marcopan
2ae89c075e
test: gate unified compose deployment
2026-08-05 13:41:33 +02:00
marcopan
b44a1b9ad9
fix: ignore commented nginx auth directives
2026-08-05 12:20:40 +02:00
marcopan
fc349e634c
fix: close server bypass edge cases
2026-08-05 12:09:32 +02:00
marcopan
a94affd6ac
fix: enforce server trust boundaries
2026-08-05 11:42:35 +02:00
marcopan
96fe5bfa79
fix: make server operations executable
2026-08-05 11:06:34 +02:00
marcopan
a707fb442c
docs: add autonomous server installation guide
2026-08-05 10:22:02 +02:00
marcopan
df21046472
fix: make local recovery fail closed
2026-08-05 09:48:55 +02:00
marcopan
65aa52115f
fix: harden local installation guide
2026-08-05 09:23:44 +02:00
marcopan
53d257fb76
docs: add autonomous local installation guide
2026-08-05 08:35:13 +02:00
marcopan
c01202f06c
fix: pass vector rotation operator env
2026-08-05 08:12:38 +02:00
marcopan
09834d5cd4
fix: close deployment decoupling review
2026-08-05 07:52:32 +02:00
marcopan
5d037e97c4
refactor: remove portal deployment coupling
2026-08-05 06:58:19 +02:00
marcopan
55926c75f8
fix: harden pi management verification
2026-08-05 01:00:13 +02:00
marcopan
935bb1db0e
fix: harden embedded Pi lifecycle recovery
2026-08-04 23:14:47 +02:00
marcopan
4158990c10
fix: harden thothctl diagnostics
2026-08-04 17:00:05 +02:00
marcopan
853a151796
feat: add cross-platform thothctl
2026-08-04 16:48:40 +02:00
marcopan
e2264ee295
build: harden image build inputs
2026-08-04 16:33:39 +02:00
marcopan
d42fdf4b71
build: make embedded pi images reproducible
2026-08-04 16:19:04 +02:00
marcopan
87b0fda3f6
fix(dev): proxy local API and restrict frontend upstream
2026-08-04 15:58:13 +02:00
marcopan
8ffcaf3db9
deploy: route frontend and core through one origin
2026-08-04 15:48:15 +02:00
marcopan
fe5c428354
fix(docs): export compose tool paths
2026-08-04 15:37:42 +02:00
marcopan
4f26a71156
fix(docs): enforce compose preflight workflow
2026-08-04 15:33:04 +02:00
marcopan
eb01979072
fix(deploy): generalize connector secret overrides
2026-08-04 15:21:49 +02:00
marcopan
b5071f1494
deploy: isolate git and connector secrets
2026-08-04 15:04:39 +02:00
marcopan
2ce2e0089a
fix: harden compose Pi auth mounts
2026-08-04 14:55:05 +02:00
marcopan
2595d35682
deploy: unify local and server compose stack
2026-08-04 14:47:16 +02:00
marcopan
f4b9542c92
fix: allow PowerShell CRLF line endings
2026-08-04 14:39:58 +02:00
marcopan
ad07a75490
build: enforce portable line endings
2026-08-04 14:33:45 +02:00
marcopan
3d5d26c20c
fix: validate workspace secret source paths
2026-08-04 08:29:02 +02:00
marcopan
37404512ce
fix: bind workspace connector configuration safely
2026-08-04 08:22:09 +02:00
marcopan
e5219deab1
fix: harden workspace registry installation docs
2026-08-04 08:11:28 +02:00
marcopan
72e16dd5ea
docs: add workspace registry installation manuals
2026-08-04 07:57:09 +02:00
marcopan
802b564200
fix: harden workspace registry deployment
2026-08-04 07:42:35 +02:00
marcopan
f71feecaea
feat: deploy portable workspace registry
2026-08-04 07:26:45 +02:00
marcopan
801f847ec4
fix: use Pi user auth and handle startup failures
2026-07-21 14:01:47 +02:00
marcopan
0cf09777f2
Fix session resume and PSD container configuration
2026-07-20 20:22:47 +02:00
marcopan and Claude Opus 4.8
3453f3ae23
feat: pre-check DWH reachability before creating a session (local dev only)
...
