docs(confidence-engine): checkpoint deployed product platform
This commit is contained in:
+110
-12
@@ -3,19 +3,94 @@
|
||||
> **Role:** Concise operational snapshot for resuming work today. Not a historical diary.
|
||||
> The design evolution archive index at `docs/design-evolution/README.md` provides progressive loading of experiment history; load the relevant chapter only when a specific historical question requires it.
|
||||
|
||||
## v0.62d production Docker packaging established
|
||||
## v0.62d production Docker packaging — LIVE PROVEN
|
||||
|
||||
- `Dockerfile` — minimal multi-stage Alpine build (Node 22), Next.js standalone output mode
|
||||
- `.dockerignore` — excludes dev artefacts, secrets, docs from build context
|
||||
- `next.config.mjs` — added `output: 'standalone'` (required for lean production container)
|
||||
- `.env.example` — reorganized: Supabase → Ollama → Mock sections; Ollama vars now tracked as deployment-relevant
|
||||
- **npm production build: PASS** ✓
|
||||
- **Docker image build: BLOCKED** — no Docker runtime on development machine (apparatus limitation, not product defect)
|
||||
- Production container starts / `/api/health` smoke test: pending Docker runtime availability
|
||||
- No persistent application volume required
|
||||
- Supabase remains external, Ollama remains private and server-reachable
|
||||
- Public `NEXT_PUBLIC_*` variables may require build-time injection via `--build-arg` as established by the implementation (baked into browser bundle)
|
||||
- **No deployment performed yet**
|
||||
- **Docker image build on CT 112: PROVEN** — production Docker image builds successfully on CT 112, standalone Next.js container starts successfully.
|
||||
- Production container `/api/health`: **PROVEN** — `{"healthy":true}`, no private Ollama endpoint / model name / raw internal error exposed.
|
||||
- No persistent application volume required.
|
||||
- Supabase remains external, Ollama remains private and server-reachable from the deployment host.
|
||||
- Public `NEXT_PUBLIC_*` variables may require build-time injection via `--build-arg` as established by the implementation (baked into browser bundle).
|
||||
- **Deployment: LIVE PROVEN** — manual Jenkins pipeline succeeded end-to-end (SHA-tagged image, container replaced, health check passed).
|
||||
|
||||
### v0.62d External Deployment (LIVE)
|
||||
|
||||
Confidence Engine is externally reachable at **https://confidence.rdbcloud.co.uk**.
|
||||
|
||||
Production topology:
|
||||
|
||||
```
|
||||
Internet → HTTPS → Nginx Proxy Manager → CT 112 / Confidence Engine Docker container
|
||||
```
|
||||
|
||||
CT 112 deployment details:
|
||||
|
||||
```
|
||||
hostname: confidence-engine
|
||||
LAN address: 192.168.68.73
|
||||
repo: /opt/confidence-engine
|
||||
container: confidence-engine
|
||||
port: 3000
|
||||
```
|
||||
|
||||
Docker-in-LXC has been proven. Docker image builds successfully on CT 112.
|
||||
|
||||
### v0.62d Magic-Link Login (LIVE)
|
||||
|
||||
External magic-link login has been proven through the deployed application at `https://confidence.rdbcloud.co.uk`. The reverse-proxy callback-origin defect was corrected; successful login now returns to the external Confidence Engine Portfolio rather than `0.0.0.0:3000`.
|
||||
|
||||
Auth email branding configured on external Supabase infrastructure (outside this repository):
|
||||
|
||||
- Confidence Engine sender name / subject / branded HTML body
|
||||
- SPF PASS, DKIM PASS, DMARC PASS — recipient-side confirmed
|
||||
- Missing original Message-ID / junk-folder observation remains a non-blocking external mail-deliverability note
|
||||
|
||||
### v0.62d Multi-user Boundary (LIVE)
|
||||
|
||||
Application-level isolation proven on deployed instance:
|
||||
|
||||
```
|
||||
User A sees User A investigations
|
||||
User B does not see User A investigations
|
||||
```
|
||||
|
||||
### v0.62d Real Deployed Product Journey (LIVE)
|
||||
|
||||
Manually proved through the externally deployed application:
|
||||
|
||||
```
|
||||
authenticate → Portfolio → create new investigation → reason through Qwen
|
||||
→ server persistence → return to Portfolio → leave/return → investigation restored
|
||||
```
|
||||
|
||||
Server-backed persistence remains authoritative. Legacy localStorage investigations remain ignored.
