diff --git a/deploy/community-account-role.yaml b/deploy/community-account-role.yaml new file mode 100644 index 0000000..716abca --- /dev/null +++ b/deploy/community-account-role.yaml @@ -0,0 +1,9 @@ +title: Cosift community account access +description: Verify shared accounts and tokens, and record token activity. No account or token creation or deletion. +stage: GA +includedPermissions: + - datastore.databases.get + - datastore.databases.getMetadata + - datastore.entities.get + - datastore.entities.list + - datastore.entities.update diff --git a/docs/COMMUNITY-ROLLOUT.md b/docs/COMMUNITY-ROLLOUT.md index f147077..7cefe76 100644 --- a/docs/COMMUNITY-ROLLOUT.md +++ b/docs/COMMUNITY-ROLLOUT.md @@ -1,18 +1,30 @@ # Community release: operator handoff -**Shared-account integration update:** see [SHARED-ACCOUNTS.md](SHARED-ACCOUNTS.md) and [its verification record](SHARED-ACCOUNTS-VALIDATION.md). Shared mode now connects to Andrei’s auth/MCP infrastructure. Its live staging and companion-change gates must pass before rollout; earlier standalone checks do not establish shared-mode production readiness. +**2026-09-17 rollout update:** [PR #58](https://github.com/pilot-protocol/cosift/pull/58) +merged at `c8ea845`, and the authorized v0.2.7 release completed successfully in +[workflow 35255963898](https://github.com/pilot-protocol/cosift/actions/runs/35255963898). +Andrei's auth/MCP companions are merged and serving healthy production Cloud Run +origins; the installer is public at v0.4.0/v1. The signed engine is healthy with +HNSW ready. Caddy switched the public service to the shared community gateway +at 18:23:08 UTC, with login at the public entry and operational routes blocked. +The community unit uses the shared binary and its backup timer is enabled. See +[SHARED-ACCOUNTS.md](SHARED-ACCOUNTS.md) and its +[verification record](SHARED-ACCOUNTS-VALIDATION.md) for confirmed revisions, +direct URLs, verified real email/shared-account and public request/MCP checks, +and the remaining acceptance scope. Deploy only an explicitly approved commit after its review and release gates pass. Reviewing or testing this PR does not itself authorize a release tag, published assets, updater activation, or production changes. Use the controlled sequence below for an authorized rollout. -## Current production baseline (2026-09-16) +## Retained rollback baseline (2026-09-16) -Production has been restored to the original v0.2.5 engine and original Caddy -routing. The community service and its backup timer are stopped/disabled. The -engine updater timer is also disabled so another release cannot roll out without -an explicit decision. Account data and rollback backups have been retained. +Before the September 17 rollout, production was restored to the original v0.2.5 +engine and original Caddy routing. The community service/backup timer and engine +updater were stopped/disabled. This records the rollback baseline, not the state +of an in-progress or completed v0.2.7 cutover. Account data and rollback backups +were retained; record each subsequent service/routing change during rollout. The engine binary and config were compared byte-for-byte with their original backups. Engine PID was unchanged during the public-routing rollback. The public @@ -21,14 +33,15 @@ not be selected as a release candidate. ## Review and validation -The PR contains the exact revert of the draft ranking changes from #54, the +The merged tree contains the exact revert of the draft ranking changes from #54, the public authentication entry and operational-route restrictions from #57, and mode-specific limits plus contribution quality screening. The community/CLI, local artifacts and credit ledger implementation already merged through #55 is -part of the candidate's complete tree. Review the resulting tree against v0.2.5 -as well as the PR diff; reverting #54 must receive the normal owner review. +part of the release's complete tree. The shared-account integration adds the +auth/MCP connections and CLI session handoff. Compare the resulting tree and +representative query behavior against v0.2.5 when accepting the release. -Run with Go 1.26 and `GOWORK=off` when a parent workspace uses an older Go version: +Run with Go 1.26.8 and `GOWORK=off` when a parent workspace uses an older Go version: ```sh GOWORK=off go vet ./... @@ -76,7 +89,7 @@ reuse the withdrawn v0.2.6 artifacts. strategy, or deliberately update and version-check both binaries. Run `systemctl daemon-reload` before starting the portal. Never leave it using an old standalone binary while upgrading the engine. -6. Check `/api/limits`, registration/login/logout, interest persistence, saved +6. Check `/api/limits`, email-code login/logout, interest persistence, saved requests, sample CSV, and CLI guest/member requests over loopback first. Enable the reviewed Caddy routing only after these checks pass. Confirm the root routes to signup/login, public operational/admin/debug routes are @@ -150,5 +163,7 @@ content judgments. Local embeddings are checked against server computation, so this first version does not promise server-compute savings. New content earns 10 credits, globally deduplicated by content hash. Stripe one-time credit purchases are implemented but disabled until the secret API key and webhook signing secret are configured. See [Stripe activation and -test-mode checks](STRIPE.md). Email verification and self-service password reset -are not enabled in this version. +test-mode checks](STRIPE.md). Shared mode verifies email codes through +`cosift-auth`; standalone local mode still lacks email verification and +self-service password reset. Article authoring and rewards for article views +remain outside this release. diff --git a/docs/SHARED-ACCOUNTS-VALIDATION.md b/docs/SHARED-ACCOUNTS-VALIDATION.md index 74e37b9..161be88 100644 --- a/docs/SHARED-ACCOUNTS-VALIDATION.md +++ b/docs/SHARED-ACCOUNTS-VALIDATION.md @@ -1,8 +1,12 @@ # Shared-account integration verification — 2026-09-17 -All changes remain proposed in Cosift PR #58. No production code, service, -organization policy, DNS, updater, Stripe charge, or Andrei repository was changed. -Companion patches were exercised in local audit checkouts only. +Cosift PR #58 merged at `c8ea845913829d5eece571c6facbb4462ab313c9`. The +auth/MCP/installer companions have also merged and released; this record +separates the original local tests from the verified deployment checks below. +The v0.2.7 engine/CLI release finished and the existing-host public cutover +completed on 2026-09-17 at 18:23:08 UTC. Real email and authenticated service +checks are recorded below, followed by successful public Search/Answer/Research, +MCP search/quota and topic-sync acceptance. No Stripe charge is claimed. ## Checks completed @@ -10,15 +14,15 @@ Companion patches were exercised in local audit checkouts only. |---|---| | `GOWORK=off go test -race -timeout 10m ./...` | Full Cosift regression suite, including account linking, quota isolation, saved data, moderation and CLI regressions | | `GOWORK=off go vet ./...` | Static checks | -| `CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build ./cmd/cosift` | Production-architecture compilation; no release artifact published | +| `CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build ./cmd/cosift` | Production-architecture compilation; signed release tracked separately below | | `node --test internal/community/webtests/*.test.cjs` | 11 passing tests, including OTP state transitions and stale shared-topic responses | | `GOWORK=off COSIFT_SMOKE_PORT=17983 bash scripts/smoke-test.sh` | Passed: real public crawl, ingestion, health, search, contents, admin authorization; disposable local index | | Official auth token vectors | Canonical parsing/trailing bits and HMAC over full token agree with `cosift-auth` fixtures | | Firestore SDK protocol fixture | Real Google SDK over local gRPC: collection-group lookup, typed verified/revoked timestamps, bans, last-used writes, ambiguous/missing token and IAM-denied errors | | Auth lifecycle / HTTP contracts | Auth start/verify/revoke, HttpOnly cookies, Google-vs-user credential headers, forwarded client IP, bounded JSON, redirects and upstream error handling | | Additional failure regressions | Cloud Run IAM failures versus Cosift credential rejection; OTP validation and cleanup after browser cancellation; account linking rollback; CLI credential conflicts and retryable logout; per-client login and per-account MCP limits | -| Installer → real CLI handoff | Installer passes its in-memory token to the compiled CLI, which verifies it and writes a 0600 origin-bound session; a separate CLI process reads credits with no token/server/session flags. Ten installer handoff cases and CLI race regressions pass; no harness credential extraction | -| Patched MCP suite | 248 passed, 2 skipped, 5 integration tests deselected; no cloud calls or model downloads | +| Installer → real CLI handoff | Installer passes its in-memory token to the compiled CLI, which verifies it and writes a 0600 origin-bound session; a separate CLI process reads credits with no token/server/session flags. All 11 installer handoff cases and CLI race