New session now refuses to spawn a Pi runtime that would only die in bootstrap
retrieval when the DWH/vector host is unreachable (e.g. a dropped VPN). Before
`session new`, POST /sessions probes the DWH via `tht db ping`; if it is down it
returns 503 {code:"dwh_unreachable"} with a clear message and creates nothing.
- Gated behind the THT_DWH_PRECHECK flag (default off), enabled only by the local
dev launcher (run-stack.sh) — containers/CI never pay the probe, and existing
tests that don't set it are unaffected.
- ThtRunner.dbPing() runs `tht db ping` with a 10s timeout (run() gains an optional
timeout that SIGKILLs a hung child).
- Frontend: apiFetch throws a typed ApiError (status + parsed payload); the new-
session composer shows the specific alert on `dwh_unreachable` instead of the
generic retry hint, keeping the question for retry.
Verified live on an isolated backend (precheck on + broken DWH host → 503
dwh_unreachable, no session created) and via unit tests (backend 228, frontend 308).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-07-18 12:08:47 +02:00
User
df1e7dea9c
fix(resume): recover cleanly after Pi exits
2026-07-14 21:35:50 +02:00
User
5891bb4a18
fix(deploy): connect core to local Qwen
2026-07-14 20:58:19 +02:00
User
2bd2f72356
Merge origin/codex/portable-deployment into feat/docker-local-deploy
...
Unisce gli internals di Codex (secret-bundle, provider-credentials, auth upstream,
security hardening, CI multiarch) mantenendo le fix portal-specific:
- backend: configPath da THT_CONFIG (fix sessioni) + dataRoot di Codex; authMode 'upstream'
- Docker/compose: TENUTO il mio (verificato live: omics_network+alias, env_file, pi npm-g)
perche' il compose/Dockerfile/entrypoint di Codex sono accoppiati al suo modello
secret-bundle (tht doctor inesistente, secret-policy.sh). Adottabile in futuro.
- config.test.ts: preso Codex (superset)
Verificato: tsc clean, 132/132 vitest.
2026-07-12 21:13:20 +02:00
marcopan
7628eaa579
fix(docker): run real questions through trusted Pi gate
2026-07-12 19:20:10 +02:00
User
67d030b24d
feat(deploy): docker images, compose, roles SQL, local workspace
...
- core.Dockerfile: python:3.12-slim + node 22 copied (same bookworm glibc), non-root, tht+pi
- frontend.Dockerfile: vite build (env-driven base/assetsDir) + nginx-unprivileged
- compose.yaml (embedded, omics_network ext, zero host ports) + docker-compose.dev.yml (standalone)
- deploy/sql: thoth_dwh_reader (ro) + thoth_vector_rw (rw) roles
- deploy/thothii.env.example + harness/workspaces/local.yaml (direct DWH+vector, 5438)
- scripts/docker-smoke.sh; .dockerignore; gitignore deploy secrets
- verified: both images build, core health {ok}, config check validates local.yaml
2026-07-12 16:49:03 +02:00
marcopan
449a333365
fix(security): validate bundle and clean runtime secrets
2026-07-12 11:52:02 +02:00
marcopan
10465917a5
test(compose): validate bundle deployment contract
2026-07-12 11:48:43 +02:00
marcopan
07967bf589
docs: document one-command Docker installation
2026-07-12 11:44:00 +02:00
marcopan
70a19f290d
feat(compose): use one secret bundle for local services
2026-07-12 11:30:43 +02:00
marcopan
32a2b71687
build(compose): make root startup the default
2026-07-12 11:14:36 +02:00
marcopan
72bc50ab2e
fix(preprocess): enforce local vector startup chain
2026-07-12 07:54:09 +02:00
marcopan
e40a9d9a56
fix(backend): inject provider credentials from file
2026-07-12 07:53:22 +02:00
marcopan
ee92ef45ab
fix(vector): track packaged migrations in restore smoke
2026-07-12 07:49:58 +02:00
marcopan
