Security / Security check (push) Failing after 1s

Details

feat(settings): hub auth-policy panel — T4/T5 security parity in the GUI

Settings → Security now shows the hub's effective auth policy via the
new read-only AuthStatus RPC: active token validator (static / jwt-rs256
with issuer, audience, JWKS source), anonymous-access warning, per-token
cards with scope grants, env-var presence and rate limits, plus a
localized admin-denied story for non-admin tokens. Live-reloads on
endpoint change.

Also fixes a batch of fai→chain rename leftovers this panel's
verification uncovered: hub_auth_token.dart and registry_token.dart
read/wrote ~/.fai/ while the hub reads ~/.chain/ (stored registry
tokens never reached the hub), today_story_loader + tools/today used
~/.fai/today, chain_log legacy ~/.fai/logs migration removed per the
no-legacy-recognisers decision, and UI strings still advertised the
retired .fai bundle extension.

Includes 5 widget tests for the panel, an integration-test screenshot
harness (auth_policy_shots_test.dart, guide-shots style), and DE+EN
l10n. flutter analyze clean, 58 tests green.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

2026-07-15 03:19:33 +02:00

2.7 KiB

Raw Blame History

Today-Hero proposal tooling

Daily-build pipeline for the editorial Today-Hero card in Studio's store. See ../../docs/today-pipeline.md for the full design rationale.

Quick start

# 1. Generate today's proposals (calls the local Ollama by default).
./propose.sh

# 2. Skim them — they sit under ~/.chain/today/proposals/<ISO-DATE>/
ls ~/.chain/today/proposals/

# 3. Accept one. The chosen file becomes ~/.chain/today/active.yaml,
#    which Studio reads at startup.
./accept.sh ~/.chain/today/proposals/2026-05-08/candidate-2.yaml

# 4. Restart Studio (or let the next launch pick it up).

Schedule it

macOS — launchd

# Drop a plist that runs propose.sh every morning at 07:30 local time.
# `launchctl load ~/Library/LaunchAgents/ai.flemming.chain.today.plist` to
# install. The plist must point at the absolute path of propose.sh.

A starter plist lives at launchd/ai.flemming.chain.today.plist.

Linux — systemd timer

# Copy systemd/fai-today.{service,timer} into ~/.config/systemd/user/,
# then `systemctl --user enable --now fai-today.timer`.

Anywhere — cron

30 7 * * * /Users/flemming/.../tools/today/propose.sh > /tmp/fai-today.log 2>&1

Provider override

propose.sh defaults to Ollama at http://127.0.0.1:11434 with the model gemma3:4b. Override via env vars:

Variable	Default	Example
`CHAIN_TODAY_API`	`http://127.0.0.1:11434/api/generate`	`https://api.openai.com/v1/chat/completions`
`CHAIN_TODAY_MODEL`	`gemma3:4b`	`gpt-4o-mini`
`CHAIN_TODAY_KEY`	(unset)	`$OPENAI_API_KEY`
`CHAIN_TODAY_N`	`3`	`1` (single shot)

OpenAI-compatible endpoints will work as long as they speak chat/completions or generate; the script auto-detects from the URL path.

Trust model

Reads only git log, git diff, and the bundled seed.yaml of installed Ch∆In monorepos. Never your audit log without explicit op-in.
Calls only the System-AI you've already configured for Studio. The same privacy mode you set there applies here.
Writes only into ~/.chain/today/. Nothing in ~/.chain/data/ or ~/.chain/config.yaml is touched.
Studio loads active.yaml at startup; if the file is missing or fails schema validation, the compiled-in fallback story renders. KRITIS fresh installs see the fallback until and unless an operator accepts a proposal.

2.7 KiB Raw Blame History