drive-rag

8 Commits 1 Branch 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
MarioGLealPandClaude Opus 5.5	84807850ec	feat: optional mTLS - only felt-core's Felt cert gets in (WP-62 M2b B5.2, D10.2) CI / test (pull_request) Successful in 27s Details Off unless DRIVE_RAG_TLS_BUNDLE is set (plain HTTP as before), so this ships ahead of the switch. - server/mtls.py: the same module as felt-voice's (B5.1): uvicorn with TLS 1.3, client cert required against DRIVE_RAG_TLS_CA (the pki_felt intermediate, partial chain - never the root); the peer must carry exactly one SPIFFE URI from DRIVE_RAG_TLS_ALLOWED (default felt-core), checked before any request byte; the server cert reloads when the bundle is renewed. - server/serve.py: the entry point (Dockerfile CMD) - plain uvicorn or mTLS. - tests/test_mtls.py: real test PKI (name-constrained intermediate): felt-core in; no cert, another Felt identity, wrong CA, TLS 1.2 refused; a renewed cert is picked up without a restart. 6 pass. CI runs them. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_015bTPg3qG72vYPLBigJks5h	2026-10-07 18:00:57 +01:00
MarioGLealPandClaude Opus 5.5	22b0a9998a	ci: drop the deploy job - releases come from the release path now (WP-62) CI / test (push) Successful in 11s Details The privileged runner that built and pushed images (Docker socket = root on the server) is retired. A commit on this branch whose CI passes is now snapshotted by the validator, built in the sandboxed CI worker, published by digest and promoted as a PR on clockmost-infra, which the merge gate merges. CI here only tests. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JNYj35rhLswffGwAHYFzia	2026-10-05 18:44:36 +01:00
MarioGLealPandClaude Opus 5.5	0ce0e750fd	import from clockmost-infra projects/drive-rag/app (WP-53 phase 2) CI / test (push) Successful in 8s Details CI / deploy (push) Successful in 7s Details Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01GZZ5ztbBNFM4DjL1zF4dua	2026-10-02 14:15:41 +01:00

Author

SHA1

Message

Date

MarioGLealPandClaude Opus 5.5

84807850ec

feat: optional mTLS - only felt-core's Felt cert gets in (WP-62 M2b B5.2, D10.2)

CI / test (pull_request) Successful in 27s

Details

Off unless DRIVE_RAG_TLS_BUNDLE is set (plain HTTP as before), so this ships
ahead of the switch.

- server/mtls.py: the same module as felt-voice's (B5.1): uvicorn with TLS
  1.3, client cert required against DRIVE_RAG_TLS_CA (the pki_felt
  intermediate, partial chain - never the root); the peer must carry exactly
  one SPIFFE URI from DRIVE_RAG_TLS_ALLOWED (default felt-core), checked before
  any request byte; the server cert reloads when the bundle is renewed.
- server/serve.py: the entry point (Dockerfile CMD) - plain uvicorn or mTLS.
- tests/test_mtls.py: real test PKI (name-constrained intermediate): felt-core
  in; no cert, another Felt identity, wrong CA, TLS 1.2 refused; a renewed cert
  is picked up without a restart. 6 pass. CI runs them.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_015bTPg3qG72vYPLBigJks5h

2026-10-07 18:00:57 +01:00

MarioGLealPandClaude Opus 5.5

22b0a9998a

ci: drop the deploy job - releases come from the release path now (WP-62)

CI / test (push) Successful in 11s

Details

The privileged runner that built and pushed images (Docker socket = root on
the server) is retired. A commit on this branch whose CI passes is now
snapshotted by the validator, built in the sandboxed CI worker, published by
digest and promoted as a PR on clockmost-infra, which the merge gate merges.
CI here only tests.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JNYj35rhLswffGwAHYFzia

2026-10-05 18:44:36 +01:00

MarioGLealPandClaude Opus 5.5

0ce0e750fd

import from clockmost-infra projects/drive-rag/app (WP-53 phase 2)

CI / test (push) Successful in 8s

Details

CI / deploy (push) Successful in 7s

Details

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01GZZ5ztbBNFM4DjL1zF4dua

2026-10-02 14:15:41 +01:00