feat: add container packaging, Docker Compose, and CI pipeline#269
feat: add container packaging, Docker Compose, and CI pipeline#269
Conversation
Three-stage backend Dockerfile (builder → setup → Chainguard Python distroless runtime) with CIS Docker Benchmark hardening: non-root UID 65532, cap_drop ALL, no-new-privileges, read-only rootfs, no shell/uv/package-manager in final image. Web UI scaffold with nginx-unprivileged (non-root), SPA routing, API/WebSocket reverse proxy to backend, security headers. Docker Compose orchestration with named volumes, healthchecks, tmpfs for writable paths, and configurable ports via env vars. GitHub Actions CI workflow: parallel backend + web builds, GHCR push, version tagging from pyproject.toml, Trivy + Grype vulnerability scans, cosign image signing, SBOM + SLSA provenance. Housekeeping: move CONTRIBUTING.md and SECURITY.md to .github/, delete empty config/ directory, add Dependabot Docker digest updates, update README.md and CLAUDE.md with Docker documentation.
…CSP, docs - Pin ALL GitHub Actions to full-length commit SHAs across 4 workflows - Scan-before-push pattern: build → Trivy/Grype scan → push (prevents publishing vulnerable images to GHCR) - Replace deprecated X-XSS-Protection with Content-Security-Policy header in nginx; add path-aware CSP middleware in backend (strict for API, relaxed for Scalar docs allowing cdn.jsdelivr.net + fonts.scalar.com) - Consolidate per-service .dockerignore files into single root .dockerignore - Fix 6 broken relative links in CONTRIBUTING.md and getting_started.md after CONTRIBUTING.md move to .github/ - Update DESIGN_SPEC.md §15.2 (containerization row), §15.3 (add docker/, web/, .github/ to project structure), §15.4 (add Container Packaging design decision) - Fix compose.override.yml misleading "auto-merged" comment - Fix fetch() r.ok check in web/index.html for non-2xx responses - Fix .env.example copy command path for repo root usage - Add version extraction error handling in CI - Add ENTRYPOINT [] explanatory comment in backend Dockerfile - Update CONTRIBUTING.md and getting_started.md project structure listings
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly advances the project's deployment and operational capabilities by introducing a robust containerization strategy for both the backend and web UI. It establishes a secure and automated CI/CD pipeline for building and managing container images, while also providing a foundational web interface with secure proxying. These changes enhance reproducibility, security, and ease of deployment for the entire application stack. Highlights
Changelog
Ignored Files
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (6)
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds production-grade containerization and CI: multi-stage hardened Dockerfiles for backend and web, Docker Compose and env scaffolding, a GitHub Actions workflow to build/scan/push/sign images, Dependabot docker updates, repo ignore updates, web static assets, path-aware CSP middleware, and tests and docs updates. Changes
Sequence DiagramsequenceDiagram
actor Developer
participant GitHub as GitHub<br/>(repo)
participant GHA as GitHub Actions
participant Builder as Docker Build
participant Trivy as Trivy<br/>(Scanner)
participant Grype as Grype<br/>(Scanner)
participant Registry as GHCR<br/>(Registry)
participant Cosign as Cosign<br/>(Signer)
Developer->>GitHub: push to main or tag v*
GitHub->>GHA: trigger Docker workflow
rect rgba(100, 150, 200, 0.5)
Note over GHA,Builder: Build Phase
GHA->>GHA: extract version from pyproject.toml
GHA->>Builder: build backend image (multi-stage)
Builder-->>GHA: image artifact
end
rect rgba(150, 100, 150, 0.5)
Note over GHA,Trivy: Scanning Phase
GHA->>Trivy: scan image (fail on CRITICAL/HIGH)
Trivy-->>GHA: report
GHA->>Grype: scan image (fail on HIGH)
Grype-->>GHA: report
end
rect rgba(100, 200, 100, 0.5)
Note over GHA,Registry: Push & Sign Phase
alt scans pass
GHA->>Registry: push image with tags & SBOM
Registry-->>GHA: return digest
GHA->>Cosign: sign image using digest
Cosign-->>Registry: upload signature
else scans fail
GHA-->>Developer: report failure
end
end
Note over GHA: same flow repeated for web image
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
There was a problem hiding this comment.
Code Review
This pull request significantly improves the project's infrastructure by adding a comprehensive containerization and CI solution, utilizing multi-stage, hardened, distroless Docker images and a security-conscious Docker Compose setup. While the implementation follows many security best practices, a critical vulnerability has been identified: the Content Security Policy (CSP) for both the documentation UI and the placeholder web page currently uses 'unsafe-inline', which significantly weakens protection against Cross-Site Scripting (XSS) attacks. This should be addressed to maintain a high security standard. Additionally, a minor maintainability point involves a workaround in the backend Dockerfile (touch README.md) that could be addressed for better clarity. Overall, this is a very strong contribution that significantly improves the project's infrastructure and production readiness.
web/nginx.conf
Outdated
| add_header X-Frame-Options "DENY" always; | ||
| add_header Referrer-Policy "strict-origin-when-cross-origin" always; | ||
| add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always; | ||
| add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; font-src 'self'" always; |
There was a problem hiding this comment.
The Content-Security-Policy header in web/nginx.conf currently uses 'unsafe-inline' for script-src and style-src. This significantly weakens the application's protection against Cross-Site Scripting (XSS) attacks, as it applies to the entire web application. It is strongly recommended to move inline scripts and styles from web/index.html into separate .js and .css files. If inline content must remain, consider using SHA256 hashes for specific blocks to maintain a more secure CSP.
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' data:; font-src 'self'" always;
| uv sync --frozen --no-dev --no-install-project | ||
|
|
||
| # Copy source and install project (dummy README satisfies hatchling metadata) | ||
| RUN touch README.md |
There was a problem hiding this comment.
The use of touch README.md appears to be a workaround for a hatchling metadata requirement. While this works, it can be confusing for future maintainers and makes the build process less explicit. It would be more robust to configure the build system (likely in pyproject.toml) to not require README.md for the wheel, or to include a minimal one within the source if it's truly necessary for the package. This would make the build process clearer and less reliant on such side effects.
src/ai_company/api/middleware.py
Outdated
| _DOCS_CSP = ( | ||
| "default-src 'self'; " | ||
| "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; " | ||
| "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; " | ||
| "img-src 'self' data: https://cdn.jsdelivr.net; " | ||
| "font-src 'self' data: https://cdn.jsdelivr.net https://fonts.scalar.com; " | ||
| "connect-src 'self' https://cdn.jsdelivr.net https://proxy.scalar.com" | ||
| ) |
There was a problem hiding this comment.
The Content Security Policy (CSP) for the /docs path includes 'unsafe-inline' for both script-src and style-src. This is a security risk as it allows the execution of arbitrary inline scripts, which can lead to Cross-Site Scripting (XSS) vulnerabilities. While this might be a requirement for the Scalar UI, it's worth investigating if more secure alternatives like nonces or hashes can be used.
For example, if the inline scripts are static, you could use hashes:
script-src 'self' 'sha256-yourScriptHashHere==' https://cdn.jsdelivr.net;
This would provide a much stronger security posture by only allowing specific, known inline scripts to execute.
Greptile SummaryThis PR introduces a complete containerization and CI/CD pipeline for the AI Company project: a three-stage CIS-hardened backend Dockerfile using Chainguard distroless Python, a non-root nginx web container, Docker Compose orchestration with read-only rootfs and tmpfs mounts, a GitHub Actions pipeline with vulnerability scanning and cosign image signing, and a new path-aware Key findings from the review:
Confidence Score: 4/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant Browser
participant Nginx as nginx (web :3000)
participant Backend as Backend (uvicorn :8000)
Browser->>Nginx: GET /api/v1/health
Nginx->>Backend: proxy_pass /api/v1/health
Note over Backend: CSPMiddleware injects CSP header
Backend-->>Nginx: 200 OK + CSP header from middleware
Note over Nginx: server-block add_header ALSO injects CSP
Nginx-->>Browser: 200 OK + duplicate CSP headers warning
Browser->>Nginx: GET / (SPA route)
Note over Nginx: No proxy, no upstream CSP
Nginx-->>Browser: 200 index.html + single CSP header (correct)
Browser->>Nginx: WS /ws upgrade
Nginx->>Backend: proxy_pass with HTTP Upgrade
Note over Nginx: No proxy_buffering off set
Backend-->>Nginx: 101 Switching Protocols
Nginx-->>Browser: 101 WebSocket tunnel (potential frame buffering latency)
Browser->>Backend: GET /docs/api (direct port 8000)
Note over Backend: CSPMiddleware sends relaxed CSP for Scalar UI
Backend-->>Browser: 200 Scalar UI + relaxed CSP (no nginx duplication)
Last reviewed commit: 3c5c182 |
There was a problem hiding this comment.
Pull request overview
Adds production-oriented container packaging and deployment scaffolding for the AI Company stack, including hardened Docker images, Compose orchestration, and a supply-chain-focused CI pipeline.
Changes:
- Introduces backend and web container images (Chainguard distroless Python runtime; unprivileged nginx web tier) plus a CIS-hardened Docker Compose setup and
.envtemplate. - Adds a Docker CI workflow to build, scan (Trivy/Grype), publish to GHCR, and cosign-sign images; pins GitHub Actions to commit SHAs.
- Adds path-aware CSP handling for backend docs vs API routes and updates docs to reflect the new structure and workflows.
Reviewed changes
Copilot reviewed 20 out of 23 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| web/nginx.conf | nginx SPA routing, API/WS reverse proxy, gzip, and security headers for the web tier |
| web/index.html | Placeholder dashboard page with periodic backend health check |
| src/ai_company/api/middleware.py | Adds CSP middleware (path-aware) alongside request logging middleware |
| src/ai_company/api/app.py | Wires CSP middleware into Litestar app and removes static CSP response header |
| docs/getting_started.md | Updates project structure and links after .github/ move and containerization additions |
| docker/web/Dockerfile | Builds the web nginx image with healthcheck |
| docker/compose.yml | CIS-hardened Compose stack for backend + web with volumes/tmpfs and health dependencies |
| docker/compose.override.yml | Local-only overrides (debug log level; documented docker socket option) |
| docker/backend/Dockerfile | Multi-stage backend image build (uv builder → setup → Chainguard distroless runtime) |
| docker/.env.example | Environment variable template for running the stack via Compose |
| config/.gitkeep | Keeps the config/ directory tracked in git |
| README.md | Adds Docker Compose quickstart and updates contributing link |
| DESIGN_SPEC.md | Updates containerization/packaging sections and project structure diagram |
| CLAUDE.md | Adds Docker usage and CI notes for contributors/assistants |
| .gitignore | Ignores future web UI build artifacts (node_modules/dist) |
| .github/workflows/secret-scan.yml | Pins actions/checkout to a full commit SHA |
| .github/workflows/docker.yml | New workflow: build → scan → push → sign for backend + web images |
| .github/workflows/dependency-review.yml | Pins actions to full commit SHAs |
| .github/workflows/ci.yml | Pins checkout and upload-artifact actions to full commit SHAs |
| .github/dependabot.yml | Adds docker ecosystem updates for backend/web Dockerfiles |
| .github/SECURITY.md | Adds repository security policy and reporting guidance |
| .github/CONTRIBUTING.md | Fixes links after moving under .github/ and updates structure docs |
| .dockerignore | Adds a consolidated root .dockerignore for root-context Docker builds |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
docker/backend/Dockerfile
Outdated
| FROM python:3.14.3-slim AS builder | ||
|
|
||
| COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /bin/ |
There was a problem hiding this comment.
