New external role administrator_viewer: signs into the admin interface
and reads everything for its granted funds and SPVs (overview, partners,
capital accounts with every investor's statements, documents, valuation
history) but every write is refused: no imports, uploads, deletions,
entity edits, exit marking, or account management. No migration needed;
roles are stored as strings.
Internal admins can flip an Administrator between full management and
view only via a new Access level dropdown in Users > Manage. The
user-list endpoint is read-widened for the viewer role so investor names
resolve on its screens; all mutating endpoints keep the stricter gate.
The LP portal's 'In bitcoin terms' box converted ALL paid-in capital at
the fund close date's BTC price, mispricing every mid-life capital call.
It now walks the statement history: the first statement's contributions
at the close-date entry mark, each later quarter's new contributions at
that statement date's price, and distributions at the price when
received. A dollar called later is no longer credited with bitcoin it
could never have bought. Funds with a single statement (and files
predating the uploaded price range) fall back to the close-date price.
Frontend only; shared by the LP portal and the admin Investor View.
The batch history import now also records each quarter's NAV in the
fund's valuation history: the old file's HLD rows are matched by issuer
and security name against the book as it exists today, matched rows
write that quarter's valuations, unmatched rows are counted and
reported, and nothing outside the round is created or modified. A
manually signed quarter is never overwritten.
The single-file wizard automatically takes the same history-only path
when the file is older than the fund's newest round. Previously that
import would regress position cost basis to the old file's values and
resurrect since-exited positions, corrupting the fund's Invested total.
The external fund_administrator role (relabeled Administrator) now signs
into the full admin interface, fenced to the funds and SPVs granted to
it via EntityAccess:
- Partners, capital accounts, documents (upload and delete), entity
edits, and eNAV imports for its own funds only; no fund creation,
valuation sign-off, audit log, or investor view.
- Scoped user management: sees and manages only investors tied to its
funds; creates investor accounts only; updates preserve grants on
funds outside its scope.
- New DELETE /api/users/{id} (in-app Delete user button) with the
cascade cleanup factored out of the CLI; Service Admin and self are
protected, and an Administrator can only delete an investor who
belongs solely to its funds.
- Internal fund_admin relabeled 'Staff (all funds)' and dropped from
the create picker to end the two-similar-names confusion.
- Version badge removed from the UI (sidebar and portal header); the
build version now logs to the browser console instead.
- deploy/.startos (signing key) added to .gitignore.
Percent-encoded traversal (..%2f) survived routing and let an
unauthenticated request read files outside static/, including the
database and session secret on the data volume. Paths are now resolved
and contained to the frontend build directory; anything that escapes
falls back to index.html.
The capital-over-time chart gains a dashed orange series on its own
right-hand ₿ axis: total value (ending balance + distributions) divided
by the BTC price at each statement date — the time-series of the
"In bitcoin terms" box. The history table gains a matching In-bitcoin
column. Frontend-only; prices were already stamped per statement.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- BTC prices: btc_prices table, CSV upload on Import page (auto-detected
date/close columns, upsert by date), entities.close_date as the BTC entry
mark; statements carry btc_price_cents (as-of) + btc_close_price_cents.
LP capital blocks show paid-in vs current value in bitcoin terms.
- First login: accounts on the shared default password are flagged
(must_change_password) and blocked behind a full-screen password change;
external accounts then get a one-time welcome tour with a 2FA offer
(users.onboarded_at).
- LP portal: Unfunded (callable commitment) metric; Tax documents center
aggregating K-1/tax docs across funds, grouped by year.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A fully-exited fund/SPV card sinks to the bottom of the LP's stack
instead of sitting between active funds (stable sort, shared by the
LP portal and the admin Investor View).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The admin read-only Investor View built capital-account responses
without exited_on, so an exited position showed the active card with
$0s (the LP's own portal was correct). Extracted exit_dates() into
capital_account_router and stamp it in investor_view too; regression
test added. A fund card where every position is exited now renders
greyed (bg + title) so it reads as closed at a glance.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The eNAV keeps producing statements after an exit (quarterly for funds,
event-driven for SPVs), so an unfiltered graph would crash to zero.
