Point solve + telemetry defaults at production - #233
Merged
Merged
Conversation
The one token in ~/.amico/cloud.json authenticates BOTH the solve API and the run-corpus ingest, and each AWS account has its own credentials table: the ingest hashes the token and looks it up in ITS account's table, so a token minted in the other account is rejected on every batch — 401, while the UI still reports capture as enabled. Nothing enforced that coupling, and it broke for real: a user holding a prod-minted credential against the staging ingest default produced ~1265 rejected batches in one morning, capturing nothing. Flip both defaults together: DEFAULT_CLOUD_URL -> vsaje7ynp5 (prod solves) amicode.telemetry.endpoint -> bld42qbg… (prod run-corpus ingest) Add a test pinning the pair so a one-sided edit fails CI instead of shipping. Bump the manifest to 0.1.1 to satisfy release.yml's version guard for the v0.1.1 tag. Every existing staging-minted token must be re-minted in prod.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Flips both client defaults to the production account, together, and pins them with a test.
Why
The single token in
~/.amico/cloud.jsonauthenticates both the solve API and the run-corpus ingest. Each AWS account has its ownharmoniqs-api-credentialstable, and the ingest hashes the token and looks it up in its own account's table — so a token minted in the other account is rejected on every batch (401) while the UI still reports capture as enabled.Nothing enforced that coupling. It broke for real today: a user holding a prod-minted credential against the staging ingest default produced ~1265 rejected batches in one morning, capturing nothing. Diagnosed via the
harmoniqs-run-corpus-staging-ingest-rejectedalarm.What
DEFAULT_CLOUD_URL(cloud_key.ts)qy2gwqy5s5(staging solves)vsaje7ynp5(prod solves)amicode.telemetry.endpoint(package.json)4pbhrnv2…(staging ingest)bld42qbg…(prod ingest)Both endpoints verified live against AWS. Manifest bumped
0.1.0→0.1.1for release.yml's version guard.New test
the solve and telemetry defaults point at the SAME account (production)pins the pair and rejects either staging URL, so a one-sided edit fails CI rather than silently shipping.Consequences
raghav-internal,jacktest,jack-piccolissimo,jack,aaron.Testing
pnpm --filter amicode test— 810 passed, 80 files, 0 failed.