Upload folder using huggingface_hub

.pytest_cache/v/cache/nodeids

@@ -4,6 +4,8 @@
   "tests/test_agent_api.py::test_agent_operations_use_canonical_workspace_scope",
   "tests/test_agent_api.py::test_agent_security_discovery_and_openapi",
   "tests/test_agent_api.py::test_relationship_worker_rejects_missing_brain_scope",
+  "tests/test_config_backend_selection.py::test_config_default_backends",
+  "tests/test_config_backend_selection.py::test_config_postgres_profile",
   "tests/test_deploy_production_contract.py::test_backup_manifest_verification_detects_tampering",
   "tests/test_deploy_production_contract.py::test_ci_embedding_stub_is_deterministic_and_normalized",
   "tests/test_deploy_production_contract.py::test_ci_profiles_enable_dense_search_without_online_llm",

Dockerfile

@@ -79,6 +79,12 @@ RUN apt-get update && apt-get upgrade -y \
     && apt-get install -y --no-install-recommends \
     curl \
     util-linux \
+    postgresql \
+    postgresql-contrib \
+    postgresql-15-pgvector \
+    redis-server \
+    nginx \
+    supervisor \
     && rm -rf /var/lib/apt/lists/* \
     && python -m pip uninstall -y setuptools wheel \
     && groupadd -r appuser && useradd -r -g appuser -m appuser

deploy/nginx.conf

@@ -0,0 +1,28 @@
+server {
+    listen 7860;
+    server_name _;
+
+    client_max_body_size 100M;
+
+    location ~ ^/brains/[^/]+/mcp(/.*)?$ {
+        proxy_pass http://127.0.0.1:8001;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Connection "";
+        proxy_buffering off;
+        proxy_cache off;
+        chunked_transfer_encoding off;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

deploy/supervisord.conf

@@ -0,0 +1,50 @@
+[supervisord]
+nodaemon=true
+user=root
+logfile=/var/log/supervisord.log
+pidfile=/var/run/supervisord.pid
+
+[program:postgres]
+command=su - postgres -c "/usr/lib/postgresql/15/bin/postgres -D %(env(PGDATA)s) -c config_file=%(env(PGDATA)s)/postgresql.conf"
+autostart=true
+autorestart=true
+stdout_logfile=/var/log/postgres.log
+stderr_logfile=/var/log/postgres.err
+
+[program:redis]
+command=redis-server /etc/redis/redis.conf
+autostart=true
+autorestart=true
+stdout_logfile=/var/log/redis.log
+stderr_logfile=/var/log/redis.err
+
+[program:brainapi-api]
+command=/app/.venv/bin/python -m uvicorn src.services.api.app:app --host 127.0.0.1 --port 8000
+directory=/app
+autostart=true
+autorestart=true
+stdout_logfile=/var/log/brainapi-api.log
+stderr_logfile=/var/log/brainapi-api.err
+
+[program:brainapi-mcp]
+command=/app/.venv/bin/python -m src.services.mcp.main
+directory=/app
+autostart=true
+autorestart=true
+stdout_logfile=/var/log/brainapi-mcp.log
+stderr_logfile=/var/log/brainapi-mcp.err
+
+[program:brainapi-worker]
+command=/app/.venv/bin/python -m celery -A src.services.tasks.main.celery_app worker --loglevel=info
+directory=/app
+autostart=true
+autorestart=true
+stdout_logfile=/var/log/brainapi-worker.log
+stderr_logfile=/var/log/brainapi-worker.err
+
+[program:nginx]
+command=nginx -g "daemon off;"
+autostart=true
+autorestart=true
+stdout_logfile=/var/log/nginx.log
+stderr_logfile=/var/log/nginx.err

