Upload folder using huggingface_hub

Dockerfile

@@ -1,16 +1,52 @@
+# syntax=docker/dockerfile:1.2
 # ---- deps stage: needs git + a credentialed clone of the private ARF repos
 #      (agentic_reliability_framework, ARF-Bayesian-Pricing-Calculator).
 #      This stage is discarded after build -- the credential never reaches
 #      the final image's layers, env, or git config. ----
+#
+# GH_PAT is read via a BuildKit secret mount, not `ARG` -- an ARG's value is
+# printed in plaintext as part of the logged RUN command that uses it (this
+# is exactly how a real, live token ended up visible in a Render deploy log
+# this session). A secret mount's value is never written to a log line or
+# an image layer. REQUIRES a matching setup step in Render's dashboard
+# before this will build: Render's Docker service settings -> Secret Files
+# -> add a file named exactly `gh_pat` containing the token value (nothing
+# else in the file). The old `GH_PAT` environment variable is no longer
+# read by this Dockerfile and can be removed once this is confirmed working.
 FROM python:3.12-slim AS deps
-ARG GH_PAT
 RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
-RUN git config --global url."https://${GH_PAT}@github.com/".insteadOf "https://github.com/"
+RUN --mount=type=secret,id=gh_pat,dst=/etc/secrets/gh_pat \
+    git config --global url."https://$(cat /etc/secrets/gh_pat)@github.com/".insteadOf "https://github.com/"
 RUN python -m venv /opt/venv
 ENV PATH="/opt/venv/bin:$PATH"
 WORKDIR /app
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+# torch has no explicit pin anywhere in this dependency tree -- it's pulled in
+# transitively by sentence-transformers (for agentic_reliability_framework's
+# RAG/semantic-memory features) and, left to the default PyPI index, resolves
+# to the CUDA-enabled build (nvidia-cusparselt, cuda-toolkit, nvidia-nccl, ...)
+# even though this service runs on CPU-only Render instances. That variant's
+# extra weight is a real contributor to out-of-memory deploy failures.
+#
+# A separate `pip install torch==... --index-url .../cpu` RUN before this one
+# does NOT work: it's a distinct resolve that only knows about the CPU wheel;
+# the very next `pip install -r requirements.txt`, seeing no --index-url, only
+# has the default PyPI index in view and re-resolves torch from there,
+# silently replacing the CPU build with the CUDA one at the same version
+# number (confirmed happening in a real deploy -- final `pip install` log
+# showed plain `torch-2.13.0` plus the full nvidia/cuda-toolkit/triton stack,
+# not `torch-2.13.0+cpu`). Putting torch and -r requirements.txt in one
+# `pip install` call, with the CPU wheelhouse as the primary --index-url and
+# PyPI as --extra-index-url, makes it a single resolve: torch is satisfied
+# from the CPU index and nothing later re-derives a different build for it.
+# Version pinned to 2.13.0 to match exactly what pip's resolver already chose
+# for this dependency tree (confirmed available on the CPU index for
+# cp312/manylinux before pinning it here, not assumed).
+RUN pip install --no-cache-dir \
+    --index-url https://download.pytorch.org/whl/cpu \
+    --extra-index-url https://pypi.org/simple \
+    torch==2.13.0 \
+    -r requirements.txt
 
 # ---- final stage: just the built venv + app code, no git, no credential ----
 FROM python:3.12-slim
@@ -18,4 +54,11 @@ COPY --from=deps /opt/venv /opt/venv
 ENV PATH="/opt/venv/bin:$PATH"
 WORKDIR /app
 COPY . .
-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]
+# Shell form (not exec/JSON-array form) deliberately -- ${PORT:-7860} only
+# expands with a real shell interpreting the command; exec form passes
+# arguments literally with no variable substitution at all. Render injects
+# PORT and expects the app to bind to it (its deploy log explicitly failed
+# port-scanning for it: "Bind your service to at least one port"); the
+# Hugging Face Space mirror sets no such variable and expects the
+# conventional default, 7860. One image, correct on both targets.
+CMD uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-7860}