Several image references are pinned only by tag (e.g., python:3.14.3-slim, ghcr.io/astral-sh/uv:0.10.9). Tags can be retargeted upstream, which reduces build reproducibility and supply-chain hardening. If the intent is fully pinned builds, consider pinning these to digests as well (and letting Dependabot update them).
| FROM python:3.14.3-slim AS builder | |
| COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /bin/ | |
| FROM python:3.14.3-slim@sha256:1111111111111111111111111111111111111111111111111111111111111111 AS builder | |
| COPY --from=ghcr.io/astral-sh/uv:0.10.9@sha256:2222222222222222222222222222222222222222222222222222222222222222 /uv /uvx /bin/ |
docker/web/Dockerfile
Outdated
| # AI Company Web — CIS-hardened nginx container (non-root) | ||
| # ============================================================================= | ||
|
|
||
| FROM nginxinc/nginx-unprivileged:1.29.5-alpine |
There was a problem hiding this comment.
The nginx base image is tag-pinned but not digest-pinned. If you want fully reproducible / supply-chain-hardened builds, consider pinning nginxinc/nginx-unprivileged:1.29.5-alpine by digest too (and relying on Dependabot for updates).
| FROM nginxinc/nginx-unprivileged:1.29.5-alpine | |
| FROM nginxinc/nginx-unprivileged:1.29.5-alpine@sha256:REPLACE_WITH_ACTUAL_DIGEST |
| class CSPMiddleware: | ||
| """ASGI middleware that applies path-aware Content-Security-Policy. | ||
|
|
||
| API routes get a strict policy (self-origin only). The ``/docs/`` | ||
| path gets a relaxed policy that allows Scalar UI resources from | ||
| ``cdn.jsdelivr.net``. | ||
| """ | ||
|
|
||
| def __init__(self, app: ASGIApp) -> None: | ||
| self.app = app | ||
|
|
||
| async def __call__( | ||
| self, | ||
| scope: Scope, | ||
| receive: Receive, | ||
| send: Send, | ||
| ) -> None: | ||
| """Inject the appropriate CSP header based on request path.""" |
There was a problem hiding this comment.
New CSPMiddleware behavior isn’t covered by tests. Since middleware behavior is security-sensitive, add unit tests (similar to existing middleware tests) asserting the Content-Security-Policy header value differs for /docs vs non-doc paths.
src/ai_company/api/middleware.py
Outdated
| return | ||
|
|
||
| path: str = scope.get("path", "") | ||
| is_docs = path.startswith("/docs") |
There was a problem hiding this comment.
is_docs = path.startswith("/docs") will also match unrelated paths like /docs-foo, unintentionally applying the relaxed CSP to non-doc routes. Consider using an exact match for /docs plus a /docs/ prefix check (path boundary) so only the documentation UI gets the relaxed policy.
| is_docs = path.startswith("/docs") | |
| is_docs = path == "/docs" or path.startswith("/docs/") |
web/nginx.conf
Outdated
| add_header X-Frame-Options "DENY" always; | ||
| add_header Referrer-Policy "strict-origin-when-cross-origin" always; | ||
| add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always; | ||
| add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; font-src 'self'" always; |
There was a problem hiding this comment.
The CSP here allows 'unsafe-inline' for both scripts and styles, which substantially weakens XSS protections (any injected inline script/style will run). If possible, move the inline JS/CSS to separate files or use a nonce/hash-based policy so you can keep unsafe-inline disabled.
| add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; font-src 'self'" always; | |
| add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' data:; font-src 'self'" always; |
| server { | ||
| listen 8080; | ||
| server_name _; | ||
|
|
There was a problem hiding this comment.
Consider disabling server_tokens to avoid disclosing the nginx version in error pages and response headers (minor information disclosure hardening).
| server_tokens off; |
.github/workflows/docker.yml
Outdated
| type=raw,value=${{ needs.version.outputs.app_version }} | ||
| type=semver,pattern={{version}} | ||
| type=semver,pattern={{major}}.{{minor}} | ||
| type=sha,prefix= |
There was a problem hiding this comment.
This workflow publishes a mutable app_version tag (from pyproject.toml) on every push to main. If the version isn't bumped on each merge, the same tag will be overwritten with different image contents, which is confusing for consumers and makes rollbacks harder. Consider only publishing version/semver tags on v* git tag events and using commit-SHA tags for main pushes.
| type=raw,value=${{ needs.version.outputs.app_version }} | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=sha,prefix= | |
| # Publish human-readable version tags only on v* git tags | |
| type=raw,value=${{ needs.version.outputs.app_version }},enable=${{ startsWith(github.ref, 'refs/tags/v') }} | |
| type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }} | |
| type=semver,pattern={{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') }} | |
| # Use immutable SHA tags for main branch pushes | |
| type=sha,prefix=,enable=${{ github.ref == 'refs/heads/main' }} |
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/docker.yml:
- Around line 73-77: The SHA-based image tag currently uses "type=sha,prefix="
which yields bare short SHAs that can collide with semver-like tags; change the
tag entry to use "type=sha,prefix=sha-" so tags become "sha-<shortsha>" and
update the identical "type=sha,prefix=" occurrence for the web image as well
(the entries containing the literal string type=sha,prefix=).
In `@DESIGN_SPEC.md`:
- Line 2742: Update the Containerization table entry that currently claims "zero
CVEs" (the row labeled **Containerization**) to remove the absolute guarantee
and instead state the continuous remediation posture; replace "zero CVEs" with
wording such as "minimal attack surface, continuously scanned in CI with rapid
remediation" and mirror this change for the second occurrence noted (the other
similar entry at the later mention). Ensure the new phrasing retains references
to Chainguard Python distroless, non-root UID 65532,
nginxinc/nginx-unprivileged, GHCR, cosign, Trivy + Grype, SBOM and SLSA
provenance while removing the fixed "zero CVEs" claim.
In `@README.md`:
- Around line 87-94: Update the README service URL lines and example commands to
indicate the ports are defaults and configurable via BACKEND_PORT and WEB_PORT
in docker/compose.yml; change the "Backend API: http://localhost:8000" and "Web
Dashboard: http://localhost:3000" text to note these are default values (e.g.,
"default BACKEND_PORT" / "default WEB_PORT"), and update the curl comment to
append a note like "default BACKEND_PORT; use your configured value if changed"
while keeping the docker compose stop command unchanged.
In `@src/ai_company/api/middleware.py`:
- Around line 60-62: The current check uses path.startswith("/docs") which
incorrectly matches prefixes like "/documents"; update the is_docs detection in
the middleware to only treat the exact docs routes as docs (for example match
"/docs" and "/docs/" or use exact equality and a normalized trailing slash)
before selecting _DOCS_CSP vs _API_CSP; modify the logic around
scope.get("path") / path and the is_docs variable so only the intended OpenAPI
docs endpoints receive _DOCS_CSP.
In `@web/nginx.conf`:
- Line 21: The Content-Security-Policy header added in the nginx config includes
'unsafe-inline' for script-src and style-src which weakens XSS protection;
update the Content-Security-Policy add_header directive (the line adding
Content-Security-Policy) to remove 'unsafe-inline' from script-src (and consider
removing it from style-src), and if inline scripts/styles are required for the
placeholder index.html replace them with nonce- or hash-based allowances
(generate and inject nonces or compute script/style hashes) so the policy can
stay strict while permitting necessary inline content.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: e276b6dd-b888-4258-b613-e3092bee6de6
📒 Files selected for processing (23)
.dockerignore.github/CONTRIBUTING.md.github/SECURITY.md.github/dependabot.yml.github/workflows/ci.yml.github/workflows/dependency-review.yml.github/workflows/docker.yml.github/workflows/secret-scan.yml.gitignoreCLAUDE.mdDESIGN_SPEC.mdREADME.mdconfig/.gitkeepdocker/.env.exampledocker/backend/Dockerfiledocker/compose.override.ymldocker/compose.ymldocker/web/Dockerfiledocs/getting_started.mdsrc/ai_company/api/app.pysrc/ai_company/api/middleware.pyweb/index.htmlweb/nginx.conf
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Agent
- GitHub Check: Greptile Review
🧰 Additional context used
📓 Path-based instructions (3)
**/*.py
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.py: Do not usefrom __future__ import annotations— Python 3.14 has PEP 649 native lazy annotations
Useexcept A, B:syntax (no parentheses) for PEP 758 except syntax — ruff enforces this on Python 3.14
Include type hints on all public functions; use mypy strict mode
Use Google-style docstrings on all public classes and functions; enforce via ruff D rules
Create new objects and never mutate existing ones; for non-Pydantic internal collections (registries, BaseTool), use copy.deepcopy() at construction and MappingProxyType wrapping for read-only enforcement
For dict/list fields in frozen Pydantic models, rely on frozen=True for field reassignment prevention and copy.deepcopy() at system boundaries (tool execution, LLM provider serialization, inter-agent delegation, persistence serialization)
Use frozen Pydantic models for config/identity; use separate mutable-via-copy models with model_copy(update=...) for runtime state that evolves (e.g. agent execution state, task progress); never mix static config fields with mutable runtime fields in one model
Use Pydantic v2 (BaseModel, model_validator, computed_field, ConfigDict); use@computed_fieldfor derived values instead of storing redundant fields; use NotBlankStr from core.types for all identifier/name fields (including optional and tuple variants) instead of manual whitespace validators
Prefer asyncio.TaskGroup for fan-out/fan-in parallel operations in new code (e.g. multiple tool invocations, parallel agent calls); prefer structured concurrency over bare create_task
Maintain 88-character line length; enforce via ruff
Keep functions under 50 lines and files under 800 lines
Handle errors explicitly; never silently swallow exceptions
Validate at system boundaries (user input, external APIs, config files)
Files:
src/ai_company/api/middleware.pysrc/ai_company/api/app.py
src/**/*.py
📄 CodeRabbit inference engine (CLAUDE.md)
src/**/*.py: Every module with business logic must include: from ai_company.observability import get_logger then logger = get_logger(name); never use import logging / logging.getLogger() / print() in application code; always use variable name logger (not _logger, not log)
Always use event name constants from domain-specific modules under ai_company.observability.events (e.g. PROVIDER_CALL_START from events.provider, BUDGET_RECORD_ADDED from events.budget); import directly: from ai_company.observability.events. import EVENT_CONSTANT
Use structured logging via logger.info(EVENT, key=value) syntax; never use logger.info('msg %s', val) formatting
All error paths must log at WARNING or ERROR with context before raising
All state transitions must log at INFO level
DEBUG level logging is for object creation, internal flow, and entry/exit of key functions; pure data models, enums, and re-exports do not need logging
Files:
src/ai_company/api/middleware.pysrc/ai_company/api/app.py
{src,tests}/**/*.{py,yaml,yml}
📄 CodeRabbit inference engine (CLAUDE.md)
Never use real vendor names (Anthropic, OpenAI, Claude, GPT, etc.) in project-owned code, docstrings, comments, tests, or config examples; use generic names: example-provider, example-large-001, example-medium-001, example-small-001, large/medium/small as aliases. Vendor names may only appear in: (1) DESIGN_SPEC.md provider list, (2) .claude/ skill/agent files, (3) third-party import paths/module names. Tests must use test-provider, test-small-001, etc.
