Railway use case integration (Flatland scenarios, ZWL frontend, experiment mode - #24
Open
Janick96733 wants to merge 22 commits into
Open
Janick96733 wants to merge 22 commits into
Janick96733 wants to merge 22 commits into
Conversation
…-simu-proxy Fix/session refresh and powergrid simu proxy
The eval-demo stubs are removed. applyRecommendation in the generic
services API and in the ATM and Railway entity APIs each returned a
hardcoded `{ message: 'ok (simulated)' }` instead of calling the
simulator, so "apply" appeared to succeed while nothing was sent.
(PowerGrid was already restored in an earlier change.)
Callers now await the call and react to a rejection: on failure the
recommendation card is left open so the user can retry, rather than
being resolved and dismissed as if the action had gone through. The
error modal itself is already raised by the http plugin.
Also hardens deploy-chart/apply-nginx-conf.sh, which patches the k8s
nginx ConfigMap for the same apply path:
- clearer failures when PyYAML is missing or the manifest is not a
ConfigMap / lacks the nginx.conf key / predates the fix
- accept Y/yes at the confirmation prompt, not just a bare `y`
- verify against `nginx -T` (what nginx actually loaded) rather than
the ConfigMap, and on failure report whether the patch stuck and
whether a crashlooping pod left the old one serving
…en server-side The nginx conf had exactly one runtime-substituted value, POWERGRID_SIMU_UPSTREAM, hand-rolled as a single sed in start-webui.sh. Generalise it and move the one secret that had no business being in the frontend bundle behind the same mechanism. Runtime substitution -------------------- Every environment-specific value now lives in the conf as a __NAME__ placeholder and is substituted from the matching env var by a loop over SUBST_VARS. Adding one is: default it, name it, use __NAME__ in the conf. The value is escaped before it reaches sed, so tokens and URLs containing # & \ cannot break out of the expression, and secrets are reported as "set (n chars)" rather than echoed. Both failure modes are now loud rather than silent: - a placeholder that survives substitution aborts startup naming the missing variable; - the generated conf is checked with `nginx -t`, and separately asserted to contain a listen directive - an empty or serverless conf.d file passes `nginx -t` and would leave nginx up and answering nothing. frontend/default.conf had drifted from the k8s ConfigMap and still carried the literal LAN address instead of the placeholder, so a plain image run got a dead upstream; it uses the placeholder again. Cognitive API token ------------------- VITE_COGNITIVE_TOKEN was a build-time value: inlined into the public JS bundle, readable by every visitor, and rotatable only by rebuilding the image - which is why the env var on the frontend pod did nothing. nginx now attaches the bearer token to /cognitive-api/ itself from $COGNITIVE_TOKEN, so the token stays server-side and rotating it is a secret update plus a pod restart. Dropped from the Dockerfile, CI build-args, env.d.ts and env/.env accordingly; the frontend no longer sends an Authorization header of its own. Two related fixes found while verifying this -------------------------------------------- - start-webui.sh built the resolver line from every nameserver in /etc/resolv.conf without joining them, so on a host with two the sed expression gained a newline, failed with "sed: unmatched '/'", and wrote an EMPTY default.conf - nginx started and served nothing. The addresses go on one line (nginx resolver accepts several) and an empty result aborts. - .dockerignore is a symlink to .gitignore, where `*.local` matches at any depth for git but only at the context root for Docker. env/.env.local was therefore copied into the image and Vite inlined its VITE_* values into the bundle; `**/*.local` excludes it. Verified by building the image and running it: config validates, SPA serves 200, and /cognitive-api/ reaches the upstream with the injected token (401 on a fake one). Also checked the built bundle no longer contains the token, and that the substituted default.conf, cab-standalone and ConfigMap configs all pass `nginx -t`.
… comments The token move in 80524c4 left two ways to be broken silently, and the OVH deploy hit both. Closing them, and bumping every image tag to 1.4.0. REQUIRED_VARS ------------- COGNITIVE_TOKEN defaulted to empty, so a pod with no env var (or a secretKeyRef to a secret that does not exist) started cleanly and served /cognitive-api/ with "Bearer " and nothing after it - visible only as a 401 from the upstream. start-webui.sh now takes REQUIRED_VARS, a list of names that must be non-empty, and aborts naming all the empty ones at once. values.ovh.yaml sets REQUIRED_VARS=COGNITIVE_TOKEN, so the pod crashloops with the reason in its log and k8s keeps the previous pod serving. It is opt-in rather than "every var is required" because an absent value is not always wrong: local dev runs the whole stack with no token and merely loses the cognitive panel, so requiring one there would block work on unrelated features. Token no longer substituted into comments ----------------------------------------- Both confs named __COGNITIVE_TOKEN__ in a comment above the directive. Substitution is a plain sed, so the real token was written into the comment as well - two copies in the generated conf, one of them where nobody would think to look. The comments now describe the placeholder instead of naming it, and say why. Same for __POWERGRID_SIMU_UPSTREAM__, for consistency. docker-compose.sh printed the secrets ------------------------------------- It ended with a plain `cat .env` on a file that now carries RL_AGENT_API_TOKEN and COGNITIVE_TOKEN, putting both in the terminal and in any CI log running the script. Credential-looking values are masked as <set>/<empty>. Verified against the published image with start-webui.sh mounted over it: an empty required token exits 1 with the new message; local dev with no token and no REQUIRED_VARS still starts and serves the SPA (200); with a token set the running conf holds exactly one copy of it, no placeholder survives, and the bundle contains none. The substituted ConfigMap passes nginx -t with its in-cluster upstreams stubbed.
Post-logout HMI survey: the operator answers the hmisurveys questionnaire chain on logout, with participant and condition prefilled from the trace session id and the use case. The session report is held back until the questionnaire is over, and the report gains a copy button for the session id plus a human decision time KPI measured from the recommendations appearing to the apply.
… experiment mode)
… experiment mode)
… experiment mode)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the Railway use case (FHNW/AI4REALNET) to InteractiveAI. Scoped strictly to Railway folders. Changes include:
usecases_examples/Railway/ - Flatland simulation, 3 scenarios, Flask brain
flatland-hmi-hack4rail/ - ZWL Angular frontend (Kartenansicht + Marey diagram)
frontend/src/entities/Railway/ - CAB Vue components (Timeline, Assistant, Context)
config/dev/cab-standalone/docker-compose-railway.yml + mongo-init.js - Railway deployment
README.md - Railway section appended without modifying existing content
HANDOVER.md - deployment decisions for the SystemX developer
Note: was unable to test locally against the new .secrets/nginx runtime config - the POWERGRID_SIMU_UPSTREAM placeholder was not being substituted. Please verify on your end.