Add PresenterOverlay (progress bar, subtitle text, play/pause/stop) - Add AvatarPlaceholder with pulse animation during speaking - Add usePresenterMode hook (state machine: idle→presenting→paused→answering→resuming) - Add 'P' keyboard shortcut to toggle presenter mode - Support [GOTO:slide-id] markers in chat responses - Dynamic slide count (was hardcoded 13, now from SLIDE_ORDER) - TTS stub prepared for future Piper integration Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-20 11:45:55 +01:00
Benjamin Admin	df0a9d6cf0	feat(pitch-deck): update TAM/SAM/SOM with bottom-up competitor revenue validation ... MarketSlide: - TAM sources updated: bottom-up from Top-10 competitor revenues (>$1.13B known) - SAM increased €850M → €950M, growth 19.5% → 24% (NIS2/CRA/AI Act expansion) - SAM source: bottom-up DACH revenues (DataGuard €52M, heyData €15M, etc.) - SOM growth increased to 30%, benchmark against Proliance/heyData - TAM growth updated to 18.5% (compliance automation wave 30-45% vs GRC avg 13.8%) ProblemSlide: - Added 3rd source to DSGVO card: market validation with real competitor revenues - Highlights: Vanta $220M/$4.15B, Top-10 >$1.1B, 80% still manual DB (pitch_market): - SAM value_eur: 850M → 950M - Growth rates: TAM 16.2→18.5, SAM 19.5→24.0, SOM 25→30 - Source strings updated to reference bottom-up methodology Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-20 08:33:18 +01:00
Benjamin Admin	38363b2837	feat(pitch-deck): rewrite CompetitionSlide with 6 detailed competitor profiles ... - Add Vanta, Drata, Sprinto (international) alongside Proliance, DataGuard, heyData (DACH) - Each card: HQ city/country, offices, employees, revenue, customers + countries, funding, investors, AI badge - Two tabs: Overview & Comparison / Feature Matrix (Detail) - 44-feature comparison table with collapsible sections: Top 5 Unterschiede, Alle Features, USP - Efficiency ratios table (revenue/employee, customers/employee) - DACH landscape note (Secjur, Usercentrics, Caralegal, 2B Advice, OneTrust) - Research-backed data: Vanta $220M/$4.15B, Drata $100M/$2B, Sprinto $38M, DataGuard €52M, heyData €15M - Dynamic feature/USP counts in subtitle - Bilingual (de/en) with i18n subtitle update Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-20 08:26:20 +01:00
Benjamin Admin	96f94475f6	fix: downgrade to PaddleOCR 2.x — 3.x uses too much RAM on CPU ... PaddlePaddle 3.x + PP-OCRv5 requires >6GB RAM and has oneDNN compatibility issues on CPU. PaddleOCR 2.x with PP-OCRv4 works reliably with ~2-3GB RAM and has no MKLDNN issues. - Pin paddlepaddle<3.0.0 and paddleocr<3.0.0 - Simplify main.py — single init strategy, direct 2.x result format - Re-enable warmup (fits in memory with 2.x) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 19:13:33 +01:00
Benjamin Admin	3fd3336f6c	fix: force-disable oneDNN via paddle.set_flags and enable_mkldnn=False ... Previous FLAGS_use_mkldnn env var was ignored by PaddlePaddle 3.x. Now using paddle.set_flags() API and PaddleOCR enable_mkldnn param. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 19:01:46 +01:00
Benjamin Admin	eaba087d11	fix: disable oneDNN/MKLDNN and support PaddleOCR 3.x result format ... - Set FLAGS_use_mkldnn=0 before paddle import to avoid ConvertPirAttribute2RuntimeAttribute error - Support both PaddleOCR 2.x (list) and 3.x (dict) result formats - Use use_textline_orientation (3.x) instead of use_angle_cls - Remove latin lang fallback (not supported in 3.x) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 18:52:31 +01:00
Benjamin Admin	ed2cc234b8	fix: add error handling and logging to OCR endpoint ... Return detailed error message instead of generic 500, and handle empty OCR results gracefully. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 18:37:32 +01:00