Files:
src/ai_company/api/middleware.pysrc/ai_company/api/app.py
🧠 Learnings (3)
📚 Learning: 2026-03-10T13:31:23.930Z
Learnt from: CR
Repo: Aureliolo/ai-company PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-10T13:31:23.930Z
Learning: Use branch naming format <type>/<slug> derived from main; pre-commit hooks enforce: trailing-whitespace, end-of-file-fixer, check-yaml, check-toml, check-json, check-merge-conflict, check-added-large-files, no-commit-to-branch (main), ruff check+format, gitleaks
Applied to files:
CLAUDE.md.github/CONTRIBUTING.md
📚 Learning: 2026-03-10T13:31:23.930Z
Learnt from: CR
Repo: Aureliolo/ai-company PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-10T13:31:23.930Z
Learning: Always read DESIGN_SPEC.md before implementing any feature or planning any issue; use the design spec as the starting point for architecture, data models, and behavior
Applied to files:
docs/getting_started.mdDESIGN_SPEC.md
📚 Learning: 2026-03-10T13:31:23.930Z
Learnt from: CR
Repo: Aureliolo/ai-company PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-10T13:31:23.930Z
Learning: When a spec section is referenced, read that section verbatim before coding; when approved deviations occur, update DESIGN_SPEC.md to reflect the new reality
Applied to files:
docs/getting_started.md
🧬 Code graph analysis (1)
src/ai_company/api/app.py (1)
src/ai_company/api/middleware.py (2)
CSPMiddleware(38-76)RequestLoggingMiddleware(79-139)
🪛 Checkov (3.2.334)
docker/web/Dockerfile
[low] 1-22: Ensure that a user for the container has been created
(CKV_DOCKER_3)
🪛 Hadolint (2.14.0)
docker/backend/Dockerfile
[warning] 46-46: Last USER should not be root
(DL3002)
🪛 LanguageTool
CLAUDE.md
[uncategorized] ~59-~59: The official name of this software platform is spelled with a capital “H”.
Context: ...iles, compose, .env.example - CI: .github/workflows/docker.yml — build → scan → ...
(GITHUB)
docs/getting_started.md
[uncategorized] ~153-~153: The official name of this software platform is spelled with a capital “H”.
Context: ...ette. ## Next Steps - CONTRIBUTING.md — branch, commit, and ...
(GITHUB)
README.md
[typographical] ~100-~100: To join two clauses or introduce examples, consider using an em dash.
Context: ...etting Started](docs/getting_started.md) - Setup and installation guide - [Contribu...
(DASH_RULE)
[uncategorized] ~101-~101: The official name of this software platform is spelled with a capital “H”.
Context: ...p and installation guide - Contributing - Branch, commit, and ...
(GITHUB)
[typographical] ~101-~101: To join two clauses or introduce examples, consider using an em dash.
Context: ... Contributing - Branch, commit, and PR workflow - [CLAUD...
(DASH_RULE)
🔇 Additional comments (24)
.gitignore (1)
49-52: LGTM!The Web UI ignore patterns are correctly structured to exclude Node.js dependencies and build artifacts from version control.
docker/web/Dockerfile (1)
1-22: Well-structured security-hardened web container.The Dockerfile correctly leverages
nginxinc/nginx-unprivileged, which already runs as a non-root user (UID 101), addressing CIS container hardening requirements. The static analysis hint about container user (CKV_DOCKER_3) is a false positive for this base image.The implementation includes proper OCI labels, version-pinned base image for reproducibility, and a functional healthcheck.
.github/dependabot.yml (1)
38-64: LGTM!The Dependabot Docker configurations are well-structured, enabling automated base image digest updates for both backend and web containers. The daily schedule and configuration align with existing dependency update patterns in this file.
.github/workflows/dependency-review.yml (1)
17-22: LGTM!Both actions are correctly pinned to full-length commit SHAs with version comments, consistent with the PR's supply chain security improvements.
.github/workflows/ci.yml (1)
23-23: LGTM!All GitHub Actions are consistently pinned to full-length commit SHAs across lint, type-check, and test jobs. The uniform checkout SHA ensures consistent behavior, and upload-artifact is similarly pinned for supply chain security.
Also applies to: 40-40, 57-57, 86-86
.dockerignore (1)
1-64: LGTM!Well-documented consolidated
.dockerignorethat properly excludes development artifacts, sensitive files, and unnecessary content from Docker build contexts. The inline comments clearly explain what each service requires, aiding maintainability.web/nginx.conf (1)
1-49: Well-configured nginx reverse proxy with good security posture.The configuration correctly implements:
- Non-privileged port (8080) compatible with
nginx-unprivileged- Comprehensive security headers with helpful inheritance warning
- Proper SPA routing with static file fallback
- API proxying with standard forwarded headers
- WebSocket support with appropriate upgrade headers and extended timeout
The documented note about
add_headerinheritance (lines 14-16) is excellent for maintainability..github/workflows/secret-scan.yml (1)
22-22: Good: SHA-pinned checkout action for supply chain security.Pinning to exact commit SHA protects against tag mutation attacks. The inline version comment (
# v6) aids maintainability.docker/backend/Dockerfile (1)
1-104: LGTM! Well-structured multi-stage Dockerfile with proper CIS hardening.The three-stage build is correctly implemented:
- Stage 1 (builder): Compiles dependencies with layer caching
- Stage 2 (setup): Fixes symlinks and sets ownership (ephemeral, needs shell)
- Stage 3 (runtime): Distroless, runs as non-root UID 65532
The Hadolint DL3002 warning about "Last USER should not be root" at line 46 is a false positive — it flags the ephemeral setup stage, but the final runtime stage correctly sets
USER 65532at line 92. The production image runs non-root as intended.web/index.html (1)
68-92: LGTM! Clean health-check implementation.The fetch logic correctly:
- Checks
r.okbefore parsing JSON (line 76)- Gracefully handles failures in the catch block
- Updates UI state appropriately for both connected and disconnected states
src/ai_company/api/middleware.py (1)
38-76: LGTM! Well-implemented path-aware CSP middleware.The middleware correctly:
- Delegates non-HTTP scopes without modification
- Injects CSP headers by wrapping the send callable
- Uses separate policies for API vs documentation routes
src/ai_company/api/app.py (2)
28-28: LGTM! Correct import of CSPMiddleware.
365-372: LGTM! Appropriate middleware ordering.CSPMiddleware is correctly positioned as the first (outermost) middleware, ensuring CSP headers are applied regardless of rate limiting or request logging outcomes. Moving CSP from static
response_headersto middleware enables the path-aware behavior needed for/docs/..github/workflows/docker.yml (1)
79-134: LGTM! Correct scan-before-push pattern with graceful signing fallback.The workflow correctly:
- Builds locally first without pushing
- Runs both Trivy and Grype scans
- Only pushes after scans pass
- Handles missing digest gracefully in the signing step
CLAUDE.md (2)
42-63: LGTM! Clear and comprehensive Docker documentation.The section provides:
- Correct compose commands with
-f docker/compose.yml- Health check verification commands for both direct and proxied access
- Accurate descriptions of the hardened container setup
The LanguageTool hint about "GitHub" capitalization is a false positive —
.github/is a directory path convention, not a reference to the company name.
162-164: LGTM! CI section correctly updated.The additions accurately describe the new Docker workflow capabilities and Dependabot configuration.
docker/compose.override.yml (1)
1-12: LGTM! Well-documented development override.The file correctly:
- Documents that explicit
-fis required (compose v2 doesn't auto-merge.override.ymlwhen using-f)- Sets debug logging for development
- Keeps the Docker socket mount commented with an appropriate security warning
docker/.env.example (1)
1-31: LGTM! Well-structured environment template.The file provides:
- Clear section organization with descriptive comments
- Sensible defaults for non-sensitive values
- Correct container paths (
/data/) matching the Dockerfile- Sensitive values (
LLM_API_KEY) left empty as expected- Optional configurations appropriately commented
docs/getting_started.md (1)
103-124: Docs layout and navigation stay aligned with the new repo structure.The new
docker//web/entries and the moved CONTRIBUTING link are consistent with the rest of the documentation changes.Also applies to: 153-153
.github/CONTRIBUTING.md (1)
11-11: Relative link fixes and structure updates look correct.These paths now resolve from
.github/CONTRIBUTING.md, and the addeddocker//web/entries match the documented repo layout.Also applies to: 110-115, 126-145
README.md (1)
57-65: The Docker-first onboarding split is clear.This keeps local Python setup intact while adding container prerequisites and the moved contributing guide.
Also applies to: 101-101
docker/compose.yml (2)
16-24: The container hardening profile looks solid.
no-new-privileges,cap_drop: ALL, read-only root filesystems, and scoped tmpfs mounts are strong defaults for both services.Also applies to: 35-44
32-34: Backend readiness gate is properly backed by HEALTHCHECK.The
service_healthycondition in compose.yml is correctly supported:docker/backend/Dockerfiledefines a HEALTHCHECK at line 97 that checkshttp://localhost:8000/api/v1/health. No action needed.DESIGN_SPEC.md (1)
3209-3230: Spec structure updates are in sync with the repo layout.Adding
docker/,web/, and the GitHub workflow/action entries keeps §15.3 aligned with the artifacts introduced by this PR.