regressions pass; 255 onboarding checks and ShellCheck pass | +| MCP release suite | 266 offline tests plus 18 final deployment tests passed, with Ruff/shell checks and a local AMD64 container embedding inference (384 dimensions, UID 65532); no production search claimed by these fixtures | | MCP → community → engine | Real MCP ASGI app and engine client against local Go gateway: concurrent accounts receive separate free allowances; repeat over-quota call does not reach the engine; `k=20`, BM25 preserved; account credential stops at the gateway | | Community client → MCP tools | Real FastMCP protocol: follow/list/unfollow, request/idempotent repeat, missing article coverage; local fake identity/topic store and topic-resolution fixture | | Auth proxy configuration companion | `bash -n infra/deploy.sh`; existing client-IP resolver and configuration tests pass | @@ -33,12 +37,11 @@ must return a retryable service error, rather than declaring the user's token revoked or account banned. The regression checks preserve both upstream services' actual JSON authentication contracts and reject HTML/Google origin failures. -The first integration commit's Snyk check failed; the Snyk report was gated by -login. An independent official `govulncheck` scan found affected gRPC v1.82.1 +An independent official `govulncheck` scan found affected gRPC v1.82.1 call paths ([GO-2026-6348](https://pkg.go.dev/vuln/GO-2026-6348)) and Go 1.26.0 standard-library paths with later security fixes. The PR now requires Go 1.26.8 -and gRPC v1.83.2; CI also runs pinned `govulncheck` v1.8.0. The independent scan -is not a substitute for a successful Snyk check on the final commit. The final +and gRPC v1.83.2; CI also runs pinned `govulncheck` v1.8.0. Merged auth uses the +same Go/gRPC versions and passed its package scan and CI. The final Cosift package-level scan reports **0 vulnerabilities in imported packages**. It still lists GO-2026-5932 for the unused OpenPGP package within the required x/crypto module; the application does not import that package. CI gates imported packages, @@ -63,20 +66,43 @@ The manual fixture is test-only and never included in the shipped binary. Its URL is disposable. See `integrations/cosift-mcp/README.md` to reproduce the cross-repository and browser checks. -## Not established by these tests +## Deployment checks completed -These results do not certify a live shared-account deployment. The available -Google CLI credentials required reauthentication, so this sweep did not exercise -live Firestore/Secret Manager IAM, an actual Cloud Run service identity, real mail -delivery, public DNS/ingress, or credential refresh over its real lifetime. +| Component | Evidence | +|---|---| +| Cosift engine/CLI | [PR #58](https://github.com/pilot-protocol/cosift/pull/58) merged at `c8ea845`; [v0.2.7 workflow](https://github.com/pilot-protocol/cosift/actions/runs/35255963898) completed successfully. The public release contains five platform binaries with checksums/signatures and `cosift-minisign.pub` | +| Auth | [PR #1](https://github.com/pilot-protocol/cosift-auth/pull/1) merged at `e6ce919`; revision `cosift-auth-00001-k6b` serves 100%, using production Firestore `(default)` and runtime identity `cosift-auth-runtime` | +| MCP | [PR #1](https://github.com/pilot-protocol/cosift-mcp/pull/1) merged at `fa60d32`; revision `cosift-mcp-00002-lf7` serves 100%, using `(default)` and `COSIFT_ENGINE_BASE_URL=https://cosift.pilotprotocol.network` | +| Public ingress | Auth `https://cosift-auth-udik5erlkq-uw.a.run.app/health` and MCP `https://cosift-mcp-udik5erlkq-uw.a.run.app/health` both returned JSON 200 without Google credentials. Production invoker checks are disabled with no `allUsers` grant; staging checks remain enabled. No organization-policy override was made | +| Credential boundaries | Public auth revoke without a credential returned Cosift JSON 401; public MCP calls with missing or fabricated canonical tokens returned application JSON 401, not infrastructure 503. Production debug routes returned 404; staging debug routes were disabled again after attribution checks | +| Proxy attribution | The actual gateway egress was measured. Private staging kept two different forwarded client addresses in separate buckets; a direct forged forwarding chain resolved to the actual caller. Production trusts only the measured gateway `/32` and Cloud Run peer `/32` | +| Real shared account | Production email-code login succeeded. Against the gateway on host loopback, anonymous `/api/me` returned 401; repeated authenticated identity was stable, credits