entrypoint.sh

@@ -1,6 +1,100 @@
 #!/bin/bash
 set -e
 
+# 1. Hugging Face Space runtime environment configuration
+export DATA_DB="${DATA_DB:-postgresql}"
+export VECTOR_DB="${VECTOR_DB:-postgresql}"
+export GRAPH_DB="${GRAPH_DB:-networkx}"
+export CELERY_BACKEND="${CELERY_BACKEND:-redis}"
+
+export POSTGRES_HOST="${POSTGRES_HOST:-127.0.0.1}"
+export POSTGRES_PORT="${POSTGRES_PORT:-5432}"
+export POSTGRES_USERNAME="${POSTGRES_USERNAME:-brainapi}"
+export POSTGRES_SYSTEM_DATABASE="${POSTGRES_SYSTEM_DATABASE:-brainapi}"
+export POSTGRES_MAINTENANCE_DATABASE="${POSTGRES_MAINTENANCE_DATABASE:-postgres}"
+
+export REDIS_HOST="${REDIS_HOST:-127.0.0.1}"
+export REDIS_PORT="${REDIS_PORT:-6379}"
+
+export DEFAULT_BRAIN_FALLBACK="${DEFAULT_BRAIN_FALLBACK:-false}"
+export MCP_PORT="${MCP_PORT:-8001}"
+
+# Persistent root determination
+if [ -d "/data" ]; then
+    PERSISTENT_ROOT="/data/brainapi"
+else
+    PERSISTENT_ROOT="/app/.data/brainapi"
+fi
+
+mkdir -p "$PERSISTENT_ROOT/postgres" "$PERSISTENT_ROOT/redis"
+chmod 700 "$PERSISTENT_ROOT"
+
+SECRETS_FILE="$PERSISTENT_ROOT/internal-secrets.env"
+if [ ! -f "$SECRETS_FILE" ]; then
+    PG_PASS="$(openssl rand -hex 16 2>/dev/null || date +%s%N | sha256sum | head -c 32)"
+    RED_PASS="$(openssl rand -hex 16 2>/dev/null || date +%s%N | sha256sum | head -c 32)"
+    cat <<EOF > "$SECRETS_FILE"
+POSTGRES_PASSWORD=$PG_PASS
+REDIS_PASSWORD=$RED_PASS
+EOF
+    chmod 0600 "$SECRETS_FILE"
+fi
+
+source "$SECRETS_FILE"
+export POSTGRES_PASSWORD
+export REDIS_PASSWORD
+
+# Print non-secret startup diagnostics
+echo "=================================================="
+echo "Starting BrainAPI Hugging Face Space Runtime"
+echo "DATA_DB=$DATA_DB"
+echo "VECTOR_DB=$VECTOR_DB"
+echo "GRAPH_DB=$GRAPH_DB"
+echo "POSTGRES_HOST=$POSTGRES_HOST"
+echo "REDIS_HOST=$REDIS_HOST"
+echo "persistent_root=$PERSISTENT_ROOT"
+echo "=================================================="
+
+# 2. PostgreSQL Setup
+PGDATA="$PERSISTENT_ROOT/postgres"
+export PGDATA
+chown -R postgres:postgres "$PGDATA"
+
+if [ ! -s "$PGDATA/PG_VERSION" ]; then
+    su - postgres -c "/usr/lib/postgresql/15/bin/initdb -D '$PGDATA'"
+    echo "listen_addresses = '127.0.0.1'" >> "$PGDATA/postgresql.conf"
+fi
+
+# Temporary start Postgres for role/db initialization
+su - postgres -c "/usr/lib/postgresql/15/bin/pg_ctl -D '$PGDATA' -w start"
+
+# Create maintenance db, system db, role, and extension
+su - postgres -c "psql -c \"CREATE USER $POSTGRES_USERNAME WITH PASSWORD '$POSTGRES_PASSWORD';\" 2>/dev/null || true"
+su - postgres -c "psql -c \"ALTER USER $POSTGRES_USERNAME WITH PASSWORD '$POSTGRES_PASSWORD';\" 2>/dev/null || true"
+su - postgres -c "psql -c \"CREATE DATABASE $POSTGRES_SYSTEM_DATABASE OWNER $POSTGRES_USERNAME;\" 2>/dev/null || true"
+su - postgres -c "psql -d $POSTGRES_SYSTEM_DATABASE -c 'CREATE EXTENSION IF NOT EXISTS vector;' 2>/dev/null || true"
+su - postgres -c "psql -c \"GRANT ALL PRIVILEGES ON DATABASE $POSTGRES_SYSTEM_DATABASE TO $POSTGRES_USERNAME;\" 2>/dev/null || true"
+su - postgres -c "psql -c \"ALTER USER $POSTGRES_USERNAME CREATEDB;\" 2>/dev/null || true"
+
+su - postgres -c "/usr/lib/postgresql/15/bin/pg_ctl -D '$PGDATA' -w stop"
+
+# 3. Redis Setup
+cat <<EOF > /etc/redis/redis.conf
+bind 127.0.0.1
+port $REDIS_PORT
+requirepass $REDIS_PASSWORD
+dir $PERSISTENT_ROOT/redis
+appendonly yes
+appendfilename "appendonly.aof"
+EOF
+
+# 4. Nginx Setup
+if [ -f /app/deploy/nginx.conf ]; then
+    cp /app/deploy/nginx.conf /etc/nginx/conf.d/default.conf
+    rm -f /etc/nginx/sites-enabled/default 2>/dev/null || true
+fi
+
+# 5. Plugin setup
 plugin_failure_policy="${PLUGIN_FAILURE_POLICY:-}"
 if [ -z "$plugin_failure_policy" ]; then
     if [ "${ENV:-production}" = "development" ]; then
@@ -9,17 +103,8 @@ if [ -z "$plugin_failure_policy" ]; then
         plugin_failure_policy="fail"
     fi
 fi
-if [ "$plugin_failure_policy" != "fail" ] && [ "$plugin_failure_policy" != "warn" ]; then
-    echo "[brainapi] PLUGIN_FAILURE_POLICY must be 'fail' or 'warn'" >&2
-    exit 64
-fi
-
-if [ -d /app/.cache ]; then
-    chown -R appuser:appuser /app/.cache 2>/dev/null || true
-fi
 