…iewers Security: fail cosign signing on empty digest, fix CSP path matching (/docs prefix too broad), remove unsafe-inline from nginx CSP by extracting inline JS/CSS to external files, add server_tokens off, digest-pin all Docker base images (python, uv, nginx). CI: limit version/semver tags to v* git tags only, use sha- prefix for SHA tags, fix file handle leak in version extraction, document scan-vs-push artifact difference, document Codecov best-effort rationale. Code quality: fix duplicate Callable import, improve _build_middleware return type (list[Middleware] instead of list[object]), add Final[str] to CSP constants, add 7 CSPMiddleware unit tests. Docs: add docker/sandbox/ and .dockerignore to DESIGN_SPEC project structure, replace "zero CVEs" with "continuously scanned" language, note configurable ports in README, fix mypy command in getting_started, clarify CIS reference numbers in compose.yml, fix Dockerfile comments (ENTRYPOINT, touch README, CIS-hardened claim), improve healthcheck to validate response body status.
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/docker.yml:
- Around line 188-201: The Trivy and Grype steps reference a non-existent tag
${{ needs.version.outputs.app_version }}; update both the image-ref and image
fields to use the same build/job output the backend scans use (the actual image
tag output from the image-build job, e.g. replace ${{
needs.version.outputs.app_version }} with the build job's image tag output such
as ${{ needs.build.outputs.image_tag }} or whatever output name the backend scan
uses) so the scans point at the real image produced by the workflow.
- Around line 94-107: The Trivy and Grype steps currently reference the tag
variable app_version which may not exist on main branch pushes; update both the
"Trivy scan" and "Grype scan" steps to reference the image produced by the
build/metadata steps instead of app_version — e.g. use the
docker/metadata-action output (steps.meta.outputs.tags) to pick the first tag
(split the CSV/JSON and use the first element) or reference the built image by
digest/output from the build step (e.g. steps.build-image.outputs.digest or the
build step’s image output) and substitute that expression for
ghcr.io/aureliolo/ai-company-backend:${{ needs.version.outputs.app_version }} in
both image-ref and image fields.
In `@docker/web/Dockerfile`:
- Around line 21-22: The current HEALTHCHECK only probes "/", which verifies
nginx but not the proxied backend; update the Dockerfile HEALTHCHECK to query
the proxied backend health endpoint ("/api/v1/health") and fail unless it
returns a 200/healthy response so the container health reflects the backend
contract used by web/app.js and docker/backend/Dockerfile; modify the
HEALTHCHECK command (the existing HEALTHCHECK line) to perform an HTTP GET
against "http://localhost:8080/api/v1/health" and treat non-2xx responses or
timeouts as unhealthy.
In `@tests/unit/api/test_middleware.py`:
- Around line 62-103: The three tests
test_unrelated_docs_prefix_gets_strict_csp,
test_docsearch_prefix_gets_strict_csp, and test_docs_subpath_gets_relaxed_csp
all repeat the same setup/assertion; refactor them to a single parametrized test
using pytest.mark.parametrize that iterates over (path, expected_csp) pairs,
call CSPMiddleware(_fake_app) once per case, use the same capture_send and await
middleware(_make_scope(path), None, capture_send), then assert
headers[b"content-security-policy"] == expected_csp.encode(); reference
CSPMiddleware, _make_scope, _API_CSP and _DOCS_CSP when building the parameter
list.
In `@web/app.js`:
- Around line 11-18: The then-handler currently sets el.className = "status
status-connected" for any 200 response; change it to honor the returned health
status by checking the payload (use data.data && data.data.status or the local
variable s) and only set status-connected when s === "healthy" (otherwise set
status-disconnected). Also update text.textContent to include the returned
status (e.g., show the version and the actual s or "unhealthy") so the UI
matches the backend's health logic referenced by the Dockerfile; adjust the
.catch behavior to remain as the fallback for network errors.
In `@web/index.html`:
- Around line 13-16: The status container with id="status" (and child
id="status-text", class "status-checking") must be exposed as a live region so
assistive tech is notified when backend state changes; update the element to
include appropriate ARIA live-region semantics (e.g., add role="status" or
aria-live="polite" and aria-atomic="true") on the div#status so screen readers
announce changes to `#status-text` when you update it.
In `@web/nginx.conf`:
- Around line 29-36: Add explicit proxy timeouts to the API proxy block
(location /api/) similar to the WebSocket block: set proxy_connect_timeout,
proxy_send_timeout and proxy_read_timeout (e.g., 30s/30s/60s or adjust to
desired SLAs) and optionally proxy_buffering off if streaming is expected;
update the location /api/ configuration to include these directives so that the
API proxy uses explicit timeouts instead of nginx defaults.
In `@web/style.css`:
- Around line 21-23: Add the standard background-clip property alongside the
vendor-prefixed one so browsers that support the unprefixed spec can apply the
text clipping; update the same rule that currently has "-webkit-background-clip:
text" (in the selector containing the linear-gradient background and
-webkit-text-fill-color) to also include "background-clip: text" immediately
before or after the vendor-prefixed declaration.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 639d7f1e-ed84-4d34-93d6-0c4a67ef15c5
📒 Files selected for processing (15)
.github/workflows/ci.yml.github/workflows/docker.ymlDESIGN_SPEC.mdREADME.mddocker/backend/Dockerfiledocker/compose.ymldocker/web/Dockerfiledocs/getting_started.mdsrc/ai_company/api/app.pysrc/ai_company/api/middleware.pytests/unit/api/test_middleware.pyweb/app.jsweb/index.htmlweb/nginx.confweb/style.css
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Greptile Review
🧰 Additional context used
📓 Path-based instructions (4)
**/*.py
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.py: Do not usefrom __future__ import annotations— Python 3.14 has PEP 649 native lazy annotations
Useexcept A, B:syntax (no parentheses) for PEP 758 except syntax — ruff enforces this on Python 3.14
Include type hints on all public functions; use mypy strict mode
Use Google-style docstrings on all public classes and functions; enforce via ruff D rules
Create new objects and never mutate existing ones; for non-Pydantic internal collections (registries, BaseTool), use copy.deepcopy() at construction and MappingProxyType wrapping for read-only enforcement
For dict/list fields in frozen Pydantic models, rely on frozen=True for field reassignment prevention and copy.deepcopy() at system boundaries (tool execution, LLM provider serialization, inter-agent delegation, persistence serialization)
Use frozen Pydantic models for config/identity; use separate mutable-via-copy models with model_copy(update=...) for runtime state that evolves (e.g. agent execution state, task progress); never mix static config fields with mutable runtime fields in one model
Use Pydantic v2 (BaseModel, model_validator, computed_field, ConfigDict); use@computed_fieldfor derived values instead of storing redundant fields; use NotBlankStr from core.types for all identifier/name fields (including optional and tuple variants) instead of manual whitespace validators
Prefer asyncio.TaskGroup for fan-out/fan-in parallel operations in new code (e.g. multiple tool invocations, parallel agent calls); prefer structured concurrency over bare create_task
Maintain 88-character line length; enforce via ruff
Keep functions under 50 lines and files under 800 lines
Handle errors explicitly; never silently swallow exceptions
Validate at system boundaries (user input, external APIs, config files)
Files:
tests/unit/api/test_middleware.pysrc/ai_company/api/app.pysrc/ai_company/api/middleware.py
tests/**/*.py
📄 CodeRabbit inference engine (CLAUDE.md)
tests/**/*.py: Use pytest markers@pytest.mark.unit,@pytest.mark.integration,@pytest.mark.e2e,@pytest.mark.slowfor test categorization
Maintain minimum 80% test coverage; enforce in CI
Use asyncio_mode = 'auto' for async tests — no manual@pytest.mark.asyncioneeded
Set 30-second timeout per test
Prefer@pytest.mark.parametrizefor testing similar cases in test files
Files:
tests/unit/api/test_middleware.py
{src,tests}/**/*.{py,yaml,yml}
📄 CodeRabbit inference engine (CLAUDE.md)
Never use real vendor names (Anthropic, OpenAI, Claude, GPT, etc.) in project-owned code, docstrings, comments, tests, or config examples; use generic names: example-provider, example-large-001, example-medium-001, example-small-001, large/medium/small as aliases. Vendor names may only appear in: (1) DESIGN_SPEC.md provider list, (2) .claude/ skill/agent files, (3) third-party import paths/module names. Tests must use test-provider, test-small-001, etc.
Files:
tests/unit/api/test_middleware.pysrc/ai_company/api/app.pysrc/ai_company/api/middleware.py
src/**/*.py
📄 CodeRabbit inference engine (CLAUDE.md)
src/**/*.py: Every module with business logic must include: from ai_company.observability import get_logger then logger = get_logger(name); never use import logging / logging.getLogger() / print() in application code; always use variable name logger (not _logger, not log)
Always use event name constants from domain-specific modules under ai_company.observability.events (e.g. PROVIDER_CALL_START from events.provider, BUDGET_RECORD_ADDED from events.budget); import directly: from ai_company.observability.events. import EVENT_CONSTANT
Use structured logging via logger.info(EVENT, key=value) syntax; never use logger.info('msg %s', val) formatting
All error paths must log at WARNING or ERROR with context before raising
All state transitions must log at INFO level
DEBUG level logging is for object creation, internal flow, and entry/exit of key functions; pure data models, enums, and re-exports do not need logging
Files:
src/ai_company/api/app.pysrc/ai_company/api/middleware.py
🧠 Learnings (4)
📚 Learning: 2026-03-10T13:31:23.930Z
Learnt from: CR
Repo: Aureliolo/ai-company PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-10T13:31:23.930Z
Learning: Always read DESIGN_SPEC.md before implementing any feature or planning any issue; use the design spec as the starting point for architecture, data models, and behavior
Applied to files:
docs/getting_started.mdDESIGN_SPEC.md
📚 Learning: 2026-03-10T13:31:23.930Z
Learnt from: CR
Repo: Aureliolo/ai-company PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-10T13:31:23.930Z
Learning: When a spec section is referenced, read that section verbatim before coding; when approved deviations occur, update DESIGN_SPEC.md to reflect the new reality
Applied to files:
docs/getting_started.md
📚 Learning: 2026-03-10T13:31:23.930Z
Learnt from: CR
Repo: Aureliolo/ai-company PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-10T13:31:23.930Z
Learning: Applies to tests/**/*.py : Maintain minimum 80% test coverage; enforce in CI
Applied to files:
.github/workflows/ci.yml
📚 Learning: 2026-03-10T13:31:23.930Z
Learnt from: CR
Repo: Aureliolo/ai-company PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-10T13:31:23.930Z
Learning: Use branch naming format <type>/<slug> derived from main; pre-commit hooks enforce: trailing-whitespace, end-of-file-fixer, check-yaml, check-toml, check-json, check-merge-conflict, check-added-large-files, no-commit-to-branch (main), ruff check+format, gitleaks
Applied to files:
.github/workflows/docker.yml
🧬 Code graph analysis (2)
tests/unit/api/test_middleware.py (1)
src/ai_company/api/middleware.py (1)
CSPMiddleware(39-78)
src/ai_company/api/app.py (1)
src/ai_company/api/middleware.py (2)
CSPMiddleware(39-78)RequestLoggingMiddleware(81-141)
🪛 Checkov (3.2.334)
docker/web/Dockerfile
[low] 1-22: Ensure that a user for the container has been created
(CKV_DOCKER_3)
🪛 Hadolint (2.14.0)
docker/backend/Dockerfile
[warning] 49-49: Last USER should not be root
(DL3002)
🪛 LanguageTool
README.md
[typographical] ~100-~100: To join two clauses or introduce examples, consider using an em dash.
