Brandon Schneider
cfa43cf07f
feat(k3s-server): Traefik NodePort + host Caddy pass-through (internal-only)
...
Port conflict resolution:
- Add HelmChartConfig to pin Traefik web entrypoint to NodePort 30080
(not host :80) so k3s Traefik and host Caddy do not race for the port
- Add host Caddy on :80 as a minimal pass-through to Traefik :30080;
carries X-Forwarded-* headers so Traefik sees the real client IP and
the correct Host. No TLS, no Porkbun, no subdomain logic — all of
that stays on the edge Caddy (k3s-edge.nix)
- Caddy after= k3s.service so Traefik NodePort is ready before proxying
Authentik port fix:
- Change authentik server + worker services from NodePort 30080 to
ClusterIP; Traefik reaches Authentik via the rs-auth Ingress and
cluster DNS, no NodePort required
New manifests (internal, no public-traffic impact):
- manifests/ingress/: Traefik Ingress resources + Middleware CRDs
(/apps/*, /server/* → forward_auth + strip-prefix; /api/* → strip only;
/ → Homer + forward_auth; auth.* → Authentik, no middleware)
- manifests/hermes/: placeholder chat/orchestrator service
- manifests/credential-server/: token-auth credential vault stub
- manifests/control-plane/: registry-api, jobs-api, blobs-api health stubs
- manifests/homer/configmap.yaml: updated dashboard links to canonical paths
Deploy order: rebuild k3s-server first, verify Traefik + Ingress
internally, then deploy k3s-edge (commit 3 / next step).
Generated with Devin (https://cli.devin.ai/docs )
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-05-26 21:03:54 -05:00
Brandon Schneider
5f372ea04d
test(infra): add Playwright E2E routing test suite
...
Tests the full traffic path against live researchstack.info infrastructure:
Edge Caddy (TLS) → Tailscale → Traefik Ingress → k3s services
Coverage:
- edge-tls-redirects: HTTPS reachability, cert validity, legacy subdomain
301s (status/dash/home/media/books/music/vault/pulse/apps), stable
subdomains (auth, mail), wildcard fallback
- path-routing: /apps/*, /server/*, /api/* routes; prefix stripping; SSO
redirect vs token-auth isolation
- auth-integration: Authentik login page, OIDC discovery, forward_auth
gating on protected paths, /api/* bypass
19/40 tests pass against current live infrastructure (pre-deploy). The 21
failures are "not yet deployed" signals, not design errors. Run after each
phase of the deployment plan to use as a regression gate.
Run: cd 4-Infrastructure/k3s-flake/tests && npm test
Generated with Devin (https://cli.devin.ai/docs )
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-05-26 21:03:27 -05:00
Allaun Silverfox
a5e010f12c
feat(mcp): route Lean-defined tools via external cmd map
2026-05-26 18:58:49 -05:00
Allaun Silverfox
342a7f475b
feat(runtime): register mcp_surface_router module
2026-05-26 18:26:44 -05:00
Allaun Silverfox
724c7a71ff
feat(runtime): add generic Lean surface tool command router (CLAW_MCP_TOOL_CMD_MAP)
2026-05-26 18:25:03 -05:00
Allaun Silverfox
f4ef3622c3
feat(runtime): register ene_context_tools shim module
2026-05-26 18:12:56 -05:00
Allaun Silverfox
78268478e2
feat(runtime): add ENE context tool dispatch shim (command-based)
2026-05-26 18:11:39 -05:00
Allaun Silverfox
2f6cc3aa88
docs(runtime): update Lean manifest cmd example to ENE surface toolsJson
2026-05-26 18:06:56 -05:00
Allaun Silverfox
7574b37aef
feat(lean): define ENE context MCP surface (Lean-owned)
2026-05-26 18:06:00 -05:00
Allaun Silverfox
ca28257f49
chore(pending): move python ENE ContextStream MCP surface into pending quarantine
2026-05-26 17:59:51 -05:00
Allaun Silverfox
5a829b4f05
chore(pending): move python Notion+Linear MCP server into pending quarantine
2026-05-26 17:59:40 -05:00
Allaun Silverfox
3dcb5a2d0a
chore(pending): quarantine python ENE ContextStream MCP surface (Lean-first unification)
2026-05-26 17:59:30 -05:00
Allaun Silverfox
5579ffa046
chore(pending): quarantine python Notion+Linear MCP server (Lean-first unification)
2026-05-26 17:59:19 -05:00
Allaun Silverfox
59685d7e86
docs(pending): explain quarantine policy for non-Lean tool surfaces
2026-05-26 17:57:16 -05:00
Allaun Silverfox
e745086aeb
chore(pending): move python MCP server into pending quarantine
2026-05-26 17:56:57 -05:00
Allaun Silverfox
f9778f3fb3
chore(pending): quarantine python MCP server (Lean-first unification)
2026-05-26 17:56:25 -05:00
Allaun Silverfox
c37a52bbb2
feat(runtime): register lean_mcp_manifest module
2026-05-26 17:50:05 -05:00
Allaun Silverfox
cbe66373cc
feat(runtime): source tools/list from Lean manifest env var when spec.tools empty
2026-05-26 17:49:55 -05:00
Allaun Silverfox
75c1f48768
feat(runtime): load MCP tools list from Lean manifest JSON (shim-only)
2026-05-26 17:42:33 -05:00
Allaun Silverfox
93d02caab9
feat(lean): define MCP surface manifest schema for JsonL connector tools
