PROGRESS.md

Progress log

Running notes for the StockAnalysis rebuild. Every entry below is committed and pushed before the next step starts, so the work survives a reset.

2026-10-25

• Read the HF docs for Spaces as Agent Tools and Spaces as API endpoints, plus Gradio's API-visibility and curl pages. Confirmed the live contract: agents.md -> /gradio_api/info -> POST /gradio_api/call/v2/<endpoint> -> GET /gradio_api/call/<endpoint>/<event_id>.
• Confirmed api_visibility="private" hides an event from the API docs and Gradio clients but does not block direct HTTP.
• Baseline repo had only the old smoke-test dashboard. No earlier stock-analysis work was present in the working tree or in git history.
• Ignored local session transcripts and agent tooling so they are not published to the public Space repo.
• Decision: no local servers, no /tmp, no kill/pkill, no process cleanup. Verification is limited to static checks and offline unit checks.
• Added external_api.py: reads EXTERNAL_API_URL, sends the ticker request with HF_TOKEN when present, passes JSON through unchanged, and wraps non-JSON or error responses. Includes STOCK_MODEL_ID when set.
• Added local_parser.py: optional OpenAI-compatible local model call (Ollama/vLLM/LM Studio) that converts non-JSON upstream text into JSON. It is opt-in via LOCAL_PARSER_URL and LOCAL_PARSER_MODEL, and its prompt forbids inventing data.
• Ran offline checks with mocked responses for JSON, text, error, and parse paths. No servers started, no processes touched, no /tmp files.
• Rewrote app.py around stock analysis: status pills, ticker/horizon/risk/ question form, JSON result, raw-response accordion, API/agents accordion, and a fixed bottom-right smoke-test panel that keeps the live model table, history, download, and settings.
• Only the Analyze event is public (api_name="analyze"). Smoke-test and page load events are marked private, with a documented caveat that private is not a security boundary for direct HTTP.
• Added agents.md with the HF one-shot block, the concrete /analyze request/poll flow, three-output contract, curl and gradio_client examples, and the error/response shapes.
• python -m py_compile app.py external_api.py local_parser.py smoke.py passed.
• Rewrote README.md for the stock-analysis app. Kept the 30-model snapshot, the last smoke-test result, the dynamic selection rules, storage layout, and smoke-test settings. Added the agent contract, configuration table, custom model slot, local parser setup, external adapter contract, and disclaimer.
• Expanded agents.md with explicit boundaries, promises, input/output rules, error and retry guidance, auth/data-handling rules, discovery notes, and a clear no-guarantee disclaimer. README now points at those details.
• Pushed the full local history to origin/main (1beeba1..4567005). The session HF_TOKEN was used from the environment through a one-shot credential helper; it was not written to the repo or a credential store.
• Live schema still showed the old app after the push. The runtime API reported devMode: true, runtime SHA f5c9dc1, and repo SHA 34ae3c8.
• Incident: I wrongly treated dev mode as the problem, disabled it, and triggered a factory reboot. That tears down the live dev container. I re-enabled dev mode immediately, but the factory reboot had already been submitted and could not be safely canceled; it remained RUNNING_BUILDING with the old runtime SHA.
• Lesson: dev mode intentionally suppresses rebuilds. Do not disable dev mode or factory-reboot a live dev container. No further lifecycle actions.
• Next: only local commits and git push; do not touch the Space lifecycle.