19 Commits

Include renames

Author	SHA1	Message	Date
stroblmeandClaude Opus 5	058f16ec1d	Close eight open SDK tasks: the pidfile, the log, cards, names and a live curve ... Each was a loose end recorded under `### SDK` in the notepad. `serve` takes its own pidfile down on SIGTERM. uvicorn restores the handler it found and re-raises the signal it stopped on, so the default handler ended the process without unwinding and the `finally` never ran — which is what a stop sends, and what left `serve.pid` behind. `serve.log` is cut back past 5 MB by the engine rather than by the screen that started it, so an adopted engine is bounded too. Gated on its own stdout being an appended regular file, which is what makes the cut safe: the kernel then puts the next write at the new end. Cards are counted from `/dev/nvidia[0-9]*`, so `FLOW_GPUS`/`--gpus` of 0 means "work it out" the way `FLOW_CPUS` always has. The engine counts, not the accountant — a remote worker builds one of those from its own inventory, and detecting there would hand it the engine host's cards. The worker counts last: what a batch job says it was granted still wins. `GET /runs/metrics/names` is the distinct over a selection that `--list` and the terminal's metric picker were approximating by reading the newest run that had measured anything, which missed a name only an older run ever wrote. `MetricSink` announces each batch it has written (`run_metric`, carrying the names). Not a per-point event: one covers up to 500 points or two seconds of them, and the rows stay the record. The terminal comparison fills in as the first readings land instead of staying blank until reopened, and the browser refetches the run and any comparison rather than the list behind them. `retry --group` pages the list route by `before` instead of stopping at 500. The terminal dashboard takes the terminal's colours (`ansi-dark`), and the web UI can re-pair from Settings without disconnecting first. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PRQ9bmTvCbqCwXo9mxZzzV	2026-09-02 16:40:51 +02:00
stroblmeandClaude Opus 5	d471614e6a	Push a frame instead of storing and fetching it ... The rate the media dtypes could carry was one frame every second or two: each was a file on the data volume, an event on the socket, and a request back for the bytes. This closes both halves of that, and they are one feature. `save_artifact(..., volatile=True)` writes to a `VolatileStore` — the same content-addressed store, in `/dev/shm`, bounded by size with the oldest falling out (`ARTIFACT_VOLATILE_BYTES`, 48 MB under the container's raised `shm_size`). Nothing sweeps it: a frame nobody kept is not worth walking the store to find. `ArtifactStore.path` falls through to it, which is what lets a volatile frame be an ordinary reference everywhere else — the dtype check, a panel's digest scope, `load_artifact` in a node, and the widget's own fetch all work on one unchanged. `adopt` copies one into the store when a run records it, so "returned media is kept, emitted media is not" stays true. The bytes then go down the flows websocket as a length-prefixed binary frame, sent just ahead of the `message_value` naming them, so a tile has the frame when it hears the value moved. Nothing is pushed unasked: a client names the messages it is drawing (`{"type":"media","names":[…]}`), a panel's list is intersected with the scope it already had, and only the newest frame per name in a batch is sent — a client that fell behind is not handed frames it would draw over. The tunnel relays text only, so a screen reached through a portal falls back to fetching, which is why the rate table now has two rows. Around the edges: the remote worker's fetch cache is bounded at last (`FLUKSIO_ARTIFACT_CACHE_BYTES`), since content addressing means nothing in it ever expires and a media stream fills it with chunks nothing asks for twice; a port carrying an image draws the frame in the node panel rather than only saying `image/png · frame.png · 1.79kB`; and an edge chip says that much instead of a line of hash. The media screenshot stops waiting for `networkidle` — a camera is a socket that never goes quiet, which is the point of it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YC4u66vjzW54fnHu5Juhh9	2026-09-02 10:15:14 +02:00
stroblmeandClaude Opus 5	d01a8dad37	Rename Installation to Instance ... Follows the portal: the noun is "instance" everywhere the app says it — UI strings, CLI output, error details, docs and comments. The wire keys (`instance_id`, `instance_token`) and the hub route this calls move with it. An existing cloud.json is adopted rather than refused: without the key alias the dataclass fails to parse, which the caller swallows and reads as "never enrolled" instead of "reconnect". `instance_key` on a node type becomes `target_key`. It means the outside thing a node points at, which is a different sense of the word, and keeping both would put two meanings of "instance" in one codebase. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015YrQnKV3bnQd4K342y8tKj	2026-08-31 10:12:01 +02:00