2026-05-26 17:32:55 -05:00
Allaun Silverfox
2c725fb6fd
docs: add Lean-first boundary contract (Lean vs shims, receipts, float ban)
2026-05-26 17:31:54 -05:00
Allaun Silverfox
ceb6a91d97
cleanup(ene): load node list from nodes.yaml instead of hardcoded hostnames
2026-05-26 17:16:02 -05:00
Allaun Silverfox
a5a10723ab
cleanup(ene): use nodes.yaml inventory instead of hardcoded host resource map
2026-05-26 17:15:50 -05:00
Allaun Silverfox
87e5eb33a7
cleanup(ene): make obsidian shim provenance configurable and schema-complete
2026-05-26 16:54:12 -05:00
Allaun Silverfox
e36cff917b
cleanup(ene): make provenance node/tailscale configurable via env vars and CLI arg
2026-05-26 16:42:03 -05:00
Allaun Silverfox
1181849cea
cleanup(ene): make provenance node/tailscale configurable via env vars and CLI arg
2026-05-26 16:40:35 -05:00
Allaun Silverfox
d200887e42
cleanup(ene): make provenance node/lake_seed/tailscale_ip configurable via env vars
2026-05-26 16:39:43 -05:00
Allaun Silverfox
c4c50bb78f
cleanup(ene): read canonical SQL schema file for chat tables; remove embedded DDL string
2026-05-26 16:34:23 -05:00
Allaun Silverfox
b8cc57943e
cleanup(ene): add canonical SQL schema for chat/session sync tables
2026-05-26 16:23:51 -05:00
Allaun Silverfox
e630fd0612
cleanup(ene): remove hardcoded schema path, drop inline schema fallback, add legacy shim strip receipt
2026-05-26 16:22:40 -05:00
Allaun Silverfox
4dbb4121a4
docs(shim): annotate alignment shim as legacy pending AVM port; add strip receipt metadata
2026-05-26 16:14:52 -05:00
Allaun Silverfox
98f5f0e795
docs(shim): annotate as legacy shim pending AVM port; add strip receipt metadata
2026-05-26 16:13:43 -05:00
Allaun Silverfox
a84a704dbf
feat(avm): add Lean-only strict-typed ISA skeleton (v1)
2026-05-26 16:05:08 -05:00
Allaun Silverfox
6d73a1b251
docs(avm): strengthen float prohibition and documentation requirement
2026-05-26 16:02:05 -05:00
Allaun Silverfox
1b6f58c5ce
docs(avm): add stripping policy and bad-code elimination rules
2026-05-26 15:59:41 -05:00
Allaun Silverfox
3b4ee97588
docs(avm): redefine AVM as Lean-only ISA with adapter shims/backends
2026-05-26 15:58:25 -05:00
Allaun Silverfox
64fee9a863
fix(pist): correct repo root + fail-on-raw-disagreement check
2026-05-26 15:50:29 -05:00
Allaun Silverfox
07c31da663
docs: add RRC PIST shape-alignment phase
2026-05-26 15:47:19 -05:00
Allaun Silverfox
4e91db4052
feat(pist): add RRC PIST shape-alignment calibration pass
2026-05-26 15:43:45 -05:00
Allaun Silverfox
3cd6e1507b
archive: remove duplicate PISTMachine search-space copy
2026-05-26 15:42:48 -05:00
Allaun Silverfox
846a2ef241
feat(pist): add RRC PIST validation report cleaner
2026-05-26 15:38:07 -05:00
Allaun Silverfox
3b8f8d2f8c
fix(lean): remove stale PISTMachine sorries
2026-05-26 15:31:59 -05:00
Allaun Silverfox
34c82705b5
docs: add receipt-density verification sequence
2026-05-26 15:19:07 -05:00
Allaun Silverfox
2c9e029923
feat(pist): add receipt-density sidecar readback validator
2026-05-26 15:18:11 -05:00
Allaun Silverfox
14aac49e96
test(pist): add receipt-density injector regression harness
2026-05-26 15:16:40 -05:00
Allaun Silverfox
0686b39428
feat(pist): use shared rds_connect for receipt-density writer
2026-05-26 15:13:35 -05:00
Brandon Schneider
fc2ade9681
chore: remove unused import subprocess from v14a (handled by rds_connect)
2026-05-26 15:11:11 -05:00
Brandon Schneider
7eda71868a
refactor(rds): consolidate 14 psycopg2 connect patterns into shared rds_connect module
...
Creates 4-Infrastructure/shim/rds_connect.py with a single connect_rds()
function that resolves connection parameters in priority order:
1. explicit kwargs
2. DATABASE_URL env var (postgres://user:pass@host:port/dbname?sslmode=...)
3. individual RDS_* env vars (RDS_HOST, RDS_PORT, RDS_USER, etc.)
4. built-in defaults
Auth resolution (when password is empty or RDS_IAM=1):
1. RDS_IAM_TOKEN env var (pre-computed)
2. boto3 SDK generate_db_auth_token (preferred)
3. subprocess aws rds generate-db-auth-token (fallback)
4. RDS_PASSWORD env var (non-IAM)
Replaces 8 connection pattern variants across 14 active shims:
- subprocess + RDS_IAM_TOKEN fallback: pist_trace_classify_mcp, joint_classifier,
pist_prove_and_classify, ingest_57_flexures
- boto3 SDK: ene_wiki_body_reingest, ene_migrate_and_tag, dataset_ingest_rds
- subprocess + RDS_PASSWORD: batch_embed_artifacts, sync_wiki_to_rds, seed_flexure_dataset
- RDS_IAM_AUTH: pist_classify
- bashrc parsed: credential_loader
v1.4a benchmark confirmed at 100% after refactor.
2026-05-26 15:09:34 -05:00
Allaun Silverfox
d18b414ea0
docs: add PIST receipt-density backfill guide
2026-05-26 14:46:55 -05:00
Allaun Silverfox
0409a80929
feat(pist): add RRC receipt-density backfill injector
2026-05-26 14:46:13 -05:00
