Conversation
Resolves PR #304 merge conflicts: - docker-compose.yml: kept our slim cheap-one-box compose; dev's conflicting change only touched the ollama healthcheck, which this branch removes entirely. - deepiri-web-frontend submodule: merged dev's unrelated feature work (codebase-intelligence, ops dashboards) on top of our static-build nginx change; pushed as infra/cheap-one-box-static-nginx. - deepiri-api-gateway submodule: merged dev's unrelated feature work (JWT verification, PrismPipe removal) on top of our Docker build fix; pushed as infra/cheap-one-box-gateway-build.
- Replace postgres-auth/postgres-core/postgres-intelligence with a single postgres service hosting 3 logical databases (platform_auth, platform_core, platform_intelligence), each with its own role. Lower overhead on the 8GB VPS, one data dir/volume, simpler backups. scripts/database/postgres-init-multi-db.sh creates the roles/databases and applies each tenant's existing schema file inside its own database. - Fix postgres-init-intelligence.sql: 'SET search_path TO intelligence;' dropped 'public' from the search path, so every unqualified uuid_generate_v4() call failed and platform_intelligence silently ended up with 0 tables. Now 'SET search_path TO intelligence, public;'. - Add real TLS: ops/nginx/cloud-prod.conf redirects HTTP to HTTPS (except the ACME challenge path and /health) and terminates TLS on 443. New certbot service auto-renews. ops/nginx/init-letsencrypt.sh does the one-time real-cert bootstrap; ops/nginx/ensure-dummy-cert.sh generates a throwaway self-signed cert so nginx never crash-loops on a missing ssl_certificate file (used by both the real bootstrap and local testing). - Rewrite postgres-backup.sh/postgres-restore.sh to back up/restore the whole cluster (pg_dumpall) instead of one hardcoded database that no longer matches the schema. Also fixes a latent bug where piping pg_dumpall's --file output through 'grep -v NOTICE' silently aborted the script under set -e once there was nothing left on stdout to filter — every backup would have died right after writing the dump, before compressing. Added a pg-backup sidecar service that runs it nightly. All of the above verified by actually booting the containers (not just config-parsing): consolidated postgres passes a full auth-service Prisma connection, TLS redirect/cert/proxy chain confirmed with curl+openssl, backup/restore round-tripped a real row through delete+restore.
fix: repair CI install, build, and test pipeline (#13) fix: bump pytest to 9.x for Dependabot vulnerability (#12) chore(deps): bump idna from 3.11 to 3.15 (#9) The other submodule drift from the earlier merge (deepiri-logger, deepiri-modelkit, deepiri-ollama-utils, deepiri-suite, diri-cyrex (+ its own nested submodules), diri-helox, deepiri-auth-service, deepiri-external-bridge-service, deepiri-language-intelligence-service, deepiri-shared-utils, deepiri-sugar-glider, deepiri-synapse) was just a local working-tree sync issue, not a scope problem — HEAD already recorded the newer commits from merging dev in, nobody had run git submodule update to check them out. No new commit needed for those.
New pg-backup-offsite service (rclone/rclone) copies pg-backup's output to S3-compatible storage (AWS S3, Cloudflare R2, Backblaze B2, DO Spaces, MinIO — anything speaking the S3 API), configured entirely via env vars so no rclone config file/credentials-in-image is needed. Uses 'rclone copy' (never 'sync') so local retention pruning never deletes off-box copies. Disabled by default (BACKUP_OFFSITE_ENABLED=false) — picking the actual bucket/account is an infra decision, not a code one, so this stays a clean no-op (verified exit 0, no error) until someone opts in. Verified live against a throwaway MinIO container standing in for a real S3-compatible endpoint: uploaded a real file, confirmed it landed remotely, and confirmed the disabled path no-ops correctly.
Replaces the cut Prometheus/Grafana/InfluxDB stack with a single Netdata container (~150-200MB RAM vs. that combo's 500MB-1GB+) — host + container CPU/mem/disk/network metrics, threshold alerting. Uses host networking + PID namespace (Netdata's own recommended Docker setup) so it sees real host-level stats rather than a NATed container view. Mounts the docker socket read-only for per-container metrics. Opt-in cloud dashboard: unclaimed by default (no NETDATA_CLAIM_TOKEN). Claiming to Netdata Cloud is a free-tier account signup, not something this repo can do — left as an env var for whoever sets that account up. SECURITY: local dashboard on :19999 has no auth by default. Documented in both the compose file and .env.example — needs either a Netdata Cloud claim + firewalling :19999 from the public internet, or just firewalling :19999 and using an SSH tunnel for local access. Verified live: booted it standalone, confirmed the dashboard responds (HTTP 200), host metrics populate, and per-container cgroup metrics are collected via the docker socket mount (confirmed a real cgroup_deepiri-netdata.cpu chart).
This reverts commit 311564b.
Capture the local-prod idle measurement, minimum service set, and Netcup hourly vs 12M costs so deploy can start without the CloudInfra doc as the only source of truth. Request David Li review on PR #304. Co-authored-by: Cursor <cursoragent@cursor.com>
Record Netcup hourly/12M/16GB, OVH configurator, Hetzner CX/CPX, Contabo, and CloudInfra/PR URLs in CHEAP_ONE_BOX_VPS.md. Co-authored-by: Cursor <cursoragent@cursor.com>
…restore Sorge findings on PR #304, gone through individually: - depends_on used service_started instead of service_healthy for every service api-gateway depends on — real issue. 8 of those 9 services had no healthcheck at all, so the naive fix (just flip the condition) would have broken compose validation. Added healthchecks to all 8 (curl-based, except synapse which has no curl in its slim Python image — used a python urllib one-liner instead) and switched api-gateway's depends_on to service_healthy across the board. Verified live: full compose up, all 9 report healthy before api-gateway starts. - Port "conflict" between language-intelligence-service and registry (both container-internal :5003) — false positive. Neither publishes a host port; they're isolated per-container network namespaces, which is exactly why api-gateway can address both by hostname without issue. No change. - AUTH_ENABLED defaulting to false for language-intelligence-service — this is already deliberately mitigated: api-gateway's own routes to that service run userAuthMiddleware and re-verify the JWT independently, regardless of the downstream service's own auth config (see the comment already on those routes). Flipping the default would risk breaking internal service-to-service calls without auditing every caller first. No change. - Hardcoded mem_limit values — this is Joe's own explicit design in the immediately preceding commit ("conservative soft caps... operators should tune per actual box size"). Making it match Sorge's env-var suggestion would work against that stated intent. Left as-is. - Generic `server_name _` in cloud-prod.conf — standard, correct pattern for a single-vhost catch-all; nginx doesn't envsubst plain .conf files anyway so Sorge's literal suggestion wouldn't work without adding an envsubst step that doesn't currently exist or get used elsewhere. No change. - postgres-backup.sh NOTICE-suppression — already fixed in an earlier commit on this branch; stale finding. While verifying the postgres-restore.sh twin of that already-fixed backup-script bug, found it's worse than a stale review comment: the grep -E "(ERROR|FATAL|WARNING)" || true on the actual restore pipe means the script has *never* been able to detect a failed restore — psql doesn't return non-zero for per-statement SQL errors unless told to, so every restore reported "completed successfully" regardless of whether it restored anything. Fixed by adding -v ON_ERROR_STOP=1 so psql actually aborts on error, then checking its real exit code via PIPESTATUS (had to capture the whole array in one statement — reading indices across separate lines silently loses everything past the first once another command runs in between). Fixing the detection surfaced a second, previously-invisible bug: pg_dumpall --clean emits DROP ROLE for every role including the one used to connect for the restore, which Postgres always refuses ("current user cannot be dropped") — so with detection now working, every restore would have failed outright. Strip that one self-referential DROP ROLE/CREATE ROLE pair before piping into psql; the role already exists with correct attributes regardless, and the ALTER ROLE line right after still re-syncs its password/attributes. Verified all of this live, not just read the diff: a deliberately-broken backup now correctly fails loudly (exit 1) instead of reporting fake success, and a real backup/restore/data round-trip (insert marker row -> backup -> corrupt -> restore -> confirm row is back) now both succeeds *and* correctly reports success. Also updated docs/architecture/CHEAP_ONE_BOX_VPS.md's sizing numbers — the existing ones were idle-only and from before Postgres consolidation (2026-08-12, three Postgres containers). Replaced with current-branch idle + concurrent-load numbers: idle is still comfortably light, but CPU (not memory) is the real ceiling under simulated concurrent load, worth flagging explicitly in a purchasing decision doc.
Record Netcup 1000 G12 launch suitability (RAM fine, CPU watch), document-upload test gap, and env readiness vs STORAGE_/OAuth/ offsite-backup blockers while BACKUP_OFFSITE_ENABLED=false. Co-authored-by: Cursor <cursoragent@cursor.com>
Record his 2:58 PM Netcup 1000 G12 launch verdict (RAM fine, CPU watch, doc-upload gap) and 3:40 PM env readiness vs STORAGE_/OAuth/ offsite-backup blockers verbatim in CHEAP_ONE_BOX_VPS.md. Co-authored-by: Cursor <cursoragent@cursor.com>
Define what portal/gateway/auth/jobs are for for builders, and a phased split: compose profiles → product-owned composes → optional deepiri-control-plane repo, with AI/LIS off the cheap cloud box. Co-authored-by: Cursor <cursoragent@cursor.com>
Cloud is the internal Deepiri hub only; Cyrex and LIS move exclusively to a local deepiri-control-plane. New deepiri_hub Postgres model; quarantine compose/env and FE flags called out in phases. Co-authored-by: Cursor <cursoragent@cursor.com>
Spell out deepiri_hub (cloud), lis_db (control plane), cyrex_db (Cyrex stack), and which containers belong in each compose. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Joe Black <jrb00013wvu@gmail.com>
Use postgres-platform (cloud), postgres-cp-db + postgres-cyrex-db (control plane); map every docker-compose.dev.yml service to a plane. Co-authored-by: Cursor <cursoragent@cursor.com>
Cloud keeps api-gateway (no Cyrex/LIS hard deps). jobs and registry run on postgres-platform; control plane keeps the rest. Co-authored-by: Cursor <cursoragent@cursor.com>
Rename frontend/frontend-dev to platform-frontend and treat it as a cloud service (optional local copy for offline only). Co-authored-by: Cursor <cursoragent@cursor.com>
Identity/org/portal/catalog/onboarding/vizult/Plaky integrations; vizult CLI on VM via jobs; Plaky owned by external-bridge, not gateway. Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(infra): wire beefed-up Sugar Glider across compose and RTG Bump sugar-glider + modelkit for speech-events, enable publish pipeline, DLQ policies, WAL caps, and dual SUGAR_GLIDER_* env wiring so the bus is ready for Cyrex/Helox/LIS/speech producers. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(infra): point Cyrex-AGI config at Sugar Glider Prefill SYNAPSE_SUGAR_GLIDER_URL in the AGI configmap and commented compose service so enabling the observer uses the shared transport. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(infra): address Sorge feedback on Sugar Glider compose wiring Use a single SUGAR_GLIDER_* env set (no duplicate SIDECAR stream lists), wait on healthy redis, and clean commented cyrex-agi depends_on. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(infra): dual SUGAR_GLIDER_/SIDECAR_ env for Sorge + binary compat Mirror identical values under both namespaces so compose works with the beefed-up sugar-glider image and older SIDECAR_*-only binaries. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(infra): bump sugar-glider CodeQL fix and mirror DLQ env on RTG Point submodule at bounded int-conversion fix and set SUGAR_GLIDER_* DLQ/pipeline/WAL knobs alongside SIDECAR_* in local RTG compose. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(infra): bump sugar-glider for CodeQL cast sanitizer fix Co-authored-by: Cursor <cursoragent@cursor.com> * chore(infra): dual SUGAR_GLIDER_* DLQ knobs on RTG local compose Match SIDECAR_DLQ_* with identical SUGAR_GLIDER_DLQ_* so local RTG sidecars prefer the new env namespace without losing legacy keys. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
api-gateway only proxies /api/plaky/*; bridge owns poll/webhooks + DB. Add postgres-init-platform.sql and definitive compose membership tables. Co-authored-by: Cursor <cursoragent@cursor.com>
Complete DDL/seeds for identity, org, portal, catalog, registry, onboarding, vizult, Plaky integrations, jobs_meta; bootstrap shell creates deepiri_platform role + platform DB. Mark multi-db init as legacy for cloud. Co-authored-by: Cursor <cursoragent@cursor.com>
Capture the full 2026-08-26 design thread: VPS sizing, David Li minimums, portal product goals, DB naming, service split, Plaky on external-bridge, vizult, and postgres-platform schema direction. Co-authored-by: Cursor <cursoragent@cursor.com>
… DEV ENVIRONMENT CONSOLIDATION with .ymls (#302) * feat(scripts): skip CI and sync both branches in dev-to-main PR bot Use direct API merges with [skip ci] to avoid pull_request workflows, fall back to admin squash when needed, and run dev→main after main→dev in backwards mode. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(setup): map QA tiers 1–3 to frontend/backend/AI eng envs QA onboarding now picks a capacity tier that reuses the matching team's submodules and build/start scripts instead of the monolithic qa-team path. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(speech): add LiveKit + deepiri-speech stack with Jobs/Truss wiring Introduce livekit and speech compose services with healthchecks, Silero/faster-whisper hooks, LiveKit worker stub, and workflow-orchestrator /speech proxies for batch STT/TTS. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(diri-cyrex): bump submodule for speech setup --run wiring Points at joe_black/feature/speech (setup.sh livekit/speech + messaging delivery). Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(dev): unify team env ops into setup-deepiri-dev.sh + teams/*.yml Replace duplicated per-team build/start/stop/pull scripts with YAML inventories and a single entrypoint, preserving QA tiers (PR #301) and aligning services to docker-compose.dev.yml (including deepiri-logger). Co-authored-by: Cursor <cursoragent@cursor.com> * feat(speech): integrate Pipecat in-process over WS providers Wire optional Pipecat orchestration inside deepiri-speech (not a separate service), CUDA/MPS/CPU device selection, Kokoro TTS hooks, and make LiveKit an optional webrtc profile so WS duplex stands alone. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(speech): auto-enable Pipecat and full LiveKit agent path Make pipecat-ai[websocket,livekit] a core dependency with FastAPI + LiveKit transports, default LIVEKIT_WORKER_ENABLED, room/token APIs, and Pipecat LiveKitTransport agent joining deepiri-voice on startup. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(compose): point cyrex at deepiri-speech for Track C voice Set SPEECH_* / LIVEKIT env on cyrex and VITE_SPEECH_URL on cyrex-interface so Voice Query can reach the platform speech engine. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(diri-cyrex): bump to voice-and-viz-impl speech wiring Points submodule at Track C branch with deepiri-speech STT/TTS integration. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(speech): guard LiveKitAPI aclose when construction fails Avoid UnboundLocalError in create/list/delete room finally blocks (Sorge on #302). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(cyrex-db): correct in-compose Postgres port + artifact DDL Cyrex must reach postgres-cyrex on container port 5432; add AGI artifact tables to cyrex init SQL. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(cyrex): bump submodule to Postgres artifact store wiring Point diri-cyrex at voice-and-viz-impl commit with postgres-cyrex ArtifactStore DI. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(dev): collapse team ops into setup-deepiri-dev.sh Replace teams/team_ctl.py with pure bash YAML-driven pull/build/start/stop. Bump api-gateway for in-image shared-utils builds and cyrex for Poetry authors. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(speech): add ops/k8s speech configmap and point Jobs/Truss at truss Wire K8S_SERVICE_NAME=speech in compose, include SPEECH_URL on truss configmap, and drop dead workflow-orchestrator defaults. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(compose): indent MESSAGING_SERVICE_URL under api-gateway env Broken indent from merge made docker compose config fail CI Validate compose. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(speech): point JOBS_URL at jobs:5007, TRUSS_URL at truss:5002 They are separate services; /speech/events notify prefers Truss. Co-authored-by: Cursor <cursoragent@cursor.com> * Potential fix for pull request finding 'CodeQL / Information exposure through an exception' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for pull request finding 'CodeQL / Information exposure through an exception' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * fix(platform): separate JOBS_URL (:5007) from TRUSS_URL (:5002) everywhere Wire Jobs into truss/telemetry compose+configmaps, rename team catalogs off legacy workflow-orchestrator names, and document the speech URL map. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(speech): harden LiveKit cleanup and stop leaking exceptions Use LiveKitAPI async context managers (Sorge follow-up) and return generic client errors instead of exception strings on rooms/WS/token paths. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(speech): address QA follow-ups for runtime configuration and tests * feat(speech): swap vendored engine for Team-Deepiri/deepiri-speech submodule + local-first defaults The platform PR carried a byte-for-byte snapshot of deepiri-speech pinned to its pre-local-first state (mock STT/TTS, no cache, no warm-start). Replace the vendored tree at platform-services/backend/deepiri-speech with a real git submodule pinned to the local-first engine (Kokoro-82M TTS + faster-whisper STT, 100% on-device). - Remove platform-services/backend/deepiri-speech/app, tests, Dockerfile, etc. (23 files) in favor of the submodule gitlink (e0aa71b). - compose speech service: SPEECH_EXTRAS=engines default, STT_PROVIDER=faster_whisper, TTS_PROVIDER=kokoro, KOKORO_AUTO_DOWNLOAD=1; dev mount + uvicorn command now use the deepiri_speech package; livekit.yaml resolves inside the submodule. - speech-configmap.yaml: same local-first defaults (faster_whisper/kokoro, auto-download). - teams/all-submodules.yml: move speech out of not_submodules into the real submodule list (Team-Deepiri/deepiri-speech). - teams/ai-team.yml: add deepiri-speech to the AI-team submodule set (AI-team only; ml/backend/frontend/infra/qa teams unchanged). - TEAM_INVENTORY_AUDIT.md + DEEPIRI_SPEECH_INTEGRATION.md updated. Verified: docker compose config parses; all-submodules.yml + ai-team.yml valid YAML; speech submodule pinned to e0aa71b; platform-engineers/all pulls include it via git submodule update --recursive. * fix(setup): restore WSL safe.directory handling lost in team-dev refactor Addresses sorge review finding: detect_existing_clone dropped the dubious-ownership handling that origin/dev shipped for WSL + Windows-mount (/mnt/c) checkouts. Reintroduce the safe.directory exception (script_dir + toplevel) and base clone detection on the git toplevel so detection still works when setup-deepiri-dev.sh runs from a subdirectory. * fix consolidation for team dev environments * fix(ci): bump submodule pins to pick up Docker build fixes - deepiri-sugar-glider: bump to dev (go build image now matches go.mod's go 1.25 requirement) - deepiri-external-bridge-service: bump to pick up BEDD_IMAGE ARG COPY --from fix (buildx doesn't support ARG expansion directly in --from) * fix(ci): bump external-bridge-service submodule pin (BEDD_IMAGE 0.6 -> 0.8) * feat(ci): bump external-bridge-service submodule pin (bedd redact wiring) * fix(ci): bump diri-cyrex submodule pin (Dockerfile.cpu Bedd tag/syntax fix) * fix(ci): bump LIS and diri-cyrex submodule pins (strip unused Bedd embeds) * fix(k8s,teams): add missing LIS configmap, drop redundant pull.recursive Sorge AI review triage for PR #302: - ops/k8s/configmaps/language-intelligence-service-configmap.yaml was missing entirely — every other K8S_SERVICE_NAME-scoped service (auth, external-bridge, messaging, registry, synapse, telemetry, truss, jobs, realtime-gateway, cyrex, speech) has one, LIS didn't. load-k8s-env.sh silently no-ops when the file is absent (no error), so docker-compose dev was unaffected (PORT is set directly there and already correctly 5003, matching api-gateway's LANGUAGE_INTELLIGENCE_SERVICE_URL), but a real k8s deployment sourcing config from these files would have nothing for this service. Added, matching the values already used in docker-compose.dev.yml. - teams/platform-engineers.yml: pull.recursive was dead config — pull.all_recursive: true takes the branch in setup-deepiri-dev.sh that never reads pull.recursive (only the non-all_recursive branch does). Removed. Reviewed and dismissed as false positives (verified against the actual code, no fix needed): - deepiri-truss missing @team-deepiri/shared-utils dep — already declared in package.json:13 - SPEECH_URL hardcoded fallback in speechClient.ts — matches the established codebase-wide pattern (every *_URL in api-gateway does the same), keeping as-is - missing deepiri-speech submodule in backend/infra/qa team ymls — speechClient.ts imports nothing from that submodule (pure HTTP client), and truss's speech routes fail gracefully via try/catch; the existing 'ai-team livekit+speech stack only' scoping is correct - deepiri-logger 'missing' from frontend-team.yml — already present at line 16 - postgres-cyrex POSTGRES_PORT 5432 'conflict' — that's the cyrex service correctly using the container-internal port to reach postgres-cyrex over the Docker network; the host mapping is the distinct 5434:5432, already commented in compose * fix(teams): address PR #302 QA blockers for sugar-glider and pull_only Confirm compose service name sugar-glider in team YAMLs, make team_catalog_list strip inline comments so cyrex-interface stays pull_only, and point onboarding docs at setup-deepiri-dev.sh. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(messaging): extract Cyrex response/message for agent forward forwardToAgent now reads response.response as well as message so Cyrex invoke replies are persisted instead of a duplicate "No response from agent". Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Christian Krider <christian.krider@gmail.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Nightly Postgres dumps run inside jobs via cron-scheduled platform.pg_backup jobs (pg_dump, gzip, retention). Remove the standalone pg-backup service from cloud compose; wire PG_BACKUP_* env and postgres_backups volume on jobs. Add IMPLEMENTATION_PLAN.md and update architecture docs for the decoupling split. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Init script used bash + CRLF, which fails inside postgres:16-alpine (env: can't execute bash). Convert to POSIX sh with LF endings so cloud compose volume bootstrap creates role, DB, and schemas. Co-authored-by: Cursor <cursoragent@cursor.com>
- Frontend perf: split vendor chunks (three, firebase, charts, leaflet, framer-motion) + lazy-load heavy routes via React.lazy; initial bundle 1.7MB -> 303KB (65KB gzip), three lazy-loaded. nginx: immutable caching for /assets/*. - Register: fix payload 'name' -> 'username' (gateway validation rejected name), add confirm password field with match validation, add debounced email availability check via GET /auth/check-email. - Auth-service: add GET /auth/check-email endpoint. - Infra: add CD workflow .github/workflows/cd-cloud-portal.yml (rsync + docker compose build on push to dev), document secrets in ops/ci/GITHUB_SECRETS.md, add CLOUD_DEPLOYMENT_GUIDE.md.
…-dev feat(infra): add cheap one-box platform compose
- Delete non-cloud backends: language-intelligence, messaging, realtime-gateway, speech, telemetry, truss. - Delete non-cloud shared: prismpipe, synapse, sugar-glider. - Delete non-cloud root submodules: diri-cyrex, diri-helox, deepiri-elkedel, deepiri-modelkit, deepiri-ollama-utils, deepiri-logger (not needed for cloud portal). - Frontend: portal home as developer hub / home base of our operations (quick access, cloud vs control plane, hub DB), hub-centric nav when VITE_ENABLE_LIS/CYREX false. - Keep cloud portal: auth, gateway, registry, jobs, external-bridge, frontend, postgres-platform, redis, nginx, certbot, backup.
…ices chore: remove non-cloud services, portal is home base
Pulls in perf/lazy-load-legacy-pages — fixes the sluggish platform.deepiri.com load by lazy-loading ~30 legacy gamification routes that were eagerly bundled (including a path that pulled in three.js at 947KB/270KB gzip on every page load).
…ding perf: bump frontend submodule for lazy-loaded routes
'deepiri-web-frontend/**' only matches files inside the dir, not a gitlink change to the submodule path itself -- so bumping the deepiri-web-frontend submodule pointer (as in PR #339) never triggered a redeploy. Add the bare 'deepiri-web-frontend' entry.
…rigger fix: CD path filter misses frontend submodule pointer bumps
Fixes the 'Connection to server lost' toast spam on platform.deepiri.com -- cloud has no Socket.IO server since realtime-gateway was cut, but SocketProvider still opened a connection on every authenticated session and looped connect_error.
David flagged the Node deprecation warning about spawn(..., {shell:
true}) unescaped-arg risk. Args here are static literals (not user
input), so there's no actual injection vector, but shell:true is
only needed to resolve npm.cmd on Windows -- gate it to that
platform instead of always shelling out.
fix: bump frontend submodule to drop dead SocketProvider
docker compose up -d was not recreating containers when only the image was rebuilt in place (same tag, new image ID) -- the frontend container kept running the stale image after PR #341's build, and had to be manually force-recreated to pick up the new build. Add --force-recreate so this can't silently no-op again.
…iners fix(cd): force-recreate containers so rebuilt images actually deploy
Announcements + Documents pages, real nav destinations, SVG nav icons.
feat: bump frontend to real internal-portal functionality
chore: CD verify - trigger deploy
fix(cd): robust frontend build - explicit service builds
- deepiri-web-frontend ec88d60 -> 806cb63 (dashboard with meetings + 6 roles) - Dashboard no longer blank: Team Meetings (role-filtered, IT/Admin/Leadership see all) + Upcoming Events (always loaded even without location) - Roles: ai_ml, qa_support, software_developer, it, admin, leadership stored in localStorage + user.metadata, sidebar shows role - Meetings: AI/ML Mon 9:30pm EST, QA Mon 10pm, Infra Tue 9:30pm, Tri-Weekly Tue 10pm (SPHtqLyNsCrw682t9), Management 1st Thu 9pm (3A3zDsDzPFsuXmmAA) - CD now robust (explicit build platform-frontend)
feat: bump frontend to dashboard meetings + RBAC
- deepiri-web-frontend f0d5e1c (perf) -> be66141 (Tools grid + dashboard announcements window + Norozo, role RBAC) - deepiri-api-gateway ba51583 -> bacff67 (GET/POST /api/announcements + POST /api/webhooks/norozo/announcements, in-memory + file, Norozo forwards Discord #announcements 1436509524818395156) - Dashboard no longer blank: announcements window + meetings + tools preview - Tools page role-filtered (admin sees all), Sidebar Tools replaces Announcements - CD now via deepiri user (fixed perms + key)
feat: bump frontend to Tools + Norozo + gateway announcements API
Member
|
@daev1005 please resolve all conflicts and let's merge this. Then we will see what needs to be taken out of this deepiri-platform like local service wise to only have the cloud services, if anything. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Created with dev-to-main-pr.py