returned the expected shape, gateway/direct-production-MCP topic lists matched, and authenticated BM25 `k=20` search returned 20 hits. This exercised live Firestore, Secret Manager and MCP with the same real account; no topic mutation was required | +| Signed engine upgrade | Official v0.2.7 Linux ARM64 artifact passed SHA-256/minisign verification against the host trust anchor. One graceful restart completed; HNSW finished loading and the existing engine returned healthy responses. The full-corpus process was not duplicated | +| Retrieval comparison | Both BM25 baseline queries preserved all six results and their order. Hybrid TLS preserved all six URLs, with ranks 3/4 swapped. Search returned 200 in 122–265 ms, Answer in 3.506 s, Research in 2.031 s. The existing weak Go evidence remained visible: Answer declined and Research noted missing specific evidence | +| Live moderation | Useful text was allowed, garbage rejected as low quality, and harmful promotion with embedded prompt injection rejected as phishing. Anonymous moderation returned 401. These moderation fixtures were not indexed | +| Public cutover | Caddy reloaded successfully at 18:23:08 UTC; public/origin `/api/auth/config` report shared mode, root opens login, and operational routes are blocked. The community unit uses the same v0.2.7 binary path as the engine with its old standalone override removed. Community backup upload succeeded and its timer is enabled | +| Public request/account checks | Shared auth, identity, credits and topics passed through the public gateway. BM25 `k=20` returned 20 hits in 0.458 s. Authenticated Answer returned 200 with five sources and five valid cited IDs in 6.650 s; Research returned 200 with three plan steps, eight sources and five valid cited IDs in 3.926 s | +| Public MCP and shared limits | Direct MCP search returned two filtered hits in 1.395 s through the gateway. The same user's SQLite search/free quota increased, and the credits response matched the ledger. A temporary topic added through the gateway appeared in direct MCP; removing it through MCP restored both lists to their initial state | +| Local contribution | An authenticated Rust text/metadata/local-embedding artifact passed validation and reached Indexed. The account balance remained zero for this existing-page check; new-content credit fulfillment and durable receipt acceptance are separate checks. Repeating the URL through CSV reported one duplicate and zero accepted | +| Public installer | [PR #1](https://github.com/pilot-protocol/cosift-install/pull/1) merged at `d18edef`. Full Git history and all issue/PR/release content had zero Gitleaks findings; custom-token inspection found only deterministic fixtures. The repository is public. `v0.4.0` and `v1` resolve to that merge; unauthenticated downloads returned 200 and the exact tested SHA-256 `fca1e4887b98e4b18957e48932203e3f0510e249b37baeaddd9292bcc4f8945b` | + +The original Google-login blocker is resolved. These checks establish deployed +services, invocation boundaries and measured proxy behavior. They do not by +themselves establish a completed authenticated web/CLI/MCP workflow. + +## Acceptance still recorded separately + +Status at the 18:30 UTC documentation checkpoint: + +Complete the remaining revocation, saved-request and new-content reward checks. +Observe credential +refresh over its real lifetime. Retain the existing model and capacity gates; +the pre-upgrade search/Answer/Research baseline records relevance limitations, +so a healthy endpoint is not evidence of strong answer quality. -Before rollout: provision the gateway identity; confirm the exact project, -database, index, accepted Cloud Run URLs/audiences and IAM grants; verify safe -proxy attribution with two real client addresses and a spoofed direct request; -land the MCP token-forwarding and auth deployment-configuration companions; -exercise real email login, revocation and ban handling in staging. Retain the -existing load, model and Stripe acceptance gates. Article generation and the -distributed contributor network remain outside the implemented upstream scope. +Stripe purchases remain disabled until the API key and webhook signing secret +are supplied and the test-mode checks pass. Article authoring, the distributed +contributor network and rewards for article views are unfinished upstream work. The first full test run flagged the new operator-controlled auth/MCP HTTP client in the repository's outbound-client inventory. It now has an explicit documented diff --git a/docs/SHARED-ACCOUNTS.md b/docs/SHARED-ACCOUNTS.md index 244a68b..3c5375a 100644 --- a/docs/SHARED-ACCOUNTS.md +++ b/docs/SHARED-ACCOUNTS.md @@ -1,17 +1,36 @@ # Connect the community web app and CLI to Andrei's services -This integration is proposed in PR #58. **It has not been deployed.