From 4985cd411ae3f74dc6e43cd24d6d1ba208885585 Mon Sep 17 00:00:00 2001 From: tornidomaroc-web Date: Thu, 23 Jul 2026 01:35:20 +0100 Subject: [PATCH] fix: remove the vestigial vercel.json ingestion service (live duplicate) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit vercel.json's `experimentalServices.ingestion` block was serving a LIVE DUPLICATE of the ingestion service at /_/ingestion — confirmed by a 200 from `GET https://tryknowflow.com/_/ingestion/health`. It was NOT vestigial-inert, and NOT stale April code: Vercel rebuilds `services/ingestion` from the deployed commit, so it runs the same current main.py as the real Railway service (INGESTION_SERVICE_URL = knowflow-production.up.railway.app). The duplicate is token-shared: INGESTION_TOKEN is a Vercel project env var the Next route already needs, so the same token that authorizes Next->Railway opens this copy's /convert and /embed. VOYAGE_API_KEY is set on Vercel, so a token-holder could burn Voyage credits and run arbitrary documents through MarkItDown here, bypassing every Next-route guard (auth, per-KB limit, enforceLimit, rate limits) — none of which live in the Python service. /health is unauthenticated and discloses provider/model/dimension. This removes ONLY the `ingestion` sub-key, keeping `frontend` exactly as-is, so the Next.js frontend keeps deploying. Logged as register #45 (OPEN). A distinct incident from B5b — the B5b row and PIVOT_PLAN.md:270 are deliberately untouched. MANDATORY sequencing (rotate LAST): (1) merge; (2) confirm production /_/ingestion/health -> 404, and DELETE the Vercel service in the dashboard if it does not (config removal may be necessary-but-insufficient); (3) THEN rotate INGESTION_TOKEN on Railway then Vercel. Rotating before teardown just re-exposes the fresh token on the shared-env duplicate. Preview must be verified before merge: frontend still serves + a real upload completes via Railway, and /_/ingestion/health -> 404. Header fields refreshed per the §7 policy merged in PR #66 (Active branch pointed at a deleted branch, Main tip was one merge stale). Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/PROGRESS.md | 11 ++++++++--- vercel.json | 4 ---- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/docs/PROGRESS.md b/docs/PROGRESS.md index 9234917..3257c18 100644 --- a/docs/PROGRESS.md +++ b/docs/PROGRESS.md @@ -5,9 +5,9 @@ commit history + [`PIVOT_PLAN.md`](./PIVOT_PLAN.md) + project memory. Update thi file at the **end of every step** so we never jump ahead on a deferred item or skip a main phase. -- **Last updated:** 2026-07-22 - see [PROGRESS §7 Changelog](#7-changelog). This field carries the date only; the narrative lives in §7. -- **Active branch:** `docs/changelog-section-migration` - this docs-only PR moves the changelog out of the `Last updated` header field into the new append-only **PROGRESS §7**, moving all **17** entry bodies **byte-identical**, and refreshes these three header fields to current reality (they named a deleted branch and a two-merges-stale tip). It touches **only** the new §7 and lines 8-10 - **no register row, no §1-§6 content, no phase status, no code, no CI.** Register **#17** stays **OPEN**. New rule: a step adds one `###` block to §7 and updates these three fields - it never edits a landed entry. -- **Main tip:** `c119f6b` (PR **#65** merge - the docs note recording register #17's WIP preservation snapshot, preserved as the annotated tag `snapshot/stash-17-legal-i18n-20260501` pointing directly at stash commit `3b41621`; register #17 stayed OPEN), on top of `0a0557f` (PR **#64** - the gate-integrity arc log) and `3378dd8` (PR **#63** - `postgres-meta` pinned by index digest). Both required checks green on `c119f6b` (`tsc`, `db-types`). +- **Last updated:** 2026-07-23 - see [PROGRESS §7 Changelog](#7-changelog). This field carries the date only; the narrative lives in §7. +- **Active branch:** `fix/remove-duplicate-vercel-ingestion-service` - this PR removes the vestigial `experimentalServices.ingestion` sub-key from `vercel.json` that was serving a LIVE DUPLICATE of the ingestion service at `/_/ingestion` (confirmed 200 on `/health`), and logs the incident as register **#45**. Touches **only** `vercel.json` and this file (the #45 row, this §7 block, and these three header fields). **No code, no other register row, no §1-§6 content, no B5b row, `PIVOT_PLAN.md` untouched.** Register **#45** stays OPEN until production `/_/ingestion/health` is confirmed 404 AND `INGESTION_TOKEN` is rotated. +- **Main tip:** `2d0856d` (PR **#66** merge - the changelog migration off the line-8 header field into the append-only §7, all 17 entry bodies byte-identical), on top of `c119f6b` (PR **#65** - register #17 WIP preservation snapshot) and `0a0557f` (PR **#64** - the gate-integrity arc log). Both required checks green on `2d0856d` (`tsc`, `db-types`). > ✅ **RESOLVED 2026-07-04 — Supabase project back online (register #21).** The > project **auto-paused** (free-tier inactivity) and then hit Supabase's free @@ -141,6 +141,7 @@ project memory, and per-step review debates. "Where" is the target phase/trigger | 42 🔎 **SURFACED 2026-07-17 (P4 wiring session) — the class behind #3 stays open. `file_type` sub-class ROOT-closed 2026-07-18 (PR #56); `language` sub-class app-closed 2026-07-18 (PR #58); `Tier` inline copy deduped 2026-07-20 (PR #60); CLASS STILL OPEN — `Message.role` primary.** | **Nothing prevents the NEXT drifted hand-written type.** `db-types` proves `database.types.ts` matches the migrations; `tsc` (post-``) proves app **code** matches those generated types. **Neither checks that the hand-written types in `src/types/index.ts` match the generated `Row` types.** Under `strict:false` (see #41) a wider DB row assigns cleanly to a narrower/wrong hand-written interface, so a stale union or a missing column drifts **silently** — exactly how #3's `file_type` was wrong on `main` for months, and why `Quiz` was missing `lang`. Adding `lang` to `Quiz` (PR #53) closed **today's instance**; the **class stays open.** **UPDATE 2026-07-18 (PR #56, merge `77ffdd3`) — the MOST HARMFUL sub-class is now closed AT ITS ROOT for `file_type`, not merely corrected.** The sub-class is: **a narrowed, app-enforced string column whose union can rot apart from a SECOND declaration** (the write-path validator). PR #56 hoisted `ALLOWED_FILE_TYPES` (an `as const` array) into `src/types/index.ts` as the SINGLE SOURCE OF TRUTH; `Document.file_type = FileType | null` DERIVES from it, and the ingest route's upload validator IMPORTS the same array (MIME map typed `Record`; runtime allowlist tests membership against that array) — so the compile-time domain and the write-path allowlist are LITERALLY the same declaration, and a drift is a `tsc` error instead of the silent 415/type-lie that made #3's `file_type` wrong for months. **Type-level dedup only — ingestion behaviour UNCHANGED** (same accepted set, same 415 + message, same MIME cross-check, same `ext` written). **#42 STAYS OPEN — this is ONE column at its root, NOT the class.** The same rot-capable second declaration still exists for **`KnowledgeBase.language`** (`useState<'ar'|'en'|'both'>` + a lying `as 'ar'|'en'|'both'` cast on the ``'s `