Ca Donations

Search the build

51 commits indexed

1. 3296d4e 2026-09-26 auto-data-snapshot: 2026-09-26T09:40:15 (1 data files) — data/latest.json
2. 53d04aa 2026-09-25 auto-data-snapshot: 2026-09-25T09:20:47 (1 data files) — data/latest.json
3. 1e421ec 2026-09-24 auto-data-snapshot: 2026-09-24T09:44:11 (1 data files) — data/latest.json
4. 181636a 2026-09-23 auto-data-snapshot: 2026-09-23T09:31:43 (1 data files) — data/latest.json
5. 6f9e876 2026-09-23 auto-data-snapshot: 2026-09-23T04:15:24 (1 data files) — data/latest.json
6. 129bcf2 2026-09-22 auto-data-snapshot: 2026-09-22T09:54:34 (1 data files) — data/latest.json
7. 5ced7f8 2026-09-21 auto-data-snapshot: 2026-09-21T09:21:33 (1 data files) — data/latest.json
8. 27676a1 2026-09-20 auto-data-snapshot: 2026-09-20T09:27:07 (1 data files) — data/latest.json
9. 90e19eb 2026-09-19 auto-data-snapshot: 2026-09-19T09:27:32 (1 data files) — data/latest.json
10. dc8c9bf 2026-09-18 auto-data-snapshot: 2026-09-18T09:26:51 (1 data files) — data/latest.json
11. 8e86229 2026-09-17 auto-data-snapshot: 2026-09-17T09:20:48 (1 data files) — data/latest.json
12. bb2d1f9 2026-09-16 auto-data-snapshot: 2026-09-16T09:33:20 (1 data files) — data/latest.json
13. 1c5656f 2026-09-15 auto-data-snapshot: 2026-09-15T09:48:56 (1 data files) — data/latest.json
14. 658763d 2026-09-14 auto-data-snapshot: 2026-09-14T09:19:35 (1 data files) — data/latest.json
15. 73669e5 2026-09-13 auto-data-snapshot: 2026-09-13T09:49:22 (1 data files) — data/latest.json
16. ce3d989 2026-09-12 auto-data-snapshot: 2026-09-12T09:28:54 (1 data files) — data/latest.json
17. d02968a 2026-09-11 auto-data-snapshot: 2026-09-11T09:31:49 (1 data files) — data/latest.json
18. 2127872 2026-09-10 auto-data-snapshot: 2026-09-10T09:22:46 (1 data files) — data/latest.json
19. dbb620a 2026-09-09 auto-data-snapshot: 2026-09-09T09:32:15 (1 data files) — data/latest.json
20. 71f6984 2026-09-08 auto-data-snapshot: 2026-09-08T09:40:47 (1 data files) — data/latest.json
21. 9770295 2026-09-07 auto-data-snapshot: 2026-09-07T09:25:49 (1 data files) — data/latest.json
22. 1a19cc7 2026-09-06 auto-data-snapshot: 2026-09-06T09:42:39 (1 data files) — data/latest.json
23. 76d16ab 2026-09-05 auto-data-snapshot: 2026-09-05T09:24:41 (1 data files) — data/latest.json
24. 64181ae 2026-09-04 auto-data-snapshot: 2026-09-04T09:31:20 (1 data files) — data/latest.json
25. 5263e1e 2026-09-03 auto-data-snapshot: 2026-09-03T09:53:05 (1 data files) — data/latest.json
26. f0c5d71 2026-09-02 auto-data-snapshot: 2026-09-02T09:35:20 (1 data files) — data/latest.json
27. dc40ae8 2026-09-01 auto-data-snapshot: 2026-09-01T09:42:16 (1 data files) — data/latest.json
28. 99b9662 2026-08-31 auto-data-snapshot: 2026-08-31T09:29:05 (1 data files) — data/latest.json
29. 9e95ec9 2026-08-30 auto-data-snapshot: 2026-08-30T09:43:11 (1 data files) — data/latest.json
30. 201e0b6 2026-08-29 auto-data-snapshot: 2026-08-29T09:43:04 (1 data files) — data/latest.json
31. 8273b35 2026-08-28 auto-data-snapshot: 2026-08-28T09:39:28 (1 data files) — data/latest.json
32. 1c4c4df 2026-08-27 auto-data-snapshot: 2026-08-27T09:33:34 (1 data files) — data/latest.json
33. c7f03c2 2026-08-26 auto-data-snapshot: 2026-08-26T09:38:32 (1 data files) — data/latest.json
34. 2d6ecd0 2026-08-25 creds-safe fetch guard: resolve relative fetch vs credential-free location (creds-in-URL trap)
35. 0ec0654 2026-08-25 auto-data-snapshot: 2026-08-25T09:32:22 (1 data files) — data/latest.json
36. e807f8e 2026-08-24 ca-donations: materialized k-anon political rollup (political_agg) — agg endpoint fast + Basic-Auth gated (not public), refreshes on ingest
37. 15aa128 2026-08-24 ca-donations: gated go-live runbook (Kamatera migration + nginx/cert + DNS + daily-loader launchd) — Steve-run
38. 80ce7b1 2026-08-24 ca-donations: harden public gate — strict positive allowlist, Object.hasOwn agg validator, explicit column lists (Cody FIX-FIRST)
39. b285cb4 2026-08-24 ca-donations: public tier behind PUBLIC_TIER flag (default-off) — charitable open, political gated, k-anon aggregate rollups
40. 1068eb4 2026-08-24 auto-data-snapshot: 2026-08-24T11:44:27 (2 data files) — data/latest.json public/robots.txt
41. 1aaea0a 2026-08-24 auto-data-snapshot: 2026-08-24T09:36:43 (1 data files) — data/latest.json
42. 30429c4 2026-08-23 auto-data-snapshot: 2026-08-23T09:39:07 (1 data files) — data/latest.json
43. 6af8822 2026-08-23 ca-donations: href-to-deeper-data — chips are real drill anchors + URL-synced tab/filter state (deep-link/back-button), clears href-drill regression
44. b63091b 2026-08-22 auto-data-snapshot: 2026-08-22T18:14:40 (1 data files) — data/latest.json
45. e220fe9 2026-08-22 ca-donations: freshness+completeness canary + data-quality audit (cycle 2)
46. 8340af8 2026-08-22 ca-donations: FIX-FIRST hardening (Cody gate) — rate limit + data-quality guard
47. 9e7508b 2026-08-22 ca-donations: wire server-side sort (mandatory sort rule) across all 3 families
48. 37ac678 2026-08-22 ca-donations: political + foundation-grant ingest landed (both families live)
49. 5197daa 2026-08-21 auto-data-snapshot: 2026-08-21T08:45:49 (2 data files) — package-lock.json package.json
50. 1be72ab 2026-08-21 ca-donations: Express server + Basic-Auth + searchable two-family grid UI
51. 8c89370 2026-08-21 ca-donations: scaffold + schema + charitable ingest pipeline proven

