8 Commits

Include renames

Author	SHA1	Message	Date
mathias	2125558196	docs: extend harness boundary decision to cover Crush as third harness	2026-05-28 11:38:36 +00:00
mathias	2beaac2feb	docs: add 2026-05-28 decisions — harness boundary + field benchmark definition	2026-05-28 10:31:41 +00:00
mathias	58c57412a9	feat(brain-mcp): OAuth 2.0 client_credentials flow for claude.ai ... Adds a minimal RFC 8414 + RFC 6749 client_credentials flow so claude.ai's custom-MCP integration (no static-Bearer field in the UI) can exchange a client_id + client_secret pair for the existing BRAIN_MCP_TOKEN and use it as a Bearer on /mcp. No JWTs, no refresh, no expiry — the rest of the auth middleware is unchanged. New package ingestion/internal/oauth: - MetadataHandler(issuer): serves /.well-known/oauth-authorization-server with grant_types=[client_credentials] and both token_endpoint_auth_methods (post + basic). - TokenHandler(cfg): serves /oauth/token. Validates client_id and client_secret via constant-time compare; returns BRAIN_MCP_TOKEN as access_token. RFC 6749 §5.2 error JSON on bad grant / bad creds. Wiring in cmd/server/main.go: opt-in by setting both OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET. Setting only one is misconfiguration → exit 1. Mounts both endpoints with no auth; MCP_RESOURCE_URL supplies the issuer. Also pivots issue #8's vector backend from Qdrant to pgvector (see DECISIONS.md 2026-05-18) — Qdrant was never deployed and postgres18 with pgvector already runs as the project default; supersedes 2026-04-08 for this use case. Tests cover post-auth, basic-auth, wrong secret, bad grant, GET rejection, malformed Basic header, and Basic without colon. Closes hyperguild#5.	2026-05-18 22:21:54 +02:00
mathias	937355cabe	fix(project_create): commit staging namespace directly to infra main ... Drops the intermediate `staging/<name>` branch so Flux begins reconciling the namespace within ~60s of `project_create` instead of waiting on a human PR merge. Consistent with project-wide trunk-based development. Rationale: ADR 2026-05-18 in DECISIONS.md. Closes hyperguild#14 (item 1). Item 2 (GITEA_MCP_TOKEN in SOPS) verified already-present in infra@408a527 secrets.enc.yaml. Note: TestRoutingPodEndToEnd is failing on main pre-existing this commit (context deadline waiting for port 33310 in <5s). Not caused by this change; project skill tests pass. To track in a separate issue.	2026-05-18 17:20:53 +02:00
mathiasandClaude Sonnet 4.6	87cf9d0afc	docs: update CLAUDE.md and DECISIONS.md for completed 7-plan migration ... Reflects Plan 7 (supervisor retirement) and brain_answer/brain_classify addition. Supervisor MCP endpoint removed; brain now exposes HTTPS domain with Dex JWT auth. Routing decisions documented for LLM berget→iguana chain. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-12 14:53:08 +02:00
mathiasandClaude Sonnet 4.6	bee4bb3c1f	chore(routing): pre-merge cleanup — Plan 7 reminders, code_review→review, operator note ... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-05 23:22:15 +02:00
mathias	235d70ad0b	docs: document hyperguild scope reset — drop parametric learning, simplify brain	2026-04-22 15:27:52 +02:00
mathias	92c9c42e24	chore: scaffold supervisor from project template	2026-04-16 21:50:53 +02:00