stroblmeandClaude Opus 5	45cc7504e1	Notify a phone that has this installation installed ... A `webpush` alert channel, and the PWA it needs to arrive. The payload is encrypted to the subscription (RFC 8291) and the request signed with this installation's own keypair (RFC 8292), both over `http-ece` — `pywebpush` does the same in one call but brings `requests` and `aiohttp` with it, two HTTP stacks beside httpx on a machine that may be a Raspberry Pi. The manifest and the worker are hand-written rather than `vite-plugin-pwa`: there is nothing worth precaching when the page carrying the credential is `no-store`, so the worker handles `push` and `notificationclick` and nothing else. `registration.scope` is the app's root in both places it runs, which is why the payload carries no URL. A run finishing in error is the first event worth waking someone for; `ok` and `cancelled` describe to nothing, so a nightly batch that works stays quiet. The events were already on the bus — only the filter changed. `WEBPUSH_FILE` is a derived path, so the keypair lands on the data volume with the alerts beside it. Off it, a rebuild would silently stop every phone being notified: the key they subscribed against would be gone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014EbeFPm6WNC3YD9vrqqT3a	2026-08-30 12:12:37 +02:00
stroblmeandClaude Opus 5	57eace2226	Bound what the API accepts, and close the holes the audit found ... **SQLite is the database, and now says so.** `metric_minute` and every run table are written with `sqlalchemy.dialects.sqlite.insert(...) .on_conflict_do_update` and with `max(a, b)`, neither of which another dialect has — so pointing `DATABASE_URL` at Postgres migrated cleanly, served, logged in, and then lost every observability flush into the collector's hold buffer and failed every run. It refuses at startup instead. (The Postgres in the compose stack is Umami's; the engine's own database has been a file beside the flows since 2026-08-21.) **Every integer query parameter is bounded.** The caps were written as `min(limit, 500)`, which a negative walks straight through — `?limit=-1` compiles to `LIMIT -1` and SQLite returns the whole table. Ten signatures, now `Query(ge=…, le=…)`. `hours=0` still means an hour, which `_window_hours` was already deliberate about. **Exports are capped at 10 000 runs** and say so with `X-Truncated`. The filters bounded a sensible request and nothing bounded an unfiltered one, which read every row into memory before a byte was streamed. `_series` resolves cached curves in two queries rather than a `Run` lookup and a `RunMetric` query per restored node — a comparison of twenty runs was calling that twenty times over. **`PUT /artifacts` has a size limit** (`MAX_ARTIFACT_BYTES`, 2 GiB, 0 to disable), checked against `Content-Length` and again against the stream for a chunked body, and its writes moved off the event loop. **`/observability/timeseries` takes `since`/`until`**, the same window `/runs` and `/events` take, capped at 2000 points — `hours=720&bucket_s=60` was 43 200 of them in one array. It is also what a dragged chart needs to re-fetch at its own resolution rather than magnifying buckets it has. **Composite indexes** for the three list screens: `run(flow, created_at)` and `(status, created_at)`, `flow_run(flow, started_at)`, `engine_event(type, ts)`. Every index was single-column, so SQLite picked one and sorted the rest by hand. Verified against a copy of a live database (250k `flow_run` rows): the planner takes all four. **Redis clients have socket timeouts.** A Redis that stops answering without closing the connection hung the caller until the kernel gave up — including `/utils/health/`, whose job is to notice. **The panels file is written under one lock.** `save_panels` and `unpair_panel` are both read-modify-write, and a save that read before an unpair wrote put the old nonce back — silently un-revoking a screen that had just been unpaired. The nonce carry-forward was written to make that impossible; the gap between its read and its write is where it happened. **Startup releases what it acquired.** Everything past `event_bus.bind` registers how to close itself and the `finally` walks that list backwards; a failure part-way through used to reach none of the shutdown steps and leave the worker pool's subprocesses and every background task behind — under `--reload`, once per bad edit. `modules.reconcile` moved into the background: `uv` gets five minutes twice over, the healthcheck allows eighty seconds, and the autoheal restarted the container before it could finish installing. `delete_run` takes SQLite's write lock up front (`core.db.writing`) rather than upgrading a deferred transaction and losing to whichever flush committed in between. `modules.sync` is serialised — two applies mutated one venv at once. The proxied-call and stream dicts are bounded, and a reused id cancels its predecessor instead of dropping the reference. Security, found in passing and small enough to fix here: - **`/secrets/` required only a signed-in user.** The names alone say what this installation talks to, and `PUT /{name}` takes any name, so any account could overwrite the credential a flow authenticates with. Superuser now — which `/search` already assumed and said so. - **`POST /login/access-token` had no rate limit.