LegacyHUB is subscribed to AssetRegistered/AssetApproved from QMS but
never polled its service inbox. New consumer maps the §7 payload to an
AssetManifestEnvelope and runs the local knowledge-ingest, then confirms
the delivery. Outcome policy avoids head-of-line blocking: Registered →
ingest (accepted/duplicate/rejected all confirm), Approved/unknown →
confirm without work, malformed → confirm as poison; only transient
infrastructure failures (object_read_failed) leave the message pending
and stop the run for the next scheduled retry. Thin CLI wrapper
scripts/consume_dispatch_inbox.py (scripts/ ships in the image).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Repeated knowledge-ingest of identical content (same sha256, new
asset_id -> new canonical object key) reuses the Document row but
appends a second ORIGINAL_PDF artifact, because ensure_artifact identity
is (document_id, storage_key). process_document_id then crashed with
MultipleResultsFound on scalar_one_or_none and Celery retried forever.
New latest_artifact helper picks the newest row deterministically
(created_at DESC, id DESC) — every duplicate references byte-identical
objects (sha256 verified at ingest), so the latest reference is always
safe.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The client posted a body-only envelope to {DISPATCH_API_URL}/messages — an
endpoint that does not exist. Now: /dispatch/envelopes, mandatory DispatchCard
block per the platform pydantic model (int schema_version=1/state_code=0,
task_id=0, int4-safe epoch-second sequence_number), payload under card.event,
UUID card_uid (stable uuid5 for ULID-style asset ids). Inbox accepts both
card.event and legacy root body.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Ruff: declare adapter re-exports via __all__ in docling_extractor
(F401) and sort the engine import block in the adapter test (I001).
Pytest: engine-dependent tests now importorskip the pinned engine —
CI installs light deps only and the engine repo is private, so they
skip visibly there and run in Docker/dev envs with the engine.
Verified: ruff clean; pytest 74 passed + 2 skipped without engine,
80 passed with the pinned engine v0.1.0 installed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds defence-in-depth shared-secret auth that activates when API_KEY
is set. Behaviour:
- empty API_KEY (dev default): every request allowed, middleware is
not even installed;
- non-empty API_KEY: every request under APP_API_PREFIX except
/health must carry X-API-Key: <value> or
Authorization: Bearer <value>. /, /docs, /redoc, /openapi.json and
CORS preflight stay open. hmac.compare_digest is used for the
constant-time comparison.
The middleware resolves settings lazily so test fixtures can reload
app.config and have the new API_KEY take effect on the next install.
Tests (tests/test_api_security.py, 5 cases):
- /health remains open;
- protected route rejects missing key (401);
- protected route accepts X-API-Key header;
- protected route accepts Authorization: Bearer header;
- protected route rejects a wrong key.
Frontend:
- VITE_API_KEY env reads the key and Axios injects it on every
request, falling back to no header when empty so SSO/reverse-proxy
deployments stay unchanged.
- vite-env.d.ts adds the new env entry.
Docs/ops:
- .env.example documents the dev-default empty key;
- .env.prod.example marks API_KEY as a required rotation point;
- docker-compose.yml forwards API_KEY (defaults to empty);
- docker-compose.prod.yml fails the stack with ?:required when API_KEY
is missing;
- RUNBOOK gains an API authentication section with header examples
and the reverse-proxy + key layering recommendation.
pytest -q: 33 passed (5 new security + 28 prior).
npx tsc --noEmit: clean.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
tests/test_alembic.py points Alembic at an in-process SQLite database
in --sql mode so the migration files are validated end to end without
needing the real Postgres compose service. Asserts the documents,
chunks, and processing_events tables plus the unique constraints
appear in the generated DDL, and that the revision graph stays
linear at 0001_initial.
tests/test_routes_search.py monkeypatches
app.indexing.hybrid_search.run_search so the FastAPI route can be
exercised with the real SearchRequest/SearchResponse schemas. Covers
the happy path (rank, citation, reranked flag) and that empty queries
are rejected at schema validation before the backend is called.
pytest tests/test_alembic.py tests/test_routes_search.py -q: 4 passed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
CORS:
- New setting CORS_ALLOWED_ORIGINS (comma separated). Defaults cover
the three local Vite ports (5173, 5273, 4173); production overlay
expects the real origin in .env.prod.
- main.py wires CORSMiddleware from settings.cors_origins. No * in
production - see RUNBOOK and .env.prod.example.
- docker-compose.yml forwards the variable to both api and worker.
Tests:
- tests/test_api_health.py uses FastAPI TestClient and monkeypatches
the five probe functions (postgres/minio/opensearch/qdrant/redis).
Verifies the all-ok, any-error, and degraded paths, that the root
endpoint reports the configured api prefix, and that the CORS
preflight echoes the allowed origin.
- pytest tests/test_api_health.py -q: 5 passed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
