Remove the migrated v1 app from main (#3)

* Remove the migrated v1 app from main

Production has served from the v2 base directory since the storage migration finished, so the flat app at the root was a full second copy of the site doing nothing: byte-identical stylesheet, parallel functions, its own test suite doubling CI. It is preserved at the v1-final tag. The migration guard and its checklist went with it since the migration it protected is complete. Dependabot now targets v2 only, and the README describes the current layout.

* chore: keep one set of project docs at the root

The v2 copies of CONTRIBUTING, SECURITY, LICENSE and the dotfiles duplicated the root set with small drifts. The root files now carry the stricter v2 wording (context packs, audience separation, current contact address) and the duplicates are gone.

* chore: delete the unreachable context import and clear functions

No rendered template or click handler ever wired importContext or clearContext; the admin screen intentionally says the pack cannot be changed from the deployed site.

* docs: match the privacy notes to the locked-down context workflow

* ci: validate the deployed v2 app

* Finish the v1 cleanup documentation

---------

Co-authored-by: Jamie Parr <JamieP-205@users.noreply.github.com>

Author: JamieP-205

.env.example

@@ -1,7 +1,7 @@
 version: 2
 updates:
   - package-ecosystem: npm
-    directory: /
+    directory: /v2
     schedule:
       interval: monthly
     open-pull-requests-limit: 5

.github/dependabot.yml

@@ -9,18 +9,7 @@ permissions:
   contents: read
 
 jobs:
-  validate-current:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm test
-
-  validate-v2:
+  validate:
     runs-on: ubuntu-latest
     defaults:
       run:

.github/workflows/ci.yml

@@ -9,3 +9,5 @@ node_modules/
 npm-debug.log*
 .DS_Store
 Thumbs.db
+private-context/
+*.context-pack.json

.gitignore

@@ -3,9 +3,9 @@
 This application handles account and conversation data. Keep changes small, reviewable, and privacy-conscious.
 
 1. Create a branch from `main`.
-2. Install dependencies with `npm ci`.
+2. Work in `v2/` and install dependencies there with `npm ci`.
 3. Run `npm test`.
 4. Test authentication, guest access, chat persistence, blocking, deletion, and admin-only routes with `netlify dev`.
-5. Never commit deployment tokens, AI keys, Blobs credentials, user exports, or conversation data.
+5. Never commit deployment tokens, AI keys, Blobs credentials, generated context packs, user exports, or conversation data.
 
-Security-sensitive changes require a clear threat model in the pull request.
+Security-sensitive changes require a clear threat model in the pull request. Context changes must also test public/admin audience separation.

404.html

@@ -8,7 +8,7 @@ The public experiment is available at [talkwithjamie.netlify.app](https://talkwi
 
 ## Status
 
-**Experimental, active development** this is a personal AI chat experiment. Features and privacy controls continue to evolve.
+**Experimental, active development** - this is a personal AI chat experiment. Features and privacy controls continue to evolve.
 
 ## Summary
 
@@ -19,17 +19,16 @@ workspace and is not available through public chat.
 
 ### Active codebase
 
-[`v2/`](v2/) is the active deployment and the place for new development. The root application is
-kept for migration history and compatibility notes; its version-specific setup and privacy details
-are in [`v2/README.md`](v2/README.md).
+[`v2/`](v2/) is the whole application: Netlify builds with `v2` as the base directory. The
+original flat app that previously served production was removed once the migration finished;
+it is still readable at the [`v1-final`](https://github.com/JamieP-205/talk-with-jamie/tree/v1-final) tag. Setup, context-pack and
+privacy details live in [`v2/README.md`](v2/README.md).
 
 ## Architecture overview
 
 The app uses a static frontend served by Netlify alongside a serverless backend. Authenticated and guest users interact with Netlify Functions through signed `HttpOnly` cookies. Persistent users, conversations and rate limits are stored in Netlify Blobs. The owner workspace can use a protected context pack, while public chat stays limited to approved general information. The configured AI provider generates responses from selected context rather than exposing source material.
 
