为什么值得关注

它将 ELA/OCR/dHash 取证、AI 图像筛查、IPFS/区块链等技术与角色分离的门户和公开透明机制结合，并提供了完整的系统设计文档，便于复现和部署。

适合谁使用

需要提交受害者或代表证据的公民及起义相关人员
负责审核、批准或拒绝证据的管理员与审查人员
基于 Next.js/Supabase 构建问责或档案平台的技术团队
需要查阅案件进展、预算和 JulyStories 的研究者与记者

典型使用场景

市民创建账户后通过受保护的上传器提交受害者或代表证据
无需账户即可公开浏览记录、预算、案件进展、JulyStories 和时间线
管理员通过受角色保护的路由审核、批准或拒绝提交的证据
按照文档在本地或生产环境部署和运行平台，并执行相关检查

项目优势

取证流程包含客户端 ELA/OCR/dHash 检查，并在保存前由服务端对原始图像重复 AI 筛查
采用独立管理员登录和路由级角色保护，确保后台操作受控
公开透明：核心记录无需账户即可阅读，同时提交证据需要受保护注册
文档涵盖架构、工作流、数据库 RLS、取证、区块链模型、部署、安全与路线图

使用前须知

当前未启用 SMTP，市民邮箱未经所有权验证，不能单独作为提交者身份的法律证明
存储目前使用本地 mock 适配器；在无服务器环境启用证据接收前必须实现持久化生产适配器
AI 筛查结果只是审核标记而非证据，且默认共享密钥仅用于本地开发

README 快速开始

PROTOCOL36

PROTOCOL36 is a bilingual public accountability, rehabilitation, justice, and historical archive platform for Bangladesh's July 2024 mass uprising.

Documentation

The complete as-built architecture, workflows, database/RLS design, forensics, blockchain model, setup, deployment, security, operations, and roadmap are documented in docs/SYSTEM_DESIGN.md.

Access Model

Citizen portal: citizens create an email-and-password account before submitting victim or representative evidence. Registration is server-side, rate-limited, and opens the protected evidence uploader without depending on an email provider. Public records, budgets, case progress, JulyStories, and the timeline remain readable without an account.
Admin portal: approved administrators authenticate through the separate password login page. Role checks protect every admin route and allow review, approval, or rejection of submitted evidence.

Stack

Next.js 16, React 19, TypeScript, Tailwind CSS 4, next-intl, Supabase Auth/Postgres/RLS, client-side ELA/OCR/dHash forensics, a FastAPI/Transformers AI-image screening service, IPFS adapters, Solidity, Ethers, Polygon Amoy, Recharts, and Leaflet.

Local Setup

Copy .env.example to .env.local and add the Supabase keys.
Apply the Supabase migrations.
Set ADMIN_INITIAL_PASSWORD in the current shell and create or promote an admin with npm run seed:admin -- administrator@example.com. Remove the temporary environment variable after the command.
Install the AI checker with python -m pip install -r services/ai_checker/requirements.txt.
Start the AI checker with npm run ai:dev.
In another terminal, start the app with npm run dev.
Open http://localhost:3000.

Authentication

Password authentication is the operational default for citizens and administrators. Citizen registration is handled by a same-origin, rate-limited server endpoint; it creates only citizen accounts. Administrators must be explicitly created or promoted with:

npm run seed:admin -- administrator@example.com

Email-link infrastructure can be restored later without changing protected routes. The callback still supports PKCE authorization codes and SSR-safe token hashes, and the local Supabase template remains at [supabase/templates/protocol-magic-link.html](supabase/templates/pro

项目描述

Explore the live platform: protocol36.vercel.app

PROTOCOL