Rollingcat-Software · ahmetabdullahgultekin · May 12, 2026 · May 16, 2026 · May 16, 2026 · May 16, 2026
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -5,7 +5,7 @@
 Multi-tenant biometric auth platform | Marmara University CSE4297 | Hexagonal Architecture
 
 **Status**: Production deployed. Phases 0-8 complete. ~1,900+ tests. All services healthy.
-**Last verified**: 2026-05-12 (Carry-forward from 2026-05-11: 11 PRs shipped across 5 repos + Flyway repair on prod, V59/V60 applied, branch protection on 6 branches, master/main reconciled, INVESTIGATION 2026-05-07 P1 residue closed, tenant onboarding playbook + 8 ADRs + docs/ hierarchy consolidated, spoof-detector blink cache + EAR recalibration paper-P0. **Added today**: parent PR #57 (poster suite: A0 default + 4 style variants compliant with CSE4198 §5.1) + parent PR #58 (archived 18 dated 2026-04/2026-05-04 docs into `archive/2026-05/{audits,plans,reviews,roadmaps,sessions}/`, tidied `.gitignore`); bio PR #99 (closed issue #91: 32 stale unit tests + 3 asyncio-fixture leaks fixed, no production code touched, module-scoped TestClient pattern documented for follow-ups); bio Dependabot #97/#98 in flight (rebased post-#99). Submodule pointer for biometric-processor bumped to post-#99 main.)
+**Last verified**: 2026-05-28 (2026-05-28: **Suite launcher unified + security backlog.** Redesigned shared `<fivucsas-launcher>` web component (web-app #103) — hosted at `app.fivucsas.com/launcher.js` (ships in web-app `public/` → Hostinger deploy), it is the ONE cross-site app switcher + global EN/TR toggle. Rolled out to `demo`, `docs` (+3 subpages: biometric/identity/sdk), `amispoof` (web-app #104 removed the amispoof auto-skip), and `landing`; deleted every site's bespoke "FIVUCSAS suite" cross-site bar + per-site EN/TR switch, incl. the dashboard TopBar toggle (Settings-page language `<select>` kept). One toggle drives `html[data-lang]` (static sites localize via `[data-lang]` CSS) and fires a `fivucsas:languagechange` CustomEvent → `i18n.changeLanguage` for the React surfaces (dashboard + verify share `web-app/src/i18n/index.ts`; landing listens in `App.tsx`). `links.fivucsas.com` keeps its own controls — it IS the hub. **api #111 (S13)**: TOTP used-code replay prevention — bounded ~120s Redis `SET key 1 EX NX` marker per `(userId, timeStep)`, max ~3 in-window markers/user, in-memory fallback capped 50k; NOT an infinite blacklist; enrollment keeps plain verify (legit retries). **web #102 (F13/F9)**: surfaced swallowed voice-enrollment errors via `formatApiError` + the `OTP_ATTEMPTS_EXHAUSTED` state. **F12** voice threshold verified CORRECT (verify = cosine *similarity* `>=` 0.65; search = pgvector `<=>` cosine *distance* `< 0.6`) — no change. 2026-05-21: `links.fivucsas.com` hub — API tile → `/swagger-ui.html` with admin-IP "gated" badge (raw API root returned 401), Turkish i18n role-label fixes (English under `lang=tr` was İ-mangling Latin `i` under uppercase), team contact info, Ayşenur LinkedIn URL fix; poster author contact block + **regenerated A0 PDF/PNG** from `landing-website/public/poster/files/fivucsas-poster.html`; attribution — Ayşe Gülsüm Eren GitHub `@aysegulsum` + `marun.edu.tr` academic emails across `spoof-detector` + `practice-and-test` (forensic git-author records left intact); bilingual TR/EN switchers completed on `bys-demo`/`docs-site`/`verify-widget`. Consolidated into PR #69 → `master` (whole `fix/2026-05-12-bake-mini-fasnet-models` branch). NOTE: `api.fivucsas.com/` returns 401 by design (it's an API origin, not a page); Swagger/`/v3/api-docs`/`/actuator` are admin-IP gated (403 public), OIDC discovery is public (200). Carry-forward from 2026-05-12 / 2026-05-11: 11 PRs shipped across 5 repos + Flyway repair on prod, V59/V60 applied, branch protection on 6 branches, master/main reconciled, INVESTIGATION 2026-05-07 P1 residue closed, tenant onboarding playbook + 8 ADRs + docs/ hierarchy consolidated, spoof-detector blink cache + EAR recalibration paper-P0. **Added today**: parent PR #57 (poster suite: A0 default + 4 style variants compliant with CSE4198 §5.1) + parent PR #58 (archived 18 dated 2026-04/2026-05-04 docs into `archive/2026-05/{audits,plans,reviews,roadmaps,sessions}/`, tidied `.gitignore`); bio PR #99 (closed issue #91: 32 stale unit tests + 3 asyncio-fixture leaks fixed, no production code touched, module-scoped TestClient pattern documented for follow-ups); bio Dependabot #97/#98 in flight (rebased post-#99). Submodule pointer for biometric-processor bumped to post-#99 main.)
 