Context: ...etting Started](docs/getting_started.md) - Setup and installation guide - [Contribu...
(DASH_RULE)
[uncategorized] ~101-~101: The official name of this software platform is spelled with a capital “H”.
Context: ...p and installation guide - Contributing - Branch, commit, and ...
(GITHUB)
[typographical] ~101-~101: To join two clauses or introduce examples, consider using an em dash.
Context: ... Contributing - Branch, commit, and PR workflow - [CLAUD...
(DASH_RULE)
docs/getting_started.md
[uncategorized] ~153-~153: The official name of this software platform is spelled with a capital “H”.
Context: ...ette. ## Next Steps - CONTRIBUTING.md — branch, commit, and ...
(GITHUB)
🔇 Additional comments (15)
docs/getting_started.md (3)
123-124: LGTM! Docker and web directories correctly documented.These additions accurately reflect the containerization deliverables: the
docker/directory with Dockerfiles and Compose configuration, and theweb/directory with the nginx-based UI scaffold. Both are explicitly mentioned in the PR objectives.
153-153: LGTM! Path correctly updated after .github/ reorganization.The link update to
../.github/CONTRIBUTING.mdis explicitly mentioned in the PR objectives as part of fixing documentation links after the .github/ directory restructuring.
103-103: The documentation accurately reflects the actual codebase. Thehr/,observability/, andpersistence/directories exist in the project, Litestar is the active framework (with no FastAPI dependencies), and the CLI structure is in place. These updates are not scope creep or documentation drift—they are correct descriptions of the real project structure..github/workflows/ci.yml (4)
76-77: Clear documentation of Codecov best-effort behavior.The comments accurately explain why
fail_ci_if_error: falseis set and that coverage enforcement is handled by--cov-fail-under. This prevents CI failures due to Codecov outages while still enforcing coverage thresholds locally via pytest.Also applies to: 78-84
68-74: Coverage enforcement satisfies the 80% threshold requirement.The
--cov-fail-under=80flag ensures the CI fails if coverage drops below 80%, which aligns with project requirements. Based on learnings: "Maintain minimum 80% test coverage; enforce in CI".
23-23: SHA pinning foractions/checkoutis a good supply chain security practice. Pinning GitHub Actions to full-length commit SHAs prevents supply chain attacks via compromised tags. The SHAde0fac2e4500dabe0009e67214ff5f5447ce83ddcorrectly corresponds to thev6release. The consistent pinning across all jobs is correct.
88-88: Theactions/upload-artifactSHA is correct for v7. The pinned SHAbbbca2ddaa5d8feaa63e36b76fdaad77386f024fmatches the v7 release.README.md (2)
57-58: LGTM!Tech stack additions clearly document the Docker and nginx components with their security characteristics (CIS-hardened, non-root, unprivileged).
79-96: LGTM!Docker Compose section is well-documented with clear instructions. The port configurability note and default port clarification address previous review feedback.
web/nginx.conf (1)
14-22: LGTM!Security headers are well-configured: CSP without
unsafe-inline,server_tokens off, and the helpful comment aboutadd_headerinheritance behavior. The previous review concern aboutunsafe-inlinehas been addressed.docker/compose.yml (3)
1-24: LGTM!Backend service configuration is solid: CIS-hardened security options, configurable port mapping, proper volume mount for persistent data, and tmpfs for
/tmpto support read-only rootfs.
26-47: LGTM!Web service configuration properly mirrors backend hardening, with appropriate tmpfs mounts for nginx's runtime directories (
/var/cache/nginx,/var/run).
32-34: Backend and web services have HEALTHCHECK instructions defined.The web service's
depends_onwithcondition: service_healthycorrectly requires the backend to have a healthcheck. Both the backend Dockerfile (line 100) and web Dockerfile (line 21) define the necessaryHEALTHCHECKinstructions, so the dependency configuration is properly supported..github/workflows/docker.yml (2)
29-44: LGTM!Version extraction is well-implemented: uses
tomllibwith proper file handling (withstatement), clear error messages to stderr, and exits with non-zero code on failure.
130-138: LGTM!Good defensive check for empty digest before signing. This prevents silent failures where cosign would sign an invalid reference.
| HEALTHCHECK --interval=10s --timeout=3s --retries=3 --start-period=5s \ | ||
| CMD ["wget", "--spider", "--quiet", "http://localhost:8080/"] |
There was a problem hiding this comment.
Validate the proxied backend health, not just the static page.
This only proves nginx can serve /. A broken /api reverse proxy or unhealthy backend still leaves the container healthy, even though web/app.js depends on /api/v1/health and docker/backend/Dockerfile (Lines 100-101) already treats status == healthy as the health contract.
🩺 Suggested healthcheck
-HEALTHCHECK --interval=10s --timeout=3s --retries=3 --start-period=5s \
- CMD ["wget", "--spider", "--quiet", "http://localhost:8080/"]
+HEALTHCHECK --interval=10s --timeout=3s --retries=3 --start-period=5s \
+ CMD-SHELL wget -qO- http://localhost:8080/api/v1/health | grep -Eq '"status"[[:space:]]*:[[:space:]]*"healthy"'🧰 Tools
🪛 Checkov (3.2.334)
[low] 1-22: Ensure that a user for the container has been created
(CKV_DOCKER_3)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@docker/web/Dockerfile` around lines 21 - 22, The current HEALTHCHECK only
probes "/", which verifies nginx but not the proxied backend; update the
Dockerfile HEALTHCHECK to query the proxied backend health endpoint
("/api/v1/health") and fail unless it returns a 200/healthy response so the
container health reflects the backend contract used by web/app.js and
docker/backend/Dockerfile; modify the HEALTHCHECK command (the existing
HEALTHCHECK line) to perform an HTTP GET against
"http://localhost:8080/api/v1/health" and treat non-2xx responses or timeouts as
unhealthy.
…y timeouts - Use SHA tag (always exists) for Trivy/Grype scan image-ref instead of app_version which is only present on v* tag pushes (#29, #30) - Check data.status === "healthy" before showing green badge in web UI (#31) - Add aria-live="polite" to status div for screen reader accessibility (#32) - Parametrize direct-ASGI CSP boundary tests (#33) - Add explicit proxy_connect/send/read_timeout to nginx API location (#34) - Add standard background-clip: text alongside -webkit- prefix (#35)
| location /api/ { | ||
| proxy_pass http://backend:8000; | ||
| proxy_connect_timeout 5s; | ||
| proxy_send_timeout 30s; | ||
| proxy_read_timeout 30s; | ||
| proxy_set_header Host $host; | ||
| proxy_set_header X-Real-IP $remote_addr; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_set_header X-Forwarded-Proto $scheme; | ||
| } |
There was a problem hiding this comment.
Duplicate CSP headers on proxied responses
The add_header Content-Security-Policy directive in the server block (line 22) applies to all location blocks — including /api/ and /ws — because neither of those location blocks defines its own add_header. At the same time, the backend's CSPMiddleware injects its own Content-Security-Policy header for every HTTP response.
This means every proxied API response includes two Content-Security-Policy headers: nginx's strict server-level one (default-src 'self'; script-src 'self'; ...) and the backend middleware's (default-src 'self'; script-src 'self'). Per the CSP spec, when multiple headers are present, the browser enforces the intersection — effectively the more restrictive policy. While both policies agree for API (JSON) responses, this is a subtle misconfiguration that could break future endpoints needing different CSP treatment and creates confusing redundancy.
Add proxy_hide_header Content-Security-Policy; to both proxied location blocks to suppress the upstream header so only nginx's server-level CSP is returned:
| location /api/ { | |
| proxy_pass http://backend:8000; | |
| proxy_connect_timeout 5s; | |
| proxy_send_timeout 30s; | |
| proxy_read_timeout 30s; | |
| proxy_set_header Host $host; | |
| proxy_set_header X-Real-IP $remote_addr; | |
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | |
| proxy_set_header X-Forwarded-Proto $scheme; | |
| } | |
| # API proxy to backend service | |
| location /api/ { | |
| proxy_pass http://backend:8000; | |
| proxy_hide_header Content-Security-Policy; | |
| proxy_connect_timeout 5s; | |
| proxy_send_timeout 30s; | |
| proxy_read_timeout 30s; | |
| proxy_set_header Host $host; | |
| proxy_set_header X-Real-IP $remote_addr; | |
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | |
| proxy_set_header X-Forwarded-Proto $scheme; | |
| } |
Prompt To Fix With AI
This is a comment left during a code review.
Path: web/nginx.conf
Line: 30-39
Comment:
**Duplicate CSP headers on proxied responses**
The `add_header Content-Security-Policy` directive in the `server` block (line 22) applies to **all** location blocks — including `/api/` and `/ws` — because neither of those location blocks defines its own `add_header`. At the same time, the backend's `CSPMiddleware` injects its own `Content-Security-Policy` header for every HTTP response.
This means every proxied API response includes **two** `Content-Security-Policy` headers: nginx's strict server-level one (`default-src 'self'; script-src 'self'; ...`) and the backend middleware's (`default-src 'self'; script-src 'self'`). Per the CSP spec, when multiple headers are present, the browser enforces the intersection — effectively the more restrictive policy. While both policies agree for API (JSON) responses, this is a subtle misconfiguration that could break future endpoints needing different CSP treatment and creates confusing redundancy.