Benjamin Admin	ffd3fd1d7c	fix: remove warmup OCR call — causes OOM on 6G container ... The warmup OCR call during startup pushes memory over 6G and causes OOM kills + restart loops. First real OCR request will be slow (JIT compilation) but container stays stable. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 18:24:55 +01:00
Benjamin Admin	23694b6555	fix: increase paddleocr memory limit 4G → 6G ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 18:08:33 +01:00
Benjamin Admin	8979aa8e43	fix: add warmup OCR call to avoid timeout on first request ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 16:56:08 +01:00
Benjamin Admin	c433bc021e	docs: add post-push deploy monitoring to CLAUDE.md ... After every push to gitea, Claude automatically polls health endpoints and notifies the user when deployment is ready for testing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 13:45:09 +01:00
Benjamin Admin	f4ed1eb10c	feat: add paddleocr-service to Coolify compose ... Add PaddleOCR PP-OCRv5 service with 4G memory limit, model volume, and health check (5min start period for model loading). Domain routing (ocr.breakpilot.com) to be configured in Coolify UI. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 13:43:11 +01:00
Benjamin Admin	9c8663a0f1	Merge gitea/main: accept Coolify compose config ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 13:27:29 +01:00
Benjamin Admin	d1632fca17	docs: update all docs to reflect Coolify deployment model ... Replace Hetzner references with Coolify. Deployment is now: - Core + Compliance: Push gitea → Coolify auto-deploys - Lehrer: stays local on Mac Mini Updated: CLAUDE.md, MkDocs CI/CD pipeline, MkDocs index, environments. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 12:18:25 +01:00
Sharang Parnerkar	fcf8aa8652	fix: migrate deployment from Hetzner to Coolify (#1) ... ## Summary - Add Coolify deployment configuration (docker-compose, healthchecks, network setup) - Replace deploy-hetzner CI job with Coolify webhook deploy - Externalize postgres, qdrant, S3 for Coolify environment - Remove services not needed for SDK deployment (voice, jitsi, synapse) ## All changes since branch creation - Coolify docker-compose with healthchecks for all services - CI pipeline: deploy-hetzner → deploy-coolify (simple webhook curl) - QDRANT_API_KEY support in rag-service - Alpine-compatible Dockerfile fixes Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com> Reviewed-on: #1	2026-03-13 10:45:18 +00:00
Benjamin Admin	65177d3ff7	fix: robust PaddleOCR init with multiple fallback strategies ... PaddleOCR 3.x removed show_log param and lang='latin'. Try multiple init strategies in order until one succeeds. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 11:09:33 +01:00
Benjamin Admin	559d6a351c	fix: resolve stash conflict	2026-03-13 10:59:30 +01:00
Benjamin Admin	8fd11998e4	merge: resolve docker-compose.coolify.yml conflict (accept remote)	2026-03-13 10:56:36 +01:00
Benjamin Admin	4ce649aa71	fix: upgrade PaddleOCR to 3.x for PP-OCRv5 and stability ... Old paddlepaddle==2.6.2 + paddleocr==2.8.1 caused hangs on first OCR request. Upgrading to paddlepaddle>=3.0.0 + paddleocr>=2.9.0 enables native PP-OCRv5 support and fixes stability issues. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 10:53:18 +01:00
Benjamin Admin	5ee3cc0104	fix: load PaddleOCR model in background thread ... The import and model loading can take minutes and was blocking the startup event, causing health checks to timeout. Now loads in a background thread — health endpoint returns 200 immediately with status 'loading' until model is ready. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 10:21:59 +01:00
Benjamin Admin	b36712247b	fix: add detailed logging for PaddleOCR model loading debug ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 10:19:10 +01:00
