ducoterra
86c8bf4992
Phase 33 completion pass is done. Final report:
## Phase 33 — completion report
**All 8 task files complete** (`.agents/phases/complete/33_gateway_route_switching/`), full gate green, docs verified.
### Work in this pass
1. **`tests/test_routectl.py` added** (17 tests, all green) — exercises the *real* helper binary unprivileged against a fake tree (`--root`), the real agent parser, the captured gateway fixtures, and stubbed `nginx`/`haproxy`/`systemctl` on `PATH`. Pins the full protocol (locate → state → dry-run → temp-file/fsync/`os.replace` write → checker → restore on checker failure → reload-never-restart → re-read proof → sidecar record), all three route shapes (haproxy `server`, nginx `proxy_pass`, nginx stream `map` via its sink-value id), `drift` / unknown-id / `map-default` refusals, `list`/`verify`, and the `--serve` peer gate (`SO_PEERCRED` uid check, one JSON line per request, exact body shape).
2. **Real helper defect fixed** — `deploy/dashboards-routectl.py`: `main()`'s early-return paths returned `({"ok": False, …}, EXIT_*)` tuples, so `sys.exit()` printed a Python repr instead of a JSON line (usage errors, agent-import refusal). Now prints `json.dumps(…)` and returns only the code, keeping the one-JSON-line contract.
3. **Documentation consistency fixes** (task 08 criterion 6):
- `README.md`: garbled verdict-colour sentence on the switch ("green and to the position") → "in the **on** position and tinted `--gate-on`" (the existence-pair contract).
- `README.md`: audit sentence now names all three event kinds — `route-disabled` / `route-enabled` / **`route-denied`** (the code stores one per refused call; dry runs store none).
- `page-gateway.js`: replaced the stale pre-33 module docstring ("the switch is not wired") with the two-arm `GATEWAY_ALLOW_WRITES` contract.
- `AGENTS.md`: every phase-33 claim re-verified against code (the ten gates, the 35 s/30 s budget pair, `gateway.writes_enabled`, `/api/summary`'s `disabled`, the 1.4.0 agent bullet, the gap list) — no changes needed.
### Verification
- `uv run pytest --cov`: **1970 passed**, 18 skipped — coverage **98.74%** (floor 94%)
- `ruff` clean · `pyright` 0 errors · `bash .agents/validate.sh` **exit 0** (incl. `node --check` on every page script)
- Dev server running; all 10 sources `ok`; bundles exported
### Live infrastructure
**No live changes made.** The live drill remains unexecuted per `data/logs/NOTES-33-switching.md` (no operator approval; checker binaries unavailable in the podman proxy units). All routes stay enabled, config hashes unchanged, and the sandbox rehearsal + backup tree are in place for the operator's own `DANGER` call. All changes are in the working tree only.
93 lines
3.4 KiB
TOML
93 lines
3.4 KiB
TOML
[project]
|
|
name = "dashboards"
|
|
version = "0.1.0"
|
|
description = "Homelab dashboards on one domain: system resources, LLM engines, and UPS battery health"
|
|
readme = "README.md"
|
|
# 3.14 is what the Containerfile, the venv, and the fleet agent's tests run on. The floor
|
|
# is deliberately hard: 3.13 would resolve a different lock and CI would test a stack nobody
|
|
# deploys.
|
|
requires-python = ">=3.14"
|
|
# Deliberately small. Everything we collect is either our own agent's JSON (stdlib only,
|
|
# see agent/host_agent.py) or an upstream Prometheus exposition parsed by our own parser
|
|
# (src/dashboards/prom.py). No prometheus_client, no Grafana, no CDN, no bundler.
|
|
dependencies = [
|
|
"fastapi>=0.143.3",
|
|
"httpx>=0.28.1",
|
|
"uvicorn[standard]>=0.54.0",
|
|
"pydantic>=2.14.1",
|
|
"python-dotenv>=1.2.4",
|
|
# Phase 15: the dashboard mints its own root CA and signs the agent certs (`certs.py`).
|
|
# Dashboard-side ONLY — `agent/host_agent.py` stays stdlib and loads the PEMs with `ssl`.
|
|
# Wheels exist for every platform we build on, and it is the only sane way to issue X.509.
|
|
"cryptography>=50.0.2",
|
|
]
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"pytest>=9.1.1",
|
|
"pytest-cov>=7.1.0",
|
|
"pytest-asyncio>=1.4.1",
|
|
"ruff>=0.17.1",
|
|
"pyright>=1.1.414",
|
|
"debugpy>=1.8.22",
|
|
]
|
|
|
|
# Installed editable by `uv sync` (src layout), so `uv run dashboards` and
|
|
# `uv run uvicorn dashboards.app:app` both work without PYTHONPATH gymnastics.
|
|
[build-system]
|
|
requires = ["hatchling>=1.27"]
|
|
build-backend = "hatchling.build"
|
|
|
|
[project.scripts]
|
|
dashboards = "dashboards.__main__:main"
|
|
|
|
[tool.hatch.build.targets.wheel]
|
|
packages = ["src/dashboards"]
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
addopts = "-q --strict-markers"
|
|
# pytest-asyncio 1.x (pytest 9.2) errors at configure if the default fixture loop scope is
|
|
# unset; "function" is the scope the deprecation points at and matches how every async
|
|
# fixture here is cached (nothing shares a loop across fixtures).
|
|
asyncio_default_fixture_loop_scope = "function"
|
|
markers = [
|
|
# `-m live --live` runs them; without --live they SKIP, so `uv run pytest` stays
|
|
# network-free. See tests/test_live_fleet.py for the env vars each one needs.
|
|
"live: needs real hardware (fleet hosts, LLM engines, or upsd) — opt in with --live",
|
|
# `-m store_perf --store-perf` runs them: the phase-14 timing measurements over the seeded
|
|
# production-shaped store (tests/store_perf.py). The seed itself runs in the default suite;
|
|
# only the multi-minute measurement passes are behind this flag. Underscored because Python
|
|
# decorators cannot carry a hyphen; the CLI flag stays `--store-perf`.
|
|
"store_perf: measures the seeded store's hot paths — opt in with --store-perf",
|
|
]
|
|
# auto: async tests run without a decorator on every single one
|
|
asyncio_mode = "auto"
|
|
filterwarnings = ["error::DeprecationWarning"]
|
|
|
|
[tool.coverage.run]
|
|
source = ["src/dashboards"]
|
|
omit = ["tests/*"]
|
|
|
|
[tool.coverage.report]
|
|
show_missing = true
|
|
skip_covered = false
|
|
|
|
[tool.ruff]
|
|
line-length = 110
|
|
target-version = "py314"
|
|
src = ["src", "tests", "agent"]
|
|
|
|
[tool.ruff.lint]
|
|
select = ["E", "F", "W", "I", "UP", "B", "C4", "SIM", "RUF", "BLE", "PLC"]
|
|
ignore = ["E501"]
|
|
|
|
[tool.ruff.lint.per-file-ignores]
|
|
# FastAPI's dependency injection is a call in a default argument; that is the API, not a bug.
|
|
"src/dashboards/api.py" = ["B008"]
|
|
|
|
[tool.pyright]
|
|
include = ["src", "tests"]
|
|
pythonVersion = "3.14"
|
|
typeCheckingMode = "standard"
|