 ## Architecture
 
@@ -26,6 +26,7 @@ Storage: PostgreSQL 17 + pgvector | Redis 7.4
 | Landing Site | https://fivucsas.com |
 | Auth Widget / SDK | https://verify.fivucsas.com |
 | BYS Demo | https://demo.fivucsas.com |
+| amispoof — browser anti-spoof tester | https://amispoof.fivucsas.com/ (old https://fivucsas.com/amispoof/ now 301s to the subdomain) |
 | Uptime Monitor | https://status.fivucsas.com |
 | Swagger | https://api.fivucsas.com/swagger-ui.html (admin-IP-gated since IN-H2 2026-04-19; allowlist in `infra/traefik/config/dynamic.yml`) |
 
@@ -62,6 +63,38 @@ scp -P 65002 -r dist/* u349700627@46.202.158.52:~/domains/app.fivucsas.com/publi
 # BYS demo deploy
 scp -P 65002 -r /opt/projects/fivucsas/bys-demo/* u349700627@46.202.158.52:~/domains/demo.fivucsas.com/public_html/
 
+# amispoof deploy (TypeScript spoof-detector + webcam tester to amispoof.fivucsas.com)
+# Migrated 2026-05-17 from fivucsas.com/amispoof/ → amispoof.fivucsas.com subdomain.
+# Old URL serves a 301 to the new one via ~/domains/fivucsas.com/public_html/amispoof/.htaccess.
+# We deploy to the NEW subdomain root; the lazy chunks under lib/ + models/ need to be sent too.
+cd /opt/projects/fivucsas/spoof-detector/web
+npm run build && npm run amispoof:bundle
+scp -P 65002 amispoof/index.html amispoof/app.js u349700627@46.202.158.52:~/domains/amispoof.fivucsas.com/public_html/
+scp -P 65002 amispoof/lib/spoof-detector.js amispoof/lib/spoof-detector.js.map amispoof/lib/spoof-detector-*.js amispoof/lib/spoof-detector-*.js.map u349700627@46.202.158.52:~/domains/amispoof.fivucsas.com/public_html/lib/
+# Models only need to be sent once after the subdomain is created; subsequent deploys can skip these.
+# scp -P 65002 amispoof/models/minifasnet_v2.onnx amispoof/models/face_landmarker.task u349700627@46.202.158.52:~/domains/amispoof.fivucsas.com/public_html/models/
+
+# Deploy links hub (links.fivucsas.com — single static index.html)
+scp -P 65002 /opt/projects/fivucsas/links-website/index.html u349700627@46.202.158.52:~/domains/links.fivucsas.com/public_html/index.html
+
+# Deploy verify.fivucsas.com (hosted login + auth widget — Docker/nginx via Traefik, NOT Hostinger)
+# CRITICAL: build:verify needs VITE_API_BASE_URL. vite.verify.config.ts sets envDir=project root
+# so .env.production is loaded — without it env.ts throws at boot and /login renders blank
+# (#verify-root never mounts). Preserve the SDK files (fivucsas-auth*.js) at the html root.
+cd /opt/projects/fivucsas/web-app && npm run build:verify
+rsync -a --delete dist-verify/assets/ ../verify-widget/html/assets/   # assets/ = verify build only
+cp dist-verify/index.html ../verify-widget/html/index.html            # keep html/fivucsas-auth*.js
+cd /opt/projects/fivucsas/verify-widget
+docker compose -f docker-compose.prod.yml build && docker compose -f docker-compose.prod.yml up -d
+# Verify: curl -s https://verify.fivucsas.com/ | grep assets/index-  (new hash) — /login must mount React
+
+# Regenerate + deploy the poster PDF/PNG from the canonical HTML (A0 841×1189mm).
+# Canonical poster = landing-website/public/poster/files/fivucsas-poster.html (served at fivucsas.com/poster/files/; the viewer poster/index.html links only to files/*).
+cd /opt/projects/fivucsas/landing-website/public/poster/files
+google-chrome-stable --headless=new --no-sandbox --virtual-time-budget=20000 --no-pdf-header-footer --print-to-pdf=fivucsas-poster.pdf "file://$PWD/fivucsas-poster.html"
+google-chrome-stable --headless=new --no-sandbox --virtual-time-budget=20000 --window-size=3179,4494 --screenshot=fivucsas-poster-preview.png "file://$PWD/fivucsas-poster.html"
+scp -P 65002 fivucsas-poster.pdf fivucsas-poster-preview.png u349700627@46.202.158.52:~/domains/fivucsas.com/public_html/poster/files/
+
 # Check all services
 docker ps --format "table {{.Names}}\t{{.Status}}"
 ```
@@ -80,6 +113,7 @@ FIVUCSAS/                    # Parent repo (submodules)
 ├── docs/                    # Architecture docs + plans
 ├── bys-demo/                # Demo site (static HTML)
 ├── landing-website/         # Landing page → Hostinger
+├── links-website/           # links.fivucsas.com hub (static index.html) → Hostinger
 ├── practice-and-test/       # R&D experiments
 ├── scripts/                 # Deploy scripts, setup-twilio.sh
 └── ROADMAP.md               # Product roadmap
@@ -193,4 +227,5 @@ CX43 CPU-only — GPU ihtiyacı doğmaz (Faz 1-3 roadmap CPU-safe).
 - **Python**: Clean Architecture, Pydantic, async/await
 - No hardcoded secrets — use .env.prod
 - Do NOT dockerize static sites (keep on Hostinger)
-- Recommend first, implement only after explicit approval
+- Autonomy (2026-05-28): commit/push/merge (incl. PR `--admin`) without per-action approval; spawn concurrent agents for independent stacked tasks. Recommend-first is reserved for significant DESIGN/product choices and destructive/irreversible actions.
+- Always keep related docs up to date (CLAUDE.md, READMEs, deploy runbooks) and commit them with the change.