Phase 4 slice 3 - hosted build profile + SSE-safe HAProxy front template + deploy wiring (REQ-84/85 legs) #34
1 Participants
coreci-cpo
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: coreci/researchx#34
Reference in New Issue
Block a user
Delete Branch "po/phase4-host-live"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
TL;DR — slice 3 of the phase-4 board item (researchx#30): the hosted frontend build profile (T-4.3), the SSE-safe HAProxy front template (T-4.5), and the deploy wiring + first host-side auth smoke (T-4.7(1) deployable leg). Three files; no frontend source change.
What —
frontend/Dockerfile— build stage gains ARG/ENV forNEXT_PUBLIC_RESEARCHX_API_MODE=live+NEXT_PUBLIC_API_BASE_URL=""beforepnpm build(Next.js inlines NEXT_PUBLIC_* at build time — this cannot be fixed at runtime), plus a build assert failing unless mode=live and the base is empty (a non-empty base would break the same-origin session cookie behind the TLS front; RESEARCH-v03.md §10 pitfall). Empty base is already supported by the code (client.tsbaseUrl() flows into openapi-fetch's relative base, live-client.ts:236; EventSource uses${baseUrl()}/api/runs/...relative, live-client.ts:498) — so no client source change..ciagent/release/haproxy-researchx.cfg(new) — the front template per RESEARCH-v03.md §9:/api+/healthz→ backend_api (option httpchk GET /healthz,server api1 127.0.0.1:8000 check,timeout server/tunnel 3600s), default → frontend_next; the SSE hazards named ABSENT (nohttp-buffer-response, no compression on the API backend, 15s ping kept); the G-104 per-IP/api/auth/*stick-table as a starting threshold for security-engineer review;timeout client3600s stated as a host-defaults requirement. Documentation + idempotent template — applied to the host only on owner directive (D-019)..ciagent/release/deploy.sh— the frontend docker build now passes both build-args explicitly; a post-write-probe smoke asserts unauthenticatedGET /api/config→ 401.Verified — branch off the merged base
c31b61be(milestone/v0.3-hosted post-#32/#33), three commits, each read back byte-identical (1945 B Dockerfile / 2922 B cfg / 14442 B deploy.sh),bash -nclean, authored and pushed as coreci-researchx-po. The gate file rides the branch (inherited from the merged base), so push + pull_request runs fire the gate — evidence lands here as it concludes.Not claimed — this seat has no Docker and the gate does not build images: the Dockerfile assert runs at build time on the deploy host, and the first hosted build rides the owner directive (D-019). The cfg is documentation until applied. The authenticated live-mode tier marker is T-4.7's staged smoke (D-019). The 401 smoke does not discriminate the serving entrypoint (both create_app shapes default auth_enabled=True) — the entrypoint is pinned by T-4.2 / PR #32's CMD fix.
Action — @coreci-hap @coreci-cpo: review and merge; the merge is the approval (v1.3). Order constraint is gone — #32 and #33 are merged.