The service no longer schedules work itself. POST /api/v1/encyclopedia/run
syncs and runs the encyclopedia; it answers 502 when the run fails or the
text model stopped it, so a CronJob shows a failed run as a failed Job.
The sync loop keeps its startup sync and the webhook trigger; the 30-min
interval is a CronJob calling POST /api/v1/sync.
Removed: EncyclopediaBackgroundService, Encyclopedia RunAt/TimeZone,
Wiki:Sync IntervalSeconds/RetrySeconds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The ProxyHeader scheme took the username from X-Authentik-Username for any
peer inside Auth:ReverseProxy:TrustedProxies. The deployment set that to
the whole pod CIDR (a hand copy of the Talos podSubnets), so every pod the
network policies let reach :8080 (Hermes, Gitea, Traefik, all of ai and
monitoring) could claim any human's name on the Facts page and on saved
answers. Authentik's proxy provider sends no signed identity header, so the
header cannot be verified at all.
Humans now sign in with OpenID Connect against Authentik: a public client
with PKCE, the username is preferred_username from the ID token, whose
signature is checked against the provider's JWKS. Nothing about the
network path or the request headers names a user any more.
- Auth:Oidc:Authority, ClientId and PublicOrigin are required; the host
refuses to start without them. PublicOrigin builds the redirect URI,
because TLS ends at Traefik and the request scheme is http.
- UI pages, static assets and the Blazor hub need a session (fallback
policy); an anonymous browser is redirected to the provider.
- The read API (/api/v1 reads, /ask, /questions, /rank, /status) needs a
session or an API key (policy "read") and answers 401, never a redirect.
Before, it was anonymous and relied on the gate, BasicAuth or network
policy in front.
- Writes still need an API key (policy "write").
- /health, /ready and the HMAC-signed /webhook stay anonymous.
- ProxyHeaderAuthenticationHandler and Auth:ReverseProxy are removed.
Tests: an in-process OpenID provider issues RS256 ID tokens. They cover
the PKCE challenge and redirect URI, the full code flow ending in a
session named after the token's user, rejection of a token signed by a
foreign key, the Authentik header signing in nobody, and 401s for
credential-less API calls.
IFactDrafter port: a statement in, title/content/tags out. Anthropic
implements it over the transport the answer model already uses (extracted
into MessagesTransport). RecordStatementUseCase drafts, sets the person as
source, keeps the statement verbatim in the body and deposits through the
existing use case. The Facts page is the text box and the receipt; the API
shape for machines is unchanged.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Same DepositFactUseCase as POST /api/v1/facts, attributed as a human
identity from the Authentik proxy header. Cascading authentication state
carries the principal into the Blazor circuit; without a signed-in user
the form is replaced by a notice. Lists the raw sources awaiting the
nightly distill.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Both phases register their use cases and map their endpoints in the same host
files. The lab host test asserted exactly one labelled query, which held only
while no other test in the shared fixture wrote to output/; it now checks the
seeded query is among the rows.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
POST /api/v1/questions runs ask (rank + judge), selects the paragraphs that
carry probability mass, and streams one answer-model call over them. Below
the coverage gate no model is called and the response names the gap. With
save: true (signed-in user or API key) the answer lands in output/ as a
synth-shaped document with sources, confidence and the answering model.
The Answers page streams the same use case and lists saved answers.
Anthropic is the first IAnswerModel adapter; the answer model is chosen per
request or from Wiki:AnswerModels:Active.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Adds EvaluateUseCase, the C# port of bin/wiki_rank_eval.py: every output/
document with a question and a sources list labels a query, gold is the
cited slugs that still exist as wiki notes, and RankUseCase ranks each
one to report recall@k, hit-rate@k, MRR and a one-hop recall variant that
also credits a gold note reachable from a top-k note by wikilink or
related:. Exposes it as POST /api/v1/lab/eval (write-policy) and a new
/lab page for running it against any registered embedding model and
comparing runs side by side.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Rank every query, unite the top notes into one context under a per-document
and a total budget, expand context choices over paragraph or document ids
plus NONE, add the covered gate, judge context choices alone and the rest
batched, attach the answering paragraphs' text. A missing TypeSafe key is a
call-time error shown in status, not a startup failure.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The fact sink was a second adapter over the same backend. INoteStore
gains CreateAsync (DocumentExistsException on a taken path); the raw
note's shape, slug and collision numbering live in DepositFactUseCase;
GiteaRepository only moves text.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Two classes over the same backend showed as two adapters on the status
page. One GiteaRepository, one HttpClient, one health entry; the host
lists an adapter once even when it serves several ports.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
