Add production deployment configurations and guides

Deployment options:
- Railway cloud deployment (recommended, 5-min setup)
- Render alternative deployment
- Docker Compose for VPS deployment
- Comprehensive environment variable documentation

Includes:
- Production-grade Dockerfile with multi-stage builds
- Docker Compose configuration for production
- Detailed deployment guide with troubleshooting
- Backup and recovery procedures
- Monitoring and scaling recommendations

Deployment paths ready:
✅ Railway (railway.app)
✅ Render (render.com)
✅ Self-hosted VPS (DigitalOcean, Linode, etc.)

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

DEPLOYMENT.md

@@ -0,0 +1,240 @@
+# TrustOS Cloud Deployment Guide
+
+## Quick Start Options
+
+### 1. Railway Deployment (Recommended - 5 minutes)
+
+#### Prerequisites
+- Railway account (railway.app)
+- GitHub repository pushed
+
+#### Steps
+
+1. **Connect GitHub Repository**
+   - Go to railway.app and sign in
+   - Click "New Project" → "Deploy from GitHub repo"
+   - Select your TrustOS repository
+
+2. **Create Services**
+   - **PostgreSQL Database**
+     - Click "Add Service" → Select "PostgreSQL"
+     - Railway auto-configures DATABASE_URL
+   
+   - **Backend Service**
+     - Add from Dockerfile
+     - Root directory: `./backend`
+     - Set variables:
+       - `PYTHONUNBUFFERED=1`
+       - `SECRET_KEY=your-secure-key-here`
+       - `OPENAI_API_KEY=sk-...` (optional)
+     - Port: 8000
+   
+   - **Frontend Service**
+     - Add from Dockerfile
+     - Root directory: `./frontend`
+     - Set variables:
+       - `NEXT_PUBLIC_API_URL=https://your-api.railway.app`
+     - Port: 3000
+
+3. **Configure Environment**
+   ```
+   DATABASE_URL=postgresql://...  # Auto-set by Railway
+   SECRET_KEY=your-64-char-key
+   AI_PROVIDER=openai (or anthropic)
+   OPENAI_API_KEY=sk-...
+   ANTHROPIC_API_KEY=sk-ant-...
+   ```
+
+4. **Deploy**
+   - Click "Deploy" - Railway builds and deploys automatically
+   - Services available at `*.railway.app`
+
+### 2. Render Deployment (Alternative)
+
+#### Steps
+
+1. **Database Setup**
+   - Create new PostgreSQL database
+   - Note connection string
+
+2. **Deploy Backend**
+   - New → Web Service
+   - Connect GitHub repository
+   - Build command: `pip install -r requirements.txt && python -m app.db.init_db`
+   - Start command: `uvicorn app.main:app --host 0.0.0.0 --port 8000`
+   - Environment variables (same as Railway)
+
+3. **Deploy Frontend**
+   - New → Web Service  
+   - Connect GitHub repository
+   - Build command: `npm install && npm run build`
+   - Start command: `npm start`
+   - Set `NEXT_PUBLIC_API_URL` to backend URL
+
+### 3. Docker Compose on VPS (DigitalOcean, Linode)
+
+```bash
+# SSH into your VPS
+ssh root@your-vps-ip
+
+# Install Docker & Docker Compose
+curl -fsSL https://get.docker.com -o get-docker.sh
+sh get-docker.sh
+apt install -y docker-compose
+
+# Clone and deploy
+git clone https://github.com/your-username/trustos.git
+cd trustos
+
+# Set production environment
+export DB_PASSWORD=your-secure-password
+export SECRET_KEY=your-64-char-secret-key
+export API_URL=https://api.your-domain.com
+
+# Start services
+docker-compose -f docker-compose.prod.yml up -d
+
+# Set up Let's Encrypt (optional but recommended)
+apt install -y certbot python3-certbot-nginx
+certbot certonly --standalone -d api.your-domain.com -d app.your-domain.com
+```
+
+## Environment Variables
+
+| Variable | Required | Example | Purpose |
+|----------|----------|---------|---------|