Sharang Parnerkar	cf2cabd098	Remove services not needed by SDK from Coolify deployment ... Remove backend-core, billing-service, night-scheduler, and admin-core as they are not used by any compliance/SDK service. Update health-aggregator CHECK_SERVICES to reference consent-service instead. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 10:16:59 +01:00
Sharang Parnerkar	8ee02bd2e4	Add healthchecks to backend-core, consent-service, billing-service, admin-core ... Coolify/Traefik requires healthchecks to route traffic to containers. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 10:16:59 +01:00
Sharang Parnerkar	d9687725e5	Remove Traefik labels from coolify compose — Coolify handles routing ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 10:16:59 +01:00
Sharang Parnerkar	6c3911ca47	Fix admin-core build: ensure public directory exists before build ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 10:16:59 +01:00
Sharang Parnerkar	30807d1ce1	Fix backend-core TARGETARCH: auto-detect instead of hardcoded arm64 ... The Dockerfile hardcoded TARGETARCH=arm64 for Mac Mini. Coolify server is x86_64, causing exit code 126 (wrong binary arch). Now uses Docker BuildKit's auto-detected TARGETARCH with dpkg fallback. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 10:16:59 +01:00
Sharang Parnerkar	82c28a2b6e	Add QDRANT_API_KEY support to rag-service ... - Add QDRANT_API_KEY to config.py (empty string = no auth) - Pass api_key to QdrantClient constructor (None when empty) - Add QDRANT_API_KEY to coolify compose and env example Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 10:16:59 +01:00
Sharang Parnerkar	86624d72dd	Sync coolify compose with main: remove voice-service, update rag/embedding ... - Remove voice-service (removed in main branch) - Remove voice_session_data volume - Add OLLAMA_URL and OLLAMA_EMBED_MODEL to rag-service - Update embedding-service default model to BAAI/bge-m3, memory 4G→8G - Update health-aggregator CHECK_SERVICES (remove voice-service) - Update .env.coolify.example accordingly Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 10:16:59 +01:00
Sharang Parnerkar	9218664400	fix: use Alpine-compatible addgroup/adduser flags in Dockerfiles ... Replace --system/--gid/--uid (Debian syntax) with -S/-g/-u (BusyBox/Alpine). Coolify ARG injection causes exit code 255 with Debian-style flags. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 10:16:59 +01:00
Sharang Parnerkar	8fa5d9061a	refactor(coolify): externalize postgres, qdrant, S3; remove jitsi/synapse ... - Remove PostgreSQL, Qdrant, MinIO services (managed separately in Coolify) - Remove Jitsi stack (web, xmpp, jicofo, jvb) and Synapse/synapse-db - Add POSTGRES_HOST, QDRANT_URL, S3_ENDPOINT/S3_ACCESS_KEY/S3_SECRET_KEY env vars - Remove Traefik labels from internal-only services - Health aggregator no longer checks external services - Core now has 10 services: valkey + 9 application services Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 10:16:59 +01:00
Sharang Parnerkar	84002f5719	feat: add Coolify deployment configuration ... Add docker-compose.coolify.yml (17 services), .env.coolify.example, and Gitea Action workflow for Coolify API deployment. Removes nginx, vault, gitea, woodpecker, mailpit, and dev-only services. Adds Traefik labels for *.breakpilot.ai domain routing with Let's Encrypt SSL. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 10:16:59 +01:00
Benjamin Admin	86b11c7e5f	fix: catch all exceptions in PaddleOCR version fallback ... PaddleOCR 2.8.1 throws a generic Exception (not ValueError) when ocr_version='PP-OCRv5' is used. Broadened except clause to catch any error and fall back to lang='latin' for older versions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 10:12:32 +01:00
Benjamin Admin	8003dcac39	fix: PaddleOCR 3.4.0 compatibility — use lang=en with PP-OCRv5 ... PaddleOCR 3.4.0 removed 'latin' language support, causing ValueError at startup. Now uses lang='en' with ocr_version='PP-OCRv5' and falls back to lang='latin' for older PaddleOCR versions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 09:54:52 +01:00