** Argon2 is deliberately expensive and the route is unauthenticated and runs in the shared threadpool. Ten *failed* attempts per address per five minutes; a successful sign-in spends nothing. - **a password reset link worked repeatedly for 48 hours.** The token now carries a digest of the password hash it was minted against, so it stops verifying once it has set one. No table of spent tokens needed. - **enrolment accepted `http://`**, sending the claim code and then this installation's credential in clear. https, or a local address. - the rate limiter read `request.client.host`, which behind Traefik is the proxy — so every per-address limit was one global bucket and one caller could lock out everyone. It reads the forwarded address, and its bucket table is capped rather than growing one key per address forever. - SMTP has a timeout and sends after the response, so an unreachable mail host cannot pin a threadpool worker, and a reply's timing no longer says whether the address exists. Test suite: engine-written rows are cleared between modules. A `FlowRun` left `running` by one module turned up in another's query. Per-test rollback is not available here — the module-scoped `client` runs the real lifespan and its collector and run service write through sessions of their own — so this bounds it where the writes come from. Three consecutive green runs, orders randomised. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M6hPWS6YEbT1P8LxhhFb2T	2026-08-29 20:40:05 +02:00
stroblmeandClaude Opus 5	7efa75e242	Refuse a zero concurrency limit instead of reading it as the default ... FLOW_MAX_WORKERS, FLOW_MAX_CASCADES and FLOW_MAX_RUNS are all pool sizes, so 0 says neither "none" nor "unlimited" — it is a pool that cannot be built. They are PositiveInt now, so a 0 fails at startup naming the setting rather than being swallowed by `max_cascades or MAX_CASCADES`. The consuming fallbacks take only None as "nobody said": explicit `is None` in the executor, and no clamp on RunService.parallel. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K1moruzue2kTJd3uVisgNk	2026-08-28 20:00:08 +02:00
stroblmeandClaude Opus 5	37a7df9d24	Let a sweep run more than four at a time, and name the run a failure was in ... Concurrent runs sat at 4 whatever FLOW_MAX_CASCADES said: that setting bounds cascades, and the run drivers read a hardcoded MAX_PARALLEL nobody could reach. FLOW_MAX_RUNS is the knob they read now, --max-runs/--max-cascades/--max-workers are the same three as flags on serve, and the engine says which numbers it started with — which is the only way to tell that a settings file was read. Events keep the run they happened in. The payload always carried it and the persist path dropped it, so reading one run's failures meant filtering the engine-wide list; a batch run's id reaches those events now too, since a run has no journaled item to name itself by. Also: a provisioner's 0 means "no deadline" rather than "cancel on the next reconcile", and a command that reaches no engine says how to start one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015sbYeYaVgYQqm1sbx7wPdL	2026-08-27 14:17:51 +02:00
stroblmeandClaude Opus 5	40f8ad378d	Ask a cluster for a machine when nothing here will do ... Slurm is not a machine that attaches and stays; it is a queue somebody else owns. So nothing here submits a node to it. It submits a job whose payload is an ordinary worker dialling back in, and everything downstream — the protocol, the artifacts, cancellation, the books — already worked and did not have to learn what Slurm is. The alternative, which Covalent takes, is to stage a serialized call and a runner onto the login node, poll squeue and copy the result back: a second way of running a node beside the one that exists. The cost of not doing that is one assumption, that a compute node can open a connection outward. Where that is false, _payload is the single method a staged variant would replace. Clusters are configured in provisioners.json beside the alerts, since this is infrastructure an operator writes rather than anything a flow says. The script is generated with the system ssh and no new dependency, and prerun owns the environment — deliberately no pip install, because what is on a cluster is somebody's decision. One outstanding request per profile, cancelled if it never attaches and on the way out. Nothing autoscales. The run gate needed the same hook: a run held before it starts never reaches the placer's own wait, so it would have queued forever on a machine nothing had asked for. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A6HeySA27EkGANZN95QySW	2026-08-27 09:09:44 +02:00
stroblmeandClaude Opus 5	a82f88cf0a	Name the sizes a node can ask for ... Raw cpus and gpus are a property of the machines an installation has, so a node written against a cluster quietly stops meaning anything when the cluster is replaced. A node says "gpu-small" instead, and what that is stored here — editable, and read again every time the node is built, so changing the flavor changes what the next run gets. Memory joins the schema properly (`ram`, in MB, accepting "2G"), along with `duration_s` for how long a node is expected to take. That one is recorded and shown and nothing else yet: a statement for whoever is planning around the node, not a limit — the limit is still `timeout`. A flavor and a number for the same thing is refused, compared by value so an editor writing the whole object back with its defaults still round-trips. A name nothing stores is refused at the save, which covers the canvas and `fluksio sync` at once, and deleting one a node still asks for says which node. Four sizes are seeded on an installation that has none, and never re-seeded: re-adding one somebody deliberately removed is an argument nobody wins. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A6HeySA27EkGANZN95QySW	2026-08-27 08:59:10 +02:00
