Spaces:
Sleeping
Sleeping
Commit History
-
Add Audit Mode: evidence-backed checklist audit for finance documents
Aissugur Kurganbekov +1: Claude Opus 4.8New POST /audit runs a per-type checklist (invoice / contract / payment_note / general) over a document, reusing the /ask retrieval + abstention gate so it never invents a value. A check is SUPPORTED only when retrieval does not abstain AND the cited excerpt contains the field's discriminator keyword; otherwise the field is flagged unsupported (a missing field drives the risk level). Returns a summary, risk_level, per-field findings (claim + evidence + citation), and metrics (counts + citation coverage). Reuses _owned_document for per-user scoping + 404; /ask is unchanged. Frontend: new Audit tab — a B2B audit dashboard (document + type selectors, risk badge, metric cards, per-finding evidence with highlighted citations). Backend: app/audit.py, audit schemas, POST /audit, and tests/test_audit.py (7 tests: field detection, unsupported detection, citation coverage, false-positive guard, 404, cross-user scoping, default type). Hardened after an adversarial review: field discriminators …f22b512
-
Audit-driven hardening + Google sign-in
Aissugur Kurganbekov +1: Claude Opus 4.8Security (from a multi-agent audit): - CRITICAL: never sign JWTs with a shared constant. AUTH_SECRET_KEY is required in production and a random EPHEMERAL key in dev, so a default deploy can't run on a public, forgeable secret. - Fix cross-user history leak: QA rows now carry user_id and /history is scoped to the asker, so questions over shared demo docs no longer leak across users. - Require auth on /evaluate and /demo/seed (resource-amplification guard). - Guest accounts use CSPRNG creds (crypto.getRandomValues) independent of the email; add a token-type claim; guard citations against a deleted parent doc. Feature: "Continue with Google" (Google Identity Services ID-token flow): - POST /auth/google verifies the ID token (google-auth: aud + iss + email_verified) and get-or-creates the user; password_hash is now nullable for OAuth-only accounts. Gated on GOOGLE_CLIENT_ID (button hidden when unset); /health exposes google_client_id. UX/a11y: honest "session expired" messa…90adb95 -
Add user accounts: registration, login (JWT + bcrypt), per-user documents
Aissugur Kurganbekov +1: Claude Opus 4.8Backend: - User model + nullable owner_id on Document (NULL = shared demo/eval docs). - security.py (bcrypt via passlib, PyJWT HS256) and auth.py (/auth/register, /auth/login, /auth/me + get_current_user). Generic 401 with a dummy-hash compare on miss (no user enumeration), 409 on duplicate, EmailStr validation. - /documents*, /ask, /history now require a Bearer token and are scoped to the user's own docs + shared demo docs; cross-user access returns 404 (never leaking ids). /health, /evaluate, /demo/seed stay public. AUTH_SECRET_KEY is env-driven (prod hard-fail, dev default + warning). - conftest authed-by-default so the 12 existing API tests are unchanged; new test_auth.py (register/login/me/protected/per-user isolation). 38 tests pass, live end-to-end verified. Frontend: - Split-layout AuthScreen (sign in / sign up toggle, validation, show/hide password, "Continue with the demo" guest path) in the light theme. - api.js routes every request through a Bearer wrapper …165a274
-
Re-theme the frontend light (cointracker-style) and make Thinking mode honest
Aissugur Kurganbekov +1: Claude Opus 4.8- Drop the dark-purple theme for a light canvas: navy ink (#0d1b2a) + fintech blue (#2563eb) on near-white (#fbfbfd). Rework the :root tokens and convert every dark-assuming value (white-alpha surfaces and borders, the cinematic gradient-mesh, glows, clipped-text gradients, scrollbar, topbar glass) for a light background. All WCAG AA-verified. - Add a "works with" strip and a dark navy proof/testimonials band (placeholder reviews; the 100% / 0 / 25-tests stats are real). - Remove the floating connector line from the hero preview mock. - Make Thinking mode honest: disable the toggle when no API key is configured, show a note when a Thinking request falls back to Fast, and surface the real status in the sidebar. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>a38a802
-
Redesign landing into a cinematic "Proof Engine" experience
Aissugur Kurganbekov +1: Claude Opus 4.8 (1M context)Bold visual overhaul (concept chosen via a 3-agent design judge-panel using the ui-ux-pro-max skill): - Animated gradient-mesh + hairline-grid background (fixed, GPU-cheap) - Cinematic hero stage with a self-running "Verified Answer" product mock: typewriter answer, highlight sweep on the cited figure, SVG citation connector, and an abstain card peeking behind (new HeroPreview.jsx) - Sticky blurred top bar on scroll; rotating conic accent ring on the brand mark - New sections: how-it-works flow, count-up stats band, bento feature grid, "we grade ourselves" evaluation teaser, big final CTA, real footer - IntersectionObserver scroll-reveal (new useScrollReveal hook), Space Grotesk display headlines, gradient-clip hero text - All plain CSS + React, zero new deps; full prefers-reduced-motion fallbacks; Try Demo / upload / ask / evaluation chart untouched Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>2695640
-
Redesign frontend into a premium dark-first AI workspace
Aissugur Kurganbekov +1: Claude Opus 4.8 (1M context)- New design system: dark theme tokens, Inter type, soft accent gradient, glass panels, thin borders, smooth hover/press, shimmer + answer-reveal - App shell: left sidebar nav + main area + right evidence panel - Landing/Overview: hero pitch, trust badges, drag-and-drop upload, doc grid - Ask workspace: demo question chips, loading shimmer, animated answer card, collapsible evidence panel, history - Evaluation: metric cards + pass/fail table + "why it matters" - Reusable components: Button, Card, Badge, Field, Sidebar, DocumentCard, MetricCard, EvidencePanel, Upload, LoadingState/EmptyState/ErrorState - Responsive: desktop / laptop / mobile (sidebar collapses to a top bar) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>375d687 -
FinanceFlow AI: source-grounded RAG Q&A over finance documents
Aissugur Kurganbekov +1: Claude Opus 4.8 (1M context)Full-stack MVP: FastAPI + SQLite backend, React/Vite frontend. - Upload PDF/TXT -> chunk -> TF-IDF retrieval -> focused extractive answer - Two abstention gates + citations for anti-hallucination - Golden-dataset evaluation (UI + CLI) with coverage/abstention/evidence metrics - One-click demo mode, sample-question chips, clean B2B dashboard - Logging, global exception handler, validated/typed API with Swagger docs - 19 pytest tests + GitHub Actions CI - Dockerfiles, docker-compose, Makefile Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>fc5156b