shiyuyun/wyndham-ARR
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: prepare ARR for controlled public deployment

Browse Source
This commit is contained in:
Wyndham ARR
2026-07-29 16:38:05 +08:00
commit a701de9f0e
271 changed files with 48472 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
.project-docs/30-worklog/current-state.md Normal file
View File

@@ -0,0 +1,50 @@
# Current State
## Current Focus
A controlled public-deployment source snapshot is prepared for the empty self-hosted `wyndham-ARR` repository. Its Compose Web entry explicitly enables `--enable-processing --secure-cookies`; Caddy is the only public listener and adds HTTPS plus Web Basic Auth, while MCP retains its independent bearer and exact Host allowlist. Local application defaults remain fail-closed. The snapshot passes 259 tests with 2 environment skips plus contract, checksum, candidate-file and secret scans. No public server deployment has been performed from this workspace.
## Recently Completed
- 2026-07-29: Added a Linux Dockerfile, Compose, Caddy TLS boundary, production env example and deployment runbook. The Web health gate requires both `database_ready` and `processing_ready`; the production command opens XML processing without changing the source default.
- 2026-07-29: Added opt-in HTTPS `Secure` session cookies, made the booking fixture root portable, removed local paths/test endpoints/temporary tunnel names from the publishable snapshot, and verified 271 final candidate files (about 2.0 MiB) contain no detected secrets, symlinks or files larger than 1 MiB.
- 2026-07-29: Ran the complete Python suite in a dependency-complete Python 3.12 environment: 259 tests passed and 2 were skipped. Compose YAML, JSON contracts and controlled package checksums also passed static validation.
- 2026-07-29: Restarted the controlled MCP and fixed-domain ngrok sessions. An initial authenticated 421 exposed a preserved public Host; the MCP was safely restarted with an exact loopback/public Host allowlist, after which public initialize and tools-list both returned 200.
- 2026-07-29: Reverified gateway 1.0.1, protocol 2025-11-25, one tool, 2195-byte advertised schema, and zero `$ref`/`$defs`/`$id` keys without invoking the business tool.
- 2026-07-29: Diagnosed the SuperAgent MCP `failed` state: ports 8890/4040 have no listeners, the old temporary PIDs are gone, TLS remains valid, and the public `/mcp` request is rejected by ngrok as an offline endpoint before reaching ARR authentication or MCP protocol handling.
- 2026-07-29: Started a controlled upload-capable Web instance on `127.0.0.1:8766` and submitted one no-PII XML through the real page.
- 2026-07-29: Confirmed job `arrjob-fdc2c1a0695c41b3b372a52033b2f567` reached SuperAgent run `7e1ad2fe-cb59-4d04-b92c-9f09d98f4ef8`; remote status was `success`, but MCP submission and all `2038-01-19` Finance facts remained absent.
- 2026-07-29: Safely terminalized the failed test as `PROCESSING_RESULT_MISSING`, revoked its unconsumed grant, verified zero business writes, and stopped port 8766.
- 2026-07-29: Confirmed that XML upload is the only required user action; successful structured-data commit must automatically trigger monthly processing.
- 2026-07-29: Confirmed that `TOTAL PRICE` is required and must be an Excel formula equal to `REAL PRICE × NIGHTS × NO_OF_ROOMS`.
- 2026-07-29: Initialized `.project-docs` and recorded the correction in ADR-001.
## In Progress
- Repository publication is the remaining local handoff step. Runtime deployment, DNS/Secret injection and SuperAgent stable-domain rebinding belong to the user's public server environment.
## Next Recommended Steps
1. Deploy the repository using `deploy/README.md`, inject real Secrets only on the server, and require the public Web health response to report `database_ready=true` and `processing_ready=true`.
2. Rebind SuperAgent to `https://<MCP_PUBLIC_HOST>/mcp`, rediscover exactly `arr_submit_processing_result`, save/publish the new Agent version, and stop relying on the temporary ngrok endpoint.
3. Rerun the vertical slice with a fresh no-PII XML and require a `committed`/`already_committed` receipt plus matching Finance version, current pointer and fact rows.
4. In separately authorized implementation work, add the automatic post-commit monthly dispatch and required `TOTAL PRICE` formula behavior.
## Open Questions / Blockers
- Docker and Caddy are not installed in this workspace, so image build, Compose runtime, DNS, ACME issuance and public HTTP checks must be performed on the deployment server.
- SuperAgent administration requires the user's authenticated platform session; its stale MCP configuration must be replaced with the new stable public MCP domain after deployment.
- The restored ngrok/MCP sessions remain temporary and are not the formal deployment target.
- `ProcessingRunner.poll()` can emit `delivery_missing`, but the PostgreSQL state adapter has no matching status mapping. The live run therefore required a guarded manual terminalization transaction.
- The exact automatic monthly dispatch mechanism and business-time/cutoff derivation policy still require implementation design; neither is a user input.
## Risky Areas
- A SuperAgent run reporting `success` is not business success; only an MCP receipt and committed database facts qualify.
- Enabling upload on the current all-interface 8765 listener without a confirmed authentication boundary would expose a mutation endpoint.
- Committing `deploy/.env.production`, publishing 8765/8890 directly, omitting TLS/Basic Auth, or reusing the MCP/SuperAgent/HMAC credentials would break the deployment boundary.
- Triggering before commit, duplicate trigger delivery, deriving the wrong reporting period, or replacing formulas with cached/static amounts.
## Last Updated
2026-07-29