{ "product": "Verdikt", "generated_at": "2026-10-19T04:20:00Z", "commit": "203f4be", "attestation": { "last_manually_attested_at": "2026-10-19T04:20:00Z", "attested_by": "probe", "note": "Verified against https://verdikt.aismith.ai: / and /health return 200, /ui/ redirects to sign-in, HSTS is sent, and TLS is a Let's Encrypt certificate valid to 2026-12-15. On the deploy host, web, worker, Postgres, Redis and MinIO are all up, with web, Postgres, Redis and MinIO reporting healthy; the database is at migration 0040. Deployed commit: 203f4be. The two defects open at first deploy (http asset URLs on an https page, and a missing landing video) are fixed and live: the page serves no http asset URLs and the landing video plays from YouTube. Hardening finished on 2026-10-18: secure cookies on, trusted proxies set for the tunnel, the web port bound to localhost, and the admin password and session secret rotated. After the change, admin and judge sign-in both work over https and the inbox poller kept running." }, "summary": { "verdict": "DEPLOYED", "readiness_ready": 23, "readiness_pending": 0, "readiness_total": 23, "readiness_pct": 100, "live": "LIVE", "hackathon_deploy": "2026-10-18", "public_url": "https://verdikt.aismith.ai" }, "readiness": { "one_liner": "Live on self-hosted infrastructure behind a Cloudflare tunnel, with model inference on Nebius Token Factory. All 23 runbook items are done and checked on the live host.", "categories": [ { "name": "Runbook & configuration", "description": "Documented, pre-flighted, and used for the live deploy.", "items": [ { "name": "Deploy runbook complete", "status": "ready", "detail": "Covers provisioning, TLS, verification and rotation, plus §8c for the Cloudflare tunnel deploy that prod uses.", "evidence": "docs/deploy-nebius.md" }, { "name": ".env template shipped", "status": "ready", "detail": "All production knobs represented: session/webhook/download secrets, admin hash, provider config, HSTS, inbox, judge demo sign-in.", "evidence": ".env.example" }, { "name": "Production compose file", "status": "ready", "detail": "web + worker + migrate sidecar + Postgres + Redis + MinIO. Migrations must exit 0 before web/worker start. This is the file prod runs.", "evidence": "deploy/docker-compose.prod.yml" }, { "name": "TLS edge (Cloudflare tunnel)", "status": "ready", "detail": "verdikt.aismith.ai routes through a Cloudflare tunnel to the web container. The Caddy template in §8 stays as the option for a host with public ports.", "evidence": "docs/deploy-nebius.md §8c" }, { "name": "Local prod-mode smoke test", "status": "ready", "detail": "Full docker-compose.prod stack brought up on a laptop against a stub provider before the live deploy; /health returned 200.", "evidence": "docs/deploy-nebius.md §12" } ] }, { "name": "Application health", "description": "Behavioural guarantees the deploy relies on. Verified in tests and on the live host.", "items": [ { "name": "/health endpoint", "status": "ready", "detail": "https://verdikt.aismith.ai/health returns 200 with {\"status\":\"ok\"}.", "evidence": "src/docgen/main.py (/health handler)" }, { "name": "Version-freeze byte-identical", "status": "ready", "detail": "Two consecutive renders of the same input JSON must produce byte-identical version_hash. Enforced in tests.", "evidence": "tests/test_version_freeze.py" }, { "name": "Admin auth (bcrypt)", "status": "ready", "detail": "DOCGEN_ADMIN_PASSWORD_HASH generated with hash_password(); no plaintext in the app config.", "evidence": "src/docgen/auth.py" }, { "name": "Nemotron reasoning path", "status": "ready", "detail": "Contract-tested against a Nebius Token Factory fixture, and exercised on prod by emailed test cases on 2026-10-18.", "evidence": "tests/test_provider_nebius.py" }, { "name": "Retriever warm-up", "status": "ready", "detail": "pgvector store seeded from rules/*.yaml; the embedding endpoint is first reached on the first retrieve() call, not at boot.", "evidence": "src/pap_pipeline/stages/retrieve.py" }, { "name": "Boundary tests (AI vs render)", "status": "ready", "detail": "docgen.core never imports docgen.providers; pap_pipeline never imports docgen. Enforced mechanically.", "evidence": "tests/test_boundaries.py" }, { "name": "License audit gate", "status": "ready", "detail": "CI job fails the build if a non-permissive third-party licence lands.", "evidence": "scripts/check_licenses.py" } ] }, { "name": "Infrastructure", "description": "The deploy host, DNS, TLS and model access. All in place.", "items": [ { "name": "Host provisioned", "status": "ready", "detail": "Self-hosted server running Docker Engine + Compose. The stack runs as its own compose project, apart from anything else on the host.", "evidence": "docs/deploy-nebius.md §8c" }, { "name": "DNS pointing at the deploy host", "status": "ready", "detail": "https://verdikt.aismith.ai resolves through Cloudflare and serves. Apex host; the www. label is not configured.", "evidence": "docs/deploy-nebius.md §8c" }, { "name": "No public inbound ports", "status": "ready", "detail": "The tunnel connects outbound from the host, so the web container is not exposed on a public port.", "evidence": "docs/deploy-nebius.md §8c" }, { "name": "Docker Engine + Compose installed", "status": "ready", "detail": "Installed on the deploy host; stack brought up with compose.", "evidence": "docs/deploy-nebius.md §2" }, { "name": "Nebius Token Factory API key", "status": "ready", "detail": "Issued and in use. Every model call resolves through Token Factory.", "evidence": "docs/deploy-nebius.md §4, §10" }, { "name": "TLS certificate (Let's Encrypt)", "status": "ready", "detail": "Let's Encrypt certificate at the Cloudflare edge, valid to 2026-12-15.", "evidence": "docs/deploy-nebius.md §8c" } ] }, { "name": "Security & operations", "description": "Hardening controls, all applied and checked on the live host.", "items": [ { "name": "HSTS", "status": "ready", "detail": "DOCGEN_HSTS_ENABLED=true on prod; the live site sends Strict-Transport-Security: max-age=31536000; includeSubDomains.", "evidence": ".env.example, src/docgen/security_headers.py" }, { "name": "Secure-cookies flag", "status": "ready", "detail": "DOCGEN_SECURE_COOKIES=true on prod (turned back on 2026-10-18). Sign-in over https://verdikt.aismith.ai sets docgen_session and docgen_csrf with Secure, HttpOnly, SameSite=Lax.", "evidence": "src/docgen/security_headers.py secure_cookie_flag()" }, { "name": "Trusted proxies for the tunnel", "status": "ready", "detail": "DOCGEN_TRUSTED_PROXIES=192.168.65.1, the address the web container sees tunnel requests come from. The web port is bound to 127.0.0.1, so only the tunnel on the host reaches it and X-Forwarded-For is trusted from that hop alone.", "evidence": "docs/deploy-nebius.md §8c, src/docgen/ratelimit.py client_ip()" }, { "name": ".env file permissions 600", "status": "ready", "detail": "Checked on the deploy host on 2026-10-18 after the hardening change: -rw------- (owner only).", "evidence": "docs/deploy-nebius.md §5, §10" }, { "name": "Admin credential rotation", "status": "ready", "detail": "Admin password and session secret rotated on 2026-10-18 (both the DB row and the break-glass hash). The new password signs in; the old one returns 401. The judge demo sign-in is a separate tenant-level account and is unchanged.", "evidence": "docs/deploy-nebius.md §10" } ] } ] }, "live": { "one_liner": "Live at https://verdikt.aismith.ai, self-hosted, with all model inference on Nebius Token Factory. Status below is attested by probing the public endpoints and the compose stack on the host. There is no automated probe yet.", "services": [ { "name": "Web (docgen)", "role": "FastAPI app: admin UI + inbox + pipeline", "status": "live", "detail": "Container healthy. https://verdikt.aismith.ai/health returns 200. Judge demo sign-in is on.", "last_seen": "2026-10-18" }, { "name": "Worker", "role": "Background jobs: pipeline runs, mapping, freeze, publish, inbox polling", "status": "live", "detail": "Polls the demo mailbox every 60 s. Prod is the only stack that polls it; dev has polling off so two pollers never race.", "last_seen": "2026-10-18" }, { "name": "Postgres", "role": "Primary datastore: programs, rules, packages, decisions", "status": "live", "detail": "Container healthy. Migrations run by a sidecar before web/worker start; at head (0040).", "last_seen": "2026-10-18" }, { "name": "Redis", "role": "Cache + async task broker", "status": "live", "detail": "Container healthy. Ephemeral; no persistence required.", "last_seen": "2026-10-18" }, { "name": "MinIO (object store)", "role": "Rendered PDFs, source PDFs, extracted assets", "status": "live", "detail": "Container healthy. S3-compatible.", "last_seen": "2026-10-18" }, { "name": "TLS edge (Cloudflare tunnel)", "role": "Public :443 at Cloudflare's edge, tunnelled to the web container; Let's Encrypt certificate", "status": "live", "detail": "TLS terminates at Cloudflare's edge and the tunnel carries traffic to the compose stack.", "last_seen": "2026-10-18" }, { "name": "Nebius Token Factory", "role": "External: hosts every model the pipeline calls", "status": "live", "detail": "Prod calls it on every case: MiniCPM-V (ingest), Nemotron-3.5-Super-VL (ingest verifier), Nemotron Nano (triage), Qwen3-Embedding-8B (retrieve), Nemotron Super (reasoning fallback). Verified end to end on 2026-10-18 with emailed test cases, including an approved case whose reply email arrived.", "last_seen": "2026-10-18" } ], "endpoints": [ { "name": "/health", "url": "https://verdikt.aismith.ai/health", "expect": "200 OK", "status": "live", "last_seen": "2026-10-18" }, { "name": "/ui/ (admin sign-in)", "url": "https://verdikt.aismith.ai/ui/", "expect": "303 → sign-in", "status": "live", "last_seen": "2026-10-18" }, { "name": "TLS certificate", "url": "verdikt.aismith.ai", "expect": "Let's Encrypt · valid to 2026-12-15", "status": "live", "last_seen": "2026-10-18" }, { "name": "Public demo URL", "url": "https://verdikt.aismith.ai/", "expect": "200 OK · marketing landing", "status": "live", "last_seen": "2026-10-18" }, { "name": "Demo mailbox", "url": "quire.template.agent@gmail.com", "expect": "Email in → case in the inbox → reply after approval. Judge tests 1 and 3 re-run on 2026-10-18: approve, and missing info for the scanned fax", "status": "live", "last_seen": "2026-10-18" } ] }, "deploy_timeline": [ { "date": "2026-09-13", "event": "docs/deploy-nebius.md rev 2: Caddy Cloudsmith repo + ACME failure modes documented" }, { "date": "2026-09-14", "event": "Pre-flight smoke test on laptop passed (docker-compose.prod, stub provider)" }, { "date": "2026-10-17", "event": "Stack brought up on the self-hosted server; Alderwood demo data seeded" }, { "date": "2026-10-18", "event": "Live at https://verdikt.aismith.ai through a Cloudflare tunnel (verified); runbook §8c added" }, { "date": "2026-10-18", "event": "Inbox polling moved to prod only; email test guide verified end to end on prod" }, { "date": "2026-10-18", "event": "Judge demo sign-in turned on; income rule live" }, { "date": "2026-10-18", "event": "Video published: https://youtu.be/EleEatbaEWM" }, { "date": "2026-10-18", "event": "Devpost submission sent: live URL, video URL, public repo" }, { "date": "2026-10-18", "event": "Live-host hardening: secure cookies on, trusted proxies set for the tunnel, web port bound to localhost, admin credentials rotated" }, { "date": "2026-10-18", "event": "Nemotron-3.5-Super-VL verifier turned on for Alderwood; email test guide re-run on prod (approve and missing_info as expected, no disagreements)" }, { "date": "2026-10-18", "event": "Out-of-range guard deployed: a household size outside 1-10 is treated as not read, so the scanned fax returns missing info instead of a denial" }, { "date": "2026-10-18", "event": "MinIO moved to pinned pgsty images; object store backed up before the deploy, all stored files verified" }, { "date": "2026-10-18", "event": "Judge tests re-run on prod from a clean queue: clean packet approves, low-quality scanned fax returns missing info with verifier disagreements listed" } ] }