** It adds -shared identity and topic/article-request access to the existing community UI, -CLI, contribution moderation and credit ledger. It does not replace the MCP, -installer, email service, or search engine. +The integration merged in [Cosift PR #58](https://github.com/pilot-protocol/cosift/pull/58) +at `c8ea845913829d5eece571c6facbb4462ab313c9` on 2026-09-17. The authorized +v0.2.7 release completed successfully in [workflow 35255963898](https://github.com/pilot-protocol/cosift/actions/runs/35255963898). +All five signed platform binaries and the public verification key are published. +The existing-host engine/gateway cutover completed at 18:23:08 UTC: Caddy +reloaded successfully, both public/origin auth-config endpoints report shared +mode, the public entry opens login, and operational routes are blocked. +Production email-code login, authenticated gateway/Firestore/MCP account checks, +and public Search/Answer/Research and MCP checks passed. Remaining acceptance +scope is recorded separately below. +The companion services and public installer are released as recorded below. + +The web UI and CLI add saved requests, contribution moderation, quotas and a +credit ledger to Andrei's shared identity, MCP and onboarding services. They use +the same account UID; the existing engine continues to serve source-page search. ## Verified source contracts -| Component | Reviewed revision | Infrastructure / contract | +| Component | Merged change | Infrastructure / contract | |---|---|---| -| [cosift-auth](https://github.com/pilot-protocol/cosift-auth) | `61435108d41789e08ec3832c0ea3cd2c97f520e7` | Go service, Firestore accounts/tokens, versioned Secret Manager peppers; email-code login | -| [cosift-mcp](https://github.com/pilot-protocol/cosift-mcp) | `e7477f21cf5439e1c55a53ddd7d1b0af080342c5` | Python FastMCP, stateless JSON streamable HTTP at `/v1/mcp`; account topics and article demand in Firestore | -| [cosift-install](https://github.com/pilot-protocol/cosift-install) | `3a1d90728dc7e3f99a3cf1f6c29f837054d80460` | Installs MCP/skills and authenticates agents; its existing `ck_` token can authenticate the community CLI | +| [cosift-auth PR #1](https://github.com/pilot-protocol/cosift-auth/pull/1) | `e6ce91911df8670e6913dd18ca8084236af428a5` | Go service, Firestore accounts/tokens, versioned Secret Manager peppers; email-code login and trusted-proxy configuration | +| [cosift-mcp PR #1](https://github.com/pilot-protocol/cosift-mcp/pull/1) | `fa60d320acc5adaa3a7112a38afaa7ac8d168932` | Python FastMCP at `/v1/mcp`; topics/article demand in Firestore; caller-token search forwarding to the community gateway | +| [cosift-install PR #1](https://github.com/pilot-protocol/cosift-install/pull/1) | `d18edefe257439987fa5f49c0a384cc039a65e90` | Public v0.4.0 and v1 installer; MCP/skills, email login, optional installed-CLI session handoff | + +Production auth is `https://cosift-auth-udik5erlkq-uw.a.run.app`; production MCP +is `https://cosift-mcp-udik5erlkq-uw.a.run.app/v1/mcp`. Their `/health` endpoints +returned JSON 200 without Google credentials after deployment. Cloud Run +revisions `cosift-auth-00001-k6b` and `cosift-mcp-00002-lf7` each serve 100% of +traffic. Both disable the invoker IAM check; neither has an `allUsers` binding. +Staging retains its invoker check. No organization-policy override or custom +auth/MCP DNS is required for these direct origins. Project: `telepat-cosift-5214`, number `301038218064`, region `us-west1`. Firestore databases: `staging` and `(default)` for production. Account UID is the @@ -28,7 +47,7 @@ flowchart LR Web[Community web app] --> Gateway[Community gateway on existing host] CLI[Community CLI with installed ck_ token] --> Gateway Agent[Installed agent] --> MCP[cosift-mcp on Cloud Run] - MCP -->|patched: caller token and search parameters| Gateway + MCP -->|caller token and search parameters| Gateway Gateway -->|email start, verify, revoke| Auth[cosift-auth on Cloud Run] Gateway -->|verify account and token| DB[Shared Firestore] Gateway -->|versioned token pepper| SM[Secret Manager] @@ -64,7 +83,7 @@ preserved. No new ranking change is included. - Search, Answer, Research, saved requests, URL/CSV contributions, local text / metadata / embedding contributions, moderation, credits and disabled-by-default Stripe purchases retain the existing community implementation. -- Web, CLI