|
||||
|
||||
### v0.62d Manual Jenkins Deployment Pipeline (LIVE PROVEN)
|
||||
|
||||
Manual end-to-end pipeline proven:
|
||||
|
||||
```
|
||||
manual Jenkins Build with Parameters → GIT_REF accepted
|
||||
→ remote ref resolved to immutable SHA → Jenkins SSH credential bound
|
||||
→ SSH to CT 112 → deployment script executed → exact SHA fetched/checked out
|
||||
→ Docker image built and tagged by SHA → existing CE container replaced
|
||||
→ /api/health polled → healthy response observed → DEPLOYMENT SUCCEEDED
|
||||
```
|
||||
|
||||
Pipeline design:
|
||||
|
||||
- Manual trigger, runtime-selectable `GIT_REF`, immutable SHA deployment
|
||||
- CT 112 as Docker build/runtime host, target-owned `/opt/confidence-engine/deploy.env`
|
||||
- SHA-tagged Docker images, health-gated success, bounded rollback support
|
||||
- No Docker registry, no automatic webhook deploy
|
||||
|
||||
**Path status:** success path = LIVE PROVEN. rollback path = IMPLEMENTED, NOT LIVE PROVEN.
|
||||
|
||||
Jenkins SCM branch used to load the Jenkinsfile is conceptually separate from the `GIT_REF` chosen for deployment.
|
||||
|
||||
## CURRENT MVP DIRECTION
|
||||
|
||||
@@ -75,9 +150,10 @@ Does the complete investigation process leave real people materially clearer abo
|
||||
- The full apply-proposal owner suite remains known-red in independent pre-existing 60B.43 tests, so the changed Done-for-now boundary was verified through exact isolated owner tests. Zero live calls occurred during closeout. Next boundary: reuse the existing investigation and click Done for now once, observing cases/update and subsequent synthesis.
|
||||
- Live UI proved Done for now briefly clarified the question, then server graph replacement reopened it: the client sends `preDoneGraph`, and the server previously had no deterministic closure owner. Episode-mode update now adds the selected `targetNodeId` to `resolvedNodeIds` only after successful semantic application; semantic no-ops and meaningful mutations remain valid, while failed episodes do not resolve the target and ordinary updates are unchanged. Zero live calls occurred during implementation. Next boundary: one live Done-for-now check on the existing investigation.
|
||||
|
||||
## Deployment automation (new)
|
||||
## Deployment automation (LIVE PROVEN)
|
||||
|
||||
Manual Jenkins deployment pipeline established, version-controlled, and LIVE PROVEN end-to-end.
|
||||
|
||||
- Manual Jenkins deployment pipeline established and version-controlled.
|
||||
- `Jenkinsfile` in repository root — Declarative Pipeline, three stages: Resolve → Deploy → Verify/result.
|
||||
- `scripts/deploy-production.sh` — executes on CT 112; validates SHA, fetches Git ref, checks out exact commit, builds Docker image tagged by SHA, replaces container, polls `/api/health`, one-step rollback to prior image on failure.
|
||||
- `deploy.env.example` — example of required runtime/build environment file (NOT tracked).
|
||||
@@ -85,13 +161,35 @@ Does the complete investigation process leave real people materially clearer abo
|
||||
- `GIT_REF` is runtime-selectable (Jenkins parameter); resolves to immutable SHA before deployment.
|
||||
- No Docker registry introduced. SHA-tagged images retained for rollback support.
|
||||
- Jenkins job remains manually triggered — no automatic webhook deployment.
|
||||
- No product behaviour changed.
|
||||
- No product behaviour changed by deployment automation.
|
||||
|
||||
**Success path: LIVE PROVEN.** **Rollback path: IMPLEMENTED, NOT LIVE PROVEN.**
|
||||
|
||||
## Repository checkpoint
|
||||
|
||||
- **Branch:** `feature/product-platform-foundation-v0.62`
|
||||
- **HEAD:** `6dd447e` — feat(confidence-engine): add authenticated investigation persistence
|
||||
- **Working tree:** dirty with completed v0.62c cutover (server-authoritative persistence, async seam, 404→null correction)
|
||||
- **HEAD:** *(checkpoint commit — see git log for actual SHA)*
|
||||
- **Working tree:** clean
|
||||
|
||||
## Architectural Conclusion
|
||||
|
||||
**The original v0.62 product-platform objective is achieved:**
|
||||
|
||||
- Authenticated identity (magic-link via self-hosted Supabase)
|
||||
- Authenticated reasoning APIs (private Ollama/Qwen, server-reachable)
|
||||
- User-owned server persistence (Supabase `investigations`, RLS-scoped)
|
||||
- Multi-user application behaviour (application-level isolation proven)
|
||||
- Portable Docker runtime (Docker-in-LXC on CT 112)
|
||||
- External HTTPS deployment (Nginx Proxy Manager → CE container)
|
||||
- External magic-link authentication (callback fix, email branding proven)
|
||||
- Manual one-touch Jenkins deployment (SHA-tagged, health-gated)
|
||||
|
||||
**The following are NOT required and NOT justified before testing:**
|
||||
|
||||
- Legacy localStorage migration — not required. Four development/test investigations will not be migrated; legacy data remains invisible to normal product flow.
|
||||
- Additional SaaS/platform machinery — not justified before real user testing.
|
||||
|
||||
> **Platform/deployment foundation work is complete enough to disappear into the background. The next Confidence Engine work should return to product/reasoning/user-learning priorities rather than continuing infrastructure expansion unless a real operational failure demands it.**
|
||||
|
||||
## Persistence
|
||||
|
||||
|
||||
Reference in New Issue
Block a user