81 Commits

Include renames

Author	SHA1	Message	Date
Emil	2b6531fa7e	Front the worker-key exchange through the coordinator in serve mode	2026-08-03 04:24:52 +03:00
Emil	ab922356e9	Apply migrations in the admin postgres integration tests regardless of run order	2026-08-03 04:16:37 +03:00
Emil	ea0fb8c595	Silence the gosec warning for the wizard's own log path	2026-08-03 04:12:15 +03:00
Emil	357ed34714	Add worker stats to the wizard, artifact pruning and offline-worker removal to the admin console	2026-08-03 04:11:43 +03:00
Emil	7ea7c52325	Cover the admin read model and workload settings with postgres integration tests	2026-08-03 04:07:15 +03:00
Emil	8db1f9846c	Restyle the remaining operator pages into the admin design system	2026-08-03 04:05:19 +03:00
Emil	7d1aacb19f	Reject blank worker names and probe the real credential and venv in --check	2026-08-03 04:01:45 +03:00
Emil	5790ae78a7	Create the worker directory before the wizard downloads the release wheel	2026-08-03 03:46:10 +03:00
Emil	40ff688416	Probe the managed venv in the wizard preflight and document RDKit's X11 deps	2026-08-03 03:23:28 +03:00
Emil	1ec4b2e60b	Point the wizard's task runner at the venv python automatically	2026-08-03 03:16:23 +03:00
Emil	15dd9651a8	Ship the scimesh wheel in releases; wizard and serve install it version-locked	2026-08-03 02:59:22 +03:00
Emil	30c441a7e9	Require an explicit scimesh source in the worker wizard (PyPI name is another project)	2026-08-03 02:39:24 +03:00
Emil	cb51172885	Let the worker wizard install the scimesh runtime into a managed venv	2026-08-03 02:32:06 +03:00
Emil	029b26e6ae	Explain the admin-required error and offer account switching on the login page	2026-08-03 02:06:45 +03:00
Emil	12499d2d7b	Remove the demo control room; /ui lands on the admin console	2026-08-03 01:58:02 +03:00
Emil	c4d88c7ffc	Satisfy the linter gate: errors.Is, context-aware exec/listen, gosec nolints	2026-08-03 01:47:53 +03:00
Emil	44247bd94e	Give every wizard test its own port and disable keep-alive pooling	2026-08-03 01:43:48 +03:00
Emil	7c1d0dc568	Tell non-admins why the console is off-limits instead of bouncing them to the dashboard	2026-08-03 01:34:22 +03:00
Emil	82eaec4c55	Make the wizard supervisor portable (no signal probing) and bind tests to an ephemeral port	2026-08-03 00:38:33 +03:00
Emil	8b7094b0cb	Open the admin console from serve --open and land login on the intended page	2026-08-03 00:32:47 +03:00
Emil	46645b8730	Add the worker setup wizard (setup, --config, --check) to worker-agent	2026-08-03 00:22:37 +03:00
Emil	e923627ce0	Add admin console access and platform pages (trust, users, keys, workloads, settings)	2026-08-03 00:11:47 +03:00
Emil	7fb1059401	Add coordinator admin console foundation (system, jobs, metrics)	2026-08-02 23:51:26 +03:00
Emil	45d5c2eaad	Update the add-worker command and expose the coordinator public URL in serve	2026-08-02 22:32:54 +03:00
Emil	76746187eb	Add a standalone worker installer and dynamic userservice port	2026-08-02 22:23:54 +03:00
Emil	1473bbe2a8	Embed the userservice and add serve/agent subcommands for one-binary operation	2026-08-02 19:49:54 +03:00
Emil	9883def0c2	Add an embedded SQLite storage backend for single-binary deployments	2026-08-02 19:23:44 +03:00
Emil	9fe81bc531	Use golang-migrate-compatible watermark tracking in migrations	2026-08-02 18:37:15 +03:00
Emil	771952e22e	Fix golangci-lint findings across the coordinator and agent	2026-08-02 18:23:43 +03:00
Emil	565d4466e4	Run gofmt on the setup wizard and migration test	2026-08-02 18:16:44 +03:00
Emil	59e7fb0155	Add the coordinator setup wizard for self-provisioned databases	2026-08-02 18:14:36 +03:00
Emil	320f52615e	Embed schema migrations and self-provision the schema on startup	2026-08-02 18:04:00 +03:00
Emil	361eb2e344	Advertise all catalog workloads from the worker by default	2026-08-02 17:47:52 +03:00
Emil	749396da05	Drive coordinator upload and reduction from the workload catalog	2026-08-02 17:47:47 +03:00
Emil	706bc85e17	Replace Python worker daemon with the Go worker agent	2026-08-02 16:53:04 +03:00
Emil	644c287002	Add Go worker agent prototype	2026-08-02 16:27:58 +03:00
Emil	f20cc7fe00	Serve documentation from the operator UI	2026-08-02 15:50:07 +03:00
Emil	f059ac626c	Add workload library page to the operator UI	2026-08-02 01:18:03 +03:00
Emil	b9a975b0ea	Merge self-service worker enrollment	2026-07-27 22:28:04 +03:00
Emil	fa76133efc	Secure user worker operations	2026-07-27 22:23:08 +03:00
Efremenko Arhip	9b235282fc	fix(coordinator/ui): use the entered machine name in the generated worker command ... The Add-your-machine page sent the typed name only to the worker key, while the copyable command hard-coded --worker-name my-machine, so every self-service worker registered as my-machine regardless of what the user entered. Thread the name into the command (shell-quoted; falls back to my-machine when blank).	2026-07-27 16:48:06 +03:00