 mkdir -p /app/plugins
-chown -R appuser:appuser /app/plugins 2>/dev/null || true
 
 if [ -n "$BRAINAPI_PLUGINS" ]; then
     IFS=',' read -ra PLUGINS <<< "$BRAINAPI_PLUGINS"
@@ -29,8 +114,7 @@ if [ -n "$BRAINAPI_PLUGINS" ]; then
         version="${plugin_spec##*:}"
         [ "$name" = "$version" ] && version="latest"
         echo "[brainapi] Installing plugin: $name v$version"
-        if ! setpriv --reuid=appuser --regid=appuser --init-groups -- \
-            /app/.venv/bin/python -m src.core.plugins.cli plugins install "$name" --version "$version"; then
+        if ! /app/.venv/bin/python -m src.core.plugins.cli plugins install "$name" --version "$version"; then
             if [ "$plugin_failure_policy" = "fail" ]; then
                 echo "[brainapi] Failed to install required plugin '$name'" >&2
                 exit 1
@@ -40,5 +124,14 @@ if [ -n "$BRAINAPI_PLUGINS" ]; then
     done
 fi
 
-exec setpriv --reuid=appuser --regid=appuser --init-groups -- \
-    /app/.venv/bin/python "$@"
+# Copy supervisor config if present
+if [ -f /app/deploy/supervisord.conf ]; then
+    cp /app/deploy/supervisord.conf /etc/supervisor/supervisord.conf
+fi
+
+# Execute supervisor or passed command
+if [ "$1" = "supervisord" ] || [ -z "$1" ]; then
+    exec /usr/bin/supervisord -c /etc/supervisor/supervisord.conf
+else
+    exec "$@"
+fi