Release: MCP server, LangGraph incident agent, inference/RAG service, Azure infra

.claude/.gitignore

@@ -0,0 +1,3 @@
+settings.local.json
+skills/
+CLAUDE.md

.claude/settings.json

@@ -0,0 +1,36 @@
+{
+  "permissions": {
+    "deny": [
+      "Read(/home/ivanp/PersonalProjects/api-observatory/.env)",
+      "Read(/home/ivanp/PersonalProjects/api-observatory/.env.*)",
+      "Read(/home/ivanp/PersonalProjects/api-observatory/.streamlit/secrets.toml)",
+      "Read(/home/ivanp/PersonalProjects/api-observatory/infra/certs/*-key.pem)",
+      "Bash(cat */.env*)",
+      "Bash(cat *.pem)"
+    ]
+  },
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qiE '(printenv|\\benv\\b|export|echo.*PASSWORD|echo.*SECRET|echo.*TOKEN|echo.*API_KEY)'; then echo 'BLOCKED: Command may leak secrets' >&2; exit 2; fi"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "ruff check --fix $CLAUDE_FILE_PATHS && ruff format $CLAUDE_FILE_PATHS"
+          }
+        ]
+      }
+    ]
+  }
+}

.dockerignore

@@ -9,7 +9,7 @@ __pycache__/
 *.coverage
 .coverage*
 .cache/
-pytest_cache/
+.pytest_cache/
 .env
 .env.*
 .vscode/
@@ -23,23 +23,49 @@ build/
 .eggs/
 *.egg-info/
 *.egg
+
+# Python tooling caches (large, never needed in images)
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+
+# Virtual environment (massive, kills build context)
+.venv/
+
+# Agent tooling data (large, irrelevant)
+.kilo/
+.copilot/
+
+# Streamlit local config
+.streamlit/
+
+# Terraform state/cache
+.terraform/
+
 # Exclude test and local dev files
 *.md
 learning_docs/
 tests/
 scripts/
+bruno/
+examples/
+
 # Exclude repo metadata and docs (large, never needed in images)
 .git/
 .github/
 docs/
 _archive/
+
 # Exclude sensitive and generated root files
 secrets-findings.json
+
 # Exclude Docker artifacts
 Dockerfile*
 .dockerignore
+
 # Exclude local volumes
 pg_data/
+.local-dev/
 
 # Coverage reports
 htmlcov/

.env.example

@@ -21,9 +21,8 @@ LOG_ASYNCIO_LEVEL=WARNING
 # Documentation Authentication (optional)
 # Leave empty to allow public access to /docs, /redoc, /openapi.json
 # Set both to enable HTTP Basic Auth protection on docs endpoints
-# ⚠️  Dev defaults — use strong credentials or clear both values in non-local environments
-DOCS_USERNAME=admin
-DOCS_PASSWORD=changeme
+DOCS_USERNAME=
+DOCS_PASSWORD=
 
 # API Authentication — v1 (Token-based + Session)
 # ⚠️  Dev default — replace with a strong random value in staging and production
@@ -35,13 +34,18 @@ JWT_SECRET=your-super-secret-key-at-least-32-characters-long-change-in-prod
 JWT_ALGORITHM=HS256
 JWT_EXPIRY_MINUTES=60
 
+# Service-to-service and privileged auth (injected by infra via secretKeyRef in production)
+INTERNAL_JWT_SECRET=dev-internal-secret-change-in-prod
+ADMIN_TOKEN=dev-admin-token-change-in-prod
+
 # Cache
 # Set CACHE_ENABLED=true to enable: scorecard cache (SETEX 30s), WebSocket pub/sub fan-out,
 # JWT session store, slowapi rate limiting backend, LangGraph agent checkpointer.
 # When false: in-memory fallback for rate limits, MemorySaver for agent, no live WS events.
 CACHE_ENABLED=true
-CACHE_URL=redis://localhost:6379/0
-# Inside Docker Compose: redis://cache:6379 (set automatically in docker-compose.yml)
+CACHE_URL=redis://:cache_secret@localhost:6379/0
+# Inside Docker Compose: redis://:${REDIS_PASSWORD}@cache:6379/0 (set automatically in docker-compose.yml)
+REDIS_PASSWORD=cache_secret
 
 # Local HTTPS toggle
 # Set to true to automatically use https://localhost for API, dashboard, docs.
@@ -71,7 +75,7 @@ OPENAI_API_KEY=sk-your-real-key-here
 # OpenTelemetry (distributed tracing → Jaeger)
 # Set OTEL_ENABLED=true when running with docker compose (Jaeger is included)
 OTEL_ENABLED=false
-OTEL_ENDPOINT=http://localhost:4317
+OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317
 OTEL_SERVICE_NAME=api-obs-ingestor
 
 # Sentry / GlitchTip (error tracking)
@@ -88,28 +92,19 @@ GLITCHTIP_DB_PASSWORD=glitchtip
 GLITCHTIP_SECRET_KEY=change-me-in-production-at-least-50-chars-random
 GLITCHTIP_DOMAIN=http://localhost:8010
 
-# S3 backup (used by infra/scripts/backup.sh + restore.sh)
-# BACKUP_STORAGE: local | s3 | both (default: local)
-# AWS_ENDPOINT_URL: set to http://localhost:4566 for Floci, leave empty for real AWS
+# Blob Storage backup (used by infra/scripts/backup.sh + restore.sh)
+# BACKUP_STORAGE: local | blob | both (default: local)
 BACKUP_STORAGE=local
-BACKUP_S3_BUCKET=api-observatory-backups
-BACKUP_S3_PREFIX=backups/
-AWS_ENDPOINT_URL=http://localhost:4566
+BACKUP_BLOB_CONTAINER=backups
+BACKUP_BLOB_PREFIX=
 
 # Background workers (Pillar 5 prototype)
 BACKGROUND_WORKERS_ENABLED=false
 BACKGROUND_WORKER_COUNT=2
 BACKGROUND_WORKER_QUEUE_SIZE=200
 BACKGROUND_MAX_TRACKED_TASKS=500
 
-# LocalStack configuration
-AWS_PROFILE=localstack
-AWS_ENDPOINT_URL=http://localhost:4566
-AWS_ACCESS_KEY_ID=test
-AWS_SECRET_ACCESS_KEY=test
-AWS_DEFAULT_REGION=us-east-1
-
-# Dev environment configuration
-AWS_PROFILE=dev
-AWS_DEFAULT_REGION=us-east-1
-# Don't set endpoint_url for real AWS
+# floci-az emulator (local Azure sandbox)
+AZURE_ENDPOINT_URL=http://localhost:4577
+AZURE_STORAGE_ACCOUNT=devstoreaccount1
+AZURE_STORAGE_CONNECTION_STRING=DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://127.0.0.1:4577/devstoreaccount1;QueueEndpoint=http://127.0.0.1:4577/devstoreaccount1

.github/actions/resolve-tree-sha/action.yml

@@ -0,0 +1,17 @@
+name: "Resolve tree SHA"
+description: >-
+  Compute the deterministic per-commit tree SHA used for image tags
+  (tree-<sha>). Requires the repo to already be checked out.
+outputs:
+  tree_sha:
+    description: "7-character git tree SHA"
+    value: ${{ steps.resolve.outputs.tree_sha }}
+runs:
+  using: "composite"
+  steps:
+    - id: resolve
+      shell: bash
+      run: |
+        set -euo pipefail
+        TREE_SHA=$(git rev-parse HEAD^{tree} | cut -c1-7)
+        echo "tree_sha=${TREE_SHA}" >> "$GITHUB_OUTPUT"

.github/dependabot.yml

@@ -5,39 +5,6 @@ version: 2
 # Keep this file in sync on the default branch to ensure target-branch rules apply.
 
 updates:
-  # Python package updates (pip)
-  - package-ecosystem: pip
-    directory: "/"
-    schedule:
-      interval: monthly
-    target-branch: develop
-    open-pull-requests-limit: 3
-    reviewers:
-      - ivanp
-    assignees:
-      - ivanp
-    labels:
-      - "dependencies"
-      - "type/dependency"
-      - "area/python-packages"
-    allow:
-      - dependency-type: "direct"
-      - dependency-type: "indirect"
-    commit-message:
-      prefix: "chore(deps)"
-      include: "scope"
-    pull-request-branch-name:
-      separator: "/"
-    rebase-strategy: auto
-    versioning-strategy: auto
-    groups:
-      python-minor-patch:
-        patterns:
-          - "*"
-        update-types:
-          - "minor"
-          - "patch"
-
   # Python package updates (uv)
   - package-ecosystem: uv
     directory: "/"

.github/instructions/docker-ci-guide.md

@@ -277,7 +277,7 @@ This reduces per-job setup time and guarantees Python 3.14 parity for cp314 whee
 
 ### Week 1: Docker + Lint/Test CI
 
-- [ ] Dockerfile: multi-stage, slim base, <150MB final image
+- [ ] Dockerfile: multi-stage, slim base, efficient caching (proper layers ordering)
 - [ ] .dockerignore: exclude unnecessary files
 - [ ] ci.yml: lint job (Ruff check + format)
 - [ ] ci.yml: test job with matrix (Python 3.10/3.11/3.12)