4 Commits

Include renames

Author	SHA1	Message	Date
rootandClaude Fable 5	5462842b8a	Supervise the engine's host: deep health, loop watchdog, one worker ... The API image ran four uvicorn workers, and each one built a full flow controller — four sets of MQTT subscriptions, cron ticks and webhooks. Runs one worker now; scaling out is the worker split, not more processes. Adds a loop-lag watchdog and a deep /utils/health/ that fails when the event loop is wedged or Redis is unreachable, the two failure modes a process-alive check never sees. Autoheal restarts on that signal, behind a compose profile because it mounts the Docker socket. The private user-seeding routes now need an explicit opt-in rather than just ENVIRONMENT=local, so a deployment that kept the default never exposes them. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011LF61rxW1FG5YCD2J9YqjY	2026-08-16 07:14:28 +02:00
Melvin StroblandClaude Fable 5	8d82d6c4ec	Let agents drive the flow API over MCP ... The engine now speaks MCP at /mcp, with a built-in OAuth 2.1 authorization server in front of it: an agent registers itself, sends a human to the browser to approve it, and exchanges the resulting code for a token. PKCE is required, codes are single-use and stored only as hashes, the browser is redirected to the URI that was registered rather than the one asked for, and refresh tokens rotate so that replaying a spent one revokes the whole line. Twenty tools cover reading, building, publishing and running flows, and each one calls the same REST endpoint the dashboard calls, in-process, carrying the caller's own token. That keeps one description of what a flow is and what may be done to it — validation, the draft/publish split, the version check — and means an agent can do nothing a person could not do in the browser. Agent tokens are RS256 with a keypair of their own rather than the secret that signs browser sessions, so deleting the key withdraws every agent without logging anyone out, and deps.decode_token grew the branch that trusting a second issuer will need when the hosted login arrives. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-16 00:22:41 +02:00
Melvin StroblandClaude Opus 5	82356810ce	Give the tests their own database and drop the template specs ... pytest was deleting every user on teardown against the development database. The engine is built at import time, so tests/__init__.py pins POSTGRES_DB before app.core.config loads; the fixture creates the schema and drops the database again, guarded against a name that is not _test. Playwright now defaults at the integrated stack, which is the origin the API allows, so a bare `bunx playwright test` works without a dev server. The four template specs that asserted copy we no longer ship are gone, along with the helpers they were the last callers of. The admin edit assertion was page-wide and only ever passed on a fresh database. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KkmeRiyeYmVZqJVwuyHq9o	2026-08-15 21:19:12 +02:00
Melvin StroblandClaude Opus 5	1916f7f778	Vendor backend and frontend into the monorepo ... The submodule collapse was only half applied: .gitmodules was deleted but backend/ and frontend/ were still recorded as gitlinks, so none of their files were tracked. Replace the gitlinks with the real trees. Also untrack .env (it carried placeholder secrets) in favour of a tracked .env.example, drop the committed __pycache__, and narrow the blanket *.png ignore that would have swallowed design assets. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-09 15:14:54 +02:00