Task #526: Off-Replit migration & GitHub-ready cleanup

Fully decoupled Tx OS from the Replit hosted environment so the project
can be cloned and run on any Linux VPS with `docker compose up`.

Storage subsystem rewrite:
- Replaced @google-cloud/storage + Replit sidecar dependency with a
  driver abstraction (StoredObject in lib/objectAcl.ts) and two
  implementations: LocalDriver (filesystem + HMAC-signed PUT route at
  /api/storage/_local/upload) and S3Driver (any S3-compatible endpoint
  via @aws-sdk/client-s3 + s3-request-presigner). Driver auto-selected
  by STORAGE_DRIVER / S3_ENDPOINT env vars.
- Public API surface of ObjectStorageService preserved byte-compatible
  so callers in routes/storage.ts and routes/executive-meetings.ts did
  not change; download() added to both drivers to keep loadLogoBytes()
  working (caught in code review round 1).
- Storage object-authz tests A-L (incl. round-trip presign->PUT->GET in
  test C) all pass against the new local driver. Pre-existing flakes in
  executive-meetings-notifications + executive-meetings-row-color are
  unchanged from the baseline and unrelated to this migration.

Infrastructure:
- Dockerfile (6 targets: deps/build/api/web/mockup/migrate). API stage
  uses the official Playwright base image so PDF rendering works
  in-container; web stage is nginx serving the Vite SPA bundle; mockup
  stage carries source + node_modules so the dev preview server runs
  with PORT=8081 BASE_PATH=/__mockup.
- docker-compose.yml: postgres + minio + minio-init (creates buckets) +
  api (host :8080) + web (host :3000) + one-shot migrate runner; the
  mockup-sandbox service is gated behind a `dev` profile (host :8081
  /__mockup) so a normal `docker compose up -d` does NOT start it.
  Healthchecks on every long-lived service.
- docker/nginx.conf: SPA fallback, /api proxy, /api/socket.io websocket
  upgrade ordering.
- .env.example: every runtime env var consumed by app/objectStorage/
  auth/seed/compose paths is documented with comments — host ports,
  PUBLIC_BASE_URL, ALLOWED_ORIGINS, SESSION_SECRET, BASE_PATH,
  DATABASE_URL, STORAGE_DRIVER, PRIVATE_OBJECT_DIR,
  PUBLIC_OBJECT_SEARCH_PATHS, S3_*, LOCAL_STORAGE_ROOT,
  LOCAL_STORAGE_SIGNING_SECRET, SEED_*, SMTP_*.
- README.md replaces replit.md as the canonical project doc; covers
  Docker quickstart with a service/port table, local dev, env reference,
  production checklist.
- MIGRATION_REPORT.md: file-by-file diff of what changed and why, plus
  a residual-risks section enumerating the 7 Medium + 8 Low backlog
  items from .local/security/manual-review.md and the unmigrated
  object-data note.

Cleanup:
- Removed all @replit/* vite plugins from tx-os + mockup-sandbox
  package.json + vite.config.ts + pnpm-workspace.yaml catalog.
- Removed @google-cloud/storage and google-auth-library from api-server.
- Deleted attached_assets/ (23MB), sedMkjeJm temp file, stale dist/ and
  *.tsbuildinfo build artefacts, scripts/post-merge.sh, replit.md.
- Stripped Replit references from threat_model.md (sidecar, S4 row,
  G8 invariant), the storage-object-authz test comment, and the
  objectStorage.ts header comment. Source/config/docs are now
  Replit-free.
- New comprehensive .gitignore: attached_assets/, Replit configs
  (.replit, replit.nix, .replitignore, replit.md), agent state (.local/,
  .canvas/, .agents/, .cache/, .config/, .upm/), local storage/, .env*,
  build artefacts.
- scripts/src/seed.ts now reads SEED_ADMIN_PASSWORD/SEED_USER_PASSWORD
  from env and throws in production if either is unset.

