Repository navigation
Add in-house deployment kit, docs and lockfile; fix bandit gate and stale UI test - #11
Open
VamikaSinghal wants to merge 2 commits into
Open
VamikaSinghal wants to merge 2 commits into
VamikaSinghal wants to merge 2 commits into
Conversation
…test - scripts/setup_local.sh: uv/CPython 3.12 venv from pinned lockfile, generated .env token, optional on-device embedding model, sqlite-vec verification - scripts/start_backend.sh, stop_backend.sh, health_check.sh: service wrappers for the FastAPI and standalone entry points with pidfile/log and a 4-step health contract - scripts/backup_local.sh, restore_local.sh: WAL-safe vault + index backup and restore - deploy/launchd: user LaunchAgent installer/uninstaller (KeepAlive, verified crash recovery) - Dockerfile, docker-compose.yml, .dockerignore: Linux container path (api, optional worker/proxy profiles); untested locally (no Docker on the build machine) - backend/requirements.lock.txt: universal lock of backend/requirements*.txt - .env.example rewritten as a full single-user reference; .gitignore covers env, venv, run state, data, backups, models, keys - docs: INSTALLATION, CONFIGURATION, OPERATIONS, SECURITY, DEPENDENCIES, IN_HOUSE_MIGRATION_REPORT; ARCHITECTURE deployment topology; README/SETUP pointers - Mark SHA1 content fingerprints usedforsecurity=False (bandit B324; CI security gate) - Update test_macos_ui_quality_contract to the AppleSignInSupport gate symbols Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ot requirements, remote site-feed validation - test_rerank_eval: run warmup_embedding_provider() before checking the effective provider so the gate skips (as intended) when model2vec is not installed instead of failing on hash recall - requirements.txt: restrict rumps to macOS; pyobjc cannot build on the ubuntu pip-audit runner - validate_update_manifest.py: --allow-remote-artifacts accepts https artifacts not on disk and cross-checks their sha256 against the committed checksums file; strict mode unchanged - ci.yml distribution step and ops_readiness_check site check use the new flag (release-dir validation stays strict) - migration report updated Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Makes the backend reproducible to run on infrastructure the operator controls (macOS launchd service, bare Linux, or Docker), documents the whole configuration/security/dependency surface, and fixes the two things keeping CI red on
mainthat are not release-artefact related.scripts/setup_local.sh(uv/CPython 3.12 venv from a pinned lockfile, generated.envtoken, optional on-device embedding model, sqlite-vec check),start_backend.sh/stop_backend.sh/health_check.sh(FastAPI or standalone entry point, pidfile + log, 4-step health contract),backup_local.sh/restore_local.sh(WAL-safe vault + index snapshot).deploy/launchd/install.sh+uninstall.sh(user LaunchAgent with KeepAlive).Dockerfile,docker-compose.yml(api + optional worker/proxy profiles),.dockerignore.backend/requirements.lock.txt(uv pip compile --universal, 46 packages)..env.examplerewritten as a full single-user reference;.gitignoreextended (env files, venv, run state, data, backups, models, SQLite side files, keys).docs/INSTALLATION.md,CONFIGURATION.md,OPERATIONS.md,SECURITY.md,DEPENDENCIES.md,IN_HOUSE_MIGRATION_REPORT.md; deployment topology appended toARCHITECTURE.md; pointers inREADME.md/SETUP.md.usedforsecurity=Falseinagent_sessions.py,obsidian_writeback.py,storage.py,vault.py(bandit B324, no behaviour change).test_macos_ui_quality_contract.pyupdated to theAppleSignInSupportsymbols introduced in 40705d3.No application architecture, framework or feature changes.
Verification (macOS 26, Apple Silicon, Xcode CLT + uv only)
pytest backend/tests: 2152 passed, 0 failed (was 1 failed onmain)retrieval_eval,tool_routing_eval,adapter_contract_eval,context_pack_eval,token_calibration_eval,agent_task_eval --deterministic,delivery_eval,rerank_eval,adaptation_eval,check_connector_baseline,check_docs_current,backend_beta_smoke,appstore_compliance_lint46/46)bandit -c .bandit.yaml -r backend scripts -ll: 0 medium/high (was 8 high);pip-audit --strict: cleanmacos/build.sh(CORTEX_BUNDLE_PYTHON=0, ad-hoc): builds,codesign --verify --deep --strictpasseskill -9(auto-restart, data intact); backup → restore round-trip; clean-clone install on a fresh venv/portNot verified here: Docker image (no Docker on the machine), Node packages (no Node 22).
validate_update_manifest.py/ops_readiness_check.pystill fail on the missingsite/downloads/Cortex-0.2.0-51.dmg, same as onmain; that is a release-pipeline check, unchanged by this PR.🤖 Generated with Claude Code