Repository navigation
Add the two hosted gRPC-web proxies for verdict runs to the endpoint table - #4
Merged
Merged
Conversation
The files in proxy/hosted/ are the files deployed, byte for byte, with no SPDX line, so the hash in the table is the hash of what runs. A test derives upstream, pinned image, trusted edge range and rate-limit key from them. The docs state what the platform logs and what the rate limit is keyed on. Co-Authored-By: Claude <noreply@anthropic.com>
…e hosted rate values The pipeline proxy logs each caller's address. The rate-limit measurement reads as about the same share, the query-string check names its staging service, and the method page no longer says the hosted proxy has no host name. deriveHosted now requires average 20, period 1s, burst 40. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes and why:
https://m1-rocks.konclave.xyzforwards tozec.rocks:443, andhttps://m1-global.konclave.xyztozec.global:443. Both run on Railway, with TLS at the edge, and use the Traefik image ofproxy/compose.ymlpinned by digest.proxy/hosted/{rocks,global}/(Dockerfile,traefik.yml,conf/dynamic.yml), with no SPDX line, so the sha256 inweb/endpoints.mjsis the sha256 of what runs.verdictReadyis true for these two entries only. A live row through them is judged on its range and key. The range heights are stillnull, so no live row has a verdict yet.image_digestis the base image the Dockerfile pins.proxy/logs each caller's address on that machine.Tests run (see CONTRIBUTING.md):
node --test tests/node.test.mjs tests/charts.test.mjs: 199 pass. A test derives each hosted config property from the committed files: the pinned image, two COPY lines, no access log, the trusted range, header aliases deleted, the rate limit (20/s, burst 40, keyed on X-Real-IP), the four-call router and an https upstream. The sha256 test covers the hosted entries. Each new test was checked to fail without its change.For a result under
community-results/: commit built, device, browser:Not applicable.
AI disclosure: no AI assistance / AI-assisted (tool and what it did):
AI-assisted: Claude Code wrote the change, the tests and the docs; a separate AI review pass audited them.
🤖 Generated with Claude Code