+| `DATABASE_URL` | Yes | `postgresql+asyncpg://...` | PostgreSQL connection |
+| `SECRET_KEY` | Yes | 64-char random string | JWT signing key |
+| `OPENAI_API_KEY` | No | `sk-...` | OpenAI API access (optional) |
+| `ANTHROPIC_API_KEY` | No | `sk-ant-...` | Anthropic API access (optional) |
+| `AI_PROVIDER` | No | `openai` | Which AI service to use |
+| `NEXT_PUBLIC_API_URL` | Yes (frontend) | `https://api.example.com` | Backend API URL |
+
+## Post-Deployment Setup
+
+1. **Initialize Database**
+   ```bash
+   # Automatic on first deploy, or manually:
+   docker exec trustos_backend python seed.py
+   ```
+
+2. **Create Admin User**
+   ```bash
+   curl -X POST https://api.your-domain.com/api/v1/auth/register \
+     -H "Content-Type: application/json" \
+     -d '{
+       "email":"admin@your-company.com",
+       "password":"secure-password",
+       "full_name":"Admin Name"
+     }'
+   ```
+
+3. **Configure SSL/TLS**
+   - Railway: Automatic with custom domain
+   - Render: Automatic free SSL
+   - VPS: Use Let's Encrypt via certbot
+
+4. **Set Up Monitoring**
+   - Enable health checks in Railway/Render
+   - Configure uptime monitoring (UptimeRobot, etc.)
+   - Set up error tracking (Sentry)
+
+## Scaling Considerations
+
+### Horizontal Scaling
+- Backend: Stateless, can scale to multiple instances
+- Frontend: Static files can use CDN (Cloudflare, etc.)
+- Database: Use managed database service with backups
+
+### Performance Optimization
+- Enable database query caching (Redis)
+- Use CDN for frontend assets
+- Implement API rate limiting
+- Add request/response compression
+
+### Cost Optimization (Railway/Render)
+- Use smallest instances initially
+- Auto-scale based on CPU/memory
+- Use spot instances for non-critical services
+- Schedule resource scaling by time of day
+
+## Troubleshooting
+
+### Backend won't start
+```bash
+# Check logs
+railway logs  # or docker-compose logs backend
+
+# Common issues:
+# - DATABASE_URL not set
+# - SECRET_KEY not set
+# - Port already in use
+```
+
+### Frontend won't connect to API
+```bash
+# Verify NEXT_PUBLIC_API_URL is set correctly
+# Check CORS headers on backend
+# Verify backend is accessible from frontend origin
+```
+
+### Database connection issues
+```bash
+# Test database connection
+psql $DATABASE_URL -c "SELECT version();"
+
+# Check if database exists and migrations ran
+psql $DATABASE_URL -c "\dt"
+```
+
+## Monitoring & Logging
+
+### Railway
+- Built-in dashboard with metrics
+- Automatic error tracking
+- Network activity monitoring
+
+### Render  
+- Built-in logs and metrics
+- Environment variable management
+- Auto-rollback on failed deploys
+
+### VPS with Docker
+```bash
+# View logs
+docker-compose logs -f backend
+docker-compose logs -f frontend
+
+# Monitor resources
+docker stats
+
+# Database backups
+docker exec trustos_postgres pg_dump -U trustos trustos > backup.sql
+```
+
+## Backup & Recovery
+
+### Database Backups
+```bash
+# Automatic backups (Railway/Render)
+# Manual backup
+pg_dump $DATABASE_URL > trustos_$(date +%Y%m%d).sql
+
+# Restore
+psql $DATABASE_URL < trustos_backup.sql
+```
+
+### Configuration Backup
+- Keep environment variables in secure password manager
+- Version control all code except .env files
+- Document custom configurations
+
+## Next Steps
+
+- [ ] Set up custom domain
+- [ ] Configure SSL certificates
+- [ ] Enable monitoring and alerting
+- [ ] Set up automated backups
+- [ ] Configure CI/CD pipeline
+- [ ] Add usage analytics
+- [ ] Set up support/feedback system