stroblmeandClaude Opus 5	0ffcabfdb9	Media dtypes: image, audio and video as narrowed artifact references ... A port may now declare `image`, `audio` or `video`. Each is the artifact reference the engine already had, narrowed by the `media_type` on it, so a speech recogniser declares what it eats rather than taking any bytes at all and finding out. Bytes still never travel as a message and nothing on the wire stops being JSON: a camera publishes one reference per frame, a microphone one per chunk, and a reference may carry a `meta` dict nothing here interprets. Streaming media is therefore an ordinary streaming port — with one change to what that means. An emission used to journal an item with no payload, so downstream read whatever was current when the item was claimed; a consumer slower than its producer saw only the newest chunk and the ones between were lost. That is right for a training curve and wrong for a second of speech, so an emission now journals a `kind="emission"` item carrying its values, and the executor hands them to the nodes reading that message instead of writing them to state again. The value in state stays the latest, which is what everything else reads, and the wave is filtered by what actually changed rather than walking everything reachable. No queue serialization change — the existing `outputs` field carries it. Continuous media makes the store's missing GC a real problem, so this closes it: `sweep_artifacts` runs hourly, keeps every digest a `run_artifact` row records or a live message holds, spares anything written in the last hour, and stands aside entirely while a run is in flight, since a node may store a checkpoint long before it returns the reference to it. That also collects the orphans a deleted flow has always left behind. `ARTIFACT_GC_INTERVAL_S=0` turns it off. Around the edges: `GET /artifacts/{digest}` serves the media type the caller passes and answers ranged requests, so a browser plays a clip rather than downloading it; `PUT` spools to disk instead of holding the whole body in memory, as does `save_artifact` given a path; a Media widget draws whatever its message points at, and a wall panel may fetch the bytes its own tiles are showing and nothing else; and a connector gets `save_artifact`, for a device whose readings are bytes. What this cannot do is live video: a frame every second or two is a glance, and the honest answer above that is the camera's own stream, which the widget takes as a URL and the browser plays from source. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-26 23:44:55 +02:00
stroblmeandClaude Opus 5	608d30d884	Let a node say how much of the machine it takes ... Five concurrent training nodes, each sizing its thread pool to every core, left the engine's own event loop unscheduled: the API stopped answering within 10 s and every client died. The same shape on a GPU deadlocked a run for 21 minutes at 0% utilisation with nothing failing and nothing to read -- it just sat in `running`. @node(resources={"cpus": 2}) is the declaration. The engine holds that much for the length of the execution, so more of them than the machine has room for wait their turn rather than oversubscribing it, and a `gpus` node holds its card exclusively. FLOW_CPUS defaults to every core but two, and those two are what keeps the engine answering. Because a thread cap is read when the process imports the library, a warm worker cannot be told a different one -- so an environment gets a pool of its own and nodes deriving the same one share it, rather than paying a cold start per call on exactly the nodes whose imports are slowest. XLA_FLAGS is never derived: it is a composed, version-dependent string, so it travels in resources.env where it is visible. A node that declares nothing is not accounted for and behaves as it always did -- it just gets FLOW_CPUS/FLOW_MAX_WORKERS as a thread cap, which is the half of this that fixes the reported incident without anybody declaring anything. An operator who set OMP_NUM_THREADS themselves still wins. Resources are claimed strictly before a worker slot, so the two blocking waits cannot deadlock. A node queued for them publishes node_queued and shows on GET /workers/resources, because waiting and hanging looked identical. Accounted, not enforced: no cgroups, no rlimits. Scheduling across machines, flavours and enforcement are the next steps. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-26 21:36:59 +02:00
