All 11 articles resolved manually via Légifrance web search and validated
against the PISTE API (getArticle endpoint). The search endpoint returned
HTTP 500 consistently; IDs were extracted from canonical Légifrance URLs
and cross-checked against the API for num/état correctness.
Articles covered: CP-225-1, L1881-24, CP-222-33, CP-222-33-2-2,
CP-421-2-5, CP-211-1, L1881-24bis, CP-226-4-1, CP-212-1, CP-223-13,
L1881-29. Baseline texts stored for drift detection via --check.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Implements a two-layer approach to ensure legal texts are accurate and current:
Option A — runtime injection (legifrance_client.py):
- LegifranceClient: OAuth2 via PISTE (oauth.piste.gouv.fr), fetches consolidated
article text via api.piste.gouv.fr/dila/legifrance/lf-engine-app
- Redis cache with 24h TTL (in-memory fallback if no Redis)
- build_filter_prompt() injects live texts into the prompt with explicit priority
over static descriptions — model uses official Légifrance text, not training memory
- Graceful fallback to static prompt if API is unavailable — filtering never blocks
Option B — weekly sync script (scripts/check_legal_refs.py):
- Reads legal_refs.yaml (11 tracked articles, priority critical/high/medium)
- Fetches current text from Légifrance, diffs against stored baseline
- --init: resolves LEGIARTI IDs on first run
- --check: report only; --update: saves new texts to YAML
- Exit code 2 when changes detected (CI/n8n-compatible)
Supporting changes:
- legal_refs.yaml: tracked articles with code LEGITEXT IDs, priorities, rationale
- requirements.txt: add pyyaml>=6.0.2 and requests>=2.32.0
- .env.example: document PISTE_CLIENT_ID, PISTE_CLIENT_SECRET, LEGIFRANCE_CACHE_TTL
- transparence.tsx: document the Légifrance injection for public transparency
- Fixed portal URL: piste.gouv.fr (not piste.api.gouv.fr — verified June 2026)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Prompts (legal_framework.py + prompts.ts):
- Add source-grounding rule: model must use only the provided legal texts
- Fix section 8 heading: "Livre préliminaire" doesn't exist in French CP —
correct to "Livres II et IV" with proper structural references
- Fix Art. 211-2 description: was "incitation directe et publique" (wrong) —
corrected to "participation à un groupement formé en vue de préparer"
- Fix Loi 1881 Art. 24: remove misleading terrorism note — apologie du
terrorisme was transferred to CP Art. 421-2-5 by law n° 2014-1353
- Fix CRITÈRES DE REJET: remove phantom reference to Loi 1881 Art. 24 al. 6
for terrorism (no longer in force for this offense since 2014)
transparence.tsx:
- Fix step 1: IP hash IS stored (30 days, separate table, anti-abuse only)
- Fix step 2: "(GPT)" → "(Mistral)" — wrong AI provider
- Fix data table: IP row was "Non conservée" — corrected to hash SHA-256
- Fix récapitulatif: "Données personnelles: Aucune" → accurate with IP hash
- Fix sources list: "Livre préliminaire" → correct Livre II/IV references
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Replace all OpenAI/GPT references with Mistral AI (mistral-small-latest,
mistral-large-latest) and correct env var names (FILTER_MODEL, SYNTHESIS_MODEL)
- Expand DB schema: add missing columns on ideas/synthesis, add tables
consultations, consents, ip_abuse with full column list
- Expand API routes table from 5 to 33 routes (admin, consultations,
contributions, check-law, consent, exports, ip-blacklist)
- Add third AI agent: law-check (LAW_CHECK_PROMPT / POST /api/check-law)
- Expand legal basis from 7 to 16 sources
- Update Vite version: 6 → 7
- Add public pages routing table
- Add autoclose consultation flow diagram (section 4.3)
- Fix security section: replace Azure/OpenAI with Mistral AI
- Update date (April → June 2026), status (Production → Recette)
- Fix DEPLOIEMENT.md diagram: OpenAI API → Mistral AI API
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Replace all homegit.gyozamancave.fr links with internal page links
or plain text (no external repo exposure)
- Replace piron.antoine@gmail.com with contact@example.com placeholder
- Add prompts verbatim section to /transparence page (filter, synthesis,
law-check prompts) via new src/lib/prompts.ts module
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Nav: "Fonctionnement" and "Flyer QR" restored on mobile via a ···
overflow dropdown (click-outside closes); other links always visible
Law check: new POST /api/check-law endpoint (5/min, 20/h) calls
mistral-small with a new LAW_CHECK_PROMPT to detect if a proposal is
already covered by French or EU law. Informational only, non-blocking.
