drive-rag

8 Commits

Author	SHA1	Message	Date
MarioGLealPandClaude Opus 5.5	3f793149f9	docs: README - first person, no links to private notes [skip ci] Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01As1S7fpDqEDnZxcGbSSoUW	2026-10-24 12:51:35 +01:00
MarioGLealPandClaude Opus 5.5	14d9c9e1f0	chore: add MIT license [skip ci] Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01As1S7fpDqEDnZxcGbSSoUW	2026-10-24 11:42:31 +01:00
MarioGLealPandClaude Opus 5.5	93f648affa	deps: certifi 2026.7.22 -> 2026.10.23 CI / test (push) Successful in 16s Details GHSA-6q48-6c7w-9gw2: the older bundle still trusts emSign intermediates whose keys were compromised (Trivy critical, 2026-10-23 sweep). The no-cache release build also picks up the base image's Debian fixes. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01AmGMkB5pQHziini41J7rbQ	2026-10-23 22:57:21 +01:00
MarioGLealP	efdd81f60e	Merge pull request 'feat: optional mTLS for felt-core only (WP-62 M2b B5.2)' (#1 ) from benylin/wp62-m2b-b52-mtls into main CI / test (push) Successful in 14s Details Reviewed-on: Benylin/drive-rag#1	2026-10-07 22:11:13 +01:00
MarioGLealPandClaude Opus 5.5	39124f8073	fix(mtls): a refused peer logs one warning, not an asyncio traceback CI / test (pull_request) Successful in 29s Details Returning before super().connection_made() left uvicorn's inner protocol unset, so its connection_lost raised AttributeError on every refusal. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_015bTPg3qG72vYPLBigJks5h	2026-10-07 21:22:16 +01:00
MarioGLealPandClaude Opus 5.5	84807850ec	feat: optional mTLS - only felt-core's Felt cert gets in (WP-62 M2b B5.2, D10.2) CI / test (pull_request) Successful in 27s Details Off unless DRIVE_RAG_TLS_BUNDLE is set (plain HTTP as before), so this ships ahead of the switch. - server/mtls.py: the same module as felt-voice's (B5.1): uvicorn with TLS 1.3, client cert required against DRIVE_RAG_TLS_CA (the pki_felt intermediate, partial chain - never the root); the peer must carry exactly one SPIFFE URI from DRIVE_RAG_TLS_ALLOWED (default felt-core), checked before any request byte; the server cert reloads when the bundle is renewed. - server/serve.py: the entry point (Dockerfile CMD) - plain uvicorn or mTLS. - tests/test_mtls.py: real test PKI (name-constrained intermediate): felt-core in; no cert, another Felt identity, wrong CA, TLS 1.2 refused; a renewed cert is picked up without a restart. 6 pass. CI runs them. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_015bTPg3qG72vYPLBigJks5h	2026-10-07 18:00:57 +01:00
MarioGLealPandClaude Opus 5.5	22b0a9998a	ci: drop the deploy job - releases come from the release path now (WP-62) CI / test (push) Successful in 11s Details The privileged runner that built and pushed images (Docker socket = root on the server) is retired. A commit on this branch whose CI passes is now snapshotted by the validator, built in the sandboxed CI worker, published by digest and promoted as a PR on clockmost-infra, which the merge gate merges. CI here only tests. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JNYj35rhLswffGwAHYFzia	2026-10-05 18:44:36 +01:00
MarioGLealPandClaude Opus 5.5	0ce0e750fd	import from clockmost-infra projects/drive-rag/app (WP-53 phase 2) CI / test (push) Successful in 8s Details CI / deploy (push) Successful in 7s Details Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01GZZ5ztbBNFM4DjL1zF4dua	2026-10-02 14:15:41 +01:00