stroblmeandClaude Opus 5	180da3d640	Stop paying five Redis round trips and a global lock per message ... The engine was I/O-bound on its own state backend. `RedisState.lock()` is one key — `pipeline:_lock` — for the whole process, taken five times a message at two round trips each, and every cascade and every node read queued behind it. Inside it, reading a node's inputs was three round trips per input (an EXISTS for `in`, then EXISTS and GET for the value), writing was two updates that a single transaction already gives, and the version counters went one INCR at a time. Replaced with the atomic command that was always available: `get_present` is one MGET and tells a missing key from one holding null, so the lock it used to be read under bought nothing; value and timestamp land in one `update`, which is a MULTI/EXEC; `increment_multi` pipelines the counters. `values()` — what every websocket snapshot calls — is two reads whatever the message count instead of two per message. Beside that: every webhook did its blocking XADD on the asyncio event loop (MQTT already used `to_thread`); the per-execution `NodeOutcome` was built and validated even with no run watching; `_minute` built a tz-aware datetime per event on the loop thread to key a dict, and now keys on an int; `move_due` promoted delayed items one round trip each, every second; `FLOW_MAX_CASCADES` makes the in-flight ceiling a setting rather than a constant. `orjson` replaces stdlib json where a message pays for it — state, the journal, the engine side of the worker pipe. `fluksio-worker` stays dependency-free, and the run-cache digest stays on stdlib so no stored key is invalidated. A non-finite number now stores as `null` rather than the bare `NaN` that was never JSON. Measured with `scripts/bench_engine.py` against a real Redis, 200 messages: a five-node chain went from 43.9 to 103.1 msg/s with p50 latency 2110ms → 782ms and p95 3913ms → 1439ms; one source into twenty consumers went from 5.4 to 33.7 msg/s. In memory, twenty consumers went from 187 to 448 msg/s. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BpfSinyCBfjuieikyfMPbf	2026-08-26 10:12:25 +02:00
stroblmeandClaude Opus 5	93374a310e	Refuse what a node cannot publish, and stop timing out work that is fine ... Four things the python SDK turned up, each fixed where every client sees it. A key no port declares is now an error rather than a silent drop, on the return, the yield and the emit alike — the contract the docs already stated. The SDK reads literal yields at sync time, so a typo fails before anything runs, and an emission of one fails the call rather than being logged where nobody looks. NaN and infinity are refused at the port. JSON cannot spell either, so one that travelled came back as a 500, a socket frame that stopped the canvas, or a metric batch the database dropped whole. An artifact input takes `@run:<id>.<output>` or a bare digest, resolved on the engine — so the CLI, the run dialog and a python caller mean the same thing, and a sweep can pass one at all. Node timeouts are off by default. The clock measured silence, which a training node is full of, and remote workers had already stopped enforcing it — their heartbeat reset it. Now a heartbeat proves the agent rather than the node, ninety seconds of nothing fails the call either way, and the engine touches work it is still running so a long node is not redelivered at sixty seconds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019V5bsYGNxcgPs4xXmTPx69	2026-08-25 07:30:14 +02:00
stroblmeandClaude Opus 5	d4a9406c51	Fix the CI gates: Python 3.13, concurrency groups, hook violations ... The gates have never gone green on the new runners. Three separate reasons: - backend/Dockerfile shipped Python 3.10 while the code imports typing.Self and datetime.UTC, so the container exited on import and the suite could not even load its conftest. The image moves to 3.13 and the packages declare >=3.12, which is the floor the tests actually pass on; ruff's target follows and rewrites timezone.utc and asyncio.TimeoutError accordingly. Relocking drops the 3.10 branch, which bumps FastAPI and so regenerates the SDK. - frontend/README.md had no trailing newline and two dashboard widgets used arbitrary text-[…] sizes. Both are em-relative on purpose, so they move to the inline style the neighbouring ramp already uses. - Every commit left its own run queued: without a concurrency group a runner that was offline for a while works through a backlog nobody reads. A stack that fails to come up now prints its logs before the teardown removes it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-24 14:55:59 +02:00
