The verify step curl-fetched the public key anonymously from the
dev repo's raw URL; since that repo went private the fetch 404s
and every signed release died at verification. Embed the PUBLIC
key verbatim (same pattern as the platform's sync-mirror.sh) so
the workflow is self-contained. Keep in lockstep with
infra/cosign/official.pub on key rotation.
Signed-off-by: flemming-it <sf@flemming.it>
The vendored sign.yml predated the product rename: it installed
and invoked the old CLI name, packed a .fai bundle, and verified
against the renamed fai/platform repo URL — every tag build died
on the missing binary. Align with the platform's current
sign-bundle template: chain CLI, .chain bundle extension,
fai/chain-private raw URL for official.pub.
Signed-off-by: flemming-it <sf@flemming.it>
The product is Ch∆In; the old 'F∆I Platform' name survived in module
docs/manifests. Generic 'platform' terms left untouched.
Signed-off-by: flemming-it <sf@flemming.it>
Drop-in from fai/platform .forgejo/workflow-templates/
sign-bundle-keypair.yml. Triggers on v*.*.* tag push: builds
wasm32-wasip2, fetches the fai CLI from get.fai.flemming.ai,
packs the bundle, ECDSA P-256 signs it against the org-level
Forgejo secret FAI_SIGNING_KEY, round-trip-verifies against
infra/cosign/official.pub on fai/platform main, and attaches
bundle + .sig to the Forgejo Release via the API.
Signed-off-by: flemming-it <sf@flemming.it>
Ollama-backed translation module — third real F∆I capability,
following text.extract and llm.chat. Used for the second leg of
a regulated document workflow (extract -> translate -> review
-> summarise).
Capability:
Inputs:
text : text (source text)
target_language : text (e.g. "German", "French")
source_language : text (optional hint; empty = auto)
endpoint : text (Ollama /api/chat URL)
model : text
api_key : text (optional)
Outputs:
translation : text
source_language : text (echo for audit)
target_language : text (echo for audit)
model_endpoint : text
model_name : text
model_digest : text (Ollama /api/show probe; empty
for non-Ollama or transient
failures)
Permissions: net to localhost / 127.0.0.1 / api.openai.com /
api.anthropic.com.
The translation prompt is conservative: a fixed system prompt
demands faithful translation with structure preservation and
emits no metadata, no quoting. The user prompt names the target
language and (when supplied) the source language. The LLM
client + digest-probe pattern is reused verbatim from llm-chat;
when a third module joins, the shared client moves into a small
crate.
14 host-side tests cover prompt-building, Ollama-shaped response
parsing, URL transform, digest extraction (top-level + nested),
end-to-end success, end-to-end probe-failure swallow, and
end-to-end skip-for-non-Ollama.
Wasm artifact verified to build with v1.0 fai:platform imports
baked in. Bootstrapped via 'fai new module text.translate'.
Signed-off-by: flemming-it <sf@flemming.it>