and patched MCP searches share each account's local allowance and +- Web, CLI and MCP searches share each account's local allowance and credit ledger. MCP retains its own upstream daily call cap (currently 1,000), including topic tools. Credits do not bypass that cap or buy an article. @@ -77,23 +96,24 @@ No local agent history is collected or uploaded by this integration. ## Runtime configuration Keep standalone installations on `COSIFT_AUTH_MODE=local` (the default), with -email/password login and no Google credentials. To opt into shared accounts, -provision explicit environment values in the existing private service env file: +email/password login and no Google credentials. The shared production gateway +uses the following service origins and account namespace in its private env file: ```dotenv COSIFT_AUTH_MODE=shared COSIFT_SHARED_PROJECT=telepat-cosift-5214 -COSIFT_SHARED_DATABASE=staging -COSIFT_AUTH_URL=https://cosift-auth-staging-301038218064.us-west1.run.app -COSIFT_MCP_URL=https://cosift-mcp-staging-301038218064.us-west1.run.app/v1/mcp -COSIFT_AUTH_AUDIENCE=https://cosift-auth-staging-301038218064.us-west1.run.app -COSIFT_MCP_AUDIENCE=https://cosift-mcp-staging-301038218064.us-west1.run.app +COSIFT_SHARED_DATABASE=(default) +COSIFT_AUTH_URL=https://cosift-auth-udik5erlkq-uw.a.run.app +COSIFT_MCP_URL=https://cosift-mcp-udik5erlkq-uw.a.run.app/v1/mcp +COSIFT_AUTH_AUDIENCE= +COSIFT_MCP_AUDIENCE= GOOGLE_APPLICATION_CREDENTIALS=/etc/cosift/google-credentials.json ``` -Resolve the actual Cloud Run URLs with `gcloud run services describe` before -setting these example values; use the service's accepted canonical audience. -The audiences have no MCP path. For public origins leave audiences empty. +Resolve Cloud Run URLs with `gcloud run services describe` for a different +deployment. Public origins leave audiences empty. Private staging needs the +service's accepted canonical audience, without the MCP path, and refreshing +Google credentials. Never mix staging services with `(default)` Firestore, or share a local SQLite account database across the two environments. Start staging with a fresh data directory. Shared mode requires all four project/database/auth/MCP settings. @@ -107,26 +127,29 @@ in `X-Serverless-Authorization`; the user's `ck_` stays in `Authorization`. The browser never receives the Google credential. Existing systemd sandboxing must permit reading the private ADC file and outbound HTTPS/gRPC. -Required IAM, to be provisioned by the infrastructure owner: +The gateway runtime identity requires: - Firestore account/token reads, collection-group token queries and token `last_used_at` updates in the selected database. The existing collection-group index on `tokens.tid` must be present. The application does not create accounts or issue tokens directly in Firestore. + The minimal permission set is retained in + [`deploy/community-account-role.yaml`](../deploy/community-account-role.yaml); + it grants reads/query and update, without document creation/deletion. Apply + the intended project/database scope when binding it to the runtime identity. - Secret accessor on **`cosift-token-pepper` only**, including the active version IDs carried by tokens. Never grant this application the OTP or mail secrets. - Cloud Run invoker on the chosen auth/MCP services when private. For an impersonation setup, the caller also needs the relevant identity-token minting permission on its designated service account. -Using private `run.app` origins lets the gateway connect directly without new -DNS records or an `allUsers` policy exception. Public agent installation remains -Andrei's separate release/ingress concern. Do not change organization policy as -part of applying this PR. With valid cloud credentials, inspect effective policy -before choosing public Cloud Run ingress: Google also supports disabling the -invoker IAM check where the managed require-invoker constraint permits it. +Public production `run.app` origins now allow the installer and gateway to reach +the same auth/MCP services directly. Application-level authentication is still +required for MCP tools and token revocation. The public-ingress choice was +verified by reading back the invoker-check annotation and IAM bindings; private +staging remains available for isolated tests. -## Email-code proxy attribution: required before rollout +## Email-code proxy attribution Auth currently has a 10-codes/hour/IP cap. Proxying without correct attribution collapses every web user into the community host's one bucket. The gateway now @@ -141,16 +164,19 @@ the