Drift from plan: .replit, .replitignore, replit.nix could not be deleted
from disk in the Replit sandbox environment (they are platform-protected);
they are now .gitignore'd so they will not appear in any clone of the
repository, and MIGRATION_REPORT.md documents the one-line `git rm
--cached` an operator can run on a non-Replit clone to purge them from
upstream git history. replit.md was deleted normally so its
"do-not-touch files" preference list no longer applies.

.env.example

@@ -1,34 +1,65 @@
 # ============================================================================
 # Tx OS — environment configuration. Copy to `.env` and edit before deploying.
-# Everything in this file is read by docker-compose.yml at `up` time.
+# Everything in this file is read either by docker-compose.yml at `up` time
+# or directly by the application processes (`api-server`, `tx-os`, scripts).
 # NEVER commit `.env` — it is gitignored. `.env.example` is the public template.
 # ============================================================================
 
-# --- Web (nginx → API reverse proxy) ----------------------------------------
+# -----------------------------------------------------------------------------
-# Host port that exposes the SPA. Front this with Caddy/Nginx/Traefik for TLS.
+# Host ports (compose only)
-WEB_PORT=8080
+# -----------------------------------------------------------------------------
-
+# Port the SPA (nginx) is reachable on. Front with TLS in production.
-# Public base URL the SPA + API are reachable at (used to build absolute
+WEB_PORT=3000
-# upload URLs for the local-FS storage driver and CORS allow-list checks).
+# Port the API container is reachable on. In public deployments, bind this
-PUBLIC_BASE_URL=http://localhost:8080
+# to 127.0.0.1 only so the edge proxy is the sole external entry point.
+API_PORT=8080
+# Component preview server port (dev profile only).
+MOCKUP_PORT=8081
 
+# -----------------------------------------------------------------------------
+# API server runtime
+# -----------------------------------------------------------------------------
+# In compose this is set automatically; required when running natively.
+PORT=8080
+# Public base URL the SPA + API are reachable at. Used to build absolute
+# upload URLs for the local-FS storage driver and to validate CORS origins.
+PUBLIC_BASE_URL=http://localhost:3000
 # Comma-separated list of origins allowed by the API server's CORS layer.
 # Must include PUBLIC_BASE_URL and any additional reverse-proxy domains.
-ALLOWED_ORIGINS=http://localhost:8080
+ALLOWED_ORIGINS=http://localhost:3000
+# pino log level: trace | debug | info | warn | error | fatal
+LOG_LEVEL=info
+# 32+ random bytes. Generate with `openssl rand -hex 32`. REQUIRED.
+SESSION_SECRET=change-me-session-secret-min-32-chars-please
 
-# --- Database ---------------------------------------------------------------
+# -----------------------------------------------------------------------------
+# SPA build (tx-os) — read by Vite at build time AND `pnpm --filter tx-os dev`
+# -----------------------------------------------------------------------------
+# Path the SPA is mounted at. Use "/" when serving from the domain root.
+BASE_PATH=/
+
+# -----------------------------------------------------------------------------
+# Database
+# -----------------------------------------------------------------------------
 POSTGRES_USER=tx
 POSTGRES_PASSWORD=change-me-postgres
 POSTGRES_DB=tx_os
+# Composed automatically by docker-compose; set explicitly when running natively.
+# DATABASE_URL=postgres://tx:change-me-postgres@localhost:5432/tx_os
+DATABASE_URL=postgres://tx:change-me-postgres@db:5432/tx_os
 
-# --- API server -------------------------------------------------------------
+# -----------------------------------------------------------------------------
-# 32+ random bytes. Generate with `openssl rand -hex 32`. Required.
+# Object storage
-SESSION_SECRET=change-me-session-secret-min-32-chars-please
+# -----------------------------------------------------------------------------
+# Driver selection. Set to "s3" for production (MinIO/S3); "local" persists
+# uploads on the API container's filesystem (single-host, dev-only).
+# If unset, the driver auto-detects: "s3" when S3_ENDPOINT is set, else "local".
+STORAGE_DRIVER=s3
 
