fix: production runtime integrity, concurrency, and adapter selection - #2
Merged
Conversation
…election - Fix docker-entrypoint.sh to honor command args so worker starts the worker, not the API; correct script paths to match tsdown directory-preserving output - Gate reset_demo_state crontab, reset service, and admin route behind DEMO_MODE=public with triple defense-in-depth - Fix DOCUMENT_STORAGE_PATH -> DOCUMENT_STORAGE_ROOT in both Compose files - Make quota checkAndIncrement atomic via INSERT ... ON CONFLICT DO UPDATE ... WHERE extraction_count < limit RETURNING - Fix posting PO double-decrement under concurrent delivery via early return - Switch IP hashing from createHash to createHmac - Extract shared inspectDocument for local and R2 document validation parity - Add createDocumentStore and createProcessingAdapters factories selecting R2/OpenRouter adapters from environment configuration - Fix orphan cleanup query referencing nonexistent source_documents column - Fix extraction rejection of text-only PDF pages - Re-enable comma-separated CORS origins with exact matching - Allow AP confirmation from returned_for_correction matching lifecycle table
- Finance approval scenario now covers approve -> AP post -> ACC- reference - Finance return scenario uses INV-E2E-FIN with AP correction/reconfirmation - E2E seeder creates AP confirmation for awaiting_finance_approval cases - Seeder no longer calls production demo-reset endpoint - Add .github/workflows/ci.yml with PostgreSQL service container for typecheck, lint, tests, and build on push and pull request
- Correct stale 'Playwright planned but not installed' to 'runs opt-in with E2E=1' - Add E2E=1 pnpm test:e2e to Commands section - Add DEMO_MODE guidance to deployment checklist
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Post-merge audit found deployment-integrity, concurrency, and adapter-selection defects that made the system unsafe to run in production. This PR fixes all P0–P3 findings.
Changes
P0 — Production runtime integrity
docker-entrypoint.shto honor `` so the worker container starts the worker, not the APICMDtoDockerfile.prodfor server defaultDOCUMENT_STORAGE_PATH→DOCUMENT_STORAGE_ROOTin both Compose filesreset_demo_statecrontab, reset service, and admin route behindDEMO_MODE=publicP1 — Concurrency and idempotency
checkAndIncrementatomic viaINSERT ... ON CONFLICT DO UPDATE ... WHEREcreateHashtocreateHmacP1 — Adapter selection and correctness repairs
createDocumentStoreandcreateProcessingAdaptersfactories selecting R2/OpenRouter from envinspectDocumentvalidation between local and R2 storesP2 — Defense in depth and CI
.github/workflows/ci.ymlwith PostgreSQL service containerACC-reference assertionP3 — Context and docs
context/architecture.mdto reflect shipped MVP statusDomain fix discovered during E2E
confirmApwas expanded to acceptreturned_for_correctionin addition toawaiting_ap_review. The lifecycle transition table already permitted this, and the UI already allowed AP to edit from returned state, but the domain guard was missing.Verification
main)E2E=1 pnpm test:e2e)Follow-ups (outside scope)
posting_failedretry returns 409 (needsretryPostingdomain function)main