feat: enterprise OIDC, scientist onboarding, FastCRW SDK, shieldcn badges - #299
Closed
MChorfa wants to merge 9 commits into
Closed
feat: enterprise OIDC, scientist onboarding, FastCRW SDK, shieldcn badges#299MChorfa wants to merge 9 commits into
MChorfa wants to merge 9 commits into
Conversation
added 9 commits
July 30, 2026 10:03
…ntific workbench Syncs the enterprise-oidc-foundry branch with the latest dev and squashes 121 commits into one. Resolves conflicts in the sidebar navigation (dev replaced the Workbench row with a New task action; our Science tab is retained), the goal extension (dev moved injection in-process; our branding is kept on the pure section builder), and the agent-runtime extension list (dev added automations and removed the goal extension path; our notebooks and FastCRW search extensions are retained). Includes all enterprise OIDC, APIM client credentials, Azure-style model discovery, scientific workbench, SPIFFE workload identity, foundry APIM governance, provisioning coordinator, and cortAIx appliance features.
…resets Add three starter presets for the setup flow: - local-llm-server: generic local LLM server with no auth, discover model at setup - trustnest-apim: remote APIM with subscription key header auth, discover model at setup - tensorprime-gemma4 / tensorprime-litellm: TensorPrime endpoints with no auth Skip the model match check when remote.model is empty so presets without a pinned model can proceed through setup. Show "Discover at setup" in the UI for empty model fields. Document the local SPIFFE workload identity configuration for TensorPrime.
… and extract
Extend the existing /v1/search proxy to cover the full self-hosting API
surface from the FastCRW OpenAPI spec:
- POST /v1/scrape — single-URL content extraction
- POST /v1/map — URL discovery without full scraping
- POST /v1/crawl — async multi-page crawl (maxPages clamped to 1000)
- GET /v1/crawl/{id} — poll crawl job status
- POST /v1/extract — async structured extraction (max 100 URLs)
- GET /v1/extract/{id} — poll extract job status
All endpoints share one fastCrwRequest helper that loads the onboarding
profile, validates against the allowlist, injects the keyring bearer token,
and bounds the response size. Input validation rejects empty URLs,
prompt-less extract requests, and over-cap URL lists before egress. Every
endpoint fails closed with 503 when search is disabled. A 12-case sanity
test covers request shapes, optional flags, clamping, rejection paths,
fail-closed behavior, and bearer token injection across the full surface.
…nt tracking Adds a parallel scientist experience alongside the existing developer setup: a mode picker on first run, plain-language intake form, project templates (literature review, data analysis, experiment pipeline), a guided walkthrough, a process-expression form that generates a notebook from described steps, and SQLite-backed experiment tracking with parameters, results, artifacts, and lineage.
…eation
The process-expression form generated notebook cells and an agent prompt
from the user's workflow description but then discarded them, calling
materializeProjectTemplate("blank") which wrote the generic blank template
instead. The user's described steps went nowhere.
Add a POST /studio/projects/custom endpoint that accepts notebook cells
and an agent prompt and writes them to disk. Update the process form to
call it with the generated content. Make project_path optional on both
the template materialize and custom project endpoints — when omitted,
projects land under notebook_root (which is under $HOME, so
addProjectFromPath no longer rejects with "Path is outside
WORKSPACE_ROOTS"). Expose notebook_root in studio settings.
Covers the full flow from onboarding through experiment completion: settings → profile save/retrieve → template list → template materialize → custom project creation → experiment create → experiment update with metrics/artifacts → child experiment with lineage → lineage retrieval → experiment list → get → delete. Also covers edge cases: explicit project paths, empty notebook cells rejection, non-existent template 404, experiment update on missing record 404, and empty experiment name 400.
Adds 32 edge case tests covering: Profile validation: empty data_types/goals, invalid research_field, invalid experience_level, missing required fields, profile overwrite, process_steps ordering persistence. Template edge cases: custom project_name override, all four templates produce valid notebooks, get individual template, non-existent template 404, overwrite existing project directory. Custom project edge cases: markdown-only cells, 50-cell notebook, missing project_name, missing agent_prompt, invalid cell_type, malformed JSON body. Experiment lifecycle: batch creation, list without project_id, empty project list, status transitions (running→succeeded→running), failed status with notes, cancelled status, all artifact kinds, 5-generation lineage chain, single-element lineage, non-existent lineage, delete 404, partial update preserves fields, metrics replacement. Complete lifecycle: profile guides template choice → project creation → baseline + tuned experiments with lineage → both succeed → verify lineage, listing, and on-disk project files.
Replaces the badge-less README header with a single shieldcn badge group rendering CI status, release, license, stars, and issues as joined shadcn/ui buttons. Uses the secondary variant (single-surface, no split-style) with prefers-color-scheme dark/light switching via <picture>. shieldcn badges are inherently single-surface (shadcn Button components), so no labelColor, split, or split-label styling applies.
controller, frontend: CI + license + release (3-badge group) deploy/azure/apim, deploy/spire: CI + license (2-badge group) site: license + stars (2-badge group) deploy/azure/apim-preview skipped — intentionally isolated, no promoted artifact. All badges use the secondary variant with dark/light mode switching via <picture>, consistent with the main README.
Collaborator
|
Closing as not aligned. This 554-file bundle violates the scoped workflow and permits arbitrary project-path writes without containment or an enterprise entitlement. Recut only approved slices after redesigning the filesystem and authorization boundary. |
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
<picture>. Main README gets a 5-badge group (CI, release, license, stars, issues); sub-component READMEs get focused 2-3 badge subsets. All single-surface, no split-style.Test plan
npm run check— all gates pass (contracts, structure, frontend, controller, agent-runtime)bun test tests/scientist-onboarding.integration.test.ts— 39 pass, 0 fail, 201 assertionsbun run typecheck && bun run lint(controller) — clean