README.md

@@ -1,16 +1,31 @@
+---
+title: ARF API
+emoji: 🛡️
+colorFrom: blue
+colorTo: gray
+sdk: docker
+pinned: false
+---
+
 # arf-api
 
 ARF API Control Plane (FastAPI)
 
 ## Live Demo
 
-The API is deployed and accessible at:
-- **Base URL**: [https://arf-ai-agentic-reliability-framework-api.hf.space](https://arf-ai-agentic-reliability-framework-api.hf.space)
+**Render is the primary deployment target** (custom domain, real scaling, standard secrets
+management -- the multi-stage Docker build in this repo was purpose-built for it). The Hugging
+Face Space below is a secondary, publicly-browsable mirror of the same code, not the primary
+integration target -- point real pilot/customer integrations at Render once its URL is
+confirmed live, not at the Space URL.
+
+- **HF Space (public mirror)**: [https://arf-ai-agentic-reliability-framework-api.hf.space](https://arf-ai-agentic-reliability-framework-api.hf.space)
 - **Interactive Documentation**: [https://arf-ai-agentic-reliability-framework-api.hf.space/docs](https://arf-ai-agentic-reliability-framework-api.hf.space/docs)
 
 ## Quick Start (Local Development)
 
 1. **Install dependencies**:
+
 ```bash
 pip install -r requirements.txt
 ```
@@ -91,9 +106,7 @@ curl -X POST "http://localhost:8000/api/v1/v1/incidents/evaluate"   -H "Content-
     "effect": -90,
     "explanation_text": "If we apply restart_container instead of no_action, latency would change from 600.00 to 510.00 (Δ = -90.00). Based on heuristic causal model.",
     "is_model_based": false,
-    "warnings": [
-      "Using heuristic causal model (no fitted SCM)."
-    ]
+    "warnings": ["Using heuristic causal model (no fitted SCM)."]
   },
   "utility_decision": {
     "best_action": "restart_container",
@@ -120,4 +133,3 @@ Notes
 
 - The governance endpoints use an in-process `RiskEngine` initialized at startup.
 - Outcomes are recorded via `POST /api/v1/intents/outcome` (`app/api/routes_governance.py`), tenant-scoped and auth-protected.
-

app/api/routes_history.py

@@ -1,7 +1,8 @@
-from fastapi import APIRouter
+from fastapi import APIRouter, Depends
+from app.api.deps import verify_internal_key
 from app.core.storage import incident_history
 
-router = APIRouter()
+router = APIRouter(dependencies=[Depends(verify_internal_key)])
 
 
 @router.get("/history")

app/api/routes_intents.py

@@ -1,8 +1,9 @@
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, Depends, HTTPException
+from app.api.deps import verify_internal_key
 from app.models.intent_models import IntentSimulation, IntentSimulationResponse
 from app.services.intent_service import simulate_intent
 
-router = APIRouter()
+router = APIRouter(dependencies=[Depends(verify_internal_key)])
 
 
 @router.post("/simulate_intent", response_model=IntentSimulationResponse)

app/api/routes_memory.py

@@ -1,6 +1,7 @@
-from fastapi import APIRouter, Request
+from fastapi import APIRouter, Depends, Request
+from app.api.deps import verify_internal_key
 
-router = APIRouter()
+router = APIRouter(dependencies=[Depends(verify_internal_key)])
 
 
 @router.get("/stats")