-# pino log level: trace | debug | info | warn | error | fatal
+# Bucket-level paths used by the API. Format: /<bucket>/<prefix>
-LOG_LEVEL=info
+PRIVATE_OBJECT_DIR=/tx-private/private
+PUBLIC_OBJECT_SEARCH_PATHS=/tx-public/public
 
-# --- Object storage (S3 / MinIO) -------------------------------------------
 # Bucket names — created on first boot by the minio-init container.
 S3_BUCKET_PRIVATE=tx-private
 S3_BUCKET_PUBLIC=tx-public
@@ -41,13 +72,26 @@ S3_SECRET_ACCESS_KEY=change-me-minio-secret-min-20-chars
 # Region label is cosmetic for MinIO but @aws-sdk requires one.
 S3_REGION=us-east-1
 
-# --- Seeded demo accounts ---------------------------------------------------
+# Local-FS driver settings (only consulted when STORAGE_DRIVER=local).
-# Used only by `docker compose run --rm migrate` on first boot. Required in
+# Filesystem root for uploaded objects. Defaults to ./storage relative to
+# the API server's working directory.
+LOCAL_STORAGE_ROOT=./storage
+# HMAC key used to sign + verify upload URLs for the local driver. If
+# unset, the driver falls back to SESSION_SECRET. Set explicitly to rotate
+# upload-URL trust independently of session trust.
+LOCAL_STORAGE_SIGNING_SECRET=
+
+# -----------------------------------------------------------------------------
+# Seeded demo accounts
+# -----------------------------------------------------------------------------
+# Used only by `docker compose run --rm migrate` on first boot. REQUIRED in
 # production — the seed script throws if these are unset and NODE_ENV=production.
 SEED_ADMIN_PASSWORD=change-me-admin-password
 SEED_USER_PASSWORD=change-me-user-password
 
-# --- Email (optional) -------------------------------------------------------
+# -----------------------------------------------------------------------------
+# Email (optional)
+# -----------------------------------------------------------------------------
 # Leave SMTP_HOST blank to disable outbound mail. The Executive Meetings
 # notifier no-ops when no SMTP config is present.
 SMTP_HOST=

Dockerfile

@@ -78,7 +78,22 @@ HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
   CMD wget -qO- http://localhost/healthz >/dev/null || exit 1
 
 # -----------------------------------------------------------------------------
-# Stage 5: one-shot DB migration + seed runner (used by `docker compose run migrate`).
+# Stage 5a: mockup-sandbox runtime (dev-only). Carries source + node_modules
+# so `pnpm --filter @workspace/mockup-sandbox dev` can run the Vite preview
+# server. Not part of the default compose stack — gated behind the `dev` profile.
+# -----------------------------------------------------------------------------
+FROM node:${NODE_VERSION}-bookworm-slim AS mockup
+WORKDIR /app
+RUN corepack enable && corepack prepare pnpm@10.26.1 --activate
+COPY --from=build /app /app
+ENV NODE_ENV=development \
+    PORT=8081 \
+    BASE_PATH=/__mockup
+EXPOSE 8081
+CMD ["pnpm", "--filter", "@workspace/mockup-sandbox", "run", "dev"]
+
+# -----------------------------------------------------------------------------
+# Stage 5b: one-shot DB migration + seed runner (used by `docker compose run migrate`).
 # -----------------------------------------------------------------------------
 FROM node:${NODE_VERSION}-bookworm-slim AS migrate
 WORKDIR /app

