From ea5327799a77cd537dbaf87f6fdcdbbd3ae23970 Mon Sep 17 00:00:00 2001 From: Mikhail Date: Sat, 22 Aug 2026 17:27:29 +0300 Subject: [PATCH] chore(deploy): wire optional cognitive provider secret volume --- deploy/docker-compose.prod.yml | 4 ++++ dev/ACTIVE_TASK.json | 4 ++-- dev/tasks/DEV-000153-fleet-secret-wiring.json | 23 +++++++++++++++++++ 3 files changed, 29 insertions(+), 2 deletions(-) create mode 100644 dev/tasks/DEV-000153-fleet-secret-wiring.json diff --git a/deploy/docker-compose.prod.yml b/deploy/docker-compose.prod.yml index ffcbad7..184a8fc 100644 --- a/deploy/docker-compose.prod.yml +++ b/deploy/docker-compose.prod.yml @@ -211,11 +211,15 @@ services: LISTEN_ADDR: ":8083" CORE_RUNTIME_URL: http://core-runtime:8080 LOCAL_CPU_PROVIDER_URL: http://docker.cin.su:18082/v1 + LOCAL_CPU_PROVIDER_API_KEY_FILE: ${LOCAL_CPU_PROVIDER_API_KEY_FILE:-} + LOCAL_CPU_PROVIDER_CREDENTIAL_REF: ${LOCAL_CPU_PROVIDER_CREDENTIAL_REF:-credential://domovoy/local-cpu/provider-api-key/v1} LOCAL_LIFEBOAT_PROVIDER_URL: http://cognitive-lifeboat:8086/v1 LOCAL_GPU_PROVIDER_URL: http://192.168.220.91:11434 COGNITIVE_OWNER_PRINCIPAL_ID: domovoy-creator-principal COGNITIVE_ALLOW_CANARY: "true" depends_on: [core-runtime, cognitive-lifeboat] + volumes: + - assistant_core_secrets:/run/secrets:ro cognitive-lifeboat: image: ghcr.io/ggml-org/llama.cpp:server diff --git a/dev/ACTIVE_TASK.json b/dev/ACTIVE_TASK.json index e5093a1..ca647c9 100644 --- a/dev/ACTIVE_TASK.json +++ b/dev/ACTIVE_TASK.json @@ -1,5 +1,5 @@ { - "task_file": "dev/tasks/DEV-000152-cognitive-provider-secret-reference.json", - "task_id": "DEV-000152", + "task_file": "dev/tasks/DEV-000153-fleet-secret-wiring.json", + "task_id": "DEV-000153", "task_revision": 1 } diff --git a/dev/tasks/DEV-000153-fleet-secret-wiring.json b/dev/tasks/DEV-000153-fleet-secret-wiring.json new file mode 100644 index 0000000..749d20f --- /dev/null +++ b/dev/tasks/DEV-000153-fleet-secret-wiring.json @@ -0,0 +1,23 @@ +{ + "task_id": "DEV-000153", + "task_revision": 1, + "architecture_revision": "ADR-0010", + "base_repo_revision": "dbbc54171d9c8a9edaa93e5ff5870d3ec434d799", + "risk_tier": "E", + "intent": "Wire the production cognitive-worker to the existing protected secret volume for optional local CPU gateway authentication without placing credential material in compose environment values.", + "requirement_ids": ["AUDIT-WP-003", "AUDIT-WP-201", "CONSTITUTION-1.3.28"], + "allowed_change_scope": {"modules": ["cognitive"], "paths": ["deploy/docker-compose.prod.yml", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000153-fleet-secret-wiring.json"]}, + "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/devctl/**", ".gitea/**", "database/**", "contracts/**", "modules/**", "adapters/**"]}, + "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0}, + "contracts": {"consume": ["assistant_core_secrets read-only volume", "optional LOCAL_CPU_PROVIDER_API_KEY_FILE reference"], "may_change": []}, + "semantic_owner": "capability", + "canonical_state": ["provider credential material remains outside repository and compose environment"], + "state_transitions": ["when operators provision the referenced file, cognitive-worker resolves it and authenticates the local CPU gateway; when absent, existing recovery behavior remains available"], + "side_effects_and_privileges": ["read-only mount only; no secret value is added to compose"], + "persistence_and_migrations": ["no database migration"], + "failure_retry_restart": ["empty optional file reference preserves current unauthenticated startup", "configured missing credential file fails closed at worker startup"], + "assumptions": ["the gateway credential is provisioned by production operators into assistant_core_secrets; this task does not copy or reveal it"], + "acceptance_scenarios": ["compose renders with empty optional key path", "cognitive-worker receives read-only /run/secrets mount", "no literal provider credential occurs in repository or compose", "CI and production deployment succeed"], + "required_tests": ["go test", "go vet", "docker compose config", "architecture preflight", "check-diff", "git diff --check", "independent", "CI"], + "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT", "BLOCKED_BY_ARCHITECTURE_GAP"] +} -- 2.54.0