app/api/routes_pricing.py

@@ -57,48 +57,26 @@ async def run_pricing(
     quota: dict = Depends(enforce_quota),
 ):
     """
-    Multi‑run pricing with cooldown and buffer persistence.
-    Each run’s simulated outcome is added to the buffer, so subsequent runs
-    see an updated posterior.
+    Multi‑run pricing with cooldown and buffer persistence. TEMPORARILY DISABLED.
+
+    This endpoint used to persist each run's "outcome" as
+    `random.random() > risk_score` -- a fabricated result, not a real deal
+    outcome -- into a calibration buffer with no customer_id scoping, so
+    every customer's calls read and wrote the same file. Net effect: every
+    customer's price was shaped by every other customer's randomly-generated
+    outcomes, not just their own. Disabled until both are fixed: (1) a real
+    outcome-ingestion path (this endpoint must not invent one), and (2) the
+    buffer scoped per customer. See AUDIT_arf-bayesian-pricing-calculator.md
+    and AUDIT_arf-api.md (workspace root) for the original findings and
+    recommended fix. `Depends(enforce_quota)` stays active so this still
+    requires the same auth it always did -- only authenticated callers reach
+    the disabled-notice below; everyone else still gets the normal 401/403.
     """
-    # We need to reuse the same buffer across runs; we'll load it per request.
-    # For simplicity, we'll load from the default location.
-    from arf_pricing_calculator.storage.buffer import load_buffer, add_event
-    from arf_pricing_calculator.orchestration.cooldown import enforce_cooldown, is_cooldown_active
-
-    outputs = []
-    buffer = load_buffer()   # loads from calibration_buffer.json
-
-    for i in range(req.runs):
-        if not req.force and is_cooldown_active(
-                req.customer_id, req.cooldown_hours):
-            raise HTTPException(status_code=429,
-                                detail=f"Cooldown active after {i} runs")
-
-        pricing_input = parse_input_dict(req.input)
-        engine = PricingEngine(calibration_buffer=buffer)
-        out = engine.estimate(pricing_input)
-
-        # Simulate an outcome (in real use, this would come from the actual
-        # deal)
-        import random
-        outcome = "success" if random.random() > out.risk_score else "failure"  # nosec B311
-
-        event = {
-            "run_id": out.run_history_id,
-            "customer_id": req.customer_id,
-            "outcome": outcome,
-            "price": out.recommended_price,
-            "value": out.expected_value,
-            "risk_score": out.risk_score,
-            "run_number": i + 1,
-        }
-        add_event(event)
-        buffer = load_buffer()   # reload after update
-
-        outputs.append(out)
-
-        if i < req.runs - 1:
-            enforce_cooldown(req.customer_id, req.cooldown_hours)
-
-    return outputs
+    raise HTTPException(
+        status_code=503,
+        detail=(
+            "This endpoint is temporarily disabled while a data-integrity issue is "
+            "fixed. Use POST /api/v1/pricing/estimate for a single price estimate "
+            "with no persisted learning in the meantime."
+        ),
+    )

app/api/routes_risk.py

@@ -1,8 +1,9 @@
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, Depends, HTTPException
+from app.api.deps import verify_internal_key
 from app.models.risk_models import RiskResponse
 from app.services.risk_service import get_system_risk
 
-router = APIRouter()
+router = APIRouter(dependencies=[Depends(verify_internal_key)])
 
 
 @router.get("/get_risk", response_model=RiskResponse)

docs/authentication.md

@@ -2,20 +2,36 @@
 
 This page describes how to authenticate with the ARF API.
 
-Current status (mixed — not all routers are protected)
-
-- `routes_governance.py`: the entire router requires the `X-Internal-Key` header, verified against `ARF_INTERNAL_API_KEY` (`app/api/deps.py::verify_internal_key`). This fails closed — requests are rejected with 401 if the env var is unset. This is the header arf-gateway injects when proxying to this service.
-- `routes_admin.py`: individual `/admin/*` endpoints require an `admin_key` query parameter, verified against `ARF_ADMIN_API_KEY` (`app/api/deps.py`, or the local `verify_admin` dependency in that router). Also fails closed if unset.
-- `routes_risk.py`, `routes_intents.py`, `routes_history.py`, `routes_memory.py`: **no auth dependency at all**. If this service is reachable directly (e.g., its public HF Space URL) rather than only through arf-gateway, these routes are open to anyone.
+Current status
+
+- `routes_governance.py`, `routes_risk.py`, `routes_intents.py`, `routes_history.py`,
+  `routes_memory.py`: the entire router requires the `X-Internal-Key` header, verified against
+  `ARF_INTERNAL_API_KEY` (`app/api/deps.py::verify_internal_key`). This fails closed — requests
+  are rejected with 401 if the env var is unset, if the header is missing, or if it doesn't
+  match (constant-time comparison). This is the header arf-gateway injects when proxying to
+  this service. The last four were unauthenticated until this was fixed — see
+  `tests/test_deps.py` for the tests that verify the dependency itself actually rejects what
+  it should, not just that it's wired in.
+- `routes_admin.py`: individual `/admin/*` endpoints require an `admin_key` query parameter,
+  verified against `ARF_ADMIN_API_KEY` (`app/api/deps.py`, or the local `verify_admin`
+  dependency in that router). Also fails closed if unset.
+- `routes_pricing.py`: individual `/pricing/*` endpoints require a real per-customer API key
+  (`Authorization: Bearer <key>` or `?api_key=`), verified against the tracked/tenant-scoped
+  `enforce_quota` dependency (`app/core/usage_tracker.py`) — a different mechanism from
+  `X-Internal-Key`, since pricing estimates are meant to be reachable by a customer directly,
+  not only via the gateway.
 
