drive-rag

8 Commits 1 Branch 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
MarioGLealPandClaude Opus 5.5	39124f8073	fix(mtls): a refused peer logs one warning, not an asyncio traceback CI / test (pull_request) Successful in 29s Details Returning before super().connection_made() left uvicorn's inner protocol unset, so its connection_lost raised AttributeError on every refusal. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_015bTPg3qG72vYPLBigJks5h	2026-10-07 21:22:16 +01:00
MarioGLealPandClaude Opus 5.5	84807850ec	feat: optional mTLS - only felt-core's Felt cert gets in (WP-62 M2b B5.2, D10.2) CI / test (pull_request) Successful in 27s Details Off unless DRIVE_RAG_TLS_BUNDLE is set (plain HTTP as before), so this ships ahead of the switch. - server/mtls.py: the same module as felt-voice's (B5.1): uvicorn with TLS 1.3, client cert required against DRIVE_RAG_TLS_CA (the pki_felt intermediate, partial chain - never the root); the peer must carry exactly one SPIFFE URI from DRIVE_RAG_TLS_ALLOWED (default felt-core), checked before any request byte; the server cert reloads when the bundle is renewed. - server/serve.py: the entry point (Dockerfile CMD) - plain uvicorn or mTLS. - tests/test_mtls.py: real test PKI (name-constrained intermediate): felt-core in; no cert, another Felt identity, wrong CA, TLS 1.2 refused; a renewed cert is picked up without a restart. 6 pass. CI runs them. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_015bTPg3qG72vYPLBigJks5h	2026-10-07 18:00:57 +01:00
MarioGLealPandClaude Opus 5.5	0ce0e750fd	import from clockmost-infra projects/drive-rag/app (WP-53 phase 2) CI / test (push) Successful in 8s Details CI / deploy (push) Successful in 7s Details Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01GZZ5ztbBNFM4DjL1zF4dua	2026-10-02 14:15:41 +01:00

Author

SHA1

Message

Date

MarioGLealPandClaude Opus 5.5

39124f8073

fix(mtls): a refused peer logs one warning, not an asyncio traceback

CI / test (pull_request) Successful in 29s

Details

Returning before super().connection_made() left uvicorn's inner protocol
unset, so its connection_lost raised AttributeError on every refusal.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_015bTPg3qG72vYPLBigJks5h

2026-10-07 21:22:16 +01:00

MarioGLealPandClaude Opus 5.5

84807850ec

feat: optional mTLS - only felt-core's Felt cert gets in (WP-62 M2b B5.2, D10.2)

CI / test (pull_request) Successful in 27s

Details

Off unless DRIVE_RAG_TLS_BUNDLE is set (plain HTTP as before), so this ships
ahead of the switch.

- server/mtls.py: the same module as felt-voice's (B5.1): uvicorn with TLS
  1.3, client cert required against DRIVE_RAG_TLS_CA (the pki_felt
  intermediate, partial chain - never the root); the peer must carry exactly
  one SPIFFE URI from DRIVE_RAG_TLS_ALLOWED (default felt-core), checked before
  any request byte; the server cert reloads when the bundle is renewed.
- server/serve.py: the entry point (Dockerfile CMD) - plain uvicorn or mTLS.
- tests/test_mtls.py: real test PKI (name-constrained intermediate): felt-core
  in; no cert, another Felt identity, wrong CA, TLS 1.2 refused; a renewed cert
  is picked up without a restart. 6 pass. CI runs them.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_015bTPg3qG72vYPLBigJks5h

2026-10-07 18:00:57 +01:00

MarioGLealPandClaude Opus 5.5

0ce0e750fd

import from clockmost-infra projects/drive-rag/app (WP-53 phase 2)

CI / test (push) Successful in 8s

Details

CI / deploy (push) Successful in 7s

Details

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01GZZ5ztbBNFM4DjL1zF4dua

2026-10-02 14:15:41 +01:00