README.md

@@ -51,8 +51,18 @@ docker compose run --rm migrate          # one-shot: db push + seed
 docker compose up -d api web
 ```
 
-The SPA is now served at `http://<host>:${WEB_PORT}`. Front it with Caddy /
+After this, the running stack exposes:
-Nginx / Traefik for TLS and HTTP/2.
+
+| Service          | Default host port | URL                            |
+| ---------------- | ----------------- | ------------------------------ |
+| SPA (`web`)      | `3000`            | `http://<host>:3000/`          |
+| API (`api`)      | `8080`            | `http://<host>:8080/api/healthz` |
+| MinIO console    | not exposed       | (proxy to `:9001` if you need it) |
+| `mockup-sandbox` | `8081`            | dev profile only — `docker compose --profile dev up -d mockup-sandbox` then `http://<host>:8081/__mockup` |
+
+Front the SPA (port `WEB_PORT`, default `3000`) with Caddy / Nginx / Traefik
+for TLS and HTTP/2; bind the API port (`API_PORT`, default `8080`) to
+`127.0.0.1` in production so the edge proxy is the sole external entry.
 
 ### Default seeded accounts
 

artifacts/api-server/src/lib/objectStorage.ts

@@ -406,8 +406,8 @@ export const ACTIVE_STORAGE_DRIVER = (): "s3" | "local" =>
 
 // ---------------------------------------------------------------------------
 // ObjectStorageService — public API consumed by routes/storage.ts and
-// routes/executive-meetings.ts. Surface preserved byte-compatible with the
+// routes/executive-meetings.ts. Surface is driver-agnostic and works
-// previous Replit-sidecar implementation.
+// identically against either the local-FS or S3-compatible backend.
 // ---------------------------------------------------------------------------
 
 export class ObjectStorageService {

docker-compose.yml

@@ -100,6 +100,11 @@ services:
       SMTP_PASS: ${SMTP_PASS:-}
       SMTP_SECURE: ${SMTP_SECURE:-}
       SMTP_FROM: ${SMTP_FROM:-}
+    ports:
+      # API — exposed on host :8080 for direct curl/integration access. In
+      # a public-facing deployment this should be bound to 127.0.0.1 only
+      # (e.g. "127.0.0.1:8080:8080") so only the edge proxy reaches it.
+      - "${API_PORT:-8080}:8080"
     networks: [internal]
     healthcheck:
       test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:8080/api/healthz', r => process.exit(r.statusCode===200?0:1)).on('error', () => process.exit(1))\""]
@@ -117,28 +122,28 @@ services:
       api:
         condition: service_healthy
     ports:
-      # Production endpoint — the SPA + reverse-proxied /api ride one port,
+      # SPA — exposed on host :3000. Front this with an operator-managed
-      # which an operator-managed TLS terminator (Caddy / Nginx / Traefik)
+      # TLS terminator (Caddy / Nginx / Traefik) for production HTTPS.
-      # fronts on the public interface. Default 8080 keeps WEB_PORT-driven
+      - "${WEB_PORT:-3000}:80"
-      # configs stable; override via .env to bind 80/443 directly.
-      - "${WEB_PORT:-8080}:80"
     networks: [internal]
 
   # Component preview server. Dev-only — used to iterate on isolated
-  # React components in an iframe-friendly preview. Not part of the
+  # React components in an iframe-friendly preview at /__mockup. Not part
-  # production user surface; kept under the `dev` profile so a normal
+  # of the production user surface; kept under the `dev` profile so a
-  # `docker compose up -d` does NOT start it. Run with:
+  # normal `docker compose up -d` does NOT start it. Run with:
   #   docker compose --profile dev up -d mockup-sandbox
   mockup-sandbox:
     build:
       context: .
-      target: api
+      target: mockup
-    image: tx-os/api:latest
+    image: tx-os/mockup:latest
     profiles: ["dev"]
-    command: ["pnpm", "--filter", "@workspace/mockup-sandbox", "run", "dev"]
+    environment:
-    working_dir: /app
+      NODE_ENV: development
+      PORT: "8081"
+      BASE_PATH: /__mockup
     ports:
-      - "8081:8081"
+      - "${MOCKUP_PORT:-8081}:8081"
     networks: [internal]
 
   # One-shot DB migrate + seed. Run on first boot: