ALAI Website (alai.no)

ALAI Holding AS main website — AI services company landing page

Overview

Overview

Domain & Infrastructure

Deploy Method

cc-api-server /bash → vercel --prod

Architecture

Architecture

Technology Stack

Next.js 14, React, Tailwind CSS, Vercel

Infrastructure

To be documented: hosting environment, dependencies, integrations

Deployment Pipeline

cc-api-server /bash → vercel --prod

Dependencies

To be documented: external services, APIs, databases

Deploy Runbook

Deploy Runbook — alai.no

Last updated: 2026-04-15 Status: Production — VERIFIED

Infrastructure

Field Value
Live URL https://alai.no
CDN Vercel (confirmed via response headers)
Repo ~/ALAI/web
Hosting type Static (plain HTML/CSS/JS, no build step)
Output dir public/ (served directly by Vercel)
Vercel project alai (linked via ~/ALAI/web/.vercel/)

⚠️ ~/projects/ALAI/landing is a stale Next.js experiment with Firebase config — NOT live, NOT deployed, ignore it.

Deploy Steps

cd ~/ALAI/web
git pull origin master
# make changes to public/
git add public/
git commit -m "feat: description"
vercel --prod

Verify

curl -sI https://alai.no | grep -i "server\|vercel"
# Expected: server: Vercel

Rollback

# List deployments
vercel ls

# Rollback to previous deployment URL
vercel rollback [deployment-url]

Known Issues

What NOT to use

Current State

Current State

What Works

What Doesn't Work / Known Issues

Open Tasks

Last Verified

Date: 2026-04-15

Status: Initial documentation shell created

Changelog

Changelog

2026-04-15 — Documentation Shell Created

All significant deploys and changes should be logged here with date, description, and deploy ID.

ucenje v3 — aha math + pčele + interaktivan 6×19

ucenje v3 — aha math + pčele + interaktivan 6×19

Background

On 2026-04-22, CEO Alem Basic provided feedback via Slack about the /ucenje section:

Ne sviđa mi se kompletan UI/UX. Previše teksta ima za to što poučavamo. Trebamo promijeniti stil. Hoću animacije i slike na svim stvarima — ne samo tekst.

During the 2026-04-23 session, he clarified the scope:

Full v3 redesign deployed to production: https://alai.no/ucenje/

Changes Made

MC Tasks

Five Mission Control tasks executed in sequence:

Task ID Owner Title Deliverable
#8931 datavera Research: pčele × 6×19 × honeycomb conjecture /Users/makinja/system/context/quran/bees-6x19-parallel.md
#8932 proxima Math aha copy: 3-lang bilingual ~/ALAI/web/public/ucenje/content/math-aha-{bs,no,en}.md
#8933 vizu matematika.html redesign + pcele.html new + 19-explorer interactive Commits cac230d + 14b0be0 on ~/ALAI/web master
#8934 proveo QA validation — all pages LIVE 36/36 PASS on alai.no — report: /tmp/ucenje-v3-validation/report-LIVE.json
#9035 flowforge CF Pages deploy fix (manual wrangler) DEPLOY-MAP.md created, commit a1ce178

New Files

Design Decisions

Vizu team (Brad Frost + Lea Verou) made the following trade-offs:

  1. Arabic RTL inline spans — Arabic text rendered with dir=rtl lang=ar inside LTR paragraph flow; avoids full page RTL (preserves BS/NO/EN left-to-right structure)
  2. SVG hexagon animation on pcele.html — subtle scaling pulse (1.0 → 1.05) to draw eye to honeycomb structure without being distracting
  3. Mobile horizontal scroll for 6×19 grid — 19 columns exceed mobile viewport; horizontal scroll preserves grid integrity (alternative: responsive collapse loses visual pattern)
  4. 13-card layout for matematika.html — 3 large hero cards (number 19, grid, prime factors) + 10 smaller aha cards; hero size = visual hierarchy
  5. Bilingual inline toggle — BS primary, NO/EN via lang switcher; kept single-page experience vs. separate /bs/, /no/, /en/ routes

QA Evidence

Proveo team (Angie Jones) executed full validation on LIVE production (https://alai.no/ucenje/):

No regressions detected. All links functional, all language toggles working, all interactive elements responsive.

Deploy Process

FlowForge team (Kelsey Hightower) identified systemic webhook issue (#9050 — GH Actions → CF Pages webhook not firing). Temporary fix:

  1. Manual wrangler pages deploy from local machine
  2. Created DEPLOY-MAP.md in repo root (ZAKON PI2 compliance)
  3. Tracked as MC #9050 for permanent GH Actions backup workflow

Reference commit: a1ce178

Credit Chain

Per rule ~/system/rules/no-agent-persona-as-author.md, public-facing credits MUST NOT include agent persona names (Brad Frost, Lea Verou, etc.). Correct attribution:

Every /ucenje page footer credits Khalifa + Deedat in Acknowledgment section. Byline = ALAI, 2026.

Live URLs

Documented by Skillforge, 2026-04-24. CEO feedback session 2026-04-22 + 2026-04-23.

clients.alai.no — Hosted Proposal Page

clients.alai.no — Hosted Proposal Page

Type: Vercel static site Target URL: https://clients.alai.no Source: ~/business/ALAI-Holding-AS/products/clients-alai-no/ MC task: #9410

Purpose

Minimal, single-purpose hosted proposal landing page. One CTA hands off to ALAI Documenso for signing (https://sign.alai.no/signin). No framework, no JS, no build step — hand-written HTML5 + vanilla CSS, deployed via vercel --prod.

Design

Verified state (2026-08-08)

Known gap

The products/clients-alai-no/ directory is untracked in the ALAI-Holding-AS git repo — it was deployed straight via vercel --prod, not through git-triggered CI. Non-blocking (the live deploy works), but a follow-up commit would close the hygiene gap. Not done in this pass because the parent checkout was mid-way on an unrelated feature branch (feat/oauth-metrics-reader-103888).

Local verification

cd ~/business/ALAI-Holding-AS/products/clients-alai-no
python3 -m http.server 8765
curl -s http://localhost:8765 | grep -c "Proceed to secure signing"

Deploy

vercel --prod
vercel domains add clients.alai.no

Security Sweep — Public Repository & alai.no Hardening (MC #107285)

Security Sweep — Public Repository & alai.no Hardening (MC #107285)

Date: 2026-08-16
Scope: johnatbasicas/alai-web, https://alai.no, and https://ucenje.alai.no
Production commit: 620dd3af082952b7dbded28a4c5b4685b5445366
Pull request: johnatbasicas/alai-web#2

Trigger

The source repository was public and exposed tracked CLAUDE.md and .claude/** files. A full sweep was ordered to identify and remove repository, deployment, secret-handling, browser, and production exposure risks.

Confirmed findings

  1. Public GitHub access exposed agent metadata and internal operational instructions.
  2. A stale index.html.bak file was publicly readable on alai.no.
  3. A hidden internal .credits.md file was publicly readable on ucenje.alai.no.
  4. Deprecated Vercel state contained expired OIDC tokens and duplicate local backups.
  5. A legacy unused mail dependency had high-severity advisories.
  6. GitHub Actions used mutable action tags; repository secret scanning and branch protection were unavailable or disabled.
  7. Pages lacked a true 404 response and a complete Content Security Policy.
  8. The contact proxy lacked bounded streaming input, complete validation, honeypot handling, safe upstream errors, and dynamic-response security headers.
  9. The GitHub Cloudflare deploy token was stale, causing repeated authentication failures.
  10. Wrangler debug logs contained local proxy shared-secret material and were too broadly readable.

Remediation completed

Repository and source

Cloudflare Pages

Contact endpoint

CI and credentials

Verification

Evidence

Evidence directories are restricted to user-only access. No credential values are recorded in this page or its evidence summaries.

Residual low risks

  1. GitHub branch protection for a private repository requires a paid plan. Compensating controls are enabled: private visibility, selected SHA-pinned Actions, read-only workflow permissions, Gitleaks CI, web commit signoff, and merged-branch deletion.
  2. DNSSEC and CAA remain separate registrar/certificate-issuer changes and require a dedicated controlled rollout.
  3. The edge tombstone rules should remain until the old one-week cache lifetime has fully elapsed; then revalidate direct paths before considering rule removal.

Closure

Technical remediation and production verification are complete. This page is the task-specific BookStack record for MC #107285.