37 commits

Author	SHA1	Message	Date
Emi Griffith	df409f88b3	registry: move image and repo references to the Jinemi namespace ... Repos moved to the Jinemi org; the container packages did not follow, since Forgejo does not transfer packages with a repo. The deploy path still resolved `emi/thermograph/*` — a user_redirect to admin_emi — while build-push.yml derives its push path from ${github.repository}, now jinemi/thermograph. The next backend or frontend build would have published somewhere no deploy looks. Point the image paths at jinemi/thermograph/* (lowercase: OCI references admit no uppercase, which is why build-push.yml already pipes through tr), the clone URLs at Jinemi/thermograph, and the registry logins at admin_emi — the account that actually owns the tokens, rather than the redirect. The live tags and both ci-runner tags were copied into the Jinemi namespace first, so the switch has something to pull. thermograph-infra, thermograph-observability and the retired */app packages stay under admin_emi; they did not move.	2026-08-01 09:25:02 -07:00
emi	deb039ee24	accounts: sign in with Google, on a shared provider-agnostic OAuth engine (#122)	2026-07-27 00:56:43 +00:00
emi	0617a3b067	db: raise max_connections to 200, cap work_mem at 64MB, trim async pool overflow (#124)	2026-07-26 19:48:50 +00:00
emi	41858f3e4b	bookmarks: account-synced saved locations API	2026-07-26 18:27:45 +00:00
emi	58e3a8d625	bookmarks: account-synced saved locations API	2026-07-26 18:27:44 +00:00
emi	53fd5d9225	bookmarks: account-synced saved locations API	2026-07-26 18:27:43 +00:00
emi	3fafd67600	bookmarks: account-synced saved locations API	2026-07-26 18:27:41 +00:00
emi	67284dfe2e	bookmarks: account-synced saved locations API	2026-07-26 18:27:40 +00:00
emi	8572c4aa6d	accounts: sign in with Discord, sharing the existing link callback (#115)	2026-07-26 18:16:55 +00:00
emi	5f20fba9f5	frontend: fix the three inconsistencies the onboarding guide found (#99)	2026-07-25 21:11:32 +00:00
emi	d4a00099f2	climate: stop dropping the current day from the Open-Meteo bundle (#92)	2026-07-25 16:56:21 +00:00
emi	e84b1f7937	docs: rewrite the agent context layer to match the live system (#81)	2026-07-25 07:08:54 +00:00
emi	a4ecb51401	web/worker: add a process-level liveness heartbeat (#80)	2026-07-25 04:13:47 +00:00
emi	005567dc51	Retire NASA POWER from every serving path (#72)	2026-07-24 23:56:34 +00:00
emi	6df4968679	Frontend QA batch: date/TZ, https origin, date-422, VAPID rotation, trace-precip, partial-day gate (#70)	2026-07-24 23:13:36 +00:00
emi	248eeee110	Gate MET forecast days on diurnal sample coverage (#63)	2026-07-24 22:23:51 +00:00
emi	cda6e75b38	data/climate: fix geocode_nominatim's NameError on every call (P0, live) (#51)	2026-07-24 19:45:49 +00:00
emi	bf0aaf1ec0	Pre-warm the SEO content derived-store off-request (#49) ... After a cell's archive advances, the first content request recomputes a 45yr payload cold. Add warm_cities.warm_content — idempotent, cache-only, bounded — that pre-populates the content derived-store under the same (kind,key,content_token) the routes read, wired into the leader-gated notifier loop (50 cities/30-min tick) so the ~1000-city set stays warm within hours of each daily advance.	2026-07-24 19:31:08 +00:00
emi	6fef57f05f	Check derived store before loading history on content routes (#48) ... The three content handlers loaded the full ~45yr archive before checking the cache, so even hits paid the load. Restructure to resolve cell + compute content_token cheaply first, check the store, and load history only inside the miss-only build() closure. Cache hits and 304s now return without touching the archive. Keys/kinds/ETag unchanged.	2026-07-24 19:30:57 +00:00
emi	a4fa72639f	Add cheap, stable content-page cache token (#47) ... Content pages keyed cache validity on the full-history hist_end, invalidating ~1-2x/day and paying a 45yr load even to compute the token. Add content_token(cell_id) = PAYLOAD_VER:CONTENT_VER:max_date, backed by an indexed MAX(date) (climate_store.history_max_date / climate.history_max_date), so it survives intra-day top-ups and needs no full-history load.	2026-07-24 19:30:38 +00:00
emi	4ff113f2cf	Stop logging /healthz + internal SSR hop, truncate logged IPs (#35)	2026-07-24 19:28:47 +00:00
emi	0f1b3a168c	Lake /query reads era5_daily through Iceberg metadata (#44)	2026-07-24 19:09:22 +00:00
emi	eaaa4f1ad9	Fix lake extension bake user; disable the daemon healthcheck in the stack (#30)	2026-07-24 03:47:39 +00:00
Emi Griffith	30b0c70bbb	Reconcile: merge main (shellcheck guard, Go daemon) into dev ... main took two direct PRs (#19 shell-lint, #21 the thermograph-daemon Go service) while dev accumulated the ERA5 lake stack; both sides added compose/ stack services and touched the same seams. Resolutions keep both worlds: - compose + Swarm stack: lake AND daemon are sibling services; backend env carries THERMOGRAPH_LAKE_URL and THERMOGRAPH_INTERNAL_TOKEN. - deploy.sh: backend deploys roll (backend lake daemon); all adds frontend. - requirements.txt: websockets/apscheduler stay removed (moved to the Go daemon), duckdb stays (the lake role's engine). Merged tree: backend suite green, both compose configs validate.	2026-07-23 17:06:52 -07:00
emi	6396d553d2	Own /state in the image; lake cache degrades instead of failing (#25)	2026-07-23 22:55:41 +00:00
emi	2d3f37c474	daemon: move the Discord gateway and scheduler out of the web process into Go (#21) ... The gateway bot and APScheduler were long-lived stateful I/O loops running inside the async web app under a leader election. They move into a single Go binary that owns ONLY that I/O -- websocket, RESUME, heartbeat, backoff, timers. It owns no grading logic. Anything needing data calls back over a new internal-only surface (/internal/discord/grade, /internal/jobs/*). Grading depends on polars and the parquet cache; reimplementing it in Go would let the bot's grades drift from the API's. The grade route returns gateway-ready JSON and Go relays the bytes verbatim. The binary ships in the backend image and runs as a second compose service off the same tag, so the two ends of the /internal/* contract can never skew. deploy.sh rolls daemon alongside backend -- without that the service would never be created, since a single-service deploy uses --no-deps. It also probes the image first and skips the daemon when rolling a tag that predates the binary: infra tracks main while image tags are env-staged, so a host can legitimately be asked to roll an older backend image, and creating the service anyway would leave a container crash-looping on a missing binary. replicas: 1 with order: stop-first replaces the leader election -- Discord permits one gateway connection per bot token. THERMOGRAPH_INTERNAL_TOKEN is optional: both ends derive it from THERMOGRAPH_AUTH_SECRET via HMAC under a domain-separation label, so this needs no new vault entry. The derivation is pinned to a shared cross-language test vector asserted on both sides, so drift fails CI instead of 401ing every call. Fail closed when neither secret is set. Improvements over the Python: a close intended for RESUME uses 4000 rather than 1000 (Discord invalidates a session closed 1000, so the old default defeated its own resume); MESSAGE_CREATE runs on a bounded worker pool; and a malformed HELLO returns an error rather than a clean reconnect, which would otherwise reset backoff and hot-loop against the gateway. 365 Python tests pass; Go build/vet/test -race clean; shellcheck 0 findings.	2026-07-23 22:49:54 +00:00
emi	a787f79f92	Survive Contabo PUT throttling in the lake extractor (#22)	2026-07-23 22:47:26 +00:00
emi	de8e847f9f	shell: add shellcheck CI guard and drive the tree to zero findings (#19) ... Adds .forgejo/workflows/shell-lint.yml (pinned shellcheck v0.11.0 + sha256, -x, default severity, fail on any finding, not path-filtered) and drives all 26 scripts to zero findings. Two defects shellcheck cannot see: render-secrets.sh left DECRYPTED vault contents in /tmp whenever a sops decrypt failed -- the caller's set -e aborted the function before either cleanup ran. Now removed on every exit path, with `|| return 1` on both sops calls so a decrypt failure can never write a partial /etc/thermograph.env regardless of the caller's shell options. Explicitly not a `trap ... RETURN`: such a trap set in a sourced function persists into the caller's shell and re-fires when the caller's next `.`/source completes, where the function-local tmp is unset -- fatal and silent under deploy.sh's set -u. The file now records that reasoning. autoscale.sh ran `set -eu` without pipefail while piping docker stats into awk, so a failed left side was swallowed and the loop autoscaled on empty input. Promoted to pipefail with a missed sample treated as a skip; verified busybox ash in docker:27-cli supports it. Also: capture-fixtures.sh's `jq . || cat` ran cat after jq had consumed stdin, silently writing truncated fixtures; deploy.sh/deploy-stack.sh `# shellcheck source=` paths corrected for the monorepo layout.	2026-07-23 22:26:05 +00:00
emi	21eea3a4c2	Parallelize lake tile uploads (#17)	2026-07-23 21:32:58 +00:00
emi	370a4ffdc1	ERA5 lake: bucket-hosted history primary + SQL indexer service (#15)	2026-07-23 21:20:35 +00:00
emi	0b574c88ed	Merge pull request 'Promote dev -> main (deploy beta): Open-Meteo migration (Phases 0-4)' (#9) from dev into main	2026-07-23 14:58:42 +00:00
emi	790b6bf0dc	Migrate off the Open-Meteo weather API (Phases 0-4) ... Steady-state usage of the Open-Meteo API is removed; it remains only as a dormant fallback. Geocoding -> local GeoNames + Nominatim; wind gusts -> Meteostat; history -> NASA POWER (curated cells seeded with keyless ERA5); recent+forecast -> NASA range + MET Norway. Plus a drift-check tool comparing NASA vs Open-Meteo. All keyless, no new infra. Backend suite green in-image (gate).	2026-07-23 14:34:51 +00:00
Emi Griffith	e5a4b25f71	backend: monorepo cutover marker (path-filter probe)	2026-07-23 03:18:03 -07:00
Emi Griffith	303134479d	Subtree-sync backend to split main a4d7fcd (dev->main promotion: reconciled bot + hardening, in-image CI); subtree workflow copies stay deleted (CI lives at root)	2026-07-22 22:37:21 -07:00
Emi Griffith	6bee541d66	Subtree-merge thermograph-backend origin/dev into backend/ (CI-in-image feature; workflows ported to root) ... # Conflicts: # backend/.forgejo/workflows/build.yml # backend/.forgejo/workflows/deploy.yml	2026-07-22 22:23:50 -07:00
Emi Griffith	7b2db07722	CI: port the split repos' workflows to per-domain path-filtered monorepo pipelines ... One root workflow set replaces the four repos' copies (deleted -- root-only is where Forgejo reads them, and dead copies are a trap): per-domain build-push with explicit image paths (emi/thermograph/backend|frontend; the old github.repository-derived path collides in a monorepo), path-filtered per-domain beta/prod/dev deploys, a domain-input reusable build check, a single always-reporting PR gate (path-filtered required checks deadlock auto-merge), a new infra-sync pipeline (host checkout + secrets render on infra/** pushes), and ports of secrets-guard / ops-cron / observability-validate to monorepo paths.	2026-07-22 22:11:33 -07:00
Emi Griffith	a4be7066e5	Subtree-merge thermograph-backend (origin/main) into backend/ ... git-subtree-dir: backend git-subtree-mainline: 6723fc0326 git-subtree-split: 83c2e05b96	2026-07-22 22:01:11 -07:00