release-auditor
66 lines
3.4 KiB
Markdown
66 lines
3.4 KiB
Markdown
# Current Status — agent-platform
|
|
|
|
**Date**: 2026-07-06
|
|
**Repository**: https://forgejo.media-on.de/Leopoldadmin/agent-platform
|
|
**Local path**: `/a0/usr/workdir/agent-platform/`
|
|
**Branch**: `main`
|
|
**Commit**: `347ccb0` ("fix: C3 case-insensitive Bearer prefix + S1 MCP asyncio.Lock (closes 2 xfail)")
|
|
**Visibility**: public (verified, no secrets in tree)
|
|
**App version** (`api.py`): `0.3.0`
|
|
|
|
---
|
|
|
|
## 1. Release phase
|
|
|
|
**Phase**: Release Handoff (Gate 7 of 7: intake → requirements → architecture → UI (n/a) → implementation → test → deployment → release).
|
|
**Cadence**: 3rd `release_auditor` call this project (matches the 3-block release-auditor rule).
|
|
**Decision (this audit)**: **HOLD** — see `RELEASE_NOTES.md` § "Promote decision".
|
|
|
|
| Gate | Result |
|
|
|---|---|
|
|
| intake | PASS (PLAN.md §1–§9 present, problem + outcome stated) |
|
|
| requirements | PASS_WITH_NOTES (B-IDs and C-IDs in code + tests, but no standalone `requirements.md`) |
|
|
| architecture | PASS (PLAN.md §2–§6, 2-container compose, MCP via `/mcp` path) |
|
|
| UI design | N/A (server-side HTMX UI, no separate design phase) |
|
|
| implementation | PASS_WITH_NOTES (matches architecture; residual C/D/M/X issues tracked) |
|
|
| test | PASS (`pytest`: 19 passed, 2 xpassed — see `test_report.md` in `docs/`) |
|
|
| deployment | PASS (Coolify staging healthy, compose + Traefik labels durable) |
|
|
| release | PASS_WITH_NOTES (`RELEASE_NOTES.md`, rollback plan, secrets handling) |
|
|
|
|
## 2. Deploy status
|
|
|
|
| Env | Status | URL |
|
|
|---|---|---|
|
|
| **Staging (Coolify)** | healthy (200, mcp_server reachable, 1 agent) | https://staging.agent-platform.media-on.de |
|
|
| Production | **NOT DEPLOYED** — pending HOLD resolution | n/a |
|
|
|
|
Coolify identifiers:
|
|
- Project UUID: `xht8vwszdqrk9biytxzsopu6`
|
|
- Resource UUID: `n27nquozfhcgbph182ivbht3`
|
|
|
|
Last known good image tag: `4847d3eb05ab324273d80c4594956b1a79483fe9`.
|
|
|
|
## 3. Live state (last verified during this audit)
|
|
|
|
- `/health` → 200, `mcp_server: "reachable"`, `agents: 1`, `llm_model: deepseek/deepseek-v4-flash`.
|
|
- `/api/agents` (Bearer `w6M…0W0`) → 200, one agent (`example`, source=code, 6 allowed_tools).
|
|
- Both containers (`agent-platform`, `mcp-tools`) healthy in `Coolify`.
|
|
- **Caveat 1**: `LLM_API_KEY` empty in Coolify env → `/api/chat/*` returns 500 until set. `/health`, CRUD, UI all work.
|
|
- **Caveat 2**: Master `AUTH_TOKEN` is currently the staging one — must be **rotated** before production (see `RELEASE_NOTES.md` § "Production checklist").
|
|
|
|
## 4. Next action (single, unambiguous)
|
|
|
|
1. **Promoter (human)**: resolve HOLD blockers in `RELEASE_NOTES.md`:
|
|
- Set `LLM_API_KEY` in Coolify env (any LLM provider).
|
|
- Decide whether to land SSRF hardening (S2) + auth-event audit (S5) before promotion, or accept the residual risk in writing.
|
|
- Rotate `AUTH_TOKEN` for production.
|
|
2. **Release auditor**: re-run this audit after the two patches above (small, ≤ S-effort each).
|
|
3. **Deploy agent**: clone compose to a new production Coolify resource, swap `FQDN`, bind production `AUTH_TOKEN` + `LLM_API_KEY`, redeploy.
|
|
4. **No further code changes** to `agent_platform/` unless HOLD blockers resolve into code.
|
|
|
|
## 5. Open block-level context
|
|
|
|
- 3 blocks completed this project (per 3-block release-auditor rule).
|
|
- Audit + reviewer block-compaction calls do NOT count toward the 3-task limit.
|
|
- Pending: next_steps left implicit via `RELEASE_NOTES.md` § "Production checklist"; will be added to `next_step` DB once HOLD is cleared.
|