-| Talk With Jamie architecture |
-| --- |
-| ![Talk With Jamie architecture](talk-architecture.svg) |
+![Talk With Jamie architecture](talk-architecture.svg)
 
 ## Privacy first design choices
 
@@ -50,21 +49,25 @@ The app uses a static frontend served by Netlify alongside a serverless backend.
 - A private drafting workspace for contact-specific reply ideas
 - Configurable OpenAI-compatible or Cohere model providers
 - Request size limits, input cleaning, same-origin checks and route-specific rate limits
-- Automated unit, syntax, deployment-guard and site-structure tests
+- Automated unit, integration, syntax and site-structure tests
 
 ## Key files
 
-- `index.html` - frontend shell and metadata
-- `styles.css` - responsive public and admin interface styles
-- `app.js` - client state, rendering and API requests
-- `netlify/functions/api.js` - Netlify Function entry point
-- `netlify/functions/_lib.js` - authentication, storage, validation, provider and route logic
-- `test/` - unit tests for security-sensitive helpers and deployment controls
-- `tools/` - site validation and production migration guard
+- `v2/index.html` - frontend shell and metadata
+- `v2/styles.css` - responsive public and admin interface styles
+- `v2/app.js` - client state, rendering and API requests
+- `v2/netlify/functions/api.js` - Netlify Function entry point
+- `v2/netlify/functions/_lib.js` - authentication, storage, validation, provider and route logic
+- `v2/test/` - unit and integration tests for the security and context boundaries
+- `v2/tools/` - site validation and the local private context-pack builder
 
 ## Technical approach
 
-The frontend is a lightweight static site that communicates with a single Netlify Function. Authentication is handled via signed, same-site cookies; passwords use scrypt. The function uses a modular library for storage, validation and provider logic. Conversations and user records live in Netlify Blobs. A locally generated, redacted context pack helps the model produce replies that reflect my tone without exposing raw messages. The project is tested with unit and integration tests and guarded with a production migration flag to prevent accidental data loss.
+The frontend is a lightweight static site that communicates with a single Netlify Function. Authentication is handled via signed, same-site cookies; passwords use scrypt. The function uses a modular library for storage, validation and provider logic. Conversations and user records live in Netlify Blobs. A locally generated, redacted context pack helps the model produce replies that reflect my tone without exposing raw messages. The project is tested with unit and integration tests covering the security and privacy boundaries.
+
+## Development note
+
+I used AI-assisted coding tools as a pair-programming and review aid for parts of the security-sensitive backend, particularly signed sessions, password hashing, same-origin checks and tests around the public/private context boundary. The automated tests document the expected behaviour, and I remain responsible for the code I deploy.
 
 ## Deployment
 
@@ -78,16 +81,17 @@ changes.
 ## Local development
 
 ```bash
+cd v2
 npm ci
 npm test
 npx netlify dev
 ```
 
-The test suite checks authentication helpers, password hashing, signed sessions, username rules, message cleaning, frontend syntax, site structure and the production migration guard.
+The test suite checks authentication helpers, password hashing, signed sessions, username rules, message cleaning, context boundaries, frontend syntax and site structure.
 
 ## Privacy & safety notes
 
-Chats are stored and visible to the administrator. The application warns users not to submit sensitive information, and chat content is sent to the configured model provider when generating a response. Credentials, user exports, conversations and production data must never be committed. Review [PRIVACY.md](PRIVACY.md) and [SECURITY.md](SECURITY.md) before deploying a backend change.
+Chats are stored and visible to the administrator. The application warns users not to submit sensitive information, and chat content is sent to the configured model provider when generating a response. Credentials, user exports, conversations and production data must never be committed. Review [v2/PRIVACY.md](v2/PRIVACY.md) and [SECURITY.md](SECURITY.md) before deploying a backend change.
 
 ## What I learned
 

CONTRIBUTING.md

@@ -1,5 +1,5 @@
 # Security Policy
 
-Report vulnerabilities privately to `jamieparr05@hotmail.com`. Do not open a public issue for authentication bypasses, setup takeover, stored conversation exposure, account blocking failures, provider-key exposure, or session weaknesses.
+Report vulnerabilities privately to `jamieparr205@gmail.com`. Do not open a public issue for authentication bypasses, setup takeover, stored conversation exposure, context-pack exposure, account blocking failures, provider-key exposure, or session weaknesses.
 
-Do not include live credentials or real user conversations in a report. Only the current `main` branch is supported.
+Do not include live credentials, context packs, exports, or real user conversations in a report. Only the current `main` branch is supported.