Efremenko Arhip	3a1461315f	feat: self-service worker enrollment bound to a user account ... Let a signed-in user turn their own machine into a worker without the shared token. The coordinator already binds a JWT-authenticated registration to owner_id as untrusted; this adds the missing pieces. userservice: long-lived worker keys (scimesh_wk_live_*, hash-at-rest) with create/list/revoke and a public /worker-tokens/exchange that trades a key for a short-lived JWT carrying the owner current role/verified. python worker: SCIMESH_WORKER_KEY + SCIMESH_USERSERVICE_URL; a token provider exchanges the key and refreshes the JWT proactively and on 401, so a long-running worker survives token expiry. Static bearer token path is unchanged. coordinator UI: an "add your machine" page that mints a key and shows a ready-to-run command, proxying key management to the userservice; the dashboard gains an owner-scoped "my machines" section. docs: how to run a worker from your account, plus the untrusted/quorum/ verified trust model.	2026-07-27 16:11:07 +03:00
Efremenko Arhip	172ff76fb8	fix(test): update NewCompleteTask call to new signature ... Pass workers/results repos and quorum in the postgres integration test, matching the constructor change that added quorum voting.	2026-07-27 11:29:52 +03:00
Efremenko Arhip	6f14eeb32e	fix(coordinator): silence nilerr on unresolvable-worker trust fallback	2026-07-27 11:05:36 +03:00
Efremenko Arhip	18d58cce84	feat(coordinator): quorum verification for untrusted (volunteer) results ... Replaces the C1 quarantine with real verification. Trusted results (lab token, verified, or admin worker) are accepted directly as before. An untrusted worker's result is recorded as one vote per (task, owner) in a new task_results table; the task only completes once QUORUM_SIZE distinct owners submit the same result hash, otherwise it returns to the queue for another independent compute. - migration 0013 task_results (one vote per owner, quorum by result_sha256) - CompleteTask branches on worker trust; unknown worker defaults trusted (safe: completing needs the lease, whose owner is always a known registered worker) - claim drops the quarantine and excludes chunks the owner already voted on - domain Task.ReleaseAfterVote; QUORUM_SIZE config (default 2) - unit tests: trusted direct-complete, untrusted needs-quorum, can-claim Reducer and job done/total logic untouched — still one completed task per chunk.	2026-07-26 22:55:51 +03:00
Efremenko Arhip	dcabfcd0c3	feat(coordinator): business metrics — jobs/tasks/workers by status ... A scrape-time collector reports scimesh_tasks/jobs/workers gauges keyed by status, sourced from cheap GROUP BY queries (StatsRepo), zero-filled across all known statuses so the dashboard shows flat zeros instead of gaps. A failed query yields no samples for that scrape rather than crashing it. Metrics is now built in main so the DB-backed collector can be registered (NewServer takes *metrics.Metrics; nil self-provisions for tests). Grafana dashboard gains a Domain state row: tasks/jobs/workers by status and a queue- depth stat.	2026-07-26 22:16:35 +03:00
Efremenko Arhip	e584cfc481	feat(coordinator): Prometheus /metrics endpoint ... Adds internal/metrics: a private registry with the Go runtime + process collectors and HTTP RED instrumentation (scimesh_http_requests_total and request_duration_seconds), labelled by method/status and a normalized route so per-id paths collapse to {id} and never blow up label cardinality. /metrics is unauthenticated (like /health) for a Prometheus scraper; the middleware wraps the whole router so every request is measured once.	2026-07-26 21:47:27 +03:00
Efremenko Arhip	4ac19999a9	feat(coordinator): profile page at /ui/profile ... Shows the signed-in user's id, email, role, verified status, and created-at by proxying the session token to the userservice /me endpoint (email/created_at are not in the JWT). Profile link added to the dashboard, job, and admin headers. Tests: /me proxy forwards the bearer and renders the account; redirect without a session.	2026-07-26 21:39:08 +03:00
Efremenko Arhip	df4bdc9de9	feat(coordinator): admin panel at /ui/admin ... Admin-only page to promote/demote/verify/unverify a user by id. Actions proxy to the userservice forwarding the admin's session JWT, which the userservice re-checks (defense in depth). Non-admins are redirected off the panel; the Admin link shows only for admins. Admins already see all jobs on the dashboard. Tests: requireAdmin gate, bearer forwarding, action/id validation, admin link.	2026-07-26 21:27:39 +03:00
Efremenko Arhip	49eb662798	feat(coordinator): logout button in the operator UI ... The dashboard and job pages show a 'Log out' control (POST /ui/logout) and a 'Signed in · <role>' label when a userservice session is active. Under basic auth (no session) neither appears, so the fallback UI is unchanged. Threads a template-only Session view (json:"-") from authctx into the dashboard and job views. Tests assert the control renders only in session mode.	2026-07-26 21:03:50 +03:00