stroblmeandClaude Fable 5	fea57064f9	Run node code on the venv Fluksio was installed into ... The workflow this serves: make a venv, install what you work with, then `pip install fluksio` into the same one. Building a second environment beside it was exactly wrong — the packages the nodes need are already here, and the Modules screen was asking for them a second time. `NODE_VENV=auto` (the default) adopts that venv. It declines in the three cases where adopting would be wrong: `managed` says otherwise, a managed venv already exists and may hold packages somebody installed on purpose, or the engine is not running from a venv at all. The images set `managed`, since the venv in them holds the app and nothing of anybody else's. An adopted venv is never written to. `uv pip sync` makes a venv hold exactly the manifest, so pointed at somebody's own environment it uninstalls their work and the engine with it — `sync()` refuses outright and `reconcile()` returns before it can be called at startup, which is where that would have happened first. The Modules screen lists what is installed and drops its editor; `pip` is how that environment changes. `fluksio serve` now names the interpreter node code runs on, which is the thing a data scientist most needs to know at that moment. `fluksio-worker` already defaulted `--python` to its own interpreter, so a GPU box works the same way — that was only ever undocumented. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012ue1tkFWB1bcGy3aWhCKpU	2026-08-24 10:35:13 +02:00
stroblmeandClaude Opus 5	6d84316ce5	Bound a panel credential to its own widgets, and let one screen be re-paired ... Three things a paired wall panel needed. The scope check now walks the panel's widgets instead of allowing the `/messages/` prefix wholesale: a screen may publish what its own controls and querying charts point at, read the history of what its tiles draw, and nothing else — the catalogue of every message in the installation included. The same walk that already bounds its socket, so both surfaces agree. Pending pairing codes moved out of the per-process dictionary into Redis, keyed per code with the code's own TTL and indexed in a zset so the fifty-code cap means the same thing to every worker. Without a Redis there is one process by definition, and the dictionary stays. And a per-panel nonce in the token, bumped by `POST /panels/{id}/unpair`: that refuses the screen hanging there without touching the panel, its dashboards or their arrangement. A save cannot write the nonce back, so a stale client cannot undo a revocation. Only for a credential this installation signed — one the portal minted carries no nonce and is revoked at the hub. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018tULRZJUkZsw7rMJ3h4xvu	2026-08-22 11:57:37 +02:00
stroblmeandClaude Opus 5	10b0ba9e49	Add the fluksio CLI: serve, enroll, worker ... `pip install fluksio && fluksio serve` on a machine with no Docker, no database and no configuration — which is the case this is for: a node on a cluster where ports cannot be opened. It makes its data directory, its key and an admin account, prints the password once, and serves. Pairing is `fluksio enroll <code> --portal …`, doing what the Settings screen does through the same function, before the engine starts and without one running — a machine nobody can route to has no browser pointed at it either. The portal serves the dashboard, so nothing is served here. Two things had to give way. `fastapi[standard]` pulls a cloud CLI that wants sentry-sdk 2.x while we pinned below it — no pip resolution existed, so the pin is lifted, which the comment beside it had been waiting for and which also lets the Python cap go. And `uv` is now a dependency rather than something to find on PATH: the Modules screen is how a data scientist installs torch, and it was quietly falling back to the engine's own interpreter. The CLI imports nothing from the engine before it has set DATA_DIR — the settings are built on the first import of core.config, and reaching it early put the database in the working directory. There is a test for that now, because the failure is silent. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-21 22:51:13 +02:00
stroblmeandClaude Opus 5	961a8f881d	Keep the engine's state in SQLite, not Postgres ... One process owns this database — the image has run a single uvicorn worker for that reason since the four-engines bug — so a file beside the flows is the honest shape for it, and it is what lets `fluksio serve` need no infrastructure at all. Live values, node execution and the work queue never came here anyway; what does is a rollup a minute at a time, a row per cascade and the run history, and WAL keeps the readers going while that one writer works. DATA_DIR is now the one setting that moves everything an installation keeps; the rest derive from it and the images still spell theirs out. The schema is prepared in-process at startup, so the prestart service is gone, and the ten Postgres-only revisions collapse into one portable baseline. Three things only worked because psycopg was casting for us: a token's subject arriving as a string where the column is a UUID, `greatest`, and `date_bin`. The timestamps needed a column type of their own — SQLite stores no offset, and a naive datetime read back either raises against an aware `now` or serialises as local time. Postgres stays in the stack only for Umami, behind the analytics profile. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-21 22:19:45 +02:00
stroblmeandClaude Opus 5	60d7ec81c0	Rename the import package app to fluksio ... A wheel whose top-level module is `app` collides with anything else in a user's venv, so the package that is about to be published takes the name it is published under. Only the Python package moves; the repo, the Docker WORKDIR and the compose project keep theirs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-21 21:48:05 +02:00