gabriel / musehub public
BREAKING feat/9a-4-f7-overseer-provenance #1 / 3
AI Agent gabriel · 19 hours ago · Sep 9, 2026 · Diff

merge: feat/9a-4-f7-overseer-provenance -> dev (musehub#144, closes proposal #9)

Brings the F7 overseer-run provenance enrichment API to dev, plus the HTTP-boundary test coverage that review identified as missing and aaronrene had already built on a separate, never-merged branch (feat/f7b-http-coverage).

- musehub/services/musehub_overseer_provenance.py: content-free enrichment lookup by portable flow_run:... ref; in-memory fixture store until durable tables land. - musehub/api/routes/musehub/overseer_provenance.py: GET /api/overseer-run-provenance/{run_ref}. Auto-discovered before the repos wildcard (existing alphabetical-with-repos-last convention) -- no include_router needed or applied, per aaronrene's correct pushback on that earlier (wrong) review suggestion. - musehub/config.py: musehub_overseer_provenance_enrichment_enabled, env-aliased to MUSEHUB_OVERSEER_PROVENANCE_ENRICHMENT, defaults disabled (fail-closed). - deploy/secrets.sh: writes the flag into .env per environment -- enabled on staging, disabled on production, matching the issue's staged-rollout intent. - tests/unit/test_overseer_provenance_f7.py: 6 unit tests against the service layer directly. - tests/unit/test_overseer_provenance_f7_http.py (from feat/f7b-http-coverage, never previously merged): 4 real TestClient(app) assertions -- prefixed path returns the full envelope, a percent-encoded ref (what the actual Scooling consumer sends) decodes correctly, an unknown ref 404s, and posture-off fails closed with zero record fields leaked into the 404 body. This is what actually proves the route-shadowing acceptance criterion (AC #1) end to end, not just by inspection.

Resolved the musehub/config.py::Settings conflict by hand: kept dev's current Settings (release_version, opengraph_renderer, and everything else added since this branch forked in July) and added the one new overseer-provenance field. 10/10 F7 tests pass; 95 tests across proposals/snapshot-anchors/authz-sweep/wire-push pass with zero regressions. Verified independently via app.openapi() that exactly one route is registered, correctly prefixed, no duplicates.

sha256:9aec6ea7ec6f61aef690e4616ca3599c1e03b417883d821b2bd46010faa19db8 sha
sha256:7d9bf1946da951ebe5e850065339eb42dcc3f6866956f0cb8b767977d72779fb sha256:e5530c6b8996b96fc4030d6d30fe4f688926bdda2875fb01d303092b11513bd2 parent
+64 ~2 symbols
sha256:c81ddbc2d723b1ae5de0f636ed65db69149b5af018111d5312360361472660c8 snapshot
+64
symbols added
~2
symbols modified
0
dead code introduced
Semantic Changes 66 symbols
+ .vscode/
+ alembic/
+ alembic/versions/
+ deploy/
+ deploy/load-tests/
+ docs/
+ docs/architecture/
+ docs/guides/
+ docs/issues/
+ docs/issues/assets/
+ docs/legal/
+ docs/mists/
+ docs/production-readiness/
+ docs/reference/
+ docs/releases/
+ docs/roadmaps/
+ musehub/
+ musehub/api/
+ musehub/api/routes/
+ musehub/api/routes/api/
+ musehub/api/routes/musehub/
+ musehub/auth/
+ musehub/core/
+ musehub/crypto/
+ musehub/db/
+ musehub/debug/
+ musehub/graph/
+ musehub/maintenance/
+ musehub/mcp/
+ musehub/mcp/tools/
+ musehub/mcp/write_tools/
+ musehub/middleware/
+ musehub/models/
+ musehub/muse_cli/
+ musehub/proposals/
+ musehub/protocol/
+ musehub/security/
+ musehub/services/
+ musehub/storage/
+ musehub/templates/
+ musehub/templates/mcp/
+ musehub/templates/musehub/
+ musehub/templates/musehub/fragments/
+ musehub/templates/musehub/macros/
+ musehub/templates/musehub/opengraph/
+ musehub/templates/musehub/pages/
+ musehub/templates/musehub/partials/
+ musehub/templates/musehub/static/
+ musehub/templates/musehub/static/vendor/
+ musehub/types/
+ scripts/
+ src/
+ src/scss/
+ src/scss/components/
+ src/scss/pages/
+ src/scss/patterns/
+ src/scss/theme/
+ src/ts/
+ src/ts/pages/
+ tests/
+ tests/unit/
+ tools/
+ workflows/
~ musehub/api/routes/musehub/overseer_provenance.py .py 11 symbols added
+ _require_enrichment_enabled function function _require_enrichment_enabled L16–18
+ get_overseer_run_provenance function async_function get_overseer_run_provenance L26–41
+ APIRouter import import APIRouter L8–8
+ Depends import import Depends L8–8
+ HTTPException import import HTTPException L8–8
+ TokenClaims import import TokenClaims L9–9
+ annotations import import annotations L6–6
+ enrichment import import enrichment L11–11
+ optional_token import import optional_token L9–9
+ status import import status L8–8
+ router variable variable router L13–13
~ musehub/services/musehub_overseer_provenance.py .py 20 symbols added
+ CONTRACT_VERSION variable variable CONTRACT_VERSION L17–17
+ HASH_RE variable variable HASH_RE L19–19
+ OVERSEER_PROVENANCE_ENRICHMENT_AUTHORIZED variable variable OVERSEER_PROVENANCE_ENRICHMENT_AUTHORIZED L16–16
+ OverseerRunProvenanceRecord class class OverseerRunProvenanceRecord L24–36
+ RUN_REF_RE variable variable RUN_REF_RE L18–18
+ SAFE_IDENTIFIER_RE variable variable SAFE_IDENTIFIER_RE L20–20
+ _ENRICHMENT_STORE variable variable _ENRICHMENT_STORE L88–101
+ _serialize_record function function _serialize_record L69–84
+ _validate_record_shape function function _validate_record_shape L47–66
+ default_produced_at function function default_produced_at L130–131
+ get_overseer_run_provenance function function get_overseer_run_provenance L111–127
+ Any import import Any L12–12
+ UTC import import UTC L11–11
+ annotations import import annotations L7–7
+ dataclass class import dataclass L10–10
+ datetime import import datetime L11–11
+ re import import re L9–9
+ settings import import settings L14–14
+ is_overseer_provenance_enrichment_enabled function function is_overseer_provenance_enrichment_enabled L39–44
+ seed_overseer_provenance_record function function seed_overseer_provenance_record L104–108
~ tests/unit/test_overseer_provenance_f7.py .py 9 symbols added
+ annotations import import annotations L3–3
+ enrichment import import enrichment L7–7
+ pytest import import pytest L5–5
+ test_fixture_run_ref_returns_content_free_envelope function function test_fixture_run_ref_returns_content_free_envelope L10–22
+ test_gate_off_when_env_disabled function function test_gate_off_when_env_disabled L33–39
+ test_gate_on_when_env_enabled function function test_gate_on_when_env_enabled L42–48
+ test_invalid_run_ref_returns_none function function test_invalid_run_ref_returns_none L29–30
+ test_seed_rejects_invalid_record function function test_seed_rejects_invalid_record L51–65
+ test_unknown_run_ref_returns_none function function test_unknown_run_ref_returns_none L25–26
~ tests/unit/test_overseer_provenance_f7_http.py .py 22 symbols added
+ ENCODED_PATH variable variable ENCODED_PATH L22–22
+ EXPECTED_RECORD variable variable EXPECTED_RECORD L24–38
+ FIXTURE_REF variable variable FIXTURE_REF L19–19
+ PREFIXED_PATH variable variable PREFIXED_PATH L21–21
+ RECORD_KEYS variable variable RECORD_KEYS L40–40
+ TOP_LEVEL_KEYS variable variable TOP_LEVEL_KEYS L41–41
+ UNKNOWN_REF variable variable UNKNOWN_REF L20–20
+ _disable_posture function function _disable_posture L66–71
+ _enable_posture function function _enable_posture L58–63
+ client function function client L45–55
+ AsyncIterator import import AsyncIterator L10–10
+ Iterator import import Iterator L10–10
+ TestClient import import TestClient L13–13
+ annotations import import annotations L8–8
+ app import import app L16–16
+ enrichment import import enrichment L17–17
+ get_db import import get_db L15–15
+ pytest import import pytest L12–12
+ test_a1_prefixed_path_returns_envelope function function test_a1_prefixed_path_returns_envelope L74–88
+ test_a2_percent_encoded_ref_returns_decoded_record function function test_a2_percent_encoded_ref_returns_decoded_record L102–116
+ test_a3_unknown_ref_returns_404 function function test_a3_unknown_ref_returns_404 L91–99
+ test_a4_posture_off_returns_404_fail_closed function function test_a4_posture_off_returns_404_fail_closed L119–132
~ deploy/secrets.sh .sh 1 symbol added
+ OVERSEER_PROVENANCE_ENRICHMENT variable variable OVERSEER_PROVENANCE_ENRICHMENT L130–130
~ musehub/config.py .py 1 symbol added, 2 symbols modified
+ Field import import Field L10–10
~ Settings
~ model_validator
Older fix(9A-4 F7): env alias + staging secrets for overseer provenanc… sha256:e5530c6b8996b96fc4030d6d30fe4f688926bdda2875fb01d303092b11513bd2 All commits
Newer → Latest on feat/9a-4-f7-overseer-provenance

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:9aec6ea7ec6f61aef690e4616ca3599c1e03b417883d821b2bd46010faa19db8 --body "your comment"