 What the code provides
 
-- `app/core/config.py` exposes an `api_key` setting read from `.env`, but no current route checks it — it is not the mechanism in use. The real mechanism is the two env vars above, checked in `app/api/deps.py`.
-
-If you need to lock down the remaining unauthenticated routers
-
-- Add `dependencies=[Depends(verify_internal_key)]` (or a purpose-built dependency) to the `APIRouter(...)` construction in the files listed above, following the pattern already used in `routes_governance.py`.
+- `app/core/config.py` exposes an `api_key` setting read from `.env`, but no current route
+  checks it — it is not the mechanism in use. The real mechanisms are `X-Internal-Key`,
+  `ARF_ADMIN_API_KEY`, and per-customer API keys (`enforce_quota`), all checked in
+  `app/api/deps.py` / `app/core/usage_tracker.py`.
 
 Notes
 
 - Tests run against a real Postgres connection (`tests/conftest.py`), not SQLite; see the top-level README's Tests section.
+- `tests/conftest.py` globally overrides `verify_internal_key` for the test suite (so routes
+  behind it can be exercised without the gateway-injected header) — this means the app-level
+  test suite alone can't confirm the dependency actually fails closed. `tests/test_deps.py`
+  calls it directly, bypassing that override, specifically to verify that.

tests/test_deps.py

@@ -1,5 +1,10 @@
+import importlib
+from unittest.mock import MagicMock, patch
+
 import pytest
-from unittest.mock import patch, MagicMock
+from fastapi import HTTPException
+
+import app.api.deps as deps
 from app.api.deps import get_db
 
