Skip to content

DEPLOYMENT.md

Latest commit

 

History

History
52 lines (34 loc) · 2.73 KB

DEPLOYMENT.md

File metadata and controls

52 lines (34 loc) · 2.73 KB
Raw

Production Deployment

ChatGPT Sites

Production URL: paperquant-lab.souravberaakagralius.chatgpt.site

The existing Sites project ID is stored in .openai/hosting.json. It binds:

  • DB — D1 for paper sessions and research metadata.
  • ARTIFACTS — R2 for immutable complete results.

Run the generated migration, validate npm run check, package the exact validated commit with the Sites packaging helper, create a version, inspect access, and deploy it publicly. Never place a secret in .openai/hosting.json.

Sites deployment secrets:

  • RESEARCH_WORKER_API_KEY — secret, because it authorizes job creation, polling, cancellation, and artifact retrieval.

Sites non-secret routing values:

  • RESEARCH_WORKER_URL=https://agent-testing.34-180-14-13.sslip.io/v1
  • RESEARCH_WORKER_TASK=paperquant-research/run_research

The URL and task slug are public routing identifiers, not credentials. Marking them secret is harmless but unnecessary; the API key must stay secret. Never place any of the three values in .openai/hosting.json or the client bundle.

Restrict any external callback/CORS configuration to the deployed Sites origin.

Isolated GCP worker

The production research boundary is the existing project VM service named exactly agent-testing:

  • Repository directory: /home/aryansmacbookair/agent-testing
  • Process manager: independent PM2 app agent-testing
  • Application bind: loopback 127.0.0.1:8095
  • Public boundary: HTTPS reverse proxy at https://agent-testing.34-180-14-13.sslip.io
  • Authentication: a 64-hex bearer token stored in a mode-600 worker token file and only mirrored into the Sites secret above.

The worker never needs Sites R2 credentials. It writes a complete immutable gzip beside the terminal job record and serves that artifact through an authenticated endpoint. Sites streams it directly into its bound ARTIFACTS bucket as research-runs/{runId}/workflow-result.json.gz.

Do not edit, restart, rename, or delete any other PM2 process on the VM while deploying this worker.

Verification

  1. GET /api/health and verify D1, R2, workflow readiness, safety, and data freshness.
  2. Open the public URL in an anonymous/incognito browser.
  3. Search a non-featured Binance USDT asset and load candles.
  4. Verify book/tape updates and no visible bottom scrollbar.
  5. Run the judge WebMCP journey from JUDGE_TESTING.md.
  6. Repeat one idempotency key and verify no duplicate mutation.
  7. Verify a blocked strategy returns BLOCKED_DATA.
  8. Verify a custom hosted strategy returns SANDBOX_POLICY.
  9. Inspect the client bundle, logs, Git history, and artifacts for secrets.
  10. Tag the validated commit and disable judging-release edits.