Authors

• auto-commit-fleet39
• Steve11
• steve1

Creative ideas + design notes

Commits with substantial prose (≥120 chars) — the rationale behind each move.

Fleet inoculation — opening this basic-auth app with credentials in the URL
poisoned document.baseURI and made relative fetch('/api/…') throw. Guard resolves
non-absolute request URLs against location instead. Ref: creds-in-url-fetch-guard-fleet-pattern.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- per-path public allowlist in auth middleware, gated by PUBLIC_TIER (default off = byte-for-byte original fail-closed behavior)
- /api/political stays Basic-Auth gated even in public tier; only /api/stats,/api/orgs,/api/org/:ein,/api/grants + static open
- new /api/political/agg?by=recipient|employer|city|jurisdiction: grouped SUM/COUNT only, HAVING count(distinct donor_name)>=5 k-anon floor, no per-donor rows; behind SECOND flag PUBLIC_POLITICAL_AGG (default off)
- qWithTimeout() bounds the agg full-table scan (8s -> clean 503) so a public endpoint can't hang a connection
- X-Robots-Tag: noindex on /api/org/:ein; robots.txt (Disallow /api/); takedown.html; index.html public-mode banner + footer link

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- scripts/freshness-canary.mjs: per-source freshness (stale run) AND row-presence
  (ran-ok-but-0-rows) checks; emits PASS/WARN/FAIL to data/latest.json (fleet-health vocab)
- caught a real bug on first run: fec_bulk reported ok/5000 but 0 rows landed in
  political_contributions (federal contributions silently missing)
- audit: 6.95M state contributions (2018-2026), 31995 legit negative amounts (refunds),
  17 future-dated + 125 null-donor artifacts already filtered from serving (cycle 1)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- dependency-free in-memory rate limiter on /api/* (120 req/60s/IP -> 429): caps bulk donor-row scraping
- POL_CLEAN guard: never serve future-dated (17) or null-donor (125) political artifacts as fact about named people
- GRANT_CLEAN guard: filter placeholder grantees (See Schedule/Attached/Eligible Patients)
- verified: 0 future/null rows served, 429 past cap, auth still 401 fail-closed

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- whitelisted ORDER BY per endpoint (orgs: name/status/ntee; grants: amount/year/grantor; political: date/amount/donor/recipient)
- frontend passes st.sort to /api/orgs, /api/grants, /api/political
- verified: sort=amount surfaces Uber $45M / Congressional Leadership Fund $41.7M; sort=name alphabetizes orgs

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- CAL-ACCESS 2018+ state contributions + FEC CA federal -> 6.95M political_contributions
- 990-PF Part XV grants (top 200 CA foundations) -> 40.5K charitable_grants
- ingest scripts: calaccess-political, fec-ca, 990-grants (adm-zip/unzipper/fast-xml-parser)
- verified: /api/political + /api/grants serve real rows; both grid tabs now populate

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- server.js: 401-gated API (/healthz, /api/stats, /api/orgs, /api/org/:ein, /api/grants, /api/political) with ILIKE search + drill endpoints
- public/index.html: two-family grid with mandatory sort + density (localStorage), href-drill on every chip, honest 'ingest pending' state for political + grants
- Verified: auth gate 401->200, stats=161410 orgs, live search returns real CZI/foundation records

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- Postgres schema: political_contributions + charitable_orgs/grants + sources/ingest_runs provenance
- ProPublica CA-orgs ingest (free API) + CA AG registry-status ingest (free CSV, 161k CA charities loaded)
- Join proven: orgs carry both NTEE metadata and CA AG status
- Backbones spot-checked live; plan at ~/.claude/plans/use-high-codex-deep-lovely-sparrow.md

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

File tree

19 files tracked. Click any to browse the source at HEAD.

• .deploy.conf
• .gitignore
• RUNBOOK-GOLIVE.md
• data/latest.json
• db/schema.sql
• lib/db.js
• package-lock.json
• package.json
• public/index.html
• public/robots.txt
• public/takedown.html
• scripts/freshness-canary.mjs
• scripts/ingest-990-grants.mjs
• scripts/ingest-ca-ag-status.mjs
• scripts/ingest-calaccess-political.mjs
• scripts/ingest-fec-ca.mjs
• scripts/ingest-propublica-ca-orgs.mjs
• scripts/refresh-political-agg.mjs
• server.js

Other build journals

← Builds Nightly  ·  all 4 projects  ·  Calc 67 →

Export

commits.csv · feed.atom · project.json · commits.json