Frontend: "Vérifier le cadre légal existant" button below textarea in
home.tsx; result displayed with Scale icon; resets on content change.
Favicon: replaced placeholder red square with a petrol rounded square
containing a serif "V" (for Voix) in warm cream — matches brand palette
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Persistence: PostgreSQL table ip_abuse (ip_hash SHA-256, rejection_count,
timestamps, last_idea_id, blacklisted_at, expires_at). No raw IP stored.
Logic:
- First illegal contribution: recorded, tolerated (benefit of the doubt)
- Second illegal contribution: 30-day block (IP_BLACKLIST_DAYS, configurable)
- Counter is cumulative — valid contributions do not reset it
- Block check fires before all other validations in both submit routes
Backend:
- database.py: check_ip_blacklist, record_ip_rejection, get_ip_blacklist,
remove_ip_blacklist; ip_abuse table created in init_db()
- app.py: _get_ip_hash() helper; blacklist check + record in submit_idea()
and submit_consultation_idea(); admin routes GET/DELETE /api/admin/ip-blacklist
Admin panel: new "Blacklist" tab showing active entries with hash, rejection
count, trigger idea id, dates; "Lever" button for manual removal
Docs:
- SECURITE_ANTI_ABUS.md: section 8 describing the mechanism, RGPD basis,
limits, and IP_BLACKLIST_DAYS env var
- privacy-policy.tsx: IP row updated to reflect hash storage + legal basis
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Require exact counts ("une contribution", "X sur Y") — forbid vague
"des citoyens" or "plusieurs" without numerical basis
- Prohibit paraphrasing that softens or amplifies a concrete demand
- Require explicit mention of contradictions (no artificial consensus)
- Catch-all sentence for contributions that fit no identified theme,
rather than silently dropping them
- Grouping by theme conditional on ≥2 contributions covering it
- Cap raised to 5 themes to avoid forced merging on heterogeneous sets
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Navbar: hide Fonctionnement and Flyer QR on mobile (hidden sm:inline),
preventing overflow on small screens
- Home: add mobile tab bar (Proposer / Synthèse) replacing the broken
two-column stacked layout that was constrained to h-[calc(100vh-5rem)]
- Grid: md:h-[calc(100vh-9rem)] (desktop only); columns show/hide via
mobileTab state
- Countdown: visible in synthesis tab label on mobile, in header on md+
- Textarea: 90px min-height on mobile, 120px on sm+
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Show a live countdown (15→0s) in the synthesis header indicating when the
next auto-refresh will occur. Resets on every successful synthesis fetch.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Export ApiError from api-client-react package
- home.tsx onError: extract error.data.message from ApiError and display it
(cooldown, rate limit, consent_required, validation messages are now visible)
- Differentiate alert title: "Contribution non retenue" for AI rejection
(has a reason), "Envoi impossible" for technical errors
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Backend (app.py / database.py / ai_agent.py):
- [Critique] Autoclose loop: add pg_try_advisory_lock so only one Gunicorn
worker runs the check per 60s cycle; add random startup jitter
- [Critique] admin_delete_idea: pass consultation_id to
_update_synthesis_background so the right synthesis is regenerated
- [Majeur] admin_login: return HMAC-signed session token instead of raw
ADMIN_SECRET; require_admin verifies the signature (TTL 8h)
- [Majeur] bulk_delete: replace str.isdigit() (Unicode-unsafe) with
try/except int() to prevent crash on Unicode digit characters
- [Majeur] create_consultation: force UTC timezone on naive datetime from