Add `proxy_hide_header Content-Security-Policy;` to both proxied location blocks to suppress the upstream header so only nginx's server-level CSP is returned:
```suggestion
# API proxy to backend service
location /api/ {
proxy_pass http://backend:8000;
proxy_hide_header Content-Security-Policy;
proxy_connect_timeout 5s;
proxy_send_timeout 30s;
proxy_read_timeout 30s;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
```
How can I resolve this? If you propose a fix, please make it concise.| location /ws { | ||
| proxy_pass http://backend:8000; | ||
| proxy_http_version 1.1; | ||
| proxy_set_header Upgrade $http_upgrade; | ||
| proxy_set_header Connection "upgrade"; | ||
| proxy_set_header Host $host; | ||
| proxy_set_header X-Real-IP $remote_addr; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_set_header X-Forwarded-Proto $scheme; | ||
| proxy_read_timeout 86400s; | ||
| } |
There was a problem hiding this comment.
WebSocket proxy missing proxy_buffering off
For WebSocket connections, nginx should disable response buffering to ensure frames are forwarded immediately without being held in nginx's buffer pool. Without proxy_buffering off;, nginx may buffer partial WebSocket responses before flushing them to the client, adding latency and potentially stalling the stream.
| location /ws { | |
| proxy_pass http://backend:8000; | |
| proxy_http_version 1.1; | |
| proxy_set_header Upgrade $http_upgrade; | |
| proxy_set_header Connection "upgrade"; | |
| proxy_set_header Host $host; | |
| proxy_set_header X-Real-IP $remote_addr; | |
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | |
| proxy_set_header X-Forwarded-Proto $scheme; | |
| proxy_read_timeout 86400s; | |
| } | |
| # WebSocket proxy | |
| location /ws { | |
| proxy_pass http://backend:8000; | |
| proxy_http_version 1.1; | |
| proxy_buffering off; | |
| proxy_set_header Upgrade $http_upgrade; | |
| proxy_set_header Connection "upgrade"; | |
| proxy_set_header Host $host; | |
| proxy_set_header X-Real-IP $remote_addr; | |
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | |
| proxy_set_header X-Forwarded-Proto $scheme; | |
| proxy_read_timeout 86400s; | |
| } |
Prompt To Fix With AI
This is a comment left during a code review.
Path: web/nginx.conf
Line: 42-52
Comment:
**WebSocket proxy missing `proxy_buffering off`**
For WebSocket connections, nginx should disable response buffering to ensure frames are forwarded immediately without being held in nginx's buffer pool. Without `proxy_buffering off;`, nginx may buffer partial WebSocket responses before flushing them to the client, adding latency and potentially stalling the stream.
```suggestion
# WebSocket proxy
location /ws {
proxy_pass http://backend:8000;
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 86400s;
}
```
How can I resolve this? If you propose a fix, please make it concise.| tmpfs: | ||
| - /tmp:noexec,nosuid,size=16m | ||
| - /var/cache/nginx:size=32m | ||
| - /var/run:size=1m | ||
| restart: unless-stopped |
There was a problem hiding this comment.
Inconsistent noexec,nosuid flags on web tmpfs mounts
The web service's /tmp tmpfs correctly carries noexec,nosuid, but /var/cache/nginx and /var/run do not. For consistency with the stated CIS hardening posture, these paths should carry the same mount flags — nginx doesn't need to execute files from its cache, and /var/run (used only for PID files) certainly doesn't:
| tmpfs: | |
| - /tmp:noexec,nosuid,size=16m | |
| - /var/cache/nginx:size=32m | |
| - /var/run:size=1m | |
| restart: unless-stopped | |
| tmpfs: | |
| - /tmp:noexec,nosuid,size=16m | |
| - /var/cache/nginx:noexec,nosuid,size=32m | |
| - /var/run:noexec,nosuid,size=1m |
Prompt To Fix With AI
This is a comment left during a code review.
Path: docker/compose.yml
Line: 40-44
Comment:
**Inconsistent `noexec,nosuid` flags on `web` tmpfs mounts**
The `web` service's `/tmp` tmpfs correctly carries `noexec,nosuid`, but `/var/cache/nginx` and `/var/run` do not. For consistency with the stated CIS hardening posture, these paths should carry the same mount flags — nginx doesn't need to execute files from its cache, and `/var/run` (used only for PID files) certainly doesn't:
```suggestion
tmpfs:
- /tmp:noexec,nosuid,size=16m
- /var/cache/nginx:noexec,nosuid,size=32m
- /var/run:noexec,nosuid,size=1m
```
How can I resolve this? If you propose a fix, please make it concise.There was a problem hiding this comment.
Pull request overview
Copilot reviewed 23 out of 26 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' data:; font-src 'self'" always; | ||
|
|
||
| # SPA routing — try static files, fall back to index.html | ||
| location / { |
There was a problem hiding this comment.
The server-level Content-Security-Policy header will also be added to proxied /api/ and /ws responses, while the backend now injects its own CSP header via CSPMiddleware. This results in duplicate CSP headers (and potentially conflicting policies) when accessing the API through the web container, which can lead to unexpectedly restrictive effective CSP behavior in user agents and makes headers harder to reason about. Consider scoping the CSP add_header to location / (static content only) and/or hiding/passing through upstream CSP on /api/ + /ws (e.g., proxy_hide_header Content-Security-Policy) so there is a single authoritative CSP per response.
| add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' data:; font-src 'self'" always; | |
| # SPA routing — try static files, fall back to index.html | |
| location / { | |
| # SPA routing — try static files, fall back to index.html | |
| location / { | |
| # Security headers for static content, including CSP. | |
| # Note: add_header in this location overrides server-level add_header, | |
| # so we repeat all headers here. | |
| add_header X-Content-Type-Options "nosniff" always; | |
| add_header X-Frame-Options "DENY" always; | |
| add_header Referrer-Policy "strict-origin-when-cross-origin" always; | |
| add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always; | |
| add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' data:; font-src 'self'" always; |
| - name: Extract metadata | ||
| id: meta | ||
| uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 | ||
| with: | ||
| images: ghcr.io/aureliolo/ai-company-backend | ||
| tags: | | ||
| type=raw,value=${{ needs.version.outputs.app_version }},enable=${{ startsWith(github.ref, 'refs/tags/v') }} | ||
| type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }} | ||
| type=semver,pattern={{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') }} | ||
| type=sha,prefix=sha- | ||
|
|
There was a problem hiding this comment.
The workflow tags images using both the version extracted from pyproject.toml and semver tags derived from the git ref. If a v* tag is pushed while pyproject.toml still contains a different version, the image will be published under a misleading raw version tag as well as the semver tag from the ref. To prevent mismatched releases, either validate that the git tag matches the extracted version (and fail otherwise) or choose a single source of truth for version tagging (pyproject-only or ref-only).
🤖 I have created a release *beep* *boop* --- ## [0.1.1](ai-company-v0.1.0...ai-company-v0.1.1) (2026-03-10) ### Features * add autonomy levels and approval timeout policies ([#42](#42), [#126](#126)) ([#197](#197)) ([eecc25a](eecc25a)) * add CFO cost optimization service with anomaly detection, reports, and approval decisions ([#186](#186)) ([a7fa00b](a7fa00b)) * add code quality toolchain (ruff, mypy, pre-commit, dependabot) ([#63](#63)) ([36681a8](36681a8)) * add configurable cost tiers and subscription/quota-aware tracking ([#67](#67)) ([#185](#185)) ([9baedfa](9baedfa)) * add container packaging, Docker Compose, and CI pipeline ([#269](#269)) ([435bdfe](435bdfe)), closes [#267](#267) * add coordination error taxonomy classification pipeline ([#146](#146)) ([#181](#181)) ([70c7480](70c7480)) * add cost-optimized, hierarchical, and auction assignment strategies ([#175](#175)) ([ce924fa](ce924fa)), closes [#173](#173) * add design specification, license, and project setup ([8669a09](8669a09)) * add env var substitution and config file auto-discovery ([#77](#77)) ([7f53832](7f53832)) * add FastestStrategy routing + vendor-agnostic cleanup ([#140](#140)) ([09619cb](09619cb)), closes [#139](#139) * add HR engine and performance tracking ([#45](#45), [#47](#47)) ([#193](#193)) ([2d091ea](2d091ea)) * add issue auto-search and resolution verification to PR review skill ([#119](#119)) ([deecc39](deecc39)) * add memory retrieval, ranking, and context injection pipeline ([#41](#41)) ([873b0aa](873b0aa)) * add pluggable MemoryBackend protocol with models, config, and events ([#180](#180)) ([46cfdd4](46cfdd4)) * add pluggable MemoryBackend protocol with models, config, and events ([#32](#32)) ([46cfdd4](46cfdd4)) * add pluggable PersistenceBackend protocol with SQLite implementation ([#36](#36)) ([f753779](f753779)) * add progressive trust and promotion/demotion subsystems ([#43](#43), [#49](#49)) ([3a87c08](3a87c08)) * add retry handler, rate limiter, and provider resilience ([#100](#100)) ([b890545](b890545)) * add SecOps security agent with rule engine, audit log, and ToolInvoker integration ([#40](#40)) ([83b7b6c](83b7b6c)) * add shared org memory and memory consolidation/archival ([#125](#125), [#48](#48)) ([4a0832b](4a0832b)) * design unified provider interface ([#86](#86)) ([3e23d64](3e23d64)) * expand template presets, rosters, and add inheritance ([#80](#80), [#81](#81), [#84](#84)) ([15a9134](15a9134)) * implement agent runtime state vs immutable config split ([#115](#115)) ([4cb1ca5](4cb1ca5)) * implement AgentEngine core orchestrator ([#11](#11)) ([#143](#143)) ([f2eb73a](f2eb73a)) * implement basic tool system (registry, invocation, results) ([#15](#15)) ([c51068b](c51068b)) * implement built-in file system tools ([#18](#18)) ([325ef98](325ef98)) * implement communication foundation — message bus, dispatcher, and messenger ([#157](#157)) ([8e71bfd](8e71bfd)) * implement company template system with 7 built-in presets ([#85](#85)) ([cbf1496](cbf1496)) * implement conflict resolution protocol ([#122](#122)) ([#166](#166)) ([e03f9f2](e03f9f2)) * implement core entity and role system models ([#69](#69)) ([acf9801](acf9801)) * implement crash recovery with fail-and-reassign strategy ([#149](#149)) ([e6e91ed](e6e91ed)) * implement engine extensions — Plan-and-Execute loop and call categorization ([#134](#134), [#135](#135)) ([#159](#159)) ([9b2699f](9b2699f)) * implement enterprise logging system with structlog ([#73](#73)) ([2f787e5](2f787e5)) * implement graceful shutdown with cooperative timeout strategy ([#130](#130)) ([6592515](6592515)) * implement hierarchical delegation and loop prevention ([#12](#12), [#17](#17)) ([6be60b6](6be60b6)) * implement LiteLLM driver and provider registry ([#88](#88)) ([ae3f18b](ae3f18b)), closes [#4](#4) * implement LLM decomposition strategy and workspace isolation ([#174](#174)) ([aa0eefe](aa0eefe)) * implement meeting protocol system ([#123](#123)) ([ee7caca](ee7caca)) * implement message and communication domain models ([#74](#74)) ([560a5d2](560a5d2)) * implement model routing engine ([#99](#99)) ([d3c250b](d3c250b)) * implement parallel agent execution ([#22](#22)) ([#161](#161)) ([65940b3](65940b3)) * implement per-call cost tracking service ([#7](#7)) ([#102](#102)) ([c4f1f1c](c4f1f1c)) * implement personality injection and system prompt construction ([#105](#105)) ([934dd85](934dd85)) * implement single-task execution lifecycle ([#21](#21)) ([#144](#144)) ([c7e64e4](c7e64e4)) * implement subprocess sandbox for tool execution isolation ([#131](#131)) ([#153](#153)) ([3c8394e](3c8394e)) * implement task assignment subsystem with pluggable strategies ([#172](#172)) ([c7f1b26](c7f1b26)), closes [#26](#26) [#30](#30) * implement task decomposition and routing engine ([#14](#14)) ([9c7fb52](9c7fb52)) * implement Task, Project, Artifact, Budget, and Cost domain models ([#71](#71)) ([81eabf1](81eabf1)) * implement tool permission checking ([#16](#16)) ([833c190](833c190)) * implement YAML config loader with Pydantic validation ([#59](#59)) ([ff3a2ba](ff3a2ba)) * implement YAML config loader with Pydantic validation ([#75](#75)) ([ff3a2ba](ff3a2ba)) * initialize project with uv, hatchling, and src layout ([39005f9](39005f9)) * initialize project with uv, hatchling, and src layout ([#62](#62)) ([39005f9](39005f9)) * Litestar REST API, WebSocket feed, and approval queue (M6) ([#189](#189)) ([29fcd08](29fcd08)) * make TokenUsage.total_tokens a computed field ([#118](#118)) ([c0bab18](c0bab18)), closes [#109](#109) * parallel tool execution in ToolInvoker.invoke_all ([#137](#137)) ([58517ee](58517ee)) * testing framework, CI pipeline, and M0 gap fixes ([#64](#64)) ([f581749](f581749)) * wire all modules into observability system ([#97](#97)) ([f7a0617](f7a0617)) ### Bug Fixes * address Greptile post-merge review findings from PRs [#170](https://github.com/Aureliolo/ai-company/issues/170)-[#175](https://github.com/Aureliolo/ai-company/issues/175) ([#176](#176)) ([c5ca929](c5ca929)) * address post-merge review feedback from PRs [#164](https://github.com/Aureliolo/ai-company/issues/164)-[#167](https://github.com/Aureliolo/ai-company/issues/167) ([#170](#170)) ([3bf897a](3bf897a)), closes [#169](#169) * enforce strict mypy on test files ([#89](#89)) ([aeeff8c](aeeff8c)) * harden Docker sandbox, MCP bridge, and code runner ([#50](#50), [#53](#53)) ([d5e1b6e](d5e1b6e)) * harden git tools security + code quality improvements ([#150](#150)) ([000a325](000a325)) * harden subprocess cleanup, env filtering, and shutdown resilience ([#155](#155)) ([d1fe1fb](d1fe1fb)) * incorporate post-merge feedback + pre-PR review fixes ([#164](#164)) ([c02832a](c02832a)) * pre-PR review fixes for post-merge findings ([#183](#183)) ([26b3108](26b3108)) * strengthen immutability for BaseTool schema and ToolInvoker boundaries ([#117](#117)) ([7e5e861](7e5e861)) ### Performance * harden non-inferable principle implementation ([#195](#195)) ([02b5f4e](02b5f4e)), closes [#188](#188) ### Refactoring * adopt NotBlankStr across all models ([#108](#108)) ([#120](#120)) ([ef89b90](ef89b90)) * extract _SpendingTotals base class from spending summary models ([#111](#111)) ([2f39c1b](2f39c1b)) * harden BudgetEnforcer with error handling, validation extraction, and review fixes ([#182](#182)) ([c107bf9](c107bf9)) * harden personality profiles, department validation, and template rendering ([#158](#158)) ([10b2299](10b2299)) * pre-PR review improvements for ExecutionLoop + ReAct loop ([#124](#124)) ([8dfb3c0](8dfb3c0)) * split events.py into per-domain event modules ([#136](#136)) ([e9cba89](e9cba89)) ### Documentation * add ADR-001 memory layer evaluation and selection ([#178](#178)) ([db3026f](db3026f)), closes [#39](#39) * add agent scaling research findings to DESIGN_SPEC ([#145](#145)) ([57e487b](57e487b)) * add CLAUDE.md, contributing guide, and dev documentation ([#65](#65)) ([55c1025](55c1025)), closes [#54](#54) * add crash recovery, sandboxing, analytics, and testing decisions ([#127](#127)) ([5c11595](5c11595)) * address external review feedback with MVP scope and new protocols ([#128](#128)) ([3b30b9a](3b30b9a)) * expand design spec with pluggable strategy protocols ([#121](#121)) ([6832db6](6832db6)) * finalize 23 design decisions (ADR-002) ([#190](#190)) ([8c39742](8c39742)) * update project docs for M2.5 conventions and add docs-consistency review agent ([#114](#114)) ([99766ee](99766ee)) ### Tests * add e2e single agent integration tests ([#24](#24)) ([#156](#156)) ([f566fb4](f566fb4)) * add provider adapter integration tests ([#90](#90)) ([40a61f4](40a61f4)) ### CI/CD * add Release Please for automated versioning and GitHub Releases ([#278](#278)) ([a488758](a488758)) * bump actions/checkout from 4 to 6 ([#95](#95)) ([1897247](1897247)) * bump actions/upload-artifact from 4 to 7 ([#94](#94)) ([27b1517](27b1517)) * harden CI/CD pipeline ([#92](#92)) ([ce4693c](ce4693c)) * split vulnerability scans into critical-fail and high-warn tiers ([#277](#277)) ([aba48af](aba48af)) ### Maintenance * add /worktree skill for parallel worktree management ([#171](#171)) ([951e337](951e337)) * add design spec context loading to research-link skill ([8ef9685](8ef9685)) * add post-merge-cleanup skill ([#70](#70)) ([f913705](f913705)) * add pre-pr-review skill and update CLAUDE.md ([#103](#103)) ([92e9023](92e9023)) * add research-link skill and rename skill files to SKILL.md ([#101](#101)) ([651c577](651c577)) * bump aiosqlite from 0.21.0 to 0.22.1 ([#191](#191)) ([3274a86](3274a86)) * bump pyyaml from 6.0.2 to 6.0.3 in the minor-and-patch group ([#96](#96)) ([0338d0c](0338d0c)) * bump ruff from 0.15.4 to 0.15.5 ([a49ee46](a49ee46)) * fix M0 audit items ([#66](#66)) ([c7724b5](c7724b5)) * pin setup-uv action to full SHA ([#281](#281)) ([4448002](4448002)) * post-audit cleanup — PEP 758, loggers, bug fixes, refactoring, tests, hookify rules ([#148](#148)) ([c57a6a9](c57a6a9)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
🤖 I have created a release *beep* *boop* --- ## [0.1.0](v0.0.0...v0.1.0) (2026-03-11) ### Features * add autonomy levels and approval timeout policies ([#42](#42), [#126](#126)) ([#197](#197)) ([eecc25a](eecc25a)) * add CFO cost optimization service with anomaly detection, reports, and approval decisions ([#186](#186)) ([a7fa00b](a7fa00b)) * add code quality toolchain (ruff, mypy, pre-commit, dependabot) ([#63](#63)) ([36681a8](36681a8)) * add configurable cost tiers and subscription/quota-aware tracking ([#67](#67)) ([#185](#185)) ([9baedfa](9baedfa)) * add container packaging, Docker Compose, and CI pipeline ([#269](#269)) ([435bdfe](435bdfe)), closes [#267](#267) * add coordination error taxonomy classification pipeline ([#146](#146)) ([#181](#181)) ([70c7480](70c7480)) * add cost-optimized, hierarchical, and auction assignment strategies ([#175](#175)) ([ce924fa](ce924fa)), closes [#173](#173) * add design specification, license, and project setup ([8669a09](8669a09)) * add env var substitution and config file auto-discovery ([#77](#77)) ([7f53832](7f53832)) * add FastestStrategy routing + vendor-agnostic cleanup ([#140](#140)) ([09619cb](09619cb)), closes [#139](#139) * add HR engine and performance tracking ([#45](#45), [#47](#47)) ([#193](#193)) ([2d091ea](2d091ea)) * add issue auto-search and resolution verification to PR review skill ([#119](#119)) ([deecc39](deecc39)) * add mandatory JWT + API key authentication ([#256](#256)) ([c279cfe](c279cfe)) * add memory retrieval, ranking, and context injection pipeline ([#41](#41)) ([873b0aa](873b0aa)) * add pluggable MemoryBackend protocol with models, config, and events ([#180](#180)) ([46cfdd4](46cfdd4)) * add pluggable MemoryBackend protocol with models, config, and events ([#32](#32)) ([46cfdd4](46cfdd4)) * add pluggable output scan response policies ([#263](#263)) ([b9907e8](b9907e8)) * add pluggable PersistenceBackend protocol with SQLite implementation ([#36](#36)) ([f753779](f753779)) * add progressive trust and promotion/demotion subsystems ([#43](#43), [#49](#49)) ([3a87c08](3a87c08)) * add retry handler, rate limiter, and provider resilience ([#100](#100)) ([b890545](b890545)) * add SecOps security agent with rule engine, audit log, and ToolInvoker integration ([#40](#40)) ([83b7b6c](83b7b6c)) * add shared org memory and memory consolidation/archival ([#125](#125), [#48](#48)) ([4a0832b](4a0832b)) * design unified provider interface ([#86](#86)) ([3e23d64](3e23d64)) * expand template presets, rosters, and add inheritance ([#80](#80), [#81](#81), [#84](#84)) ([15a9134](15a9134)) * implement agent runtime state vs