 
@@ -13,3 +18,72 @@ def test_get_db_closes_session():
         with pytest.raises(Exception):
             db_gen.throw(Exception("test error"))
         mock_session.close.assert_called_once()
+
+
+# verify_internal_key tests below are called directly, not through
+# TestClient: tests/conftest.py globally overrides verify_internal_key
+# (`fastapi_app.dependency_overrides[verify_internal_key] = mock_verify_internal_key`)
+# so that already-protected routes (routes_governance.py) can be exercised
+# in tests without the gateway-injected X-Internal-Key header. That override
+# makes the real fail-closed behavior untestable through the app for any
+# router that uses it -- this is the only place it's actually verified to
+# reject what it should reject, rather than just trusted to work because
+# it's wired in.
+#
+# Newly relevant as of the auth fix to routes_risk.py, routes_intents.py,
+# routes_history.py, routes_memory.py (see docs/authentication.md) -- those
+# four routers now depend on this function passing correctly.
+
+_NEWLY_PROTECTED_ROUTER_MODULES = [
+    "app.api.routes_risk",
+    "app.api.routes_intents",
+    "app.api.routes_history",
+    "app.api.routes_memory",
+]
+
+
+@pytest.mark.asyncio
+async def test_verify_internal_key_rejects_missing_header(monkeypatch):
+    monkeypatch.setattr(deps, "INTERNAL_API_KEY", "real-secret")
+    with pytest.raises(HTTPException) as exc_info:
+        await deps.verify_internal_key(x_internal_key=None)
+    assert exc_info.value.status_code == 401
+
+
+@pytest.mark.asyncio
+async def test_verify_internal_key_rejects_wrong_key(monkeypatch):
+    monkeypatch.setattr(deps, "INTERNAL_API_KEY", "real-secret")
+    with pytest.raises(HTTPException) as exc_info:
+        await deps.verify_internal_key(x_internal_key="wrong-key")
+    assert exc_info.value.status_code == 401
+
+
+@pytest.mark.asyncio
+async def test_verify_internal_key_fails_closed_when_unset(monkeypatch):
+    """The env var being unset must reject every request, not let them
+    through -- this is the specific property that makes this safe to add
+    to a router without also needing to guarantee the env var is always
+    set."""
+    monkeypatch.setattr(deps, "INTERNAL_API_KEY", "")
+    with pytest.raises(HTTPException) as exc_info:
+        await deps.verify_internal_key(x_internal_key="anything")
+    assert exc_info.value.status_code == 401
+
+
+@pytest.mark.asyncio
+async def test_verify_internal_key_accepts_correct_key(monkeypatch):
+    monkeypatch.setattr(deps, "INTERNAL_API_KEY", "real-secret")
+    result = await deps.verify_internal_key(x_internal_key="real-secret")
+    assert result is None
+
+
+@pytest.mark.parametrize("router_module_name", _NEWLY_PROTECTED_ROUTER_MODULES)
+def test_router_requires_verify_internal_key(router_module_name):
+    """Structural check, independent of the function-level tests above:
+    proves each router actually declares verify_internal_key as a
+    router-level dependency, not just that the function itself works in
+    isolation. Mirrors the pattern routes_governance.py already uses
+    (`APIRouter(dependencies=[Depends(verify_internal_key)])`)."""
+    module = importlib.import_module(router_module_name)
+    dependency_callables = [d.dependency for d in module.router.dependencies]
+    assert deps.verify_internal_key in dependency_callables

tests/test_routes_pricing.py

@@ -0,0 +1,47 @@
+from fastapi.testclient import TestClient
+from app.main import app
+
+client = TestClient(app)
+
+
+def test_run_pricing_is_temporarily_disabled():
+    """/pricing/run was disabled after AUDIT_arf-bayesian-pricing-calculator.md's
+    Critical finding: it persisted a fabricated random.random() outcome into a
+    calibration buffer with no customer_id scoping, so every customer's price
+    was shaped by every other customer's fabricated outcomes. This asserts the
+    disabled state itself, not the old (buggy) behavior -- update this test
+    when the endpoint is actually fixed and re-enabled, not before."""
+    response = client.post(
+        "/api/v1/pricing/run",
+        json={"input": {}, "customer_id": "test-customer", "runs": 1},
+    )
+    assert response.status_code == 503
+    assert "temporarily disabled" in response.json()["detail"].lower()
+
+
+def test_run_pricing_still_requires_auth():
+    """Disabling the endpoint must not also disable its auth -- conftest.py's
+    mock_enforce_quota makes every request "authenticated" for this test
+    client, so this only confirms the Depends(enforce_quota) dependency is
+    still declared and still runs before the handler body (i.e. it wasn't
+    accidentally dropped along with the rest of the function body); it does
+    not exercise the real 401/403 paths, which are covered by test_deps.py
+    and usage_tracker's own tests."""
+    response = client.post(
+        "/api/v1/pricing/run",
+        json={"input": {}, "customer_id": "test-customer", "runs": 1},
+    )
+    # Reaching the 503 (not erroring before it) proves enforce_quota resolved
+    # successfully -- if the dependency were missing or broken, this would be
+    # a 401/422/500 instead.
+    assert response.status_code == 503
+
+
+def test_estimate_pricing_route_still_registered():
+    """/pricing/estimate was not touched by the disable -- confirm it's still
+    a distinct, reachable route (a malformed request should 400, not 503/404),
+    so a caller following the "use /pricing/estimate instead" guidance in the
+    503 detail message actually has somewhere to go."""
+    response = client.post("/api/v1/pricing/estimate", json={"input": {}})
+    assert response.status_code != 503
+    assert response.status_code != 404