fromisoformat() to prevent TypeError when comparing with UTC-aware now()
- [Majeur] ai_agent.py: fix 'raw' in dir() -> 'raw' in locals() so the
JSON parse error log actually shows the raw response
- [Mineur] export print: use datetime.now(UTC) instead of datetime.now()
Frontend (React):
- [Majeur] consultation.tsx: show startsAt (not endsAt) for upcoming
consultations; add startsAt variable
- [Majeur] consultations-list.tsx: same fix for the list view
- [Mineur] home.tsx: guard new Date(idea.createdAt) against null
- [Mineur] admin.tsx: check HTTP status in exportCsv XHR before creating
download link; show error toast on non-200
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- home.tsx: extract postConsent() helper; make onSubmit async and await it
before doActualSubmit (returning users); await it in handleConsentConfirm
before doActualSubmit (new users, was fire-and-forget)
- consultation.tsx: same fix on returning-user path in onSubmit
Without this, returning users (consent_v1 in localStorage) never called
/api/consent so the _ct cookie was never set, causing all submissions to
return 403 consent_required.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Require signed _ct cookie (set by POST /api/consent) before accepting any
submission. Direct API calls without a prior consent flow are rejected 403.
- Add _sign_consent_token / _verify_consent_token (HMAC-SHA256, 24h TTL).
- Lower default CONTRIBUTION_COOLDOWN_SECONDS from 3600 to 240 (4 min).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
init_db() was only called inside if __name__ == "__main__", which Gunicorn
never executes. Tables were never created, causing every request to fail.
Move the call to module level so it runs on import, before the autoclose
thread starts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@replit/vite-plugin-cartographer and @replit/vite-plugin-runtime-error-modal
were removed from the workspace catalog during de-Replit-isation but remained
in mockup-sandbox/package.json, breaking pnpm install. Lockfile regenerated.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- CONTRIBUTING.md : section "Proposer une contribution" réécrite avec
tableaux Markdown, blocs de code inline (convention branches, commits,
template PR), règles backend/frontend détaillées
- README.md : mention financement déplacée juste après la présentation,
avant la section Fonctionnalités ; section Soutenir le projet supprimée
en fin de fichier
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- README réécrit à partir du code : fonctionnalités réelles, stack,
installation (dev local, build, prod), variables d'environnement
documentées avec leur effet, références aux docs existants
- CONTRIBUTING.md créé : signalement de bug, procédure de PR,
mention que GitHub est un miroir public du dépôt Gitea source
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Venv Python : création automatique si absent (détecte python3.11,
python3, python >= 3.9 ; erreur guidée si introuvable)
- Dépendances pip : pip install -r requirements.txt à chaque lancement
(no-op si rien n'a changé, garantit la cohérence après un pull)
- pnpm : installation automatique via corepack (si dispo) ou npm
- Node.js : non installable sans root — message d'erreur avec commandes
exactes pour Rocky/RHEL, Debian/Ubuntu et nvm
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Nouveau script scripts/dev-local.sh : lance Flask (port 8080) et le
serveur Vite dev (port 5173) en parallèle avec nettoyage propre
(trap EXIT/INT/TERM). VITE_API_URL est injecté pour pointer vers
Flask local, accessible depuis le client via tunnel SSH.
- docs/INSTALL_ROCKY.md : nouvelle section 16 avec schéma ASCII,
procédure pas-à-pas et commande tunnel SSH exacte.
- docs/INSTALL_ROCKY.md : corrige les deux références cassées à
vite.config.selfhost.ts (sections 9 et 15.1) supprimé lors de la
dé-Replit-isation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- .env.example : variables à jour (Mistral, SECRET_KEY, ADMIN_SECRET, Redis,
hCaptcha, anti-abus) — l'ancienne version référençait encore OpenAI uniquement
- Nouveau set-domain.sh : supprime la référence à vite.config.selfhost.ts supprimé
- Nouvelle page /consultations : index public des consultations actives/clôturées,
toggle "afficher les clôturées", lien dans le footer
- App.tsx : route /consultations + lien footer Consultations
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
P3 — RGPD :
- Table `consents` + `POST /api/consent` (art. 7.1 — preuve du consentement)
- Dialogue de consentement explicite avant la première contribution (art. 9.2.a)
- Pages `/mentions-legales` et `/politique-confidentialite`
- `docs/RGPD.md` — registre des traitements, bases légales, sous-traitants
- `getVisitorId()` exporté depuis l'API client React
P4 — Transparence éditoriale :
- Page `/contributions-brutes` avec pagination et export JSON/CSV
- `GET /api/contributions`, `GET /api/contributions/export/{json,csv}`
- `GET /api/stats/public` — stats publiques sans données de rejet
- Label de transparence IA sur la colonne de synthèse
- Compteurs (acceptées / soumises) dans le bandeau d'intro
- `docs/PROMPTS_IA.md` — prompts intégraux publiés + analyse des biais
- Pied de page avec liens légaux et transparence
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add secure admin panel with authentication and authorization features, update DEX.md to include admin panel documentation, and modify INSTALL_ROCKY.md to include ADMIN_SECRET configuration.
Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 923ae0e3-a363-4db8-b04a-e8baca2a1330
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 79c67b0b-a0eb-4a65-acef-813c12178ea4
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/8af7d2ec-2cc3-4ece-8af3-9f071488d072/923ae0e3-a363-4db8-b04a-e8baca2a1330/sVU8w5x
Replit-Helium-Checkpoint-Created: true
Adds an admin interface with authentication for manual content deletion and flagging. Implements a flagging system for user contributions and secures the admin panel with a secret token.
Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 923ae0e3-a363-4db8-b04a-e8baca2a1330
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 7e5834b1-796d-4a9e-bbde-cd91012292de
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/8af7d2ec-2cc3-4ece-8af3-9f071488d072/923ae0e3-a363-4db8-b04a-e8baca2a1330/nghZcOj
Replit-Helium-Checkpoint-Created: true
Update AI agent's legal framework to include French penal code, press law, and digital regulations, and update frontend to reflect new legal sources and rejection criteria.
Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 923ae0e3-a363-4db8-b04a-e8baca2a1330
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: d5df5b15-f2c9-4041-91be-f6bf0155cea0
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/8af7d2ec-2cc3-4ece-8af3-9f071488d072/923ae0e3-a363-4db8-b04a-e8baca2a1330/nghZcOj
Replit-Helium-Checkpoint-Created: true
Integrate French penal code and press law into the legal filter prompt and update frontend displays to reflect the expanded moderation criteria, including rejection of obscene and defamatory content.
Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 923ae0e3-a363-4db8-b04a-e8baca2a1330
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: ec496618-f357-4c5d-aea6-f0bff4665765
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/8af7d2ec-2cc3-4ece-8af3-9f071488d072/923ae0e3-a363-4db8-b04a-e8baca2a1330/nghZcOj
Replit-Helium-Checkpoint-Created: true
Add a detailed guide for installing the application on Rocky Linux, including systemd service setup and Nginx configuration. Streamline domain setting by introducing a script to update environment variables and rebuild the frontend, and remove the URL input from the flyer component.
Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 923ae0e3-a363-4db8-b04a-e8baca2a1330
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 3d999b96-66af-4728-92b9-3a39ade05f44
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/8af7d2ec-2cc3-4ece-8af3-9f071488d072/923ae0e3-a363-4db8-b04a-e8baca2a1330/qCk7LE3
Replit-Helium-Checkpoint-Created: true
Update documentation files (DAT.md, DEX.md, WIKI.md) to version 1.4, incorporating changes related to Gitea synchronization, the `GITEA_TOKEN` secret, and the `scripts/push-gitea.sh` script.
Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 923ae0e3-a363-4db8-b04a-e8baca2a1330
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: cae3c6dc-0372-4c09-9980-7184f80535a3
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/8af7d2ec-2cc3-4ece-8af3-9f071488d072/923ae0e3-a363-4db8-b04a-e8baca2a1330/qCk7LE3
Replit-Helium-Checkpoint-Created: true
Update the GITEA_TUTO.md file to reflect changes in authentication methods and repository setup, including instructions for storing GITEA_TOKEN as a Replit secret and using a push script for secure uploads.
Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 923ae0e3-a363-4db8-b04a-e8baca2a1330
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: ffa8f38b-d6c8-48cc-9ccf-963475e8344c
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/8af7d2ec-2cc3-4ece-8af3-9f071488d072/923ae0e3-a363-4db8-b04a-e8baca2a1330/vOeFCU4
Replit-Helium-Checkpoint-Created: true
Integrate a dark mode, an accessibility panel with options for dyslexia, high contrast, and text scaling, and enhance keyboard navigation. Update documentation to reflect these changes.
Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 923ae0e3-a363-4db8-b04a-e8baca2a1330
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: bbd001b6-1b5f-4425-9310-55a9081dabf8
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/8af7d2ec-2cc3-4ece-8af3-9f071488d072/923ae0e3-a363-4db8-b04a-e8baca2a1330/vOeFCU4
Replit-Helium-Checkpoint-Created: true
Update documentation files to reflect the new neutral color palette and expanded content regarding the platform's editorial stance on expression versus truth, including details on modifying these elements.
Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 923ae0e3-a363-4db8-b04a-e8baca2a1330
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 1404ac3c-9098-4103-9b81-7dfccdd6ff03
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/8af7d2ec-2cc3-4ece-8af3-9f071488d072/923ae0e3-a363-4db8-b04a-e8baca2a1330/UL3T8eF
Replit-Helium-Checkpoint-Created: true
Modify CSS variables for a politically neutral color palette and inject disclaimer text across multiple pages to clarify that the platform captures citizen expression rather than established truth.
Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 923ae0e3-a363-4db8-b04a-e8baca2a1330
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: a6455e51-215a-43d1-a452-a445436b0317
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/8af7d2ec-2cc3-4ece-8af3-9f071488d072/923ae0e3-a363-4db8-b04a-e8baca2a1330/UL3T8eF
Replit-Helium-Checkpoint-Created: true
Update several documentation files (.toml, .md) to reflect new features such as a QR code flyer page, share/PDF export buttons, and dependency updates, including version increments to v1.1.
Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 923ae0e3-a363-4db8-b04a-e8baca2a1330
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 88b9da52-be77-4c86-854b-f097a8c7ae86
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/8af7d2ec-2cc3-4ece-8af3-9f071488d072/923ae0e3-a363-4db8-b04a-e8baca2a1330/Z3YUti7
Replit-Helium-Checkpoint-Created: true
Update backend AI agent to support Mistral API alongside OpenAI and Replit integrations. Default filter model changed to 'mistral-small-latest' and synthesis model to 'mistral-large-latest'. Frontend transparency page updated to reflect these changes and new configuration variables.
Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 923ae0e3-a363-4db8-b04a-e8baca2a1330
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: ec257d30-4a6a-4c7b-85f5-c18945dba29f
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/8af7d2ec-2cc3-4ece-8af3-9f071488d072/923ae0e3-a363-4db8-b04a-e8baca2a1330/qrVKaka
Replit-Helium-Checkpoint-Created: true
billisdead
pironantoine