appropriate trust set. Do not blindly trust arbitrary private networks, all addresses, or caller-supplied IP headers. A direct run.app client must still resolve to its actual address, even if it forges a forwarding chain. -`integrations/cosift-auth/proxy-configuration.patch` makes the auth deploy script -preserve the selected resolver mode and `AUTH_TRUSTED_PROXIES`; its current script -hardcodes hop mode. Apply it only to the pinned auth revision in a reviewed change. -No auth runtime/schema modification is needed. Merely increasing the global hop -count on a public auth service is unsafe and is not the proposed solution. +The auth companion has merged and been deployed. Production uses +`AUTH_XFF_MODE=cidr`, `AUTH_TRUSTED_PROXIES=192.222.56.72/32,169.254.169.126/32` +and `AUTH_DEBUG_ROUTES=false`. These addresses reflect the measured gateway +egress and Cloud Run peer for this deployment, not a portable trust-all default. +The retained `integrations/cosift-auth/proxy-configuration.patch` reproduces the +change against its historical base; do not reapply it to current auth main. -Staging acceptance: two clients behind the gateway retain separate auth buckets; -a direct caller with a forged XFF header cannot choose its bucket; real email -start/verify succeeds; Google credential refresh survives its initial lifetime. -The repo's IP-resolver tests pass, but these deployment-chain checks remain open. +Private-staging checks verified that two forwarded client addresses retained +separate buckets, and a direct request with forged forwarding headers still +resolved to its actual caller. Production debug routes returned 404; staging +debug routes were disabled again after the checks. Production email delivery +and OTP verification subsequently passed. Refresh across a credential's real +lifetime remains a separate observation; health probes do not establish it. ## CLI usage @@ -163,6 +189,13 @@ credentials and session selection take precedence; an explicit different server is rejected before any credential is sent. Guest mode never reads the installed session. Existing installer sessions are preserved rather than overwritten. +The installer repository is public. Both `v0.4.0` and the compatible `v1` ref +point at the reviewed merge above; unauthenticated downloads were checked +byte-for-byte against the tested script. Follow its +[signed v0.2.7 CLI installation instructions](https://github.com/pilot-protocol/cosift-install/blob/v0.4.0/docs/CLI-INSTALL.md) +before running `install.sh --cli`. The script does not download a CLI binary. +The published release key asset is `cosift-minisign.pub`, key ID `6184E2C01CA477A6`. + Reuse the `ck_` credential already issued by Andrei's installer by providing it as `COSIFT_TOKEN` in the calling process. Do not put it in shell command arguments or commit it to config. The community CLI does not automatically scan harness @@ -189,34 +222,47 @@ Standalone email/password and existing session-file workflows remain supported. expired one; a temporary upstream failure retains the file so logout can be retried. Revoking that token also invalidates agents using the same token. -## MCP companion change and rollout boundary +## MCP routing and rollout boundary -`integrations/cosift-mcp/forward-account-token.patch` is based on the pinned MCP -revision above. It carries the already-verified token in request-scoped state, +The merged MCP companion carries the already-verified token in request-scoped state, passes it to the engine client for each search, requires HTTPS except loopback, and refuses credential redirects. It never changes shared client default headers. Point `COSIFT_ENGINE_BASE_URL` at the community origin, not the raw engine port. The included tests cover concurrent accounts and credential leakage boundaries. -Both companion patches are **artifacts inside this PR**. They were applied and -tested only in local audit checkouts, not pushed, merged or deployed in Andrei's -repositories. Review and land those companion changes before routing production -MCP searches through the gateway. Keep the original production engine/UI in place -until staging and the [community rollout gates](COMMUNITY-ROLLOUT.md) pass. +Production MCP now sets `COSIFT_ENGINE_BASE_URL=https://cosift.pilotprotocol.network`. +The gateway calls the raw engine directly on loopback; its MCP proxy allowlist +contains topic/lookup/request tools, not search, so this route does not loop. +The repository patch files remain historical reproduction artifacts. The live +MCP image includes the merged forwarding/runtime changes; its