Dockerfile.prod

@@ -0,0 +1,32 @@
+# Build stage - backend
+FROM python:3.10-slim as backend-builder
+WORKDIR /app
+COPY backend/requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Runtime stage - backend
+FROM python:3.10-slim as backend
+WORKDIR /app
+COPY --from=backend-builder /usr/local/lib/python3.10/site-packages /usr/local/lib/python3.10/site-packages
+COPY backend /app
+ENV PYTHONUNBUFFERED=1
+EXPOSE 8000
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
+
+# Frontend build
+FROM node:22-alpine as frontend-builder
+WORKDIR /app
+COPY frontend/package*.json ./
+RUN npm ci
+COPY frontend .
+RUN npm run build
+
+# Frontend runtime
+FROM node:22-alpine as frontend
+WORKDIR /app
+COPY --from=frontend-builder /app/.next ./.next
+COPY --from=frontend-builder /app/node_modules ./node_modules
+COPY --from=frontend-builder /app/package*.json ./
+COPY frontend/public ./public
+EXPOSE 3000
+CMD ["npm", "start"]

PROGRESS.md

@@ -1,7 +1,7 @@
 # TrustOS Implementation Progress
 
 **Date**: 2026-07-07  
-**Status**: Phase 1 MVP - 65% Complete
+**Status**: Phase 2 Advanced Features - 75% Complete
 
 ## ✅ COMPLETED COMPONENTS
 
@@ -21,20 +21,33 @@
   - Seed data populated with 6 demo findings
   - Risk scores calculated
   
-- [x] API Endpoints (all 7 route files implemented)
+- [x] API Endpoints (13+ endpoints fully implemented)
   - POST /api/v1/auth/login: ✅ Working
   - GET /api/v1/auth/me: ✅ Working
   - GET /api/v1/dashboard/{tenant_id}: ✅ Working (returns cyber health score: 89.2)
   - GET /api/v1/findings: ✅ Working (returns 6 findings)
   - GET /api/v1/findings/{id}: ✅ Working
-  - PATCH /api/v1/findings/{id}/status: ✅ Ready
+  - PATCH /api/v1/findings/{id}/status: ✅ Working
-  - POST /api/v1/findings: ✅ Ready
+  - POST /api/v1/findings: ✅ Working
-  - GET/POST /api/v1/audit-reports: ✅ Ready
+  - POST /api/v1/findings/{id}/ai-translate: ✅ **NEW** - AI Translation (queued)
-  - GET /api/v1/attack-paths: ✅ Ready
+  - POST /api/v1/findings/{id}/ai-question: ✅ **NEW** - AI Security Coach
-  - GET /api/v1/footprint: ✅ Ready
+  - POST /api/v1/attack-paths/{id}/generate: ✅ **NEW** - Generate attack paths
-  - POST /api/v1/ai/translate: ✅ Ready
+  - GET /api/v1/attack-paths/{id}: ✅ **NEW** - Retrieve attack graphs
+  - GET/POST /api/v1/audit-reports: ✅ Working
+  - POST /api/v1/audit-reports/{id}/pdf: ✅ **NEW** - Download PDF report
+  - POST /api/v1/audit-reports/{tenant_id}/pdf-snapshot: ✅ **NEW** - On-demand PDF
+  - GET /api/v1/footprint: ✅ Working
+  - PATCH /api/v1/findings/{id}/top-risk: ✅ Working
 
-### Frontend (70% Complete)
+- [x] Advanced AI Features (NEW Phase 2)
+  - AI Finding Translation: ✅ Working (mock + OpenAI/Anthropic ready)
+  - Business Impact Translation: ✅ Async generation
+  - Attack Path Visualization: ✅ Working (graphs with nodes/edges)
+  - AI Security Coach: ✅ Question answering about findings
+  - PDF Report Generation: ✅ Working (professional HTML-to-PDF)
+  - Mock AI System: ✅ Demo mode functional without API keys
+
+### Frontend (75% Complete)
 - [x] All pages created
   - Dashboard page: ✅ Component ready
   - Findings page: ✅ Component ready

docker-compose.prod.yml

@@ -0,0 +1,56 @@
+version: '3.9'
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: trustos
+      POSTGRES_USER: trustos
+      POSTGRES_PASSWORD: ${DB_PASSWORD:?Database password required}
+    ports:
+      - "5432:5432"
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U trustos"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  backend:
+    build:
+      context: .
+      dockerfile: Dockerfile.prod
+      target: backend
+    environment:
+      DATABASE_URL: postgresql+asyncpg://trustos:${DB_PASSWORD}@postgres:5432/trustos
+      SYNC_DATABASE_URL: postgresql://trustos:${DB_PASSWORD}@postgres:5432/trustos
+      SECRET_KEY: ${SECRET_KEY:?Secret key required}
+      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
+      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
+      AI_PROVIDER: ${AI_PROVIDER:-openai}
+    ports:
+      - "8000:8000"
+    depends_on:
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/docs"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+  frontend:
+    build:
+      context: .
+      dockerfile: Dockerfile.prod
+      target: frontend
+    environment:
+      NEXT_PUBLIC_API_URL: ${API_URL:?API URL required}
+    ports:
+      - "3000:3000"
+    depends_on:
+      - backend
+
+volumes:
+  postgres_data: