4 Commits

Author SHA1 Message Date
Hartmut 5d6ca3d8cc ci: retrigger — unit-tests flake on run 159 (setup-node .gitignore issue)
CI / Architecture Guardrails (pull_request) Successful in 3m4s
CI / Lint (pull_request) Successful in 3m40s
CI / Typecheck (pull_request) Successful in 3m45s
CI / Assistant Split Regression (pull_request) Successful in 4m3s
CI / Unit Tests (pull_request) Successful in 6m31s
CI / Build (pull_request) Successful in 5m58s
CI / E2E Tests (pull_request) Successful in 4m48s
CI / Fresh-Linux Docker Deploy (pull_request) Successful in 5m4s
CI / Release Images (pull_request) Has been skipped
2026-05-21 19:51:47 +02:00
Hartmut db7948d279 fix(ci): add --profile full to teardown so app container on port 3100 is stopped
CI / Architecture Guardrails (pull_request) Successful in 2m46s
CI / Lint (pull_request) Successful in 3m14s
CI / Typecheck (pull_request) Successful in 3m28s
CI / Assistant Split Regression (pull_request) Successful in 3m56s
CI / Unit Tests (pull_request) Failing after 1m36s
CI / Build (pull_request) Successful in 4m8s
CI / E2E Tests (pull_request) Successful in 4m30s
CI / Fresh-Linux Docker Deploy (pull_request) Successful in 5m25s
CI / Release Images (pull_request) Has been skipped
The app service is declared under the 'full' profile. Without --profile full,
docker compose down skips it — leaving nexus-app-1 (or capakraken-app-1)
running and holding port 3100, which causes the next run to fail with
"Bind for 0.0.0.0:3100 failed: port is already allocated".

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-21 19:38:03 +02:00
Hartmut 7cee3b3a97 fix(ci): tear down legacy capakraken compose project before Docker Deploy
CI / Architecture Guardrails (pull_request) Successful in 2m54s
CI / Lint (pull_request) Successful in 3m17s
CI / Typecheck (pull_request) Successful in 3m29s
CI / Assistant Split Regression (pull_request) Successful in 3m48s
CI / Unit Tests (pull_request) Successful in 6m0s
CI / Build (pull_request) Successful in 5m31s
CI / Fresh-Linux Docker Deploy (pull_request) Failing after 4m5s
CI / E2E Tests (pull_request) Successful in 5m23s
CI / Release Images (pull_request) Has been skipped
After the Phase 3 rename the project name flipped from 'capakraken' to 'nexus'.
The QNAP runner may still have capakraken-redis-1 running (holding port 6380).
The down step only cleaned up the 'nexus' project, leaving the old container
alive and causing "Bind for 0.0.0.0:6380 failed: port is already allocated".

Add an explicit `docker compose -p capakraken ... down` before the normal
cleanup so stale pre-rename containers are always removed first.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-21 17:23:34 +02:00
Hartmut 01f8974314 rename(phase 3): compose/DB/infra names + stray code refs capakraken → nexus
CI / Architecture Guardrails (pull_request) Successful in 2m59s
CI / Typecheck (pull_request) Successful in 6m41s
CI / Lint (pull_request) Successful in 4m18s
CI / Assistant Split Regression (pull_request) Successful in 5m6s
CI / Unit Tests (pull_request) Successful in 7m21s
CI / Build (pull_request) Successful in 5m21s
CI / Fresh-Linux Docker Deploy (pull_request) Failing after 38s
CI / E2E Tests (pull_request) Successful in 3m28s
CI / Release Images (pull_request) Has been skipped
- docker-compose.yml / .prod.yml / .ci.yml: project names, POSTGRES_DB/USER,
  pg_isready, DATABASE_URL, volume names (nexus_pgdata, nexus_prod_*)
- .github/workflows/ci.yml: POSTGRES_PASSWORD, pg_isready, psql credentials,
  GRANT statements, POSTGRES_PASSWORD=nexus_dev for Docker Deploy job
- scripts/db-target-guard.mjs: expectedDatabase default, NEXUS_EXPECTED_DB_NAME
- scripts/prisma-with-env.mjs, e2e/test-server.mjs: env-var rename
- packages/db/src/safe-destructive-env.ts + reset-dispo-import.ts: DB name set
- packages/db/src/destructive-db-guard.ts: PROTECTED_DATABASE_NAMES → "nexus"
- packages/db/src/destructive-db-guard.test.ts: all fixture DB names + comments
- .env.example, tooling/deploy/deploy.env.example: DATABASE_URL, image refs
- packages/api: Redis channel/key prefixes (rbac-invalidate, sse, ratelimit),
  logger service name, app-base-url log prefix
- E2E: DB container names, localStorage/sessionStorage keys, email domains
- scripts: architecture-guardrails filter, export/import-dev-seed defaults,
  harden-postgres defaults, start.sh pg_isready, worktree-hygiene fixture
- tooling/migrate/rename-to-nexus.sh: new maintenance-window cutover script

Only intentional capakraken survivor: anonymization.ts DEFAULT_ANONYMIZATION_SEED
(functional cryptographic constant — changing it would invalidate stored aliases).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-21 16:35:39 +02:00
9 changed files with 48 additions and 57 deletions
+2 -2
View File
@@ -450,7 +450,7 @@ function SidebarContent({
{!sidebarCollapsed && ( {!sidebarCollapsed && (
<div className="overflow-hidden"> <div className="overflow-hidden">
<h1 className="font-display text-xl font-semibold text-gray-900 dark:text-gray-50"> <h1 className="font-display text-xl font-semibold text-gray-900 dark:text-gray-50">
Nex<span className="text-brand-600">us</span> Capa<span className="text-brand-600">Kraken</span>
</h1> </h1>
<p className="text-xs uppercase tracking-[0.18em] text-gray-500 dark:text-gray-400"> <p className="text-xs uppercase tracking-[0.18em] text-gray-500 dark:text-gray-400">
Resource & Capacity Planning Resource & Capacity Planning
@@ -984,7 +984,7 @@ export function AppShell({
<HamburgerIcon /> <HamburgerIcon />
</button> </button>
<span className="ml-3 font-display text-sm font-semibold text-gray-900 dark:text-gray-50"> <span className="ml-3 font-display text-sm font-semibold text-gray-900 dark:text-gray-50">
Nex<span className="text-brand-600">us</span> Capa<span className="text-brand-600">Kraken</span>
</span> </span>
</div> </div>
<PageTransition>{children}</PageTransition> <PageTransition>{children}</PageTransition>
+4 -4
View File
@@ -1,5 +1,5 @@
# Nexus nginx Security Hardening # CapaKraken nginx Security Hardening
# Apply to the server block for nexus.hartmut-noerenberg.com # Apply to the server block for capakraken.hartmut-noerenberg.com
# #
# References: # References:
# - EAPPS 3.3.1.3.04 (Server Header entfernen) # - EAPPS 3.3.1.3.04 (Server Header entfernen)
@@ -113,5 +113,5 @@ log_format security '$remote_addr - $remote_user [$time_local] '
'"$http_referer" "$http_user_agent" ' '"$http_referer" "$http_user_agent" '
'$request_time $upstream_response_time'; '$request_time $upstream_response_time';
access_log /var/log/nginx/nexus_access.log security; access_log /var/log/nginx/capakraken_access.log security;
error_log /var/log/nginx/nexus_error.log warn; error_log /var/log/nginx/capakraken_error.log warn;
@@ -7,14 +7,12 @@ vi.mock("../lib/audit.js", () => ({
vi.mock("../router/assistant-approvals.js", () => ({ vi.mock("../router/assistant-approvals.js", () => ({
clearPendingAssistantApproval: vi.fn().mockResolvedValue(undefined), clearPendingAssistantApproval: vi.fn().mockResolvedValue(undefined),
consumePendingAssistantApproval: vi.fn(), consumePendingAssistantApproval: vi.fn(),
toApprovalPayload: vi.fn( toApprovalPayload: vi.fn((approval: { id: string; toolName: string; summary: string }, status: string) => ({
(approval: { id: string; toolName: string; summary: string }, status: string) => ({ id: approval.id,
id: approval.id, toolName: approval.toolName,
toolName: approval.toolName, summary: approval.summary,
summary: approval.summary, status,
status, })),
}),
),
})); }));
vi.mock("../router/assistant-confirmation.js", () => ({ vi.mock("../router/assistant-confirmation.js", () => ({
@@ -41,10 +39,16 @@ import {
clearPendingAssistantApproval, clearPendingAssistantApproval,
consumePendingAssistantApproval, consumePendingAssistantApproval,
} from "../router/assistant-approvals.js"; } from "../router/assistant-approvals.js";
import { canExecuteMutationTool, isCancellationReply } from "../router/assistant-confirmation.js"; import {
canExecuteMutationTool,
isCancellationReply,
} from "../router/assistant-confirmation.js";
import { buildAssistantInsight } from "../router/assistant-insights.js"; import { buildAssistantInsight } from "../router/assistant-insights.js";
import { handlePendingAssistantApproval } from "../router/assistant-chat-response.js"; import { handlePendingAssistantApproval } from "../router/assistant-chat-response.js";
import { readToolError, readToolSuccessMessage } from "../router/assistant-tool-results.js"; import {
readToolError,
readToolSuccessMessage,
} from "../router/assistant-tool-results.js";
import { executeTool } from "../router/assistant-tools.js"; import { executeTool } from "../router/assistant-tools.js";
function createPendingApproval() { function createPendingApproval() {
@@ -53,16 +57,14 @@ function createPendingApproval() {
userId: "user_1", userId: "user_1",
conversationId: "conv_1", conversationId: "conv_1",
toolName: "create_project", toolName: "create_project",
toolArguments: '{"name":"Apollo"}', toolArguments: "{\"name\":\"Apollo\"}",
summary: "create project (name=Apollo)", summary: "create project (name=Apollo)",
createdAt: Date.now(), createdAt: Date.now(),
expiresAt: Date.now() + 60_000, expiresAt: Date.now() + 60_000,
}; };
} }
function createHandleInput( function createHandleInput(overrides: Partial<Parameters<typeof handlePendingAssistantApproval>[0]> = {}) {
overrides: Partial<Parameters<typeof handlePendingAssistantApproval>[0]> = {},
) {
return { return {
db: {} as never, db: {} as never,
dbUserId: "user_1", dbUserId: "user_1",
@@ -79,10 +81,7 @@ function createHandleInput(
pendingApproval: createPendingApproval(), pendingApproval: createPendingApproval(),
lastUserMessage: { role: "user" as const, content: "ja" }, lastUserMessage: { role: "user" as const, content: "ja" },
messages: [ messages: [
{ { role: "assistant" as const, content: "__CAPAKRAKEN_CONFIRM__ create project (name=Apollo). Bitte bestätigen." },
role: "assistant" as const,
content: "__NEXUS_CONFIRM__ create project (name=Apollo). Bitte bestätigen.",
},
{ role: "user" as const, content: "ja" }, { role: "user" as const, content: "ja" },
], ],
collectedActions: [], collectedActions: [],
@@ -104,11 +103,9 @@ describe("assistant pending approval handling", () => {
it("cancels pending approvals when the user aborts", async () => { it("cancels pending approvals when the user aborts", async () => {
vi.mocked(isCancellationReply).mockReturnValue(true); vi.mocked(isCancellationReply).mockReturnValue(true);
const result = await handlePendingAssistantApproval( const result = await handlePendingAssistantApproval(createHandleInput({
createHandleInput({ lastUserMessage: { role: "user", content: "nein, abbrechen" },
lastUserMessage: { role: "user", content: "nein, abbrechen" }, }));
}),
);
expect(result).toMatchObject({ expect(result).toMatchObject({
response: { response: {
@@ -130,7 +127,7 @@ describe("assistant pending approval handling", () => {
summary: "create project (name=Apollo, status=DRAFT)", summary: "create project (name=Apollo, status=DRAFT)",
} as never); } as never);
vi.mocked(executeTool).mockResolvedValue({ vi.mocked(executeTool).mockResolvedValue({
content: '{"message":"Projekt Apollo angelegt"}', content: "{\"message\":\"Projekt Apollo angelegt\"}",
data: { message: "Projekt Apollo angelegt" }, data: { message: "Projekt Apollo angelegt" },
action: { type: "refresh" }, action: { type: "refresh" },
} as never); } as never);
@@ -151,35 +148,29 @@ describe("assistant pending approval handling", () => {
status: "approved", status: "approved",
}, },
actions: [{ type: "refresh" }], actions: [{ type: "refresh" }],
insights: [ insights: [{
{ kind: "holiday_region",
kind: "holiday_region", title: "Berlin",
title: "Berlin", }],
},
],
}, },
}); });
expect(executeTool).toHaveBeenCalledWith( expect(executeTool).toHaveBeenCalledWith(
"create_project", "create_project",
'{"name":"Apollo"}', "{\"name\":\"Apollo\"}",
expect.objectContaining({ userId: "user_1" }), expect.objectContaining({ userId: "user_1" }),
); );
expect(createAuditEntry).toHaveBeenCalledWith( expect(createAuditEntry).toHaveBeenCalledWith(expect.objectContaining({
expect.objectContaining({ entityName: "create_project",
entityName: "create_project", summary: "AI executed previously approved tool: create_project",
summary: "AI executed previously approved tool: create_project", }));
}),
);
}); });
it("does nothing when the user reply is not a valid confirmation", async () => { it("does nothing when the user reply is not a valid confirmation", async () => {
vi.mocked(canExecuteMutationTool).mockReturnValue(false); vi.mocked(canExecuteMutationTool).mockReturnValue(false);
const result = await handlePendingAssistantApproval( const result = await handlePendingAssistantApproval(createHandleInput({
createHandleInput({ lastUserMessage: { role: "user", content: "vielleicht" },
lastUserMessage: { role: "user", content: "vielleicht" }, }));
}),
);
expect(result).toBeNull(); expect(result).toBeNull();
expect(consumePendingAssistantApproval).not.toHaveBeenCalled(); expect(consumePendingAssistantApproval).not.toHaveBeenCalled();
+1 -1
View File
@@ -1,4 +1,4 @@
// Nexus — Prisma Schema // CapaKraken — Prisma Schema
// All monetary values stored as integer cents to avoid float precision issues. // All monetary values stored as integer cents to avoid float precision issues.
generator client { generator client {
+1 -1
View File
@@ -1,5 +1,5 @@
#!/usr/bin/env bash #!/usr/bin/env bash
# restart.sh — Rebuild the Nexus app container from scratch. # restart.sh — Rebuild the CapaKraken app container from scratch.
# #
# When to use: # When to use:
# - After changing pnpm-lock.yaml (new/removed dependencies) # - After changing pnpm-lock.yaml (new/removed dependencies)
+1 -1
View File
@@ -2,7 +2,7 @@
set -euo pipefail set -euo pipefail
cd "$(dirname "$0")/.." cd "$(dirname "$0")/.."
echo "Restarting Nexus..." echo "Restarting CapaKraken..."
echo "" echo ""
# Stop # Stop
+2 -2
View File
@@ -5,7 +5,7 @@ cd "$(dirname "$0")/.."
APP_PORT="${APP_PORT:-3100}" APP_PORT="${APP_PORT:-3100}"
APP_CONTAINER="${APP_CONTAINER:-$(docker compose --profile full ps -q app 2>/dev/null | head -1)}" APP_CONTAINER="${APP_CONTAINER:-$(docker compose --profile full ps -q app 2>/dev/null | head -1)}"
echo "Starting Nexus..." echo "Starting CapaKraken..."
# 1. Start Docker services # 1. Start Docker services
echo " Starting PostgreSQL + Redis..." echo " Starting PostgreSQL + Redis..."
@@ -34,7 +34,7 @@ echo " Waiting for server (up to 90s)..."
for i in {1..90}; do for i in {1..90}; do
if curl -sf "http://localhost:${APP_PORT}/api/health" > /dev/null 2>&1; then if curl -sf "http://localhost:${APP_PORT}/api/health" > /dev/null 2>&1; then
echo "" echo ""
echo "Nexus is running!" echo "CapaKraken is running!"
curl -s "http://localhost:${APP_PORT}/api/ready" | python3 -m json.tool 2>/dev/null || curl -s "http://localhost:${APP_PORT}/api/ready" curl -s "http://localhost:${APP_PORT}/api/ready" | python3 -m json.tool 2>/dev/null || curl -s "http://localhost:${APP_PORT}/api/ready"
echo "" echo ""
echo " URL: http://localhost:${APP_PORT}" echo " URL: http://localhost:${APP_PORT}"
+2 -2
View File
@@ -2,7 +2,7 @@
set -euo pipefail set -euo pipefail
cd "$(dirname "$0")/.." cd "$(dirname "$0")/.."
echo "Stopping Nexus..." echo "Stopping CapaKraken..."
# 1. Stop any legacy local dev server # 1. Stop any legacy local dev server
if [ -f /tmp/nexus-dev.pid ]; then if [ -f /tmp/nexus-dev.pid ]; then
@@ -28,4 +28,4 @@ echo " Stopping app, PostgreSQL and Redis..."
docker compose --profile full stop app postgres redis 2>/dev/null || true docker compose --profile full stop app postgres redis 2>/dev/null || true
echo "" echo ""
echo "Nexus stopped." echo "CapaKraken stopped."
+2 -2
View File
@@ -63,7 +63,7 @@ docker compose -p "$OLD_PROJECT" -f "$COMPOSE_FILE" stop app 2>/dev/null || true
echo "[2/7] Capturing pre-rename row counts..." echo "[2/7] Capturing pre-rename row counts..."
PRE_COUNTS=$(docker compose -p "$OLD_PROJECT" -f "$COMPOSE_FILE" exec -T postgres \ PRE_COUNTS=$(docker compose -p "$OLD_PROJECT" -f "$COMPOSE_FILE" exec -T postgres \
psql -U capakraken -d capakraken -t -c \ psql -U capakraken -d capakraken -t -c \
"SELECT relname, n_live_tup FROM pg_stat_user_tables ORDER BY relname;") "SELECT table_name, n_live_tup FROM pg_stat_user_tables ORDER BY table_name;")
echo "$PRE_COUNTS" | head -20 echo "$PRE_COUNTS" | head -20
echo "..." echo "..."
@@ -149,7 +149,7 @@ sleep 15
echo "=== Verification ===" echo "=== Verification ==="
POST_COUNTS=$(docker compose -p "$NEW_PROJECT" -f "$COMPOSE_FILE" exec -T postgres \ POST_COUNTS=$(docker compose -p "$NEW_PROJECT" -f "$COMPOSE_FILE" exec -T postgres \
psql -U nexus -d nexus -t -c \ psql -U nexus -d nexus -t -c \
"SELECT relname, n_live_tup FROM pg_stat_user_tables ORDER BY relname;") "SELECT table_name, n_live_tup FROM pg_stat_user_tables ORDER BY table_name;")
echo "Post-rename row counts (sample):" echo "Post-rename row counts (sample):"
echo "$POST_COUNTS" | head -20 echo "$POST_COUNTS" | head -20