subsequent +deployment-script-only commit selected the project explicitly. +The signed v0.2.7 engine is healthy with HNSW ready; the existing community unit +uses the same binary path, and its old standalone override has been removed. +The community backup completed an upload and its timer is enabled. The +[community rollout gates](COMMUNITY-ROLLOUT.md) remain the acceptance and +rollback procedure for this deployment. Back up the local database before linking existing users; do not downgrade a linked database to standalone password auth or restore a stale credit ledger. ## Evidence and remaining work See [the integration verification record](SHARED-ACCOUNTS-VALIDATION.md) for exact -commands and test scope. Real Cloud Run / Firestore / Secret Manager access was -not verified in this sweep: the available gcloud login required reauthentication. -Production readiness additionally requires provisioning the gateway identity, -verifying IAM/index access and email/IP attribution in staging, applying the MCP -companion, and completing the existing model, capacity and payment rollout gates. - -Security note: the audited auth revision also pins gRPC v1.82.1. Its owner should -review/update that dependency before its production release; our gateway uses -v1.83.2 to address [GO-2026-6348](https://pkg.go.dev/vuln/GO-2026-6348) and the -related gRPC advisories. The auth companion in this PR changes proxy deployment -configuration only, not its dependencies or live services. +commands, deployment evidence and remaining acceptance scope. The earlier Google +login blocker has been resolved; auth/MCP deployment and ingress checks used +authenticated cloud access. Their public health and invalid-token contracts pass. +Production email login passed, followed by stable account identity and credits +responses, matching gateway/direct-MCP topic lists, and a gateway BM25 search +returning 20 hits. Public authenticated Search/Answer/Research then passed, and +direct MCP search was verified to consume the same account's quota. A temporary +followed topic propagated both ways and was removed after the check. These used +a real account and production services. Revocation, saved requests and +new-content credit fulfillment remain distinct acceptance work. A real +local Rust artifact passed validation and reached Indexed; a repeated CSV URL +was deduplicated. Do not count synthetic moderation fixtures as +real production content. Stripe remains disabled pending its API key and +webhook signing secret plus the checks in [STRIPE.md](STRIPE.md). + +Both the gateway and merged auth now use Go 1.26.8 and gRPC v1.83.2. The older +gRPC dependency warning belongs to the historical audit baseline, not the +released auth change. Article generation, Gemini authoring, a distributed +contributor network and article-view rewards remain unfinished upstream work. diff --git a/integrations/cosift-auth/README.md b/integrations/cosift-auth/README.md index 97dfc25..e750bcb 100644 --- a/integrations/cosift-auth/README.md +++ b/integrations/cosift-auth/README.md @@ -1,5 +1,11 @@ # Auth deployment configuration companion +The companion merged in [cosift-auth PR #1](https://github.com/pilot-protocol/cosift-auth/pull/1) +at `e6ce91911df8670e6913dd18ca8084236af428a5` and is deployed. The retained +patch and commands below reproduce the historical change; do not apply the +patch again to current auth main. Current endpoints and deployment evidence are +in [SHARED-ACCOUNTS.md](../../docs/SHARED-ACCOUNTS.md). + `proxy-configuration.patch` applies to cosift-auth `61435108d41789e08ec3832c0ea3cd2c97f520e7`. It allows the existing CIDR client-IP resolver to be selected by the deploy script; it changes no auth/token runtime. diff --git a/integrations/cosift-mcp/README.md b/integrations/cosift-mcp/README.md index 891f238..86ac12c 100644 --- a/integrations/cosift-mcp/README.md +++ b/integrations/cosift-mcp/README.md @@ -1,7 +1,13 @@ # MCP companion for community PR #58 +The companion merged in [cosift-mcp PR #1](https://github.com/pilot-protocol/cosift-mcp/pull/1) +at `fa60d320acc5adaa3a7112a38afaa7ac8d168932` and is deployed with the community +gateway as its search origin. The patch remains for reproducing the original +review; current main already includes it. See +[SHARED-ACCOUNTS.md](../../docs/SHARED-ACCOUNTS.md) for live endpoints and checks. + `forward-account-token.patch` applies to cosift-mcp -`e7477f21cf5439e1c55a53ddd7d1b0af080342c5`. It is a review artifact, not a deployment. +`e7477f21cf5439e1c55a53ddd7d1b0af080342c5`. In a separate clean checkout of that revision: