itpp-infrastructure — CHANGELOG

2026-08-12 — app3 Web Docroot Migration to Per-Site Users

Change: every app3 nginx vhost moved off the shared /home/ippadmin/htdocs/ root to a per-site dedicated Linux user with docroot /home/<site-user>/htdocs/<domain> (security hardening — no more single-owner web tree).
Verified mappings (live nginx configs, 2026-08-14): mockups → /home/mockups, proposals → /home/proposals, docs → /home/docs, support → /home/support, my.verdicttank.com → /home/myverdicttank, verdicttank.com → /home/gmb, my.transitpin.com → /home/transitpin-dash.
Consequence: 10+ skills and their reference/script files still referenced the old /home/ippadmin/htdocs/ paths, causing a wrong-tree deploy on 2026-08-14. Remediated across SKILL.md, references/, and scripts/ (28 files, incl. singular mockup/proposal domain typos).
Rule: always read /etc/nginx/sites-enabled/<domain>.conf to confirm the real docroot before deploying. Never assume ippadmin owns a site's files.

Hexclave renamed to Stack Auth. Now running at auth2.itpropartner.com on app3.
This is the same service (customer-facing authentication), same server, same Docker stack — only the name changed.
Old references to "Hexclave" in scripts, docs, and backups should be updated to "Stack Auth" / stack-auth.
Rule going forward: any rename of critical infrastructure gets a changelog entry at the time of the rename, not discovered later.

Root cause: Aug 5 admin-ai budget cap + 4 dead fallback legs = $45 Anthropic burn in 10 hours
Rotated all 5 fallback provider keys (new keys for deepseek, google, xai, anthropic, openai)
Added F5: gpt-4.1-nano via OpenAI direct (independent infrastructure)
Fixed F3: grok-4.6 → grok-4.5 (grok-4.6 never existed — LiteLLM catalog ghost)
Documented two-key strategy: operational keys (admin-ai only) vs fallback keys (direct, daily-capped)
Added to operational chain: claude-haiku-4-5 (lightweight), grok-4.5 (auditor 2), deepseek-v4-flash (batch)
Synced Anita profile with identical fallback chain + provider keys
Admin-ai budget raised: $20 → $30/day
Updated: model-chain.md, operational-models.md