Now the exited card gets its collapsible History back — chart + table
showing the capital journey up to exited_on only. Post-exit statements
stay recorded (audit trail; Undo restores full history) but are never
plotted. History section extracted into a shared HistorySection
component; toggle counts "statements" not "quarters" (SPV statements
are event-driven).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The eNAV keeps listing exited members each quarter, so the admin needs
the exit control where the statements live:
- Capital Accounts table gains a Status column with the same
Exited-badge / mark / undo flow as the Partners tab (keyed per
investor+fund pair — marking any statement row marks them all)
- set_partner_exited now creates the access row (flag set) when a
manually-entered investor has statements but no roster entry yet;
clearing a never-set exit stays 404
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A member who sold/transferred their stake showed a phantom -100% loss
($0 ending balance, no distribution through the fund). Now:
- entity_access.exited_on (migration e1f2a3b4c5d6), set/cleared from the
Partners tab (writer-only, inline date picker, audited)
- LP portal card shows a quiet "Exited <date>" badge, keeps documents,
hides balance/gain
- portfolio summary excludes exited positions ("Excludes N exited")
- fund committed totals (rollup + Partners tab) skip exited members so
seller + buyer are not double-counted
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Cumulative checkpoint since 0.2.26:
- 0.2.27/28: entity valuation-history table; investor gain/loss = NAV +
distributions vs paid-in
- 0.2.29: Reset Fund Partners (endpoint, Partners-tab button, CLI, action)
- 0.2.30: "Current Capital Balance" label, %-only gain/loss
- 0.2.31: Management Entities rename, Carry Vehicle type, chart
distributions-line gate
- 0.2.32: LP-facing polish pass
* Ten31 brand palette from the logo (navy/mint); orange retired
* portfolio summary card across funds; gain labeled "net of paid-in"
* whole-dollar headline figures; "History · N quarters" toggle
* documents grouped by year with a "New" badge (users.docs_seen_at)
* eNAV-created members start on default password with login enabled;
enable-investor-logins CLI + StartOS action for existing accounts
* password minimum raised to 8 chars; login help line (Portal@ten31.xyz)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Address the security-auditor findings the user selected (items 2, 3, 4):
Default admin credentials (P2): remove the fixed `Ten31` default. First
boot now generates a strong random admin password (secrets.token_urlsafe),
records it 0600 at /data/.admin-password, and surfaces it once via a new
"Show Initial Admin Password" StartOS action (CLI `show-admin-password`).
The stored password is cleared when the admin is reset (CLI reset-password)
or self-changes it (change-password endpoint).
Login hardening (P2): add a per-IP in-memory sliding-window rate limiter
(10 failures / 5 min -> 429 + Retry-After) in ratelimit.py; run a dummy
argon2 verify when the user is unknown so timing can't enumerate usernames;
keep a single generic 401 for unknown-user and wrong-password.
Hardening (P3): server process now runs unprivileged -- Dockerfile adds
uid 10001 appuser; start.sh (still root) chowns the mounted /data then
drops via `setpriv` before exec'ing uvicorn. Spreadsheet imports are
size-capped via storage.read_capped (413 past MAX_UPLOAD_SIZE) in the
schedule, capital preview, and batch paths. batch_import no longer returns
raw exception text (generic per-file messages).
Verified in the packed amd64 container: PID1 uvicorn runs as uid 10001,
/data owned 10001 with 0600 secrets; generated admin password retrievable
via CLI and logs in (200); 11th bad login -> 429; admin reset clears the
stored password. Tests: test_auth_hardening.py (4). Full suite 21 passed;
frontend tsc + StartOS bundle clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add POST /api/import/capital-accounts/batch: upload several of a fund's
eNAV workbooks at once; each file's ALLOC SI roster is auto-matched to
existing members (by fund-admin investor ID, else name/username) and their
capital statement is saved at that file's own as-of date, building
trend-lines without replacing the latest figures. Members not already in
the portal are skipped and reported per file (never created). Capital
statements only -- holdings/NAV are untouched. One bad file (wrong
password, no ALLOC SI, unreadable date) is reported per-file and does not
abort the rest.
Import page gains a "Backfill historical capital" batch section (fund
picker, multi-file .xlsx input, shared password, per-file results table).
Investor portal "Capital over time" chart is now collapsed by default and
expands per fund (first login opens clean); applies to InvestorHome and
the admin Investor View via the shared component.
Tests: backend/tests/test_capital_batch.py (2). Full suite 17 passed;
frontend tsc clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Fixes a linked GP entity showing an empty Assets tab when its capital is
held under the linked account's other legal names (the eNAV often splits
one LLC across names).
- New GET /api/entities/{id}/asset-balances: household-aware, returns the
linked account's (and its linked names') capital balances per fund, plus
the linked account name for a clear empty state.
- Assets tab uses it; shows "linked to X but no balances on file" instead
of a blank table when the wrong account is linked.
- GP/mgmt Overview now surfaces the total linked balance across funds with
a "View by fund" link, so assets are visible without opening the tab.
Verified: 15/15 backend tests (incl. household case); frontend tsc + vite
build clean.
Ten31 LLC (and any GP/mgmt entity) can be linked to its investor account,
so its Assets tab shows its real capital-account balance in each fund,
pulled live from the eNAV capital accounts instead of manual entry.
- entities.linked_user_id (migration c9d0e1f2a3b4) + EntityCreate/Update/
Response fields; validated to be an investor account.
- Edit-entity form gains a "Linked investor account" picker for GP/mgmt.
- Assets tab now auto-lists the linked account's balance per fund (the
earlier manual-stakes API remains but is no longer used by the UI).
Verified: 13/13 backend tests pass; alembic head c9d0e1f2a3b4; frontend
tsc + vite build clean.
Snapshot commit bringing the uncommitted phase-2 work into version control
together with four new features and the 0.2.22 version bump.
New features:
- Investor capital-over-time chart (value, paid-in, distributions per
quarter), rendered from existing capital-account history.
- Admin Investor View: read-only reconstruction of an investor's portal
(GET /api/users/{id}/investor-view), reusing the investor portal UI.
- Document upload scoped to the selected fund's own investors, with an
explicit upload-target confirmation to prevent mis-attaching.
- GP/mgmt entities gain an Assets tab listing their stakes in the funds
they manage (new entity_stakes table + /api/entities/{id}/stakes).
- Edit-entity form (change type/status/etc.), so GP entities can be
categorized correctly.
Verified: 11/11 backend tests pass; alembic upgrades to head b8c9d0e1f2a3;
frontend tsc + vite build clean; s9pk packs at 0.2.22:0 (x86_64).
Also: ignore .DS_Store and *.s9pk artifacts.
Cut version 0.2.21 (current = v_0_2_21) with the adjudicated DO-item fixes.
Also commits the previously-untracked v_0_2_* version files that
versions/index.ts imports (ROADMAP item D2), so a fresh checkout builds
without dangling imports. The missing v_0_2_2 is intentional (versions are
an unordered set).
Built and verified: ten31portal_x86_64.s9pk packs cleanly at 0.2.21:0,
arch x86_64, SDK 0.4.0.
- Import page: schedule (XLSX/CSV) and entity import with dry-run toggle
- Audit Log page: paginated, filterable by object type
- Nav items now clickable (removed stubs)
- StartOS Action: Create User with name/email/password/role inputs
- Default first-boot creds: jonathan@ten31.xyz
- Dockerfile: multi-stage build (Node frontend + Python backend)
- StartOS manifest, interfaces, backups, version graph
- start.sh: auto-generates session secret, creates first approver on boot
- Backend serves built frontend as SPA in production
- Single data volume for SQLite DB, platform backups cover it