Benjamin Admin	778c44226e	fix: expose port 8095 directly (bypass Traefik 60s timeout) ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-12 14:16:04 +01:00
Benjamin Admin	79891063dd	fix: pin PaddlePaddle 2.6.2 + PaddleOCR 2.8.1 (stable, no PIR bug) ... PaddlePaddle 3.x hat oneDNN/PIR Executor Bug. Zurueck auf 2.6.2 mit bewaeherter ocr() API statt predict(). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-12 13:32:54 +01:00
Benjamin Admin	2c9b0dc448	fix: disable oneDNN (FLAGS_use_mkldnn=0) for PaddlePaddle compat ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-12 13:25:36 +01:00
Benjamin Admin	3133615044	fix: add libgomp1 (OpenMP) + remove unused lang parameter ... PaddlePaddle braucht libgomp.so.1 fuer Inferenz. lang wird ignoriert bei explizitem model_name. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-12 13:19:47 +01:00
Benjamin Admin	2bc0f87325	fix: PaddleOCR model pre-load at startup + 5min healthcheck grace ... Model wird beim Container-Start geladen (nicht erst beim ersten Request). Health-Check start_period auf 300s erhoeht fuer initialen Download. /health gibt "loading" zurueck bis Modell bereit ist. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-12 13:12:14 +01:00
Benjamin Admin	4ee38d6f0b	fix: remove show_log (unknown in PaddleOCR v3 API) ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-12 12:52:52 +01:00
Benjamin Admin	992d4f2a6b	fix: PaddleOCR v3 API — explicit model name + predict() statt ocr() ... lang="latin" braucht text_recognition_model_name in PP-OCRv5. Neue API nutzt predict() statt ocr(), Ergebnis-Format angepasst. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-12 12:47:07 +01:00
Benjamin Admin	8f5f9641c7	fix: libgl1-mesa-glx → libgl1 (Debian bookworm) ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-12 10:33:28 +01:00
Benjamin Admin	7cdb53051f	feat: PaddleOCR Service (PP-OCRv5 Latin auf x86_64) ... Microservice fuer PaddleOCR auf Hetzner. FastAPI mit /ocr und /health Endpoints, API-Key Auth, 4GB Memory Limit, Modell-Cache Volume. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-12 10:20:41 +01:00
Benjamin Admin	8b87b90cbb	fix(qdrant): Increase ulimits for RocksDB (Too many open files) ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-11 22:31:16 +01:00
Benjamin Admin	be45adb975	fix(rag): Auto-create Qdrant collection on first index ... Collections may not exist if init_collections() failed at startup (e.g. Qdrant not ready). Now index_documents() ensures the collection exists before upserting. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-11 21:02:05 +01:00
Benjamin Admin	7c932c441f	feat(rag): Add bp_compliance_gesetze + bp_compliance_ce collections ... Required for Verbraucherschutz + EU law ingestion. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-11 20:41:26 +01:00
Benjamin Admin	1eb402b3da	fix(ci): Remove Ollama host port binding — port 11434 already in use ... Host already has Ollama running (LibreChat). Our container only needs internal docker network access via container name. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-11 20:04:32 +01:00
Benjamin Admin	963e824328	fix(ci): Use external network + pre-create breakpilot-network ... Network already exists from compliance project — use external: true and pre-create with docker network create before docker compose up. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-11 20:01:17 +01:00
Benjamin Admin	c0782e0039	fix(ci): Fix backend-core TARGETARCH for amd64 + set -e in deploy ... - backend-core Dockerfile defaults TARGETARCH=arm64, override with build arg - Add set -e in helper container to fail fast on build errors Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-11 19:51:19 +01:00