Promote staging to production: doc content storage, connectors extractors, SecretStr credentials, security bumps

[qiuethan]

Promotes staging (d86a55e) to production. 96 commits, Aug 1 → Aug 9, since prod's current b445d1d7.

What ships

Features

• feat/doc-content-storage (feat(docs): full document content storage (#83) #155) — doc_content table, full extracted document text
• feat/connector-credentials (feat(connectors): new connectors service + Google Drive/Docs source (#84) #156) — connectors credential plumbing
• feat/slides-sheets-extractors (feat(connectors): native Slides and Sheets extractors #161), feat/pdf-docx-forms-extractors (feat(connectors): PDF, .docx, and Google Forms extractors #163) — Google Slides/Sheets + PDF/DOCX/Forms extractors
• feat/secretstr-settings (Hold every service's credentials in SecretStr, and make the test suites hermetic (#162) #166) — every service's credentials held in SecretStr; hermetic test suites

Fixes

• fix: correct hardcoded ports in meeting and documentation-system Dockerfiles #179 — Dockerfile ports corrected to match the documented table (meeting 8003→8004, documentation-system 8000→8001)
• fix: point llm and connectors compose build context at the repo root #180 — llm/connectors compose build context pointed at the repo root
• fix(meeting): salvage a recording when the WebSocket drops #190 — meeting salvages a recording when the WebSocket drops: the session is held for DISCONNECT_GRACE_S (new, defaults to 60s) so POST /stop can still finalize a dropped recording into minutes, and uvicorn's WS keepalive is widened to 60s/60s in both the Dockerfile CMD and railway.json startCommand. No new required env var — the setting defaults.

Dependencies — 8 Dependabot bumps, all security-motivated: undici 6.28.0, @fastify/static 10.1.2, fast-uri 3.1.5, brace-expansion 5.0.9, find-my-way 9.7.0, cryptography 50.0.0, pyasn1 0.6.4, pypdf 6.15.0

Housekeeping — ruff format enforced in CI for packages/auth, services/meeting, services/documentation-system (#184–#186); per-service doc sets and agent guides (#187); SECURITY-REVIEW-2026-07-13.md removed (#188); docs/DEPLOYMENT-HISTORY.md refreshed to cover connectors and this promotion (#191)

Migrations

Two, both on documentation-system, run via preDeployCommand:

revision	change	risk
005_doc_content	creates doc_content (new 1:1 table, FK cascade on doc delete)	additive, clean downgrade()
006_enable_google_content_fetch	sets content_fetch_enabled = true for gdocs, gsheets, gslides, gdrive	4-row data update, reversible

Neither rewrites nor drops existing data. Both have already applied cleanly against staging's database. No other service has new revisions — #190 and #191 add none.

Known: connectors is not provisioned

Migration 006 enables Google content fetching, which depends on the connectors service — and there is no connectors service in Railway in either environment. documentation-system correspondingly lacks CONNECTORS_BASE_URL, CONNECTORS_API_KEY, and GOOGLE_CREDENTIALS_JSON in both staging and production.

This degrades rather than breaks. Per services/documentation-system/.env.example, CONNECTORS_API_KEY is a soft dependency: a missing/default value logs a startup warning and boots anyway, and Google-source fetches are recorded as per-doc ingest warnings rather than breaking the catalog. Staging has run in exactly this configuration since Aug 1.

Expect ingest warning noise on Google sources until connectors is provisioned.

Pre-flight already done

• Prod meeting config wired. Railway was ignoring services/meeting/railway.json for that service (railwayConfigFile: null), so it took its port from the Dockerfile CMD — which fix: correct hardcoded ports in meeting and documentation-system Dockerfiles #179 changes. Left alone, this promotion would have taken prod's meeting service down with a green deploy and no healthcheck to catch it. Both environments now read railway.json: --port ${PORT}, healthcheckPath: /health, overlapSeconds: 0, numReplicas: 1.
• Service URLs templated. All *_BASE_URL variables in both environments converted from hardcoded literals to http://${{service.RAILWAY_PRIVATE_DOMAIN}}:${{service.PORT}}, matching docs/RAILWAY-DEPLOYMENT.md. Each renders byte-identical to the literal it replaced, so no behavior change — but port changes now propagate instead of silently pointing at a dead port.

Verification

• All 96 commits CI-green.
• SecretStr call sites traced. All six services' verify_production_secrets unwrap via .get_secret_value() before comparing — the silent failure mode (a SecretStr never compares equal to a str, so a dev-default check would stop firing) does not occur. All 13 non-config use sites unwrap correctly. platform_auth/secret_guard.py backstops with a named TypeError.
• Last 5 commits verified formatting-only by AST comparison — 44 of 47 changed Python files parse to identical ASTs. The 3 that differ are test files: two import reorderings, one removal of genuinely unused imports. Test and assertion counts unchanged.
• Staging healthy on 3f00593: all six services SUCCESS, 1/1 replicas, meeting /health 200. Two commits have landed since that check — b0ea4e2 (fix(meeting): salvage a recording when the WebSocket drops #190, meeting) and d86a55e (docs: refresh the deployment record before the staging → main promotion #191, docs only). Re-confirm staging's meeting deploy on d86a55e before merging, since fix(meeting): salvage a recording when the WebSocket drops #190 changes its start command.

Watch on deploy

documentation-system — the only service with migrations, and the only one whose deploy can fail. It fails loudly rather than silently.

🤖 Generated with Claude Code