immutable config split ([#115](#115)) ([4cb1ca5](4cb1ca5)) * implement AgentEngine core orchestrator ([#11](#11)) ([#143](#143)) ([f2eb73a](f2eb73a)) * implement AuditRepository for security audit log persistence ([#279](#279)) ([94bc29f](94bc29f)) * implement basic tool system (registry, invocation, results) ([#15](#15)) ([c51068b](c51068b)) * implement built-in file system tools ([#18](#18)) ([325ef98](325ef98)) * implement communication foundation — message bus, dispatcher, and messenger ([#157](#157)) ([8e71bfd](8e71bfd)) * implement company template system with 7 built-in presets ([#85](#85)) ([cbf1496](cbf1496)) * implement conflict resolution protocol ([#122](#122)) ([#166](#166)) ([e03f9f2](e03f9f2)) * implement core entity and role system models ([#69](#69)) ([acf9801](acf9801)) * implement crash recovery with fail-and-reassign strategy ([#149](#149)) ([e6e91ed](e6e91ed)) * implement engine extensions — Plan-and-Execute loop and call categorization ([#134](#134), [#135](#135)) ([#159](#159)) ([9b2699f](9b2699f)) * implement enterprise logging system with structlog ([#73](#73)) ([2f787e5](2f787e5)) * implement graceful shutdown with cooperative timeout strategy ([#130](#130)) ([6592515](6592515)) * implement hierarchical delegation and loop prevention ([#12](#12), [#17](#17)) ([6be60b6](6be60b6)) * implement LiteLLM driver and provider registry ([#88](#88)) ([ae3f18b](ae3f18b)), closes [#4](#4) * implement LLM decomposition strategy and workspace isolation ([#174](#174)) ([aa0eefe](aa0eefe)) * implement meeting protocol system ([#123](#123)) ([ee7caca](ee7caca)) * implement message and communication domain models ([#74](#74)) ([560a5d2](560a5d2)) * implement model routing engine ([#99](#99)) ([d3c250b](d3c250b)) * implement parallel agent execution ([#22](#22)) ([#161](#161)) ([65940b3](65940b3)) * implement per-call cost tracking service ([#7](#7)) ([#102](#102)) ([c4f1f1c](c4f1f1c)) * implement personality injection and system prompt construction ([#105](#105)) ([934dd85](934dd85)) * implement single-task execution lifecycle ([#21](#21)) ([#144](#144)) ([c7e64e4](c7e64e4)) * implement subprocess sandbox for tool execution isolation ([#131](#131)) ([#153](#153)) ([3c8394e](3c8394e)) * implement task assignment subsystem with pluggable strategies ([#172](#172)) ([c7f1b26](c7f1b26)), closes [#26](#26) [#30](#30) * implement task decomposition and routing engine ([#14](#14)) ([9c7fb52](9c7fb52)) * implement Task, Project, Artifact, Budget, and Cost domain models ([#71](#71)) ([81eabf1](81eabf1)) * implement tool permission checking ([#16](#16)) ([833c190](833c190)) * implement YAML config loader with Pydantic validation ([#59](#59)) ([ff3a2ba](ff3a2ba)) * implement YAML config loader with Pydantic validation ([#75](#75)) ([ff3a2ba](ff3a2ba)) * initialize project with uv, hatchling, and src layout ([39005f9](39005f9)) * initialize project with uv, hatchling, and src layout ([#62](#62)) ([39005f9](39005f9)) * Litestar REST API, WebSocket feed, and approval queue (M6) ([#189](#189)) ([29fcd08](29fcd08)) * make TokenUsage.total_tokens a computed field ([#118](#118)) ([c0bab18](c0bab18)), closes [#109](#109) * parallel tool execution in ToolInvoker.invoke_all ([#137](#137)) ([58517ee](58517ee)) * testing framework, CI pipeline, and M0 gap fixes ([#64](#64)) ([f581749](f581749)) * wire all modules into observability system ([#97](#97)) ([f7a0617](f7a0617)) ### Bug Fixes * address Greptile post-merge review findings from PRs [#170](https://github.com/Aureliolo/ai-company/issues/170)-[#175](https://github.com/Aureliolo/ai-company/issues/175) ([#176](#176)) ([c5ca929](c5ca929)) * address post-merge review feedback from PRs [#164](https://github.com/Aureliolo/ai-company/issues/164)-[#167](https://github.com/Aureliolo/ai-company/issues/167) ([#170](#170)) ([3bf897a](3bf897a)), closes [#169](#169) * enforce strict mypy on test files ([#89](#89)) ([aeeff8c](aeeff8c)) * harden Docker sandbox, MCP bridge, and code runner ([#50](#50), [#53](#53)) ([d5e1b6e](d5e1b6e)) * harden git tools security + code quality improvements ([#150](#150)) ([000a325](000a325)) * harden subprocess cleanup, env filtering, and shutdown resilience ([#155](#155)) ([d1fe1fb](d1fe1fb)) * incorporate post-merge feedback + pre-PR review fixes ([#164](#164)) ([c02832a](c02832a)) * pre-PR review fixes for post-merge findings ([#183](#183)) ([26b3108](26b3108)) * resolve circular imports, bump litellm, fix release tag format ([#286](#286)) ([a6659b5](a6659b5)) * strengthen immutability for BaseTool schema and ToolInvoker boundaries ([#117](#117)) ([7e5e861](7e5e861)) ### Performance * harden non-inferable principle implementation ([#195](#195)) ([02b5f4e](02b5f4e)), closes [#188](#188) ### Refactoring * adopt NotBlankStr across all models ([#108](#108)) ([#120](#120)) ([ef89b90](ef89b90)) * extract _SpendingTotals base class from spending summary models ([#111](#111)) ([2f39c1b](2f39c1b)) * harden BudgetEnforcer with error handling, validation extraction, and review fixes ([#182](#182)) ([c107bf9](c107bf9)) * harden personality profiles, department validation, and template rendering ([#158](#158)) ([10b2299](10b2299)) * pre-PR review improvements for ExecutionLoop + ReAct loop ([#124](#124)) ([8dfb3c0](8dfb3c0)) * split events.py into per-domain event modules ([#136](#136)) ([e9cba89](e9cba89)) ### Documentation * add ADR-001 memory layer evaluation and selection ([#178](#178)) ([db3026f](db3026f)), closes [#39](#39) * add agent scaling research findings to DESIGN_SPEC ([#145](#145)) ([57e487b](57e487b)) * add CLAUDE.md, contributing guide, and dev documentation ([#65](#65)) ([55c1025](55c1025)), closes [#54](#54) * add crash recovery, sandboxing, analytics, and testing decisions ([#127](#127)) ([5c11595](5c11595)) * address external review feedback with MVP scope and new protocols ([#128](#128)) ([3b30b9a](3b30b9a)) * expand design spec with pluggable strategy protocols ([#121](#121)) ([6832db6](6832db6)) * finalize 23 design decisions (ADR-002) ([#190](#190)) ([8c39742](8c39742)) * update project docs for M2.5 conventions and add docs-consistency review agent ([#114](#114)) ([99766ee](99766ee)) ### Tests * add e2e single agent integration tests ([#24](#24)) ([#156](#156)) ([f566fb4](f566fb4)) * add provider adapter integration tests ([#90](#90)) ([40a61f4](40a61f4)) ### CI/CD * add Release Please for automated versioning and GitHub Releases ([#278](#278)) ([a488758](a488758)) * bump actions/checkout from 4 to 6 ([#95](#95)) ([1897247](1897247)) * bump actions/upload-artifact from 4 to 7 ([#94](#94)) ([27b1517](27b1517)) * bump anchore/scan-action from 6.5.1 to 7.3.2 ([#271](#271)) ([80a1c15](80a1c15)) * bump docker/build-push-action from 6.19.2 to 7.0.0 ([#273](#273)) ([dd0219e](dd0219e)) * bump docker/login-action from 3.7.0 to 4.0.0 ([#272](#272)) ([33d6238](33d6238)) * bump docker/metadata-action from 5.10.0 to 6.0.0 ([#270](#270)) ([baee04e](baee04e)) * bump docker/setup-buildx-action from 3.12.0 to 4.0.0 ([#274](#274)) ([5fc06f7](5fc06f7)) * bump sigstore/cosign-installer from 3.9.1 to 4.1.0 ([#275](#275)) ([29dd16c](29dd16c)) * harden CI/CD pipeline ([#92](#92)) ([ce4693c](ce4693c)) * split vulnerability scans into critical-fail and high-warn tiers ([#277](#277)) ([aba48af](aba48af)) ### Maintenance * add /worktree skill for parallel worktree management ([#171](#171)) ([951e337](951e337)) * add design spec context loading to research-link skill ([8ef9685](8ef9685)) * add post-merge-cleanup skill ([#70](#70)) ([f913705](f913705)) * add pre-pr-review skill and update CLAUDE.md ([#103](#103)) ([92e9023](92e9023)) * add research-link skill and rename skill files to SKILL.md ([#101](#101)) ([651c577](651c577)) * bump aiosqlite from 0.21.0 to 0.22.1 ([#191](#191)) ([3274a86](3274a86)) * bump pyyaml from 6.0.2 to 6.0.3 in the minor-and-patch group ([#96](#96)) ([0338d0c](0338d0c)) * bump ruff from 0.15.4 to 0.15.5 ([a49ee46](a49ee46)) * fix M0 audit items ([#66](#66)) ([c7724b5](c7724b5)) * **main:** release ai-company 0.1.1 ([#282](#282)) ([2f4703d](2f4703d)) * pin setup-uv action to full SHA ([#281](#281)) ([4448002](4448002)) * post-audit cleanup — PEP 758, loggers, bug fixes, refactoring, tests, hookify rules ([#148](#148)) ([c57a6a9](c57a6a9)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Signed-off-by: Aurelio <19254254+Aureliolo@users.noreply.github.com>
Summary
cap_drop: ALL,no-new-privileges,read_onlyrootfs, no shell/uv/package-manager in final image. All base images version-pinned with Dependabot auto-updates for digests.nginxinc/nginx-unprivileged:1.29.5-alpinewith SPA routing,/api/and/wsreverse proxy to backend, security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Content-Security-Policy), gzip compression. Placeholderindex.htmlwith live backend health status.tmpfsfor writable paths, configurable ports via env vars (BACKEND_PORT,WEB_PORT)..github/workflows/docker.yml): Build → Trivy + Grype vulnerability scan → push to GHCR → cosign signing with SBOM + SLSA provenance. All actions pinned to full-length commit SHAs. Images only published after scans pass.default-src 'self'for API routes; relaxed policy for/docs/allowing Scalar UI resources fromcdn.jsdelivr.net,fonts.scalar.com,proxy.scalar.com..dockerignore: Consolidated from per-service files (which were ignored by Docker when context is repo root).docker.yml,ci.yml,dependency-review.yml,secret-scan.yml..github/move.Test plan
docker compose -f docker/compose.yml build— both images build successfullydocker compose -f docker/compose.yml up -d— containers start, backend healthycurl http://localhost:8000/api/v1/health— backend responds with version 0.1.0curl http://localhost:3000/api/v1/health— nginx proxies to backend correctlycurl -sI http://localhost:3000/— CSP and security headers presenthttp://localhost:8000/docs/api— Scalar UI renders with relaxed CSPReview coverage
Closes #267