busya
4c57789218
Round 2 — P1 MCL + GRACE: - logger intent-drop repaired across 182 call sites; logging unified repo-wide on the intent-first facade (211 direct SSOT log() sites migrated); facade level= support; molecular-cot-logging skill synced with the module (.agents -> .kilo). - EXPLORE/REASON-REFLECT gaps closed: poll-dispatch failure path, exploration fail-closed choke point in _finish(), 9 silent mcp_ops_dispatch adapters. - INV_6: dead agent/app.py edge removed (_llm_health); specs 033/035/036/039 sweep -> 0 dead edges (5 retargeted to live IDs, 15 tombstoned with successors). - INV_9 dedupes (TaskDrawer BINDS_TO, vestigial assistantOffset, duplicated @SIDE_EFFECT); INV_1: migrations 0014-0016 anchored, exploration_sandbox module-region span fixed. - Full-suite defect root-caused: leaked DI singleton mocks from test_dependencies_unit -> autouse restore fixture + get_session_idle_timeout_minutes hardening (int validation, EXPLORE fallback SESSION_POLICY_CONFIG_INVALID). - Executable pins: tests/test_core/test_logger_wire_format.py (wire fields, misuse proof, repo-wide AST sweeps over both forbidden shapes). Round 3 — server.py decomposition EXECUTED per the binding gate plan (specs/050-mcp-interface/plans/server-decomposition-gate.md, execution log included): - 1571 -> 177 LOC: scenario_inputs.py (268), auth.py (238, single _access_token_context site), rbac_server.py (393), tools_authoring.py (367), tools_scenario.py (373). - Addendum E: pre-existing ops_tools.py INV_7 offender split 420 -> 215 + tools_review.py (253). - Contract IDs frozen, import surface frozen, registration order frozen; monkeypatch seams relocated to owning modules (recorded); zero behavior diff. Round 4 — P2 queue closed: - Story 5 AC2: HandoffSurface copyable prompt parameterized with dashboard context (/agent route forwards objectType/objectId/objectName/envId/route/intent; i18n handoff_context_label ru/en; contract + render tests). - E6 / MCPX-FR-007a: McpTransportGuard enforces server-owned JSON-depth bound (typed 400 json_depth_exceeded pre-dispatch, iterative fail-closed walker) and per-session sliding-window rate limit (typed 429 rate_limited + standard Retry-After); rejections create no mutable state. Limits live in McpServerConfiguration. - SC-005 remnants CLOSED: /api/assistant router unmounted (package retained as MCP parity provenance, header records rationale); /api/agent/llm-config REMOVED with in-place Tombstone + dead strict service DI deleted; assistant.ts deleted (inbound edge removed first); SystemSettings assistant-retention UI + 16 i18n keys removed; .env.example 7860/GRADIO vars removed (zero consumers verified repo-wide). - SC-004 + SC-009: exact RBAC catalog pins (admin 47 / analyst 21 / viewer 15 derived from the live catalog); mid-flow role revocation hides tools in the next tools/list AND denies cached-catalog calls by name on the same identity-only token; mid-flow grant exposes the approvals surface without new consent. - Browser cookie-consent decision recorded (tasks.md T008): not built in 050. Round 5 — last 050 task + FR-010: - T008b: Core.EndpointLocality deny-by-default perimeter guard for LLM/VLM provider base_url at the create/update choke points (private ranges, enterprise DNS suffixes, all-private resolution; fail closed; anti-substring-spoofing; empty URL denied); typed 400 endpoint_not_local:<reason> pre-persistence; EXPLORE audit line on every denial; env escape hatches documented (INSTALL.md "Локальный периметр"). - MCPX-FR-010: MCP_CATALOG_VERSION published as serverInfo.version at initialize; deprecated/deprecation_note on McpToolDefinition; [DEPRECATED] marker at the single list_tools choke point (entry stays listed/callable one minor cycle); deliberate major-bump ritual pinned by test. Evidence: full backend suite 11243 passed / 240 skipped / 1 xpassed / 0 failed; frontend vitest 3435 passed / lint 0 errors; MCP slice 103; locality slice 107; anchor+AST sweeps ALL BALANCED over 138 touched files; 050 tasks.md fully [x] with proof.
86 lines
4.6 KiB
Plaintext
86 lines
4.6 KiB
Plaintext
# ======================================================================
|
||
# superset-tools — локальная разработка (docker compose)
|
||
# Все переменные, используемые docker-compose.yml.
|
||
# Скопируйте в .env.current или .env.master и отредактируйте под ветку.
|
||
# ======================================================================
|
||
|
||
# ── Проект ─────────────────────────────────────────────────────────────
|
||
COMPOSE_PROJECT_NAME=ss-tools-current
|
||
|
||
# ── PostgreSQL (встроенный, docker compose db service) ──────────────────
|
||
POSTGRES_IMAGE=postgres:16-alpine
|
||
POSTGRES_HOST=db
|
||
POSTGRES_PORT=5432
|
||
POSTGRES_HOST_PORT=5433
|
||
POSTGRES_DB=ss_tools
|
||
POSTGRES_USER=postgres
|
||
POSTGRES_PASSWORD=postgres
|
||
|
||
# Universal one-shot migration reset. Legacy Alembic revisions are replaced
|
||
# by 0001_baseline; repeated starts preserve the baseline schema.
|
||
RESET_DATABASE_SCHEMA=false
|
||
|
||
# ── Application storage ─────────────────────────────────────────────────
|
||
STORAGE_ROOT_PATH=/app/storage
|
||
|
||
# ── Порты хоста ────────────────────────────────────────────────────────
|
||
BACKEND_HOST_PORT=8101
|
||
FRONTEND_HOST_PORT=8100
|
||
FRONTEND_SSL_PORT=443
|
||
|
||
# ── Безопасность (ОБЯЗАТЕЛЬНО) ─────────────────────────────────────────
|
||
# JWT-ключ подписи токенов (backend auth + MCP).
|
||
# Сгенерировать: python3 -c "import secrets; print(secrets.token_urlsafe(32))"
|
||
AUTH_SECRET_KEY=change-me-to-a-random-secret-32-chars-min
|
||
# Fernet-ключ шифрования паролей подключений и API-ключей.
|
||
# Сгенерировать: python3 -c "import base64,os; print(base64.urlsafe_b64encode(os.urandom(32)).decode())"
|
||
ENCRYPTION_KEY=D40dpvWPZxKd41jeaTHtEs2R7nwMVLxbkMRLjAICRls=
|
||
# Сервисный токен для agent→backend вызовов.
|
||
# Сгенерировать: python3 -c "import secrets; print('svc-' + secrets.token_urlsafe(24))"
|
||
SERVICE_JWT=replace-with-random-service-secret
|
||
# JWT audience / issuer (опционально)
|
||
# JWT_AUDIENCE=superset-tools-api
|
||
# JWT_ISSUER=superset-tools
|
||
|
||
# ── Admin bootstrap (первый запуск) ────────────────────────────────────
|
||
INITIAL_ADMIN_CREATE=true
|
||
INITIAL_ADMIN_USERNAME=admin
|
||
INITIAL_ADMIN_PASSWORD=admin
|
||
INITIAL_ADMIN_EMAIL=
|
||
|
||
# ── LLM / AI провайдеры (опционально — настраивается через Web UI) ─────
|
||
OPENAI_API_KEY=
|
||
ANTHROPIC_API_KEY=
|
||
# Агент: LLM настройки (если не подтягиваются из FastAPI /api/agent/llm-config)
|
||
LLM_API_KEY=
|
||
LLM_BASE_URL=https://api.openai.com/v1
|
||
LLM_MODEL=gpt-4o
|
||
|
||
# ── Сертификаты / фронтенд ─────────────────────────────────────────────
|
||
CERTS_PATH=./certs
|
||
SSL_KEY_PASSPHRASE=
|
||
LLM_CA_CERT_URLS=
|
||
|
||
# ── Логирование ────────────────────────────────────────────────────────
|
||
ENABLE_BELIEF_STATE_LOGGING=true
|
||
TASK_LOG_LEVEL=INFO
|
||
|
||
# ── CORS / Безопасность деплоя ─────────────────────────────────────────
|
||
ALLOWED_ORIGINS=http://localhost:8100,http://127.0.0.1:8100
|
||
FORCE_HTTPS=false
|
||
APP_TIMEZONE=Europe/Moscow
|
||
|
||
# ── Features ───────────────────────────────────────────────────────────
|
||
FEATURES__DATASET_REVIEW=true
|
||
FEATURES__HEALTH_MONITOR=true
|
||
|
||
# ── ADFS SSO (опционально) ─────────────────────────────────────────────
|
||
# ADFS_CLIENT_ID=
|
||
# ADFS_CLIENT_SECRET=
|
||
# ADFS_METADATA_URL=
|
||
|
||
# ── OpenRouter (опционально) ───────────────────────────────────────────
|
||
# OPENROUTER_SITE_URL=
|
||
# OPENROUTER